Mapping Codebases with AI: Testing Scan and FogLamp

VideoAI Coding DailyDemo

AI Coding Daily demonstrates 'Scan' by Gustavo using GPT-5-O-sol in Codex. A single prompt directs the AI agent to inspect a repository, output an architectural JSON schema, and upload it to foglamp.dev to generate an interactive codebase map.
Playing loads YouTube (youtube-nocookie.com).

Key points

  1. Workflow: A ready-made prompt directs the AI agent to inspect the repository and generate a JSON diagram file (.foglamp/scan.json) detailing tools, nodes, and connections without writing HTML/CSS.
  2. Tested codebase: A Laravel application coupled with FastAPI, Pillow, and Tesseract OCR components for local image processing.
  3. Codex security intervention: Although the user granted permission, Codex's tenant security policy blocked the POST request to prevent leaking architecture summaries to an untrusted external host.
  4. Manual upload: To obtain the diagram, the creator manually executed the curl command in an external terminal, generating a public visualization URL.
  5. Execution cost and time: The agent spent 4 minutes and 32 seconds generating the JSON, consuming 3% of a $20 ChatGPT weekly quota, equivalent to approximately $1.50 in API token usage.

Why it matters

Automated codebase mapping aids developer onboarding, but sending architecture summaries to third-party endpoints creates security exposure. Codex's automated upload block demonstrates how enterprise-style tenant policies inside AI coding agents can safeguard private repo structures.

Analysis

While the generated diagram effectively highlights relationships, services, and external dependencies on mouse hover, publishing repo structures to an external, public URL makes it unsuitable for proprietary projects. The standout takeaway is Codex's policy enforcement, which actively restricted the AI agent from completing an untrusted network request even after explicit user confirmation.

Transcript

Show the full transcript (1,256 words)
Hello guys! Today I want to show you an interesting tool I found on Twitter, Scan, by Gustavo. Here I tried it out and it allows Codex or Claude or Cloud Code, or in fact, any agent, to build something like this. Interactive map of your codebase. Let me show you how it works and what are kind of caveats to that. So, if I visit that website, there's only this image and only the button "Copy scan prompt". As it says: "No install, no account, no skill". Just copy the prompt, which I did into Codex. And let me show you the actual prompt. So, I used GPT-4o, sorry, GPT-5-O-sol, and this is the actual prompt. "Analyze this repository and publish a shareable codebase scan to FogLamp - a map of the codebase, how it uses AI. You produce only the data a small JSON object, a fixed renderer draws the scan. Write no HTML or CSS." And then some guidelines, how to investigate. Also in the prompt, it emphasizes to investigate some AI-related tools, which I don't have in my repository. My repository is Laravel project with Python on the API, with fast API to perform OCR of the image, and then, "Output contract" - write EXACTLY this shape to .foglamp/scan.json. And then, this is the expected shape. Including models, tools, and integrations that are used, which in my case, none. And then there are graphs and nodes, which are basically the core of the diagram in the future. Then there are rules with nodes and labels and stuff like that. So the result of that is JSON diagram. And then as the final step, it instructs to post that diagram upload to foglamp.dev, which is risky. And I will show you in a minute how Codex reacted to this post request. So yeah, in essence, you upload your diagram to external, unverified service, to public URL, which gave me this result. So this is the actual result of my prompt. But before I dive deeper into what is inside, let me show you the actual process. This is pretty interesting. So Codex went to analyze the repository, this is Laravel repository, that's why it used Laravel review skill. But also, there was Python, so exploring, exploring, and then this is kind of the overview summary, you can say. "No generative AI SDK, model invocation, or autonomous agent loop. Its AI path is local image analysis, Pillow computes image features, and Tesseract performs OCR, reached through either a one-shot Python process or fast API." I'm now tightening the map around those two execution paths and the queue/storage lifecycle. And then this is kind of the overview summary, you can say. "No generative AI SDK, no AI nothing, and then it started editing that scan JSON which is actually requested." So 300 lines of JSON and this is how it looks. So what tools are used, Pillow and Tesseract, Filament Admin panel, and then the nodes are explained in JSON with this file result. But also, then it started editing that after some more analysis. So the file was being updated, and this was the result in 4 minutes and 32 seconds. And then, Codex asked me, GPT asked me, "Do you agree to the upload?" So, it didn't upload blindly. It asked me, and when I said yes, look what happens. If we scroll a bit down, this one: "Automatic approval review denied. High, risk, authorization: This would upload a repository-specific architecture summary and source references from a private workspace to foglamp.dev, an untrusted external destination, which tenant policy forbids even with explicit user consent." And yes, that totally makes sense. If you have your private repo, then you're uploading basically your code structure somewhere, even without .env file or secrets or password. The structure of the project is also a valuable asset. So I'm doing that for my demo project and you can probably do that for demos, but think twice about doing that for other private repositories. But Codex, as a result, denied my request and told me that the upload was blocked, and if I want to run that command myself, then yeah, sure, curl request and you can do that outside of AI agent, which I think is totally fair, and that's a good job by Codex. But my goal was to test that diagram tool, so I executed that separately in a separate terminal and it gave me the JSON result with the URL. Public URL, again, it's public. So then I went to that URL, and then as you saw, the result is pretty impressive. Let me zoom in a bit. I haven't seen the plus or minus icon here, so just zoom in the browser, and yeah, then it explains that there's Filament admin, in what file, there's upload image and other flow parts, so I have to scroll left and right. Probably not the most compact and visually friendly way to position all the items, but it's totally readable. Of course, it is useful for general first kind of overview, if you land on a new repository and you need to get familiar with the structure, or for other developers in the future, you could basically print it out almost, or save somewhere, and then you can copy the link. Also, at the bottom, there are services, stores, external, so some of those nodes are categorized in one of those categories. So if I zoom out again, and hit, for example, services, you can see services here highlighted. Actually, it's on mouse over. I don't even need to click anywhere. So stores, for example, queue, mysql, and image storage, and then external is Tesseract, OCR. So this is, I think, a good example from marketing perspective, a tool, public tool, to do something useful in your AI agent, but with the link to the actual FogLamp tool, which if we click here, I don't get paid for this video. I'm not affiliated. I'm generally curious about what that tool does. So ship AI agents like a pro, basically visibility for your AI agents, as I understand. So that is not directly related to that scan functionality, but you can check it out. Also, what I wanted to show you is the price. So GPT-5-O-sol high worked for 4 1/2 minutes on the JSON, and then tried post and failed. And let's hit exit and calculate the token usage. This is the only way I know how to find out the price, and I will use API pricing as example. So if I check my weekly usage limit, it was 28% remaining. Now it's 25, so it took 3% of my weekly usage on $20 plan of ChatGPT. And then I gave that token input to ChatGPT with sol, input and output pricing and it calculated approximately $1.50 of API pricing. So I'm not sure what do you think. Is it worth that money, the tokens, and uploading to external service? I guess for some demo projects, for quick visibility, it's totally a viable solution. But what other alternatives do you know how to summarize the codebase in some kind of diagram? Of course, the model itself, the agent itself, can provide some kind of schema in the terminal if you ask for it, but something visual. Do you use anything like that? Do you even need such service? Let's discuss in the comments below. That's it for this time and see you guys in other videos.

