astquery

astquery

astquery is a local, read-only JavaScript and TypeScript reconnaissance CLI designed for LLM agents. It converts large source trees or downloaded bundles into a reusable semantic index and returns bounded, structured answers instead of requiring an agent to read every file.

It combines:

• Oxc parsing and semantic symbol/reference analysis.
• HTTP request reconstruction with methods, URLs, query parameters, bodies, and headers.
• Reconnaissance detectors for internal infrastructure, developer leftovers, debug/admin routes, secrets-like assignments, browser storage, messaging, GraphQL, dangerous DOM sinks, and dynamic code execution.
• Stable entity IDs and precise byte/line/column locations.
• JSON and JSONL output suitable for tools and agent loops.

Status

This is an initial comprehensive foundation. JavaScript is dynamic, so no static analyzer can guarantee discovery of every runtime-generated request. astquery reports confidence and preserves unresolved expressions instead of fabricating concrete values. See Reliability and limitations.

Build

cargo build --release

The binary is written to target/release/astquery.

Quick start

Index a directory:

astquery index ./javascript-output --output .astquery/index.json

Inspect coverage:

astquery summary .astquery/index.json

List reconstructed requests:

astquery endpoints .astquery/index.json
astquery endpoints .astquery/index.json --method POST
astquery endpoints .astquery/index.json --contains auth --min-confidence medium

Inspect developer leftovers and security-relevant artifacts:

astquery findings .astquery/index.json
astquery findings .astquery/index.json --category developer-leftover
astquery findings .astquery/index.json --category internal
astquery findings .astquery/index.json --severity high

Search symbols and retrieve bounded source:

astquery symbols .astquery/index.json --contains authenticate
astquery show .astquery/index.json sym_0123456789abcdef
astquery refs .astquery/index.json sym_0123456789abcdef
astquery source .astquery/index.json sym_0123456789abcdef --context 3 --max-bytes 12000
astquery slice .astquery/index.json sym_0123456789abcdef --context 5 --max-bytes 16000

Endpoint coverage

The current request reconstruction recognizes:

• fetch(url, options)
• axios.get/post/put/patch/delete/head/options(url, ...)
• Common api, client, and http Axios-style instances
• axios({ method, url, params, data, headers })
• $.get, $.post, $.getJSON, and $.ajax
• XMLHttpRequest.open(method, url)

For recognized calls it extracts:

• HTTP method.
• Literal, template, or unresolved URL expression.
• Direct query-string parameters.
• Axios params.
• Fetch bodies, including JSON.stringify.
• Axios data.
• jQuery request data.
• Object-literal headers.
• Dynamic template components.
• Evidence, source location, client family, and confidence.

Parameters retain their source expressions. For example, { email: form.email } is represented as parameter email with value form.email; it is not evaluated.

Reconnaissance categories

Category	Examples
admin-debug-route	/admin, /debug, Swagger, GraphiQL, actuator, diagnostics, feature flag panels
internal-host	localhost and .internal, .local, .corp, or .lan hosts
non-production-host	development, staging, QA, UAT, test, and sandbox hosts
endpoint-candidate	API-like paths not necessarily associated with a recognized HTTP client
url-literal	absolute HTTP(S) and WebSocket URL literals
developer-note	TODO, FIXME, HACK, and XXX comments
debug-artifact	debugger statements
console	console instrumentation
source-map	source map references
feature-flag	debug, internal, experiment, and feature-flag identifiers
sensitive-keyword	credential-like assignments with non-empty literal values
browser-storage	localStorage, sessionStorage, and IndexedDB
message-channel	postMessage and message listeners
websocket	WebSocket and EventSource construction
graphql	named query, mutation, or subscription definitions
dangerous-dom	innerHTML, outerHTML, document.write, insertAdjacentHTML
code-execution	eval, Function constructor, and string timers

Findings are leads, not vulnerability verdicts. Every result includes evidence and location for verification.

LLM workflow

A reliable agent loop is:

1. Run summary to understand scope and parse health.
2. Query endpoints with a reasonable limit and JSONL when streaming.
3. Query findings by category rather than requesting everything at once.
4. Use stable IDs with show.
5. Use refs for precise Oxc-resolved usages.
6. Use source for a narrow excerpt or slice for an LLM context packet containing source, references, and nearby endpoints/findings.
7. Treat medium/low-confidence results as hypotheses and inspect their evidence.

All list commands default to 100 results and report total, returned, and truncation status. Increase --limit deliberately. Diagnostics go to stderr; structured data goes to stdout.

Index safety

The index contains source excerpts, request headers, parameter expressions, and possible secrets. Treat it as sensitive output. astquery makes no network requests and does not execute analyzed JavaScript.

Documentation

• Index and output schema
• Reliability and limitations
• Extending detectors