Rebrief
github.com/neracu/rebrief- Category
- Developer Tools
- Rank
- No. 1654Tools index
Previous survey · No. 1578 ·
- Pricing
- Open Source
- Type
- TOOL
- Use case
- Coding
- Interfaces
- CLI · MCP · Editor Extension · Web
- GitHub
- 9 stars
- Date
About
Rebrief is a local CLI that scans a codebase (stack, git history, ownership, and security/test risks) and generates a structured REBRIEF.md handoff report in about 30 seconds, filtering noisy commits and estimating token savings versus raw source. It also ships an MCP server, VS Code extension, web dashboard, and an optional chat mode for querying the generated brief.
What it does
Point it at a local folder or a remote Git address and it writes an onboarding dossier for whoever inherits the code. It reads dependency manifests across eight language ecosystems, pulls stated intent out of agent instruction files and the readme, maps which people wrote which modules, flags likely secrets and leftover TODO markers, and checks pinned dependency versions against the public OSV vulnerability database. The same analysis comes out as Markdown, JSON, XML or a self-contained HTML page, and a small Python plugin interface lets a team add its own risk checks.
Why it's ranked here
The breadth is backed by code, not just a feature list. It is MIT licensed, installs from PyPI with only two required runtime libraries, runs its test suite in CI on every push, and exposes an MCP (Model Context Protocol) server that gives coding agents the brief, the risk list, churn hotspots and the detected dependencies as separate tools. That makes it a context feeder for agents as much as a report for people. The weak spots are real but bounded: the local-first pitch hides a default network call, and plugins found inside a scanned repository run as code.
What's good
Failure handling is careful. The vulnerability lookup has a three-second overall deadline, and on timeout or any network error it returns a report marked as skipped instead of crashing the scan. Severity is derived from CVSS scores, with 8.0 and above treated as critical. An unparseable manifest becomes a warning, and a plugin that throws is logged while the scan continues. Token estimates use the real tokenizer when the optional extra is installed and fall back to four characters per token, skipping binaries and files over 10 MB. The chat mode masks API keys in error messages and supports Anthropic, OpenAI, Gemini, OpenRouter and a local Ollama.
Tradeoffs
The readme promises no cloud upload, yet by default every scan sends detected package names and versions to the OSV API; a flag turns that off. Python modules placed in a plugins folder inside the scanned repository are loaded automatically and run with the tool's own privileges, which matters when scanning a stranger's repo; the plugin guide itself recommends disabling third-party plugins in locked-down CI. Stack detection only walks three directory levels deep. Secret detection is pattern and entