Your Coding Agent changed an ACL in 26 seconds.

It touched 14 downstream artifacts.

8 of them never appear for verification.

The diff shows the tip. Fluent Graph shows the depth.

npx @yesprasad/fluent-graph

01install

Install.

Node.js 18+ and an existing Fluent SDK project with @servicenow/sdk installed. Nothing is installed into your ServiceNow instance, and your working tree is never modified.

CLI @yesprasad/fluent-graph

Five commands, in your terminal or your pipeline.

npm install -g @yesprasad/fluent-graph

Or run it without installing: npx @yesprasad/fluent-graph

MCP server @yesprasad/fluent-graph-mcp

Let a coding agent check reach before it acts.

npm install -g @yesprasad/fluent-graph-mcp

Or run it without installing: npx @yesprasad/fluent-graph-mcp --project-root .

Visualize @yesprasad/fluent-graph-visualize

See the whole project at once, offline and interactive.

npm install -g @yesprasad/fluent-graph-visualize

Or run it without installing: npx @yesprasad/fluent-graph-visualize

02start

Run your first review.

Three commands. The third one is the whole product.

Map the project

Scans your Fluent SDK project and writes fluent-graph.json to the project root.

npx @yesprasad/fluent-graph analyze
Ask what depends on something

Every artifact that breaks if you change this one, with the reason for each.

npx @yesprasad/fluent-graph blast incident
Review the change you are about to push

Compares your working copy against where you diverged from the team's default branch — committed, staged, unstaged and untracked Fluent files.

npx @yesprasad/fluent-graph review --out pr-review.html --open

fluent-graph reviewterminal output

 $ npx @yesprasad/fluent-graph review ✔ Workspace SDK loaded
✔ Graph built: 214 nodes, 413 edges ✔ Baseline: origin/main VERIFY [FG-BR-001] Business Rule "br_incident_assign" action_insert: false → true Validate every added or removed insert, update, delete or query trigger. ──────────────────────────────────────────── Blocking by policy · not evaluated Verify before merge 5 Awareness 33

03cli

Five questions you can answer in one command.

Each command answers something you would otherwise find out in production, or not at all.

Command	Answers	What you get back
analyze	What is actually in this project?	Every artifact and relationship, grouped by type. Writes fluent-graph.json for anything else you want to build on.
blast	What breaks if I touch this?	Every artifact that depends on the one you name, with the reason for each — reference field, logic attachment, composition.
validate	Is anything broken right now?	Structural checks across the whole project: fields that do not exist, scripts racing each other, references going nowhere.
context	What does my agent need to know?	Minimal, AI-ready context for one table, so an assistant works from resolved structure instead of guessing.
review	Is this change safe to push?	Your working copy against the branch point — committed, staged, unstaged and untracked. The one you will run most.

It will not guess your baseline

Run review with no arguments and it works out what to compare against — an explicit --base, then the configured remote HEAD, then your branch's tracked remote. If two candidates are equally plausible, it stops and asks rather than picking one and reporting against the wrong thing.

The baseline is read in a temporary detached worktree that is removed when the command finishes, including when it fails. Nothing is stashed, reset, cleaned, switched or committed. Your working tree is never touched.

The flags worth knowing

Flag	Why you would use it
--pr <number>	Review someone else's open pull request without checking it out.
--out review.html	Get a self-contained report you can attach to a PR or keep.
--details	See the exact properties that changed, not just that something did.
--expect <tables>	Say what you think you touched, and be told where you were wrong.
--no-llm	Guarantee no provider request is made. The default for CI.

--help has the rest. --expect is awareness, not a verdict — it changes no count, no finding, and not the exit code, because a change outside your declared set may be perfectly correct and only you can tell.

04ci

Wire it into CI.

The exit code is the contract. Everything else is for humans.

Exit codes review

Code	Meaning	What it tells the pipeline
0	Analysis complete	Every changed artifact was compared against the baseline.
4	Incomplete evidence	The comparison could not be completed in full. Treat as unreviewed, not as clean.
1	Error	The command could not run — bad input, unreadable project, or an ambiguous baseline.

Exit status is governed by static evidence, never by policy or the model.

.github/workflows/fluent-review.ymlgithub actions

 name: Fluent review
on: [pull_request]
jobs: review: runs-on: ubuntu-latest
steps: - uses: actions/checkout@v4
with: {fetch-depth: 0} # the baseline has to be reachable - uses: actions/setup-node@v4
with: {node-version: 20}
- run: npm ci
- run: npx @yesprasad/fluent-graph review --no-llm --out review.html
- uses: actions/upload-artifact@v4
if: always()
with: {name: fluent-review, path: review.html}

--no-llm guarantees no provider request is made from CI. Use --format json if you want to pipe the result into your own gate — JSON goes to stdout with no banner or progress text.

05mcp

Let an assistant query the graph.

The MCP server exposes the dependency graph to Claude Desktop, Cursor, or any MCP-compatible agent — so the assistant follows real edges instead of guessing from file names.

Claude Desktop claude_desktop_config.json

{
"mcpServers": {
"fluent-graph": {
"command": "fluent-graph-mcp",
"args": ["--project-root", "/path/to/my-servicenow-project"]
    }
  }
}

Cursor uses the same structure in .cursor/mcp.json.

Tools it exposes 4

Tool	Returns
blast_radius	Impacted artifacts if a named artifact changes, organised by dependency hop distance
get_artifact	Table, action, source file, attributes and dependency edges for one artifact
list_artifacts	Every artifact in the project, with optional table-name filtering
refresh	Re-run analysis and reload the in-memory dependency graph

What it looks like in use transcript

“I want to drop the caller_id field. What breaks?”

The assistant calls blast_radius and answers from the graph:

 3 artifacts depend on it, at 2 hops: hop 1 cs_incident_onchange_caller client_script · logic attachment hop 1 br_incident_assign business_rule · reads field hop 2 x_1566039_seventh_account table · reference field: owner

It followed real edges. It did not grep, and it did not guess.

06visualize

See the whole project at once.

Writes a single self-contained HTML file and opens it. The graph data is embedded — it works offline and nothing is uploaded.

npx @yesprasad/fluent-graph-visualize

Flag	Effect
-p, --project-root <path>	Project directory (default: current)
-o, --output <path>	Output filename (default: `fluent-graph-view.html`)
--no-open	Write the file without opening a browser

Left-to-right dependency layout across every Fluent artifact in the project
Validation state as coloured accents on each card
Click any artifact to highlight everything upstream and downstream of it
Search, pan and zoom; isolated artifacts grouped separately

07byok

Bring your own reasoning.

One request, or none, to a provider you choose. The report never depends on it.

Four adapters: OpenAI, Anthropic, OpenAI-compatible, and Ollama
Source code is never included in a request
Your API key is never printed, logged, placed in a command argument, written to a report, or included in a payload preview
See it before you send it — --show-llm-payload prints the exact request without making one
--no-llm guarantees no provider request at all

npx @yesprasad/fluent-graph review --w-llm --llm-provider ollama --show-llm-payload