LATEST
STOP PRESS: free to test (full functionality) until 2027! SCAN PUBLISHED PACKAGES — v2.2.2: scan published packages: new --include-dist option reads the dist/ folders where published npm packages keep their code · used by the AI Threat Index LOG KEEPER — v2.2.1: log keeper: keeps a copy of your coding agents’ logs before the agents delete them — Claude Code deletes its transcripts after 30 days by default — after log-in or daily, compressed, never deleting · protected folders refused · Agent Tracer on Windows now reads and writes UTF-8 · IT guide AI AGENT TRACER — v2.2.0: reads the session logs your coding agents write — Claude Code, Codex, Cursor, Copilot CLI, Gemini CLI and Google Antigravity — and reports what they ran, deleted, pushed and sent, which model did it and what you refused, with a since-last-run block on top · offline, nothing sent AGENT SCAN ACROSS 22 LANGUAGES — v2.1.1: every text file read at a stated level — full rules in 22 languages plus web-page scripts and notebooks · agent CLIs launched with their checks off, encoded prompts and hidden hosts, local models with no URL in the file: the three 2025 attack shapes found by name · churn now measures Julia, Lua and Elixir — 62 languages · tested on 25 public repositories · the licence check no longer stalls every run · the Agent Scan page · download ENCODED PAYLOADS AND A FASTER, STRICTER AGENT SCAN — v2.0.2: a second pass decodes base64, hex and compressed literals and rates hidden AI code that the file executes CRITICAL · the rogue-agent pattern is CRITICAL in every scanned language · Ruby and C# false CRITICALs removed · agent scan start-up 25 s → 0.1 s on a 115 MB tree · Metrics + Agent Scan runs from the GUI again · every demo opens an in-tool source page verified against a frozen baseline · download VERSION 2.0.1 — v2.0.1: the metric definitions moved (a move is not churn, braces never count, unclassified text out of the totals) so 1.9 and 2.0 numbers are not comparable · 114 known-answer fixtures behind the engine · every headless mode licence-gated · the Action reads its gate rules from the base branch · download SECURITY RELEASE — v1.9.9: AI-BOM provider counts made exact (one provider however the code spells it; frameworks reported separately) · the agent map folds to match · committed credentials, build surface and the AI-vs-exec-only split now in the machine-readable JSON · download CODE DELTA THREAT DETECTION AND CODE SECURITY TOOL PORTFOLIO — EXPANDED AND UPGRADED — v1.9.8: committed credentials found and shown redacted · merge gates for credentials, new install hooks and new remote-fetching build files · download-URL deltas on fetching build files · Agents mode in the Code Browser with the 3-D agent map as a first-class view · download MULTI-CORE ENGINE — new in v1.9.7: scans use every core with byte-identical results — large scans roughly halved — plus Code Browser inheritance, a sortable class-complexity view and a density dial on the class visualiser · download BUILD-FILE ALERTS — new in v1.9.6: a scan that compares two versions now flags every build/CI/packaging file that changed — the xz-utils entry route — install hooks first, in the GUI, the agent report and the PR comment · download THE CODE BROWSER — new in v1.9.5: the diff and the whole project's structure in one page — Changes, Overview, Files, Classes and Visualiser tabs, a directory tree, a class index with methods at file:line, a 3D include map and a class ego view coloured by this scan's churn · download THE AUDITED DIFF — new in v1.9.4: a rebuilt diff (now the Code Browser’s Changes tab) where every counter is a claim you can click, walk and cite — plus moves tracked across files and git overlays showing AI provenance, age of destroyed code and per-author churn · download TRACEABLE NUMBERS — v1.9.3 fixes the PR comment’s generated-file count: it now counts only the generated files that churned in your PR, so the number traces to the diff · download TRUE_CHURN IN CI — new in v1.9.2: pull-request comments now separate authored churn from generated churn — in a real npm/cli release, 80.1% of the churn came from one lockfile · read the paper TRUE_CHURN — new in v1.9.1: separating authored code from generated code — lockfile and codegen churn subtotalled, TRUE_CHURN = what your developers actually wrote · plus Agent Infrastructure: rogue agents and committed agent credentials found in your tree · download NEW PAPER — why LLOC is what really counts: a 35-line file holds 5 working statements, and a 12-line churn was really 1 · read the paper NEW MEASUREMENT — 28.4% of NVIDIA’s open GPU driver tree is data, not code — single statements up to 3MB · read how it was found NEW REPORT — six and a half years of Erlang/OTP, measured statement by statement — and what a line counter misses · read the report WE SCANNED CHROMIUM — 43.5 million lines of code, one command, one laptop · read the report NEW PAPER — AI-assisted development barely edits code, it replaces it: established projects rework 1 statement in 6, agent-built code 1 in 500 · read Paper C v1.9.0 released — all non-specified programming languages churned as U_LOC · TOTAL LOC · spreadsheet report columns · full coverage accounting · download LIVE DEMO — watch CodeDelta report on a real pull request · view on GitHub BUSINESS LANGUAGE BUNDLE added for the finance industry — COBOL, JCL, PL/I · see the languages