If you ever used SourceTrail or Understand, this is my idea of how it should have been done. It helps visualize complex codebases C/C++ it combines interactive call graphs, cross-references, semantic code search, reachability analysis, and inter-procedural value tracing.
Security-focused features include vulnerability discovery, attack-surface analysis, automated fuzz harness generation, and integration with external static analyzers. My favorite feature is the ability to generate semgrep rules for the specific code base.
Powered by tree-sitter, SrcWranglr can analyze codebases without requiring a successful build or compilation database.
Using this tool and my AAVR (Agentic Augmented Vuln Research) methodology I found several vulnerabilities in projects I won’t name as I just disclose to maintainers, in just a couple of hours.