A self-hosted context graph that connects your code, dependencies, supply chain, infrastructure, and runtime into one queryable, evidence-backed source of truth — for engineers and the AI assistants working beside them.
Eshu indexes source code, dependencies, container images, infrastructure, deployment config, runtime topology, external collector facts, and documentation into one queryable graph. It is the durable institutional-knowledge layer your team and its assistants query instead of re-deriving the answer from five repositories, three dashboards, a Helm chart, and a Terraform module.
The launch beachhead is supply-chain traceability: a single trace from a vulnerable dependency through the container images that ship it, the workloads that run them, and the source and Terraform that own them — every hop backed by evidence.
Use Eshu to ask:
- "Which deployed images contain this vulnerable package, and what source and Terraform own them?"
- "Who calls this function across all indexed repos?"
- "What deploys this service to production?"
- "Which workloads share this database, queue, or secret?"
- "What breaks if I change this Terraform module?"
- "Show the evidence behind this service-to-infrastructure link."
These map to the capability families reported by the get_capability_catalog
MCP tool and the public tool families in
MCP Reference.
| Capability area | What you get |
|---|---|
| Code intelligence | Find symbols, callers, call chains, imports, inheritance, complexity, and dead-code candidates across 20+ languages. |
| Code-to-cloud tracing | Connect source repos, container images, Kubernetes workloads, Helm/Kustomize/ArgoCD config, Terraform resources, and cloud observations with evidence at each hop. |
| Supply-chain traceability | Track dependencies across 13 package ecosystems, reconcile 4 advisory sources (CISA KEV, FIRST EPSS, OSV, NVD), and follow SBOM-to-image attachments with subject-digest evidence. These reads are served by external collectors (package registry, container registry, CI/CD, SBOM/attestation, advisory feeds, provider security alerts) that are off in a default deploy: enable them with ESHU_COLLECTOR_INSTANCES_JSON plus provider credentials, otherwise the list_* supply-chain tools return well-formed empty pages. |
| Vulnerability reachability | Go reachability via govulncheck ; value-flow reachability for Python, TypeScript, and JavaScript ; bounded JVM reachability . |
| Security and IAM posture | Surface hardcoded secrets, secret-access paths, and IAM trust and privilege chains with the evidence behind each finding. |
| Change-risk analysis | Ask for blast radius, shared dependencies, change surface, and direct versus transitive relationships before a change lands. |
| IaC and re-platforming | Find unmanaged resources, propose Terraform import plans, and compose multi-cloud re-platforming plans. |
| AI assistant context | Serve indexed truth through 162 read-only MCP tools so Codex, Claude, Cursor, VS Code, and other clients answer with evidence instead of guessing. |
| Operations visibility | Track ingestion, reducer queues, graph writes, runtime drift, freshness, health, metrics, traces, and logs. |
| Extensibility | Add parsers, collectors, package-registry sources, Terraform providers, and language support with fixture-backed tests. |
The Go code coverage badge links to an advisory package report. It is one signal, not a replacement for replay, golden-corpus, or full-corpus proof.
| I want to... | Start here |
|---|---|
| Get one successful local run and first answer | First successful run |
| Try the full API and MCP service stack on my laptop | Docker Compose |
| Develop Eshu or run one local workspace service | Local binaries |
| Connect Codex, Claude, Cursor, or VS Code | Connect MCP |
| Deploy Eshu as a shared team service | Kubernetes deployment |
| Deploy on EKS | EKS deployment |
| Monitor, debug, or tune a deployment | Operate Eshu |
| Code on Eshu with an AI agent | Code with agents |
| Understand the architecture | How Eshu works |
| Contribute | Contributing |
- CLI: local setup, indexing, analysis, and operator commands.
- MCP: assistant-facing tools for Codex, Claude, Cursor, VS Code, and other MCP clients.
- HTTP API: automation and platform integration.
- Helm: split-service Kubernetes deployment for shared team use.
If you only read three pages first, read these:
The full documentation is organized by job:
- Use Eshu: index repositories and ask code or infrastructure questions.
- Deploy Eshu: install the shared service with Helm or follow the EKS runbook.
- Operate Eshu: health checks, telemetry, and troubleshooting.
- Understand Eshu: architecture, graph model, and runtime modes.
- Extend Eshu: collectors, components, language support, and plugin contracts.
- Code with agents: repo rules, required proof, and the safe workflow for AI-assisted changes.
- Reference: CLI, API, MCP, configuration, telemetry, and backend details.
| Area | Status |
|---|---|
| Local Docker Compose stack | Supported |
| Local Eshu service from checkout | Supported for development and workspace-local use |
| MCP server | Supported |
| Kubernetes deployment | Supported through Helm |
| NornicDB graph backend | Default supported backend |
| Neo4j graph backend | Supported compatibility backend |
| Optional collectors | Varies by collector; see Collector And Reducer Readiness |
| Path | Purpose |
|---|---|
| go/ | Go module for the CLI, API, MCP server, ingester, reducer, collectors, storage, parser, and query code. |
| deploy/helm/eshu/ | Public split-service Helm chart. |
| deploy/observability/ | Prometheus alert rules and local OpenTelemetry Collector config. |
| apps/console/ | Private read-only product console for Eshu graph data. |
| docs/public/ | MkDocs source for the public documentation site. |
Eshu is self-hosted and does not require outbound vendor telemetry. When observability is enabled, it uses your configured OTLP and Prometheus targets.