STOP PRESS: free to test (full functionality) until 2027! SCAN PUBLISHED PACKAGES — v2.2.2: scan published packages: new --include-dist option reads the dist/ folders where published npm packages keep their code · used by the AI Threat Index LOG KEEPER — v2.2.1: log keeper: keeps a copy of your coding agents’ logs before the agents delete them — Claude Code deletes its transcripts after 30 days by default — after log-in or daily, compressed, never deleting · protected folders refused · Agent Tracer on Windows now reads and writes UTF-8 · IT guide AI AGENT TRACER — v2.2.0: reads the session logs your coding agents write — Claude Code, Codex, Cursor, Copilot CLI, Gemini CLI and Google Antigravity — and reports what they ran, deleted, pushed and sent, which model did it and what you refused, with a since-last-run block on top · offline, nothing sent AGENT SCAN ACROSS 22 LANGUAGES — v2.1.1: every text file read at a stated level — full rules in 22 languages plus web-page scripts and notebooks · agent CLIs launched with their checks off, encoded prompts and hidden hosts, local models with no URL in the file: the three 2025 attack shapes found by name · churn now measures Julia, Lua and Elixir — 62 languages · tested on 25 public repositories · the licence check no longer stalls every run · the Agent Scan page · download ENCODED PAYLOADS AND A FASTER, STRICTER AGENT SCAN — v2.0.2: a second pass decodes base64, hex and compressed literals and rates hidden AI code that the file executes CRITICAL · the rogue-agent pattern is CRITICAL in every scanned language · Ruby and C# false CRITICALs removed · agent scan start-up 25 s → 0.1 s on a 115 MB tree · Metrics + Agent Scan runs from the GUI again · every demo opens an in-tool source page verified against a frozen baseline · download VERSION 2.0.1 — v2.0.1: the metric definitions moved (a move is not churn, braces never count, unclassified text out of the totals) so 1.9 and 2.0 numbers are not comparable · 114 known-answer fixtures behind the engine · every headless mode licence-gated · the Action reads its gate rules from the base branch · download SECURITY RELEASE — v1.9.9: AI-BOM provider counts made exact (one provider however the code spells it; frameworks reported separately) · the agent map folds to match · committed credentials, build surface and the AI-vs-exec-only split now in the machine-readable JSON · download CODE DELTA THREAT DETECTION AND CODE SECURITY TOOL PORTFOLIO — EXPANDED AND UPGRADED — v1.9.8: committed credentials found and shown redacted · merge gates for credentials, new install hooks and new remote-fetching build files · download-URL deltas on fetching build files · Agents mode in the Code Browser with the 3-D agent map as a first-class view · download MULTI-CORE ENGINE — new in v1.9.7: scans use every core with byte-identical results — large scans roughly halved — plus Code Browser inheritance, a sortable class-complexity view and a density dial on the class visualiser · download BUILD-FILE ALERTS — new in v1.9.6: a scan that compares two versions now flags every build/CI/packaging file that changed — the xz-utils entry route — install hooks first, in the GUI, the agent report and the PR comment · download THE CODE BROWSER — new in v1.9.5: the diff and the whole project's structure in one page — Changes, Overview, Files, Classes and Visualiser tabs, a directory tree, a class index with methods at file:line, a 3D include map and a class ego view coloured by this scan's churn · download THE AUDITED DIFF — new in v1.9.4: a rebuilt diff (now the Code Browser’s Changes tab) where every counter is a claim you can click, walk and cite — plus moves tracked across files and git overlays showing AI provenance, age of destroyed code and per-author churn · download TRACEABLE NUMBERS — v1.9.3 fixes the PR comment’s generated-file count: it now counts only the generated files that churned in your PR, so the number traces to the diff · download TRUE_CHURN IN CI — new in v1.9.2: pull-request comments now separate authored churn from generated churn — in a real npm/cli release, 80.1% of the churn came from one lockfile · read the paper TRUE_CHURN — new in v1.9.1: separating authored code from generated code — lockfile and codegen churn subtotalled, TRUE_CHURN = what your developers actually wrote · plus Agent Infrastructure: rogue agents and committed agent credentials found in your tree · download NEW PAPER — why LLOC is what really counts: a 35-line file holds 5 working statements, and a 12-line churn was really 1 · read the paper NEW MEASUREMENT — 28.4% of NVIDIA’s open GPU driver tree is data, not code — single statements up to 3MB · read how it was found NEW REPORT — six and a half years of Erlang/OTP, measured statement by statement — and what a line counter misses · read the report WE SCANNED CHROMIUM — 43.5 million lines of code, one command, one laptop · read the report NEW PAPER — AI-assisted development barely edits code, it replaces it: established projects rework 1 statement in 6, agent-built code 1 in 500 · read Paper C v1.9.0 released — all non-specified programming languages churned as U_LOC · TOTAL LOC · spreadsheet report columns · full coverage accounting · download LIVE DEMO — watch CodeDelta report on a real pull request · view on GitHub BUSINESS LANGUAGE BUNDLE added for the finance industry — COBOL, JCL, PL/I · see the languages

