Everything you need to ship better code.

Quickstart

You can go from an empty account to a full analysis in about a minute — no build config, no agent install. Impact clones the repository, analyzes it, and streams progress live.

1. 1
   Create your account

   Sign up at /register. You land in a guided setup (the Get started screen).
2. 2
   Analyze your first repo

   Paste any public Git URL (or click an example repo) and hit Analyze. Private repos need a connected Git account first — see the next section.
3. 3
   Watch it run

   You're taken to a live console. A scan of a typical repo takes seconds to a couple of minutes depending on size; Semgrep security analysis runs on every scan.
4. 4
   Read the report

   When it completes you get a 0–100 score, an A–F grade, ranked issues, an auto-generated Project Wiki, and a dependency map.
5. 5
   Add a second repo

   Scan another repository in the same workspace. The moment one calls another's API, the Living System Map lights up — that's where Impact is unique.

Connecting repositories

Public repositories work with zero setup — paste the URL and analyze. Private repositories need a connected Git account so Impact can clone them on your behalf.

Connect a Git account

1. 1
   Open Settings → Git Accounts
2. 2
   Connect via OAuth, or paste a personal access token

   Use the scopes below for a token. Everything is encrypted at rest (AES-256-GCM) and never leaves the backend.
3. 3
   Add the repo

   Back on New Analysis, your private repos are now selectable.

Reading your results

Every analysis produces two headline numbers, and it's important not to conflate them:

• ›Overall score (0–100, A–F) — the blended seven-pillar number. This is the honest headline; a repo can't show a pristine 100 while its Security or Human pillar is failing. Every headline surface uses this.
• ›Code Quality score — a narrower composite (complexity, maintainability, duplication, docs). One input into Overall, shown as a labelled sub-metric.

The issues list is ranked by blast radius — how much of your codebase a problem can affect — not just raw severity, so the things worth fixing first float to the top. Open any issue for an AI explanation and, on paid plans, a one-click suggested fix that's generated and self-verified before it's proposed.

Custom dashboards

Your dashboard is yours to arrange. Click Customize in the top-right of the Dashboard to reorder widgets, hide the ones you don't use, and reset to defaults — the layout is saved to your account, so it follows you across devices.

The seven pillars

The Overall score blends seven intelligence pillars. Here's what each measures and what a low score is telling you.

Benchmarking

The Benchmark panel on the Intelligence page shows where a project stands on two axes at once, per metric (overall score, issue density, critical density, tech-debt ratio, duplication):

• ›Portfolio percentile — the project's rank among your own other projects. This is real data; it appears once you have at least three analyzed projects to compare against.
• ›Industry reference bands — how the value compares to broad code-quality norms, shown as a percentile with an elite / strong / average / needs-work label.

DORA metrics

Connect a GitHub account and Impact computes all four DORA metrics from your GitHub Actions history — no extra instrumentation. They appear under the Business Value pillar on the Intelligence page, each banded elite / high / medium / low.

Impact detects a "deploy" from workflows named like deploy/release/cd, or from deployment events. Override the list under Project → Settings if your pipeline uses different names.

SBOM & Cost of Quality

SBOM export (CycloneDX)

Export a full Software Bill of Materials for any project's latest scan — click SBOM in the Security Center header. It's standard CycloneDX 1.5 JSON: every dependency as a component with its package URL (purl), plus a vulnerabilities section linking known CVEs to the exact components they affect. Feed it straight into Dependency-Track, GitHub, or any supply-chain tool, or attach it to an audit (SOC 2 / EO 14028).

Cost of Quality

The Technical Debt page dollarizes your remediation effort at a blended engineering rate you set. It shows the one-off remediation cost to clear the debt, plus the estimated annual and monthly drag of leaving it unaddressed. Change the rate and every figure rescales live — the numbers always trace back to hours × your rate, so they survive a board deck.

Living System Map

The Living System Map draws your entire estate as one graph: each service (repository) is a node, and each cross-repo API call is an edge. It's rebuilt on every analysis, so it always matches reality. Open it under System Map in the dashboard (Professional and above).

Reading the map

Pan by dragging the background, zoom with the scroll wheel, drag a node to reposition it, and use the search box to find a service.

