Codebase-Diagramme via KI: Praxistest mit Scan und FogLamp

VideoAI Coding DailyDemo

AI Coding Daily testet das Tool 'Scan' von Gustavo in Kombination mit GPT-5-O-sol in Codex. Ein vorgefertigter Prompt weist den KI-Agenten an, ein bestehendes Repository zu analysieren, ein JSON-Schema der Architektur zu erstellen und dieses zur Visualisierung auf foglamp.dev hochzuladen.
Beim Abspielen wird YouTube (youtube-nocookie.com) geladen.

Das Wichtigste

  1. Funktionsweise: Ein kopierter Prompt instruiert den KI-Agenten, die Codebasis zu analysieren und eine strukturierte Datei (.foglamp/scan.json) mit Modellen, Werkzeugen und Abhängigkeiten zu erzeugen.
  2. Getestetes Repository: Ein Laravel-Projekt mit FastAPI-, Pillow- und Tesseract-Komponenten zur Bildverarbeitung und Texterkennung.
  3. Sicherheitsblockade in Codex: Obwohl der Nutzer den Upload bestätigte, verhinderte die integrierte Sicherheitsrichtlinie ('Automatic approval review denied') das Senden von Architekturdaten aus dem privaten Workspace an den externen Dienst foglamp.dev.
  4. Manueller Workaround: Der Autor führte den Curl-Befehl manuell außerhalb des KI-Agenten im Terminal aus, um die interaktive Map auf der öffentlichen URL zu generieren.
  5. Ressourcenaufwand: Die Analyse dauerte 4 Minuten und 32 Sekunden, verbrauchte 3 % des wöchentlichen Kontingents eines 20-Dollar-ChatGPT-Plans bzw. entsprach schätzungsweise 1,50 US-Dollar an API-Token-Kosten.

Warum das relevant ist

Die visuelle Aufbereitung von Codebasen erleichtert das Onboarding in neue Projekte, birgt jedoch erhebliche Datenschutzrisiken. Das Verhalten von Codex verdeutlicht, wie moderne KI-Entwicklungsumgebungen durch strikte Richtlinien verhindern, dass interne Architektur- und Metadaten unbedacht auf Drittanbieter-Server übertragen werden.

Einordnung

Das Tool bietet einen schnellen Überblick und hebt Services, Datenspeicher und externe Abhängigkeiten interaktiv hervor. Für offene Demoprojekte ist dieser Ansatz praktisch, für proprietäre Codebasen aufgrund des öffentlichen Uploads jedoch problematisch. Bemerkenswert ist vor allem das Sicherheitsfeature von Codex, das den Agenten daran hindert, sensible Repository-Strukturen selbstständig an ungesicherte externe Endpunkte weiterzuleiten.

