[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_128":129},"routes/modules.$creator.$moduleId",{"_14":15,"_16":17,"_18":19,"_20":21},"routes/modules.$creator.$moduleId.endpoints",{"_11":12,"_13":-5},"error","Module not found","tools","module",{"_20":22,"_23":21,"_24":25,"_26":27,"_28":29,"_30":31,"_32":33,"_34":25,"_35":36,"_37":-5,"_38":-5,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_55":47,"_56":57,"_58":59,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":65,"_66":67,"_68":69,"_70":71,"_72":73,"_74":-5,"_75":-5,"_76":-5,"_77":47,"_78":-5,"_79":80,"_81":82,"_83":84,"_85":86,"_87":88,"_89":90},"apiUrl","https://odel.app/api","creator","noordeen123","moduleId","culprit","@noordeen123/culprit","displayName","tagline","Deterministic, offline root-cause analysis and pre-commit fix verification for coding agents.","iconKey","https://avatars.githubusercontent.com/u/132381713?v=4","category","local","status","published","visibility","public","metaDescription","deploymentType","external","workerName","bindingName","mcpConfig","pricingModel","free","creatorUserId","system:external-import","createdAt",1785127026000,"updatedAt",1788069131000,"sourceRegistry","official-mcp-registry","sourceUrl","https://registry.modelcontextprotocol.io/v0/servers?search=io.github.noordeen123%2Fculprit","sourceVerified",true,"sourceMissingSince","importedAt","upstreamStars",6,"upstreamUpdatedAt",1787766740000,"detectedTransport","detectedAuthType","probeStatus","lastProbedAt","githubRepoUrl","https://github.com/noordeen123/culprit","githubRepoFullName","noordeen123/culprit","releaseId","ext-noordeen123-culprit","version","0.4.0","descriptionMarkdown","# culprit\n\n\n\n

\n $\"CI\"$ \n $\"PyPI\"$ \n $\"Python$ \n $\"License:$ \n

\n\n

\n Root-cause analysis for agent-driven development.
\n Your coding agent finds what introduced a bug, and verifies its own fix is complete before it commits.\n

\n\n

\n Quick start ·\n Tools ·\n Accuracy ·\n Architecture ·\n MCP registry\n

\n\n

\n $\"An$ \n
\n A real run. The fix patched one caller of parse_config and missed two, so it scores partial.\n