Cross-repo blast radius — a walkthrough

1. 1
   Click a service on the map

   Its blast radius floods outward hop-by-hop. The amber wavefront shows the order in which other services would break if you changed this one's API.
2. 2
   Read the side panel

   It leads with the blast summary — "change this service's API and N other services break, across M endpoints and K call sites."
3. 3
   Jump to a caller

   Every call site is listed by project, file, and line. Flag them in the PR — not at 3am on launch day.

Overlays & modes

• ›Drift overlay — toggle it and services with a breaking contract change pulse red, labelled "N breaking · M callers."
• ›A→B path search — select a service, then type another's name in the search box, and the shortest connection path between them highlights in blue with a "Path to X: N hops" caption.
• ›Simulate & conduct — see the Change Conductor below.
• ›Take a tour — steps through the services other repos depend on, auto-flooding each one's blast radius. A self-running walkthrough for onboarding and demos.

Contract Drift

Contract Drift (the "Time Machine") diffs your API surface between analyses. When an endpoint is removed, renamed, drops authentication, or drops input validation, Impact cross-references the org graph: does any other repo still call the old shape? If so, you get a finding in Issues, PR review, and the quality gate — automatically, with no extra setup.

Finding types

Drift is detected at the field level, not just the route: Impact extracts each endpoint's response object keys and req.body fields, so removing a field a caller reads is caught — the break that method-and-path diffing alone can't see.

Signals on each finding

• ›Ranked by blast — sorted by live cross-repo caller count, so "BREAKING · 7 callers" sits above cosmetic changes.
• ›SemVer impact — the change set is classified major / minor / none; a "MAJOR BUMP" badge appears on the map when a removal or breaking change is detected.
• ›Deprecation runway — a removed-but-still-called endpoint gets a countdown (budget: 5 analyses): "deprecation runway: N analyses left" before "RUNWAY EXPIRED — fix now." Managed sunset, not a surprise 404.
• ›External-consumer flags — a public endpoint with no tracked in-org caller is flagged, because external/mobile/third-party clients the graph can't see may depend on it.

Contract firewall

Turn the firewall on in a quality gate and any breaking cross-repo change hard-blocks the merge — regardless of the score or critical thresholds. It's the "no breaking change ships without versioning or all consumers green" policy, enforced by CI.

Gate check
GET /api/v1/projects/:id/gate?contractFirewall=true
# → { pass: false, breakingDrift: 2, failures: [
#     "Contract firewall: 2 breaking cross-repo change(s) — version the
#      API or update every consumer before merging" ] }

Change Conductor

The Change Conductor doesn't just find the risk in a cross-repo change — it sequences the whole thing. From the org graph it builds an ordered plan and attaches the pillar gates as merge conditions.

Generate a plan

1. 1
   Open the System Map and select the provider service

   The one whose API you want to change.
2. 2
   Click 'Simulate & conduct this change'

   Or pick a recipe (below). Impact reads the graph and produces the plan.
3. 3
   Follow the ordered steps

   Provider change first, then each consumer repo in dependency order (most-affected first) with the exact call sites, then tests, then a verify step.
4. 4
   Check the projected impact

   A before/after strip shows "unmanaged: N services break, gate blocked → conducted: 0 break, gate clears." Impacted services glow amber on the map.

Recipes

Roll back a shipped change

If a change already shipped and broke a consumer in production, click Roll back a shipped change (or call plan_change with intent:"rollback"). The Conductor produces the reverse plan: it restores the provider's previous shape first — which un-breaks every consumer immediately, before you touch a single call site — then rolls back any consumer that had already migrated, and re-verifies. It's the fastest ordered path back to green during an incident.

Track it live on the Changeset Board

A plan is a recommendation; a changeset is that plan being executed. Click Track as changeset on any plan to put its ordered steps on the Changeset Board — a Kanban where each cross-repo step is a card you move To-do → In-progress → Blocked → Done.

• ›Live gate — the blocking Contract-Drift gate shows clear only once the provider, every consumer, and the verify step are all done; a single blocked card holds it shut, exactly like the merge gate.
• ›Progress at a glance — each changeset carries a done/total bar and rolls up to an Open / Blocked / Done count across your workspace.
• ›Rollback changesets too — track a revert the same way, so an incident response is a visible, shared board instead of a Slack thread.