Transkript

Vollständiges Transkript anzeigen (1.256 Wörter)
Hello guys! Today I want to show you an interesting tool I found on Twitter, Scan, by Gustavo. Here I tried it out and it allows Codex or Claude or Cloud Code, or in fact, any agent, to build something like this. Interactive map of your codebase. Let me show you how it works and what are kind of caveats to that. So, if I visit that website, there's only this image and only the button "Copy scan prompt". As it says: "No install, no account, no skill". Just copy the prompt, which I did into Codex. And let me show you the actual prompt. So, I used GPT-4o, sorry, GPT-5-O-sol, and this is the actual prompt. "Analyze this repository and publish a shareable codebase scan to FogLamp - a map of the codebase, how it uses AI. You produce only the data a small JSON object, a fixed renderer draws the scan. Write no HTML or CSS." And then some guidelines, how to investigate. Also in the prompt, it emphasizes to investigate some AI-related tools, which I don't have in my repository. My repository is Laravel project with Python on the API, with fast API to perform OCR of the image, and then, "Output contract" - write EXACTLY this shape to .foglamp/scan.json. And then, this is the expected shape. Including models, tools, and integrations that are used, which in my case, none. And then there are graphs and nodes, which are basically the core of the diagram in the future. Then there are rules with nodes and labels and stuff like that. So the result of that is JSON diagram. And then as the final step, it instructs to post that diagram upload to foglamp.dev, which is risky. And I will show you in a minute how Codex reacted to this post request. So yeah, in essence, you upload your diagram to external, unverified service, to public URL, which gave me this result. So this is the actual result of my prompt. But before I dive deeper into what is inside, let me show you the actual process. This is pretty interesting. So Codex went to analyze the repository, this is Laravel repository, that's why it used Laravel review skill. But also, there was Python, so exploring, exploring, and then this is kind of the overview summary, you can say. "No generative AI SDK, model invocation, or autonomous agent loop. Its AI path is local image analysis, Pillow computes image features, and Tesseract performs OCR, reached through either a one-shot Python process or fast API." I'm now tightening the map around those two execution paths and the queue/storage lifecycle. And then this is kind of the overview summary, you can say. "No generative AI SDK, no AI nothing, and then it started editing that scan JSON which is actually requested." So 300 lines of JSON and this is how it looks. So what tools are used, Pillow and Tesseract, Filament Admin panel, and then the nodes are explained in JSON with this file result. But also, then it started editing that after some more analysis. So the file was being updated, and this was the result in 4 minutes and 32 seconds. And then, Codex asked me, GPT asked me, "Do you agree to the upload?" So, it didn't upload blindly. It asked me, and when I said yes, look what happens. If we scroll a bit down, this one: "Automatic approval review denied. High, risk, authorization: This would upload a repository-specific architecture summary and source references from a private workspace to foglamp.dev, an untrusted external destination, which tenant policy forbids even with explicit user consent." And yes, that totally makes sense. If you have your private repo, then you're uploading basically your code structure somewhere, even without .env file or secrets or password. The structure of the project is also a valuable asset. So I'm doing that for my demo project and you can probably do that for demos, but think twice about doing that for other private repositories. But Codex, as a result, denied my request and told me that the upload was blocked, and if I want to run that command myself, then yeah, sure, curl request and you can do that outside of AI agent, which I think is totally fair, and that's a good job by Codex. But my goal was to test that diagram tool, so I executed that separately in a separate terminal and it gave me the JSON result with the URL. Public URL, again, it's public. So then I went to that URL, and then as you saw, the result is pretty impressive. Let me zoom in a bit. I haven't seen the plus or minus icon here, so just zoom in the browser, and yeah, then it explains that there's Filament admin, in what file, there's upload image and other flow parts, so I have to scroll left and right. Probably not the most compact and visually friendly way to position all the items, but it's totally readable. Of course, it is useful for general first kind of overview, if you land on a new repository and you need to get familiar with the structure, or for other developers in the future, you could basically print it out almost, or save somewhere, and then you can copy the link. Also, at the bottom, there are services, stores, external, so some of those nodes are categorized in one of those categories. So if I zoom out again, and hit, for example, services, you can see services here highlighted. Actually, it's on mouse over. I don't even need to click anywhere. So stores, for example, queue, mysql, and image storage, and then external is Tesseract, OCR. So this is, I think, a good example from marketing perspective, a tool, public tool, to do something useful in your AI agent, but with the link to the actual FogLamp tool, which if we click here, I don't get paid for this video. I'm not affiliated. I'm generally curious about what that tool does. So ship AI agents like a pro, basically visibility for your AI agents, as I understand. So that is not directly related to that scan functionality, but you can check it out. Also, what I wanted to show you is the price. So GPT-5-O-sol high worked for 4 1/2 minutes on the JSON, and then tried post and failed. And let's hit exit and calculate the token usage. This is the only way I know how to find out the price, and I will use API pricing as example. So if I check my weekly usage limit, it was 28% remaining. Now it's 25, so it took 3% of my weekly usage on $20 plan of ChatGPT. And then I gave that token input to ChatGPT with sol, input and output pricing and it calculated approximately $1.50 of API pricing. So I'm not sure what do you think. Is it worth that money, the tokens, and uploading to external service? I guess for some demo projects, for quick visibility, it's totally a viable solution. But what other alternatives do you know how to summarize the codebase in some kind of diagram? Of course, the model itself, the agent itself, can provide some kind of schema in the terminal if you ask for it, but something visual. Do you use anything like that? Do you even need such service? Let's discuss in the comments below. That's it for this time and see you guys in other videos.

Links und Tools aus diesem Beitrag

Zusammenfassung von KI erstellt (Gemini 3.8 Flash, 27. September 2026). Sie kann Fehler enthalten – maßgeblich ist die Originalquelle.

Inhaltlich ähnlich, ermittelt über die KI-Suche.

  • Link:foglamp.dev

    Foglamp: Observability-Plattform für KI-Agenten

    Foglamp ist ein Observability-Tool für KI-Agenten, das Kosten, Latenzen und Ausgabequalität von LLM-Aufrufen überwacht. Die Einrichtung erfolgt automatisiert über einen Prompt für Coding-Assistenten wie Claude Code oder Codex.

    KI & AI· Tool

  • Repository:cloudflare/security-audit-skill

    Cloudflare Open-Source-Skill für automatisierte Sicherheitsaudits mit Coding-Agents

    Cloudflare hat mit security-audit-skill ein Repository veröffentlicht, das Coding-Agents in strukturierte Sicherheitsprüfer verwandelt. Das System führt mehrstufige Code-Audits mit unabhängiger Verifikation und maschinenlesbaren Ergebnissen durch.

    5196SterneJavaScript

    KI & AI· Tool

  • Repository:tt-a1i/archify

    Archify: Interaktive Architektur- und Systemdiagramme für KI-Coding-Agenten

    Archify ist ein quelloffenes Node.js-Rendering- und Validierungssystem, das als Skill für Coding-Agenten wie Cursor, Claude Code, Codex CLI und OpenCode dient. Agenten erzeugen eine typisierte JSON-Zwischendarstellung (IR), die Archify deterministisch in interaktive, eigenständige HTML- und SVG-Dateien sowie Bild- und Videoformate kompiliert.

    45.490SterneJavaScript

    KI & AI· Tool

  • Repository:affaan-m/agentshield

    AgentShield: Sicherheits-Auditor für Claude-Code- und MCP-Konfigurationen

    AgentShield ist ein Open-Source-Sicherheitsscanner in TypeScript, der lokale Konfigurationen von KI-Agenten überprüft. Das Tool untersucht `.claude/`-Verzeichnisse auf hardcodierte Secrets, unsichere MCP-Server, Hook-Injections und Fehlkonfigurationen bei Berechtigungen.

    1163SterneTypeScript

    KI & AI· Tool

Lassen Sie uns über Ihr Projekt sprechen

Standorte

  • Mattersburg
    Johann Nepomuk Bergerstraße 7/2/14
    7210 Mattersburg, Austria
  • Wien
    Ungargasse 64-66/3/404
    1030 Wien, Austria

Dieser Inhalt wurde teilweise mithilfe von KI erstellt.