\n\n## Why an agent needs this\n\nAn agent can dig through git history to find what broke, and it is good at it. What it\nwill not reliably do is spend a dozen tool calls on that every time, or stop and check\nwhether the helper it just changed has three other callers before it commits. culprit\nturns both into one deterministic call that returns structured JSON it can act on:\n\n| The agent asks | culprit answers |\n|---|---|\n| \"What introduced this bug?\" | Ranked suspect commits, the author's intent, the releases it shipped in |\n| \"Is my fix complete?\" | `verify_fix`: missed call sites, whether a test shipped, a risk level |\n| \"What could this change break?\" | Reverse-import dependents, covering tests, high-risk shared modules |\n\n- ⚡️ **Instant.** No test runs, no bisect. Benchmarked at 41% fewer agent tool calls.\n- 🔒 **Read-only and offline.** Never writes to your repo or PR. No API key, no network.\n- 🔌 **MCP-native.** 11 tools over stdio, on the official MCP registry, plus a one-command plugin.\n- 🗣️ **Language-agnostic.** Suspects work anywhere git does. Blast radius reads 12 language families.\n\n## Does it actually work?\n\nBenchmarked against 50 real regressions, 25 from [git](https://github.com/git/git) and 25 from\n[systemd](https://github.com/systemd/systemd), where the introducing commit is known from each\nfix's `Fixes:` trailer (author-verified ground truth). Given only the fix commit, culprit blames\nthe removed lines to rank the commits that introduced the bug.\n\n| Metric | Result |\n|---|---|\n| Introducing commit ranked #1 | **50%** (25/50) |\n| Introducing commit in the top-5 suspect set | **66%** (33/50) |\n\nDeterministic and offline, on large C codebases the engine has never seen. Reproduce with\n`python benchmarks/run.py`, which clones the repos and scores every case.\n\n### But an agent can run `git blame` itself\n\nIt can, and it is good at it. So the honest question is not whether culprit is accurate,\nbut whether it beats or helps an agent that has git and no culprit. Same 10 regressions,\nthree arms, isolated so no arm can read the answer from the fix commit:\n\n| | culprit alone | agent alone | agent + culprit |\n|---|---|---|---|\n| Introducing commit ranked #1 | 80% | **90%** | **90%** |\n| Introducing commit in top 5 | 90% | **100%** | **100%** |\n| Mean tool calls to get there | 1 | 14.9 | **8.8** (-41%) |\n| Mean tokens to get there | ~0 | 55,534 | **47,616** (-14%) |\n\n**The agent wins on accuracy, and culprit does not make it more accurate. What culprit\ndoes is get it there in roughly half the steps for about 8,000 fewer tokens per\ninvestigation.** Tool calls dropped in 10 of 10 cases, tokens in 7 of 10. On the hardest\ncase the agent needed 42 tool calls and 124k tokens alone, against 16 calls and 84k with\nculprit.\n\nThose savings are already net of reading culprit's output, which is counted in the third\ncolumn. culprit's own run is one deterministic call, no model, under a second.\n\nSo culprit is an accelerator for an agent, not a replacement for one, and not a smarter\nblamer than one. Method, caveats (n=10, and this slice is easier than the full 50), and\nreproduction: [`benchmarks/agent/`](https://github.com/noordeen123/culprit/blob/main/benchmarks/agent/).\n\n## Quick start\n\n**Claude Code plugin** (installs the MCP server plus a skill that tells the agent when to use it):\n\n```bash\n/plugin marketplace add noordeen123/culprit\n/plugin install culprit@culprit\n```\n\n**Any MCP client** (Cursor, Windsurf, VS Code, Codex CLI, Zed, Continue, Cline, Amazon Q, Goose):\n\n```json\n{\n \"mcpServers\": {\n \"culprit\": {\n \"command\": \"uvx\",\n \"args\": [\"--from\", \"culprit[mcp]\", \"culprit-mcp\"]\n }\n }\n}\n```\n\n**CLI**, no agent required:\n\n```bash\nuvx culprit # run from PyPI on demand\nrca --verify-fix patch.diff # exit 0 if complete, 1 otherwise\n```\n\nNeeds Python 3.10+ and [uv](https://docs.astral.sh/uv/) for the MCP server. The CLI runs on 3.9+.\n\n## The tools\n\n| Tool | What it answers |\n|---|---|\n| `analyze` | Full RCA in one call: classify, suspects or blast radius, risk, test impact |\n| `verify_fix` | Is this diff safe to commit? `complete` / `partial` / `risky`, plus the missed call sites |\n| `find_suspects` | Rank the commits that introduced the bug |\n| `check_completeness` | Call sites of the changed symbol the fix did not touch |\n| `get_intent` | The introducing commit's message, linked PR, referenced issues |\n| `get_evolution` | Per-commit history of the buggy lines via `git log -L` |\n| `get_risk_score` | QA gate score (0 to 100, low/medium/high) with contributing factors |\n| `get_blast_radius` | Feature impact: dependents, covering tests, high-risk files |\n| `get_test_impact` | Minimal test set to run for this change |\n| `classify_change` | Bugfix vs feature, with evidence |\n| `from_trace` | RCA straight from a stack trace, no diff or PR needed |\n\n## verify_fix, the pre-commit gate\n\nThe agent runs this on its own diff before committing:\n\n- **`verdict`**: `complete` when no untouched call site is left behind, `partial` when one was\n missed, `risky` when risk is high. The verdict is the completeness axis; test coverage is\n the separate confidence axis on `risk_level`.\n- **`untouched_references`**: the exact files that still use the changed symbol. This is the\n list the agent goes and patches.\n- **`skipped_symbols`**, **`adds_test`**, **`notes`**: what was too widely used to check, whether\n a test shipped, and what to do next.\n\nLoop until `complete`, then commit. That is the whole idea.\n\n## CLI and CI\n\n```bash\nrca # current branch vs the configured base\nrca --last # the latest commit only\nrca --pr 16786 # a specific PR (uses the PR's own base)\nrca --trace crash.txt # RCA from a stack trace, no fix or PR needed\nrca --verify-fix patch.diff # check a diff before committing\nrca --select-tests # print the tests to run for this change\nrca --html report.html --open # a single self-contained HTML report\nrca --pr 16889 --fail-on high # exit non-zero when QA risk is high\nrca serve --repo /path # local web UI with a base picker\n```\n\n**CI gate**: risk via exit code only, no PR comments, no writes. Copy\n[`examples/github-actions/culprit-pr.yml`](https://github.com/noordeen123/culprit/blob/main/examples/github-actions/culprit-pr.yml) into\n`.github/workflows/`:\n\n```yaml\n- run: pip install \"culprit>=0.3.0\"\n- env: { GH_TOKEN: \"${{ github.token }}\" }\n run: rca --pr ${{ github.event.pull_request.number }} --fail-on high\n```\n\n## HTML report\n\n`--html` writes one self-contained file. No CDN, opens offline, attaches to CI. It opens with the\nverdict: a scored QA risk with the factors behind it, and the prime suspect with how long the bug\nlived.\n\n

