> ## Documentation Index > Fetch the complete documentation index at: https://docs.monolex.ai/llms.txt > Use this file to discover all available pages before exploring further. # Monogram Semantics > Extract clean-room structural IR, build cross-file graphs, audit effects and possibility bands, and request explicit compiler-review evidence across 25 source/config languages. Monogram Semantics builds a local libSQL Store of per-function or per-config-unit structural IR. Its default extractor is Tree-sitter plus libSQL, except for the Dockerfile line parser. It can also run explicit `compiler-facts` probes, but those facts are review output only: they are not persisted into the Store and do not become ranking signals. *Published contract: `monogram-semantics 0.6.0`, OpenCLIs build `2026-07-12-191804`. The executing binary, OpenCLIs registry, and public CDN metadata agree on this release.* The dispatcher exposes **74 operational root commands**. `help`, `--help`, and `-h` are root-only guide forms; an operational command followed by `--help` returns exit 1 instead of a command-specific guide. `version`, `--version`, and `-V` are identity forms rather than operational commands. The installed `0.6.0` no-argument guide predates 15 dispatcher roots even though the binary recognizes them. This page and repository HEAD enumerate the complete surface; the missing embedded-guide entries are called out in the tables below rather than being hidden. ## Quick Start ```bash theme={null} openclis install monogram-semantics monogram-semantics --version monogram-semantics index /path/to/project monogram-semantics stats --db /path/to/project/.monogram-semantics.db --json monogram-semantics fn resolve_calls --db /path/to/project/.monogram-semantics.db --pretty ``` Index the full module or repository root when cross-file resolution matters. A subdirectory-only index cannot prove edges to definitions outside that slice. ## Complete Command Inventory ### Entry, traversal, and module graph | Command | What it does | Important controls | | ---------------- | ----------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- | | `fn` | Finds functions/config units by exact or qualified-suffix name. | ``, `--db`, `--pretty`, `--json` | | `implementors` | Finds trait, parent, base, or interface implementation edges. | ``, `--by-type`, `--pretty`, `--json` | | `cross-lang` | Joins literal TS/JS Tauri invokes with Rust command handlers. | `--target`, `--unresolved`, `--dead-handlers`, `--pretty`, `--json` | | `callers` | Finds functions that call a name; optionally restricts to resolved or external caller evidence. | ``, `--resolved`, `--external`, `--db`, `--json` | | `callees` | Lists direct lexical or resolved callees of a function. | ``, `--resolved`, `--db`, `--json` | | `importers` | Finds files that import, re-export, or dynamically import a module. | ``, `--json` | | `imports` | Lists import/re-export edges originating from matching files. | ``, `--json` | | `exports` | Locates export and re-export sites for a symbol. | ``, `--json` | | `orphan-modules` | Lists TS/TSX/JS files with no resolved inbound module edge. | `--limit`, `--json`; candidates, not automatic dead-code verdicts. | | `types` | Reads TypeScript alias/enum surface by name. | ``, `--json` | | `chain` | Executes the composable entry/traversal DSL. | Quoted pipeline, `--db`, `--explain`, `--json` | ### Aggregate audits and possibility bands | Command | What it does | Important controls | | | --------------------- | ------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------- | | `audit` | Produces a one-shot structure, resolution, complexity, Tauri, and module-graph health card. | `--db`, `--json` | | | `module-stats` | Reports module-edge kinds, import hubs, exports, and dead-export candidates. | `--top`, `--json` | | | `complexity` | Ranks functions by decision-point and nesting proxies. | `--top`, `--json` | | | `hubs` | Ranks resolved call-graph fan-in/fan-out or unreferenced candidates. | `--fanout`, `--unreferenced`, `--top`, `--json` | | | `metrics` | Emits HIS-style complexity/LOC/parameter/fan-out threshold coverage. | `--over`, `--top`, `--json` | | | `smell` | Names severity-ranked god-function, complexity, length, parameter, and hub candidates. | `--top`, `--json` | | | `effects` | Summarizes or lists effect flags and selected transitive effects. | Effect name, `--transitive`, `--limit`, `--json` | | | `unsafe-reach` | Compares lexical and confidently resolved reachability into unsafe code. | `--limit`, `--json` | | | `blocking-in-async` | Finds known blocking calls inside async Rust or Python functions. | \`--lang rust | python`, `--limit`, `--json\`; possibility band. | | `lock-across-await` | Finds Rust lock guards or C# acquire/release pairs spanning await. | \`--lang rust | csharp`, `--limit`, `--json\`; structural over-approximation. | | `select-sites` | Lists every `tokio::select!