Outcome Ledger

The Outcome Ledger is the "Prove" phase — a running record of what Impact predicted and what it prevented, so value is provable rather than asserted. Open it under Outcome Ledger in the dashboard. It fills in as your projects are analyzed.

What's recorded

• ›Prevented incidents — each breaking contract change caught before merge, logged with an estimated cost avoided (severity × cross-repo exposure). Dollar figures are clearly labelled estimates.
• ›Predictions — the top risk-next hotspots for each analysis, logged open.

How calibration works

On a later analysis, each open prediction is reconciled against reality: a predicted file that goes on to gain a critical issue counts as a hit; one that stays clean is held up. The calibration bar shows confirmed / held-up / watching and a measured hit-rate. Because the reconciliation is automatic, the hit-rate is measured on your repos — not claimed — and it sharpens the longer Impact runs.

The rest of the page

• ›Headline tiles — estimated $ prevented, prevented count, prediction hit-rate, open predictions.
• ›Per-project scorecards — a board-ready table of prevented, $ avoided, predictions and confirmations per project.
• ›ROI calculator — a public estimator at /roi projects prevented incidents and dollars saved for your estate size.

AI Assistant

Ask questions in plain English and get answers grounded in your actual analysis — not autocomplete. Open Ask in the dashboard (Starter and above). The assistant handles two kinds of question:

• ›Locate — "where do we handle refunds?", "which file has the auth logic?" — answered from the code map, with every source file cited.
• ›Advise — "what should I fix first?", "where are my security gaps?" — a prioritized plan drawn from your ranked issues, tech debt, and reachability.

Every answer cites its sources, and it never answers beyond what the analysis actually shows — if the map doesn't know, it says so.

It learns how your team works

The assistant improves for your team over time. Two signals feed it:

• ›Thumbs up / down on any answer, and an automatic "accepted" signal whenever you open a PR from a suggested fix.
• ›Team conventions an owner or admin sets (e.g. "use zod for validation"). Consistently accepted or rejected fixes become patterns the assistant leans into — or avoids — in future advice.

Agent Tools (MCP server)

The coding agents — Claude Code, Cursor, Copilot — are the new IDE. Impact exposes its cross-repo intelligence to them as a Model Context Protocol (MCP) server, so your agent can ask "what breaks in another repo?" before it writes the change. Open Agent Tools in the dashboard for your live endpoint and a copyable config.

Endpoint & protocol

The server speaks JSON-RPC 2.0 over HTTP (MCP protocol version 2024-11-05). One endpoint handles everything:

POST https://api.impactcodeanalysis.com/api/v1/mcp
Authorization: Bearer <your-token>
Content-Type: application/json

A discovery manifest for directories lives at GET /api/v1/mcp/manifest — name, transport, auth, and the full tool catalog.

Authentication & tenancy

Every request needs a bearer token in the Authorization header — use your workspace session token. Each tool is additionally tenancy-scoped: a tool that names a project you can't access errors before any data is read, so an agent can never reach across workspaces.

Connect your agent

1. 1
   Copy your endpoint & config

   From the dashboard Agent Tools page (the "Copy config" button gives you the block below).
2. 2
   Add it to your client's MCP config

   Paste into your client's settings — for example, an mcpServers block:

mcp config
{
  "mcpServers": {
    "impact-code-analysis": {
      "url": "https://api.impactcodeanalysis.com/api/v1/mcp",
      "headers": { "Authorization": "Bearer <your-token>" }
    }
  }
}

1. 3
   Restart your agent

   It will handshake, discover the tools, and can now call them mid-edit.

Tool reference

Nine tools are available. Every tool takes a projectId; some take more. Results come back as JSON in the tool response.

A worked example

Handshake, list the tools, then call one. In practice your client makes these calls for you once the server is configured.