\n $\"QA$ \n

\n\nThen it reconstructs how the bug got there. Every commit that touched the buggy line, from\ncreation through the commit that broke it (red, with the exact diff) to the fix (green):\n\n

\n $\"Line$ \n

\n\n

Every node expands to its diff. See the full report.

\n\n## vs `git bisect`\n\n| | `git bisect` | culprit |\n|---|---|---|\n| Input | A reliable failing test | The fix diff (or a stack trace) |\n| Method | Checks out commits and runs the test | Blames the fix's lines plus `git log -L` |\n| Speed | Minutes (about log2(N) test runs) | Instant |\n| Output | First bad commit | Suspect set, intent, lifecycle, completeness, risk |\n| Confidence | Proof | Strong heuristic |\n\n`--bisect \"\"` runs a real bisect as an optional confirmation layer, in a throwaway\n`git worktree` so your checkout is never touched. When the first failing commit matches the\nblamed suspect, the report stamps it **confirmed by git bisect**.\n\n## Architecture\n\nOne normalized context in, one structured JSON result out. The only non-deterministic step\nis the optional LLM narrative, isolated behind an adapter so the engine runs with no API key.\n\n

\n \n \n $\"Two$ \n \n

\n\nTwo lanes, one engine. Every module writes one slice of the result, so nothing cares whether\nthe target came from `gh`, the REST API, local git, or a pasted stack trace. Full module map:\n[`docs/ARCHITECTURE.md`](https://github.com/noordeen123/culprit/blob/main/docs/ARCHITECTURE.md).\n\n## Configuration\n\nThe base branch resolves in order: the `--base` flag, then `CULPRIT_BASE`, then `.culprit.toml`\n(`base = \"origin/main\"`), then `HEAD~1`. `--last` forces the latest-commit view.\n\nPR titles and labels use the GitHub CLI when present, or the unauthenticated REST API for public\nrepos (set `GITHUB_TOKEN` or `GITLAB_TOKEN` to raise limits). Deep links cover GitHub, GitLab,\nBitbucket, and Gitea. Blast radius reads imports across JS/TS, Python, Go, Java/Kotlin, Ruby,\nC/C++, C#, PHP, Rust, Scala, and Swift.\n\n## Contributing\n\n```bash\npip install -e \".[dev]\" && pytest\n```\n\nModule map and data shapes: [`docs/ARCHITECTURE.md`](https://github.com/noordeen123/culprit/blob/main/docs/ARCHITECTURE.md). Publishing the MCP\nserver to the registries: [`docs/PUBLISHING.md`](https://github.com/noordeen123/culprit/blob/main/docs/PUBLISHING.md). MIT licensed.\n\n

\n \n $\"culprit$ \n \n

\n","changelogMarkdown","videoKey","requiredSecretsJson","publishedAt","priceCents","trialDays",0,"upstream",{"_108":109,"_110":111,"_112":113,"_114":115,"_116":117,"_118":119},"requiredSecrets",[],"tags",[93,94,95,96,97,98,99,100,101,102,103,104,105,106,107],"assets",[],"stats",{"_91":80,"_92":80},"ratingAvg","reviewCount","ai-agents","ci","claude-code","cli","code-review","coding-agents","developer-tools","git","git-blame","pull","python","rca","regression","root-cause-analysis","static-analysis","topics",[93,94,95,96,97,98,99,100,101,124,125,126,102,103,104,105,106,107,127],"license","MIT","language","Python","registryName","io.github.noordeen123/culprit","homepage","https://pypi.org/project/culprit/","packages",[120],{"_121":122,"_123":21,"_70":71},"registryType","pypi","identifier","mcp","mcp-server","model-context-protocol","subagents","ENV",{"_130":131,"_132":133,"_134":135},"ENVIRONMENT","production","TURNSTILE_SITE_KEY","0x4AAAAAAB8-rEI2gNDf_QhU","SENTRY_DSN","https://45fd1229f78089d5c3ee78be128030e1@o4510583261757440.ingest.de.sentry.io/4510584253448272"]