` site and highlights loop contexts for cancel-safety review. | `--limit`, `--json`; complete worklist, not bug verdict. | | | `worklist` | Runs a named fixed-predicate Tier-0 worklist band. | ``, `--limit`, `--json` | | | `taint-candidates` | Lists path, XSS, SQL, and XPath sinks whose first argument is function-parameter-derived within one function. | `--limit`, `--db`, `--json`; flow-insensitive candidate list, not attacker-control or sanitizer proof. | | | `inter-proc-taint` | Extends the arg-0 taint lane through confidently resolved helper calls. | `--depth`, `--limit`, `--db`, `--json`; unresolved/ambiguous edges break chains. | | | `xss-candidates` | Lists parameter-derived TS/JS `innerHTML`/`outerHTML` assignments. | `--limit`, `--db`, `--json`; recognized escapers are annotated and demoted, not dropped. | | | `provenance` | Navigates from a stored field/getter to writer functions, RHS identifiers, and writer callees. | ``, `--db`; answers where, not whether the value is correct. | | | `mutable-defaults` | Finds Python list/dict/set literal parameter defaults. | `--lang python`, `--limit`, `--json` | | | `panic-reach` | Finds Rust Tauri commands that transitively reach panic/abort effects. | `--limit`, `--json` | | | `goto-fail` | Finds code after definite divergence, the CWE-561/705 double-transfer family. | `--limit`, `--db`, `--json`; preprocessor-dead rows are subtracted where captured. | | | `empty-catch` | Finds empty catch/except bodies that swallow an exception. | `--limit`, `--db`, `--json`; intentional ignores still need explicit review. | | | `comparator-overflow` | Finds comparator methods that return bare subtraction and can overflow/invert ordering. | `--limit`, `--db`, `--json`; CWE-128/190 candidate band. | | | `force-unwrap` | Finds Kotlin `!!`, Dart `!`, and Swift force unwraps. | `--limit`, `--db`, `--json`; CWE-476 review surface, including deliberate assertions. | | | `toctou` | Finds same-function path check plus path use pairs. | `--limit`, `--db`, `--json`; CWE-367 structural co-occurrence, not raceability proof. | | | `lock-no-unlock` | Finds lock acquisition without a same-function unlock. | `--limit`, `--db`, `--json`; paired helper release is the main false-positive class. | | | `resource-leak` | Finds C allocation without a same-function free. | `--limit`, `--db`, `--json`; ownership transfer to the caller is the main caveat. | | | `unsafe-send` | Lists hand-written Rust `unsafe impl Send/Sync` audit sites. | `--limit`, `--json` | | | `async-void` | Lists C# `async void` functions. | `--limit`, `--json` | | | `is-literal` | Finds Python value literals compared with identity rather than equality. | `--limit`, `--db`, `--json` | | | `bitwise-precedence` | Finds C bitwise/comparison precedence candidates such as `a & 1 == 2`. | `--limit`, `--db`, `--json`; CWE-783 possibility band. | | | `rescue-exception` | Lists Ruby `rescue Exception` sites. | `--limit`, `--json` | | | `throwing-dtor` | Lists C++ destructors that can throw. | `--limit`, `--json` | | | `floating-promise` | Finds resolved TS/JS async calls without await/then/catch handling. | `--limit`, `--json` | | | `contract-pair` | Finds incomplete equality/hash contract pairs. | Positional contract `java-eq` or `py-eq`; `--limit`, `--json` | | | `injection-surface` | Traces Tauri commands to unsafe, FFI, process, or SQL sinks; optional value lane. | `--value`, `--lexical`, `--depth`, `--json` | | | `audit-commands` | Reports each Tauri command's confident reachability into a selected target class/function. | `--reaches`, `--depth`, `--all`, `--json` | | | `impact` | Computes confident or lexical forward/reverse transitive closure for one function. | ``, `--forward`, `--depth`, `--lexical`, `--json` | | ### Index, lifecycle, schema, configuration, and utilities | Command | What it does | Important controls | | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------- | | `index` | Recursively extracts supported files and persists incremental Store state. | Paths, `--db`, `--verbose`, `--full-resolve`, `--timing` | | `stats` | Reports files/functions/calls, resolution tiers, effects, and bridge aggregates. | `--db`, `--json` | | `emit-anchors` | Emits structural owner-setup/owner-teardown labels for Monogram Language induction. | `--db`, `--json` | | `teardown-reach` | Traverses confident callees reachable from structural destructors. | `--db`, `--depth`, `--json` | | `lifecycle-flow` | Shows source-order acquire/use/release/transfer call labels for one function. | ``, `--db`, `--json`; not execution-order/dataflow proof. | | `find-like` | Fuzzy-finds a function when the exact name is unknown. | ``, `--db`, `--pretty`, `--json` | | `exceptions` | Finds handlers, declarations, or transitive throws for an exception type. | ``, `--handles`, `--declares`, `--throws`, `--db`, `--json` | | `references` | Reads typed non-call reference edges beneath a path prefix. | ``, `--db`, `--json` | | `reference-census` | Reports total reference edges and highest fan-in paths. | `--top`, `--db`, `--json` | | `contract-drift` | Diffs Rust struct, TypeScript