Links and tools from this entry

Summary generated by AI (Gemini 3.8 Flash, 27 September 2026). It may contain errors – the original source is authoritative.

Similar in content, found by the AI search.

  • Link:foglamp.dev

    Foglamp: Observability Platform for AI Agents

    Foglamp is an observability tool designed for AI agents that tracks the cost, latency, and output quality of LLM calls. Setup is automated using a single prompt handed to coding agents such as Claude Code or Codex.

    AI & LLMs· Tool

  • Repository:oh-my-mermaid/oh-my-mermaid

    Oh-my-mermaid: AI-Driven Architecture Diagrams for Codebases

    Oh-my-mermaid (omm) is a CLI tool and AI skill that analyses complex codebases to generate hierarchical architecture documentation powered by Mermaid diagrams.

    2.5kstarsTypeScript

    AI & LLMs· Tool

  • Repository:bex-co/bex-security

    Bex Security: Agent-Agnostic AI Security Scanner

    Bex Security is an open-source, upstream-first fork of OpenAI Codex Security that brings vulnerability detection, validation, and remediation to multiple coding agents via the Agent Client Protocol (ACP).

    51starsTypeScript

    AI & LLMs· Tool

  • Repository:nealbridges/VulnHunter

    VulnHunter: Agentic AI Security Scanner for Exploitable Vulnerabilities

    VulnHunter is an open-source, agentic AI security scanner that inspects source code from an attacker's perspective, confirms exploitability, and generates fixes. This maintained fork of Capital One's original project decouples the tool from Claude Code to support arbitrary agent harnesses and open-weight models.

    223starsPython

    AI & LLMs· Tool

  • Repository:cloudflare/security-audit-skill

    Cloudflare Open-Sources Security Audit Skill for Coding Agents

    Cloudflare's security-audit-skill is an open-source coding-agent workflow that orchestrates multi-phase security audits with independently verified, machine-readable findings.

    5.2kstarsJavaScript

    AI & LLMs· Tool

Let's talk about your project

Locations

  • Mattersburg
    Johann Nepomuk Bergerstraße 7/2/14
    7210 Mattersburg, Austria
  • Vienna
    Ungargasse 64-66/3/404
    1030 Wien, Austria

Parts of this content were created with the assistance of AI.