brakit-ai/brakit
You writes your code. Brakit watches what it does.
What's novel
You writes your code. Brakit watches what it does.
Code Analysis
17 files read · 4 roundsA zero-config, in-process API observability tool that monkeypatches Node.js HTTP servers and DB drivers to trace every request, query, and fetch call, then runs a rules engine to detect N+1 queries, PII leaks, duplicate calls, performance regressions, and security issues, serving results via a local
Strengths
Exceptionally well-architected with a clean event-bus pattern, safe wrapping that guarantees brakit failures never break the user's app, adaptive thresholds for performance detection that avoid false positives, and a thoughtful issue lifecycle with evidence-based auto-resolution. The instrumentation layer is non-invasive (diagnostics_channel for fetch, prototype patching for DB) and the graph builder's pending-buffer pattern elegantly solves the async timing problem.
Weaknesses
The security rules are regex-based pattern matching rather than deep semantic analysis, which limits their ability to catch obfuscated or novel attack patterns. The test suite (27 files) appears thin relative to the 198 source files, and I couldn't verify the depth of edge case coverage for the more complex paths like the graph builder clustering or the PII detection heuristics.
Score Breakdown
Signal breakdown
Innovation
Craft
Traction
Scope
Evidence
Commits
90
Contributors
2
Files
296
Active weeks
6
Repository
Language
TypeScript
Stars
11
Forks
0
License
MIT