type, and JSON Schema field sets. | Any two of `--rust`, `--ts`, `--schema`; `--db`, `--json` | | `schema-bands` | Finds dangling, dead, and recursive JSON Schema `$ref` candidates. | `--db`, `--json` | | `schema-metrics` | Ranks schemas by `$ref` fan-in and validator-edge profile. | `--db`, `--json` | | `env-surface` | Groups literal environment-variable reads and highlights single readers. | `--db`, `--json` | | `command-surface` | Groups external process spawns and flags dynamic executable selection. | `--db`, `--json` | | `css-bands` | Reports dangling custom-property reads and dead-token candidates, excluding captured JS `getPropertyValue`/`setProperty` references. | `--db`, `--json`; dynamic token-name construction remains outside the scan. | | `css-token` | Shows one CSS custom property's definitions, CSS/JS consumers, and token dependencies. | ``, `--db`, `--json`; name may be bare or `--`-prefixed. | | `cargo-unused` | Joins Cargo normal dependencies with indexed Rust imports to find unused candidates. | `--db`, `--json` | | `cargo-deps` | Builds reverse path-dependency fan-in for indexed Cargo workspace manifests. | `--db`, `--json` | | `npm-unused` | Finds package dependencies whose names appear nowhere in indexed package source. | `--db`, `--json`; dev dependencies excluded. | | `wrangler-dead-bindings` | Finds D1/KV/R2 bindings never referenced as `env.` in indexed Worker source. | `--db`, `--json` | | `audit-resolutions` | Reports resolution kinds and honesty-floor invariant violations. | `--db`, `--json` | | `dead-code` | Finds intra-function statements/cases after terminal control flow. | `--limit`, `--db`, `--json` | | `mutation-surface` | Finds C# out/ref and Rust `&mut` argument mutation through calls. | `--db`, `--json` | | `release-fns` | Lists structural release/teardown seed functions. | `--db`, `--json` | | `extract` | Extracts one file without persistence. | ``, `--pretty`, `--summary` | | `compiler-facts` | Runs explicit compiler/parser review probes over files or directories. | Paths, `--recursive`/`--no-recursive`, `--limit`, `--json`, `--pretty` | | `debug-tree` | Dumps the Tree-sitter parse tree for extractor development. | `` | | `version` | Prints the executing version. | Read-only. | | `help` | Prints the installed full reference. | No arguments also print it. | ## Language and Proof Levels The default Store covers Rust, TypeScript/TSX, JavaScript, Python, Go, Java, C, C++, C#, Swift, Kotlin, Dart, Scala, Zig, PHP, Ruby, Lua, Bash, HCL, CSS, HTML, Dockerfile, TOML, YAML, and JSON. ```text theme={null} default extract/index source structure, names, calls, effects, module/type/config edges ↓ compiler-facts (explicit opt-in) compiler/parser diagnostics and summaries for review only ↓ runtime or language-server proof still separate when behavior, binding, type flow, or lifetime is claimed ``` The structural Store does not silently claim type inference, macro expansion, borrow checking, overload/trait resolution, runtime scheduling, package-manager semantics, browser cascade/layout, JSON Schema validation, or host-application config semantics. ## Incremental Store Contract `index` skips unchanged files by modification time. Body-only edits with an unchanged exported surface can use scoped call re-resolution; signature, implementation, field, config, file-add/remove, or other surface changes fall back to a full resolve. `--full-resolve` and `MONOGRAM_SEMANTICS_FORCE_FULL_RESOLVE=1` are explicit kill switches. The default database is `/.monogram-semantics.db`. Pin `--db` in reproducible reviews and use `stats` to state exactly which Store supplied the result. ## Release Platforms The `0.6.0` CDN metadata publishes five artifacts. Intel macOS is not present; do not infer it from source portability. | Platform key | Binary | | ----------------- | ------------------------ | | `darwin-aarch64` | `monogram-semantics` | | `linux-aarch64` | `monogram-semantics` | | `linux-x86_64` | `monogram-semantics` | | `windows-aarch64` | `monogram-semantics.exe` | | `windows-x86_64` | `monogram-semantics.exe` | The installed macOS ARM payload is Developer ID signed. Source checkout, installed immutable payload, CDN metadata, and public documentation are separate proof layers; this page's release stamp identifies the shipped layer. ## Relationships | Tool | Ownership | | ----------------------------------------------- | -------------------------------------------------------------------- | | [Monogram](/ai-clis/monogram/overview) | Everyday code navigation, product ranking, and score-debug | | [Monogram Logos](/ai-clis/monogram-logos) | Possibility-band foundry review over this Store | | [Monogram Language](/ai-clis/monogram-language) | Corpus-derived lexical/language priors and gated review artifacts | | [Monograph](/ai-clis/monograph) | Mechanism and fix-shape knowledge attached after detector bands fire | | [Monobench](/ai-clis/monobench/overview) | External behavior/lift evaluation, not an in-tool verdict command |