JSON-RPC
# 1) initialize
{"jsonrpc":"2.0","id":1,"method":"initialize"}

# 2) list tools
{"jsonrpc":"2.0","id":2,"method":"tools/list"}

# 3) call a tool
{"jsonrpc":"2.0","id":3,"method":"tools/call",
 "params":{"name":"blast_radius",
           "arguments":{"projectId":"prj_123","path":"/api/widgets/:id"}}}
# → content: which services break, with call sites

Project Wiki

Every analyzed repo gets an auto-generated handbook under the Project Wiki tab — generated from analysis, never hand-maintained, so it never goes stale. It's the fastest way to onboard onto an unfamiliar codebase.

Quality gates

A quality gate is a pass/fail policy evaluated on every analysis and in PR checks. Configure gates per project under Project → Settings → Quality Gate; custom gates are Professional and above.

A good starting policy

• ›Block on any new critical issue (regressions, not legacy debt).
• ›Block on breaking Contract Drift (turn on the contract firewall).
• ›Warn on rising tech debt or major-issue count.
• ›Set a minimum score only once your baseline is stable — otherwise it fails on day one and gets ignored.

policy
new_critical_issues: 0        # fail if any new critical issue
contract_firewall:   true     # fail on any breaking cross-repo change
coverage_drop:       "> 2%"   # fail if coverage falls more than 2%
maintainability:     ">= B"   # require a B or better

CI/CD & auto-rescan

Keep scores current by re-analyzing on every push.

Webhook (recommended)

1. 1
   Open Project → Auto-rescan

   Copy the signed webhook URL.
2. 2
   Paste it into your provider's webhook settings

   GitHub, GitLab, or Bitbucket. Impact validates the payload signature (HMAC-SHA256) on every call.
3. 3
   Push

   Impact re-scans automatically and updates the score, gate, and map.

From a pipeline

Trigger an analysis with the API and fail the job on a gate result:

bash
curl -X POST https://api.impactcodeanalysis.com/api/v1/analyze \
  -H "x-api-key: $IMPACT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"projectId": "prj_123"}'

# then, after it completes, check the gate:
curl "https://api.impactcodeanalysis.com/api/v1/projects/prj_123/gate?contractFirewall=true" \
  -H "x-api-key: $IMPACT_API_KEY"

Weekly digest

Get a Monday-morning email summarizing what changed in your code over the week: average score and its trend, the net score change, scans run, open critical issues, and your biggest movers — improved and regressed. Turn it on under Settings → Notifications → Weekly Summary.

• ›Preview it now — with the toggle on, click Send test digest to build one from your projects and send it to your inbox immediately.
• ›Only your projects — the digest is per-user and scoped to what you can see; a quiet week still sends a short "here's where you stand."

API & CLI

Everything in the UI is available over a REST API. Generate a key under Settings → API Keys and pass it as an x-api-key header.

Self-hosting (Docker)

Business and Enterprise plans can run Impact entirely inside your own infrastructure. The stack ships as Docker images (backend, frontend, license server) and a Compose file.

bash
git clone https://github.com/ImpactDev/impact.git
cd impact
cp .env.example .env      # set secrets + your license key
docker compose up -d      # backend, frontend, license server
# open http://localhost:3000

Self-hosted instances run fully offline with an air-gapped license (Enterprise). Data never leaves your network.

Security & data

We don't train on your source, and you can export or delete your data at any time. Access tokens are short-lived, refresh tokens live in HttpOnly cookies, and every data route is tenant-isolated. Git credentials are encrypted at rest. For the full picture — SOC 2 practices, encryption, SSO/SAML — see the Trust & Security page.

FAQ

Why is my Living System Map empty?

It needs two or more repos in the same workspace where one calls another's API with a statically-visible URL. Confirm both have completed an analysis. Dynamic URLs built from variables aren't traced yet.

Why is the Outcome Ledger empty?

It records going forward — prevented incidents on breaking drift, and predictions that reconcile on a later analysis. Run a couple of scans and it populates; the calibration hit-rate needs at least one reconciled prediction.

Which tier do I need for the cross-repo features?

The Living System Map and Change Conductor are Professional and above (or the Team trial). The Outcome Ledger and Agent Tools are available more broadly. See pricing.

Does a scan change my code or open PRs?

No. Analysis is read-only. Suggested fixes and the Change Conductor only propose changes for you to review — nothing is committed without you.