Code Delta — multi-faceted, multi-featured, much more than a churn tool!

True Churn is the headline. This page is the rest of the box — the Code Browser, the AI Agent Scan, the AI Code Scan, the GitHub Action, the build-file alert and the desktop app — shown as the screens they actually are. Eighteen screens, one per feature — click any picture to enlarge it.

↓  eighteen screens below  ↓
New in v1.9.5

The Code Browser.

Every scan writes one self-contained page that reads the code: five tabs that never leave the screen — Changes (the side-by-side diff, for comparisons), Overview, Files, Classes and Visualiser — with the browser’s Back button and a breadcrumb on every screen. A single-project scan gets the same page without the Changes tab.

Code Browser — Overview tab on a two-release comparison of fmt: changed files ranked with one-line stories, then the project structure
Overview. A comparison opens with the changed files ranked by what happened in them, each with a one-line story; below that, the whole project — languages, directories with their include links, every class, every file — and changed files open in the diff.
Code Browser — Changes tab: side-by-side diff of a YAML workflow file with changed lines in red, the changed-file list on the left
Changes. The side-by-side diff: every counter in the toolbar is a claim you can click and step through, the Ledger decomposes it into rows, moves paint violet at both ends, and the changed-file list carries per-function churn chips.
Code Browser — Files tab: directory tree on the left, format.h open in the reader at line 2678 with its includes and included-by lists above the source
Files. A directory tree of every file; the reader shows a file’s classes, its functions in line order, what it includes, who includes it, and the source with line numbers. Changed files wear C/D/A chips and open in the diff.
Code Browser — Classes tab: class list on the left, the internal namespace open with 103 methods listed by file and line
Classes. Every class or namespace container found (C++, C# and Java): its files, its methods with file and line, the classes its code mentions — a textual match, each mention cited to file and line — and the classes that mention it.
Code Browser — Visualiser, directories mode: the include map drawn as a 3D scene, one dot per top-level directory, arrows with counts
Visualiser — directories. The include map as a 3D scene: one dot per top-level directory, an arrow from A to B for every include that crosses between them, with the count on the arrow. Drag to orbit, scroll to zoom.
Code Browser — Visualiser, classes mode: the class ego view on a 2,000-class tree with folly at the centre
Visualiser — classes. The class ego view: one class at the centre, its methods round it coloured by this scan’s churn, the classes its code mentions as satellites; click one to travel to it, and every link cites where the mention is.

Read it in the guide: The Code Browser · the papers behind the counters: Papers.

AI agents in your tree

The AI Agent Scan.

Named SDK calls, model endpoints, exec-on-model-output, raw API keys, non-Western providers — found by reading the code, never by running it. Every flag names the file and line; the Agent Map draws the AI bill of materials as a picture. Agent Scan now has its own page: coverage, detections and the evidence.

CodeDelta AI Agent Scan report — flagged files ranked by risk with the reason for each flag
The agent-scan report. Flagged files ranked by risk, each with the reason — which SDK, which endpoint, which danger pattern — and a link to the source.
CodeDelta AI Agent Scan — the flagged source lines shown in context
The evidence. Click a flag and the flagged lines are shown in context, so the finding can be checked in seconds rather than trusted.
CodeDelta desktop app — agent scan results in the GUI
In the desktop app. The same scan from the app’s AI Agent Scan mode: one click, one local window, nothing leaves the machine.
CodeDelta Agent Map — agent files connected to the provider SDKs they call; providers in sovereignty-sensitive jurisdictions drawn in red
The Agent Map. Every file where an AI SDK was detected, connected to the providers it calls. Red providers sit in sovereignty-sensitive jurisdictions (CN/RU/KP/IR) — data sent there leaves friendly soil. Hover anything for its story.

Also in the box, without a picture: the AI bill of materials (native and CycloneDX) and the policy gate (--gate) that blocks unapproved providers in CI; the baseline that fails a merge only on new findings. CLI / CI reference.

Pointers, not verdicts

The AI Code Scan.

Files scored for generated-code characteristics — HIGH, Elevated, Normal — as a review aid. It tells you where to look first; it never claims to know who wrote a line. The paper says exactly what it can and cannot do.

CodeDelta AI Code Scan — 1,000 files scored: 1 HIGH, 395 ELEVATED
The AI Code Scan. 1,000 files scored — 1 HIGH, 395 ELEVATED, ~39% of flagged code showing generated-code characteristics. A review aid, never an authorship verdict.
Where it actually runs

In your pipeline.

Two lines in a workflow file. On every pull request, inside your own runner: the churn summary and agent findings as a PR comment, SARIF into the Security tab, and an optional merge gate. The engine downloads itself; a licence is built in for the beta.

The CodeDelta PR comment on a pull request — churn summary, AI audit and agent-scan findings
The PR comment. Churn summary, TRUE_CHURN with the generated files named, agent findings — posted by the Action on the pull request.
A CodeDelta GitHub Action run in the Actions tab
The run. The Action in the Actions tab: fetch the engine, install the licence, scan the diff, comment, upload SARIF, gate.

Set it up in five minutes · See it on a real PR · an MCP server lets your own agents call the engine (CLI / CI).

The app

The desktop app.

macOS, Windows and Linux. Pick a mode, point it at two snapshots or one project, and read churn, the AI code scan, the agent scan and the Code Browser in one local window — nothing phones home.

The CodeDelta desktop app — analysis modes, demos, and the results panel
The desktop app. Analysis modes on the left, the results panel on the right; Open Churn Report and Open Code Browser under every run.
CodeDelta results tiles — CHG, DEL, ADD, TRUE_CHURN, REWORK and the rest
The tiles. Every counter with its definition one hover away — CHG/DEL/ADD, TRUE_CHURN, REWORK, generated churn, data share — and a button to the report or the Code Browser behind each number.
Supply-chain watch

The Build-File Alert.

The files that control how a project builds and ships — Makefiles, CI pipelines, packaging, dependency manifests — are where supply-chain backdoors such as xz-utils actually entered. When a scan compares two versions, CodeDelta lists every build file that changed. It’s computed with no ML and no scoring — pure determinism: both directory trees are walked and every filename is checked against a rule table (exact names like Makefile, Dockerfile, package.json; tell-tale suffixes like .m4, .spec; locations like .github/workflows/ where a yml file is executable CI). Each recognised file gets a category — build definition, CI/CD, packaging, dependency manifest. Then the two lists are compared: in new only = ADDED, in old only = DELETED, in both = the bytes are compared and if they differ = MODIFIED.

Why it matters: code review reads source diffs — and the xz-utils payload never appeared in one. It entered through an edit to an autoconf .m4 build file that no source reviewer would open. Churn in build machinery is rare and disproportionately consequential, which is exactly the profile that deserves an alert rather than a line in a table. One honest limit: this catches the conventional build surface — a determined attacker can invoke an arbitrarily named script from a build, so it is coverage of the known surface, not a guarantee.

CodeDelta build-file change alert — build, CI and packaging files that changed between two versions, grouped by category with ADDED, MODIFIED and DELETED statuses and install hooks flagged at the top
Build Files Changed In This Diff. The count is the red-alarm entries; install hooks — a package.json that gains a postinstall, a setup.py with a cmdclass override, code that runs the moment someone installs — head the table whatever their category. Dependency manifests sit in the quieter line below because they change constantly and red-flagging them would desensitise the alert.
CodeDelta build-file change alert on FFmpeg 6.0 to 7.0 — 28 build files changed: configure and per-architecture Makefiles, each marked ADDED or MODIFIED
On a real release pair. FFmpeg 6.0 → 7.0: 28 build files changed — configure, the root Makefile and the per-architecture Makefiles across the codec libraries. Exactly the class of files the xz attacker edited.
CodeDelta Build and Deployment Surface inventory — the 50 build files present in the FFmpeg tree, 49 build definitions and one CI pipeline
The standing inventory. Every agent report opens its build section with what build machinery exists — FFmpeg carries 50 build files. Against that baseline, a changed one is an event and a new one is a question.

Run against two real curl releases (8.5.0 → 8.8.0) it flags 69 build-file changes — configure.ac, the .m4 macros, thirty CI workflows — exactly the surface the xz attacker used. Every agent report also carries the standing Build & Deployment Surface inventory of what build machinery exists in the tree. A pointer for review, not a verdict. Details in the user guide.

ModeChange alert (“changed in this diff”)Presence inventory (“what exists”)
Churn✓ GUI box + CLI [build] lines—
Churn + Agent Scan✓ + agent report + PR comment✓
Both (churn + AI + agent)✓ + agent report + PR comment✓
Agent Scan only— (no pair)✓
AI Audit— (no pair)✓
Metrics + Agent Scan— (no pair)✓
AI Code Scan——
Metrics——

Every scan that compares two versions carries the change alert; snapshot scans have nothing to diff. The presence inventory rides every agent scan.

Free to test (full functionality) until 2027, on every platform.

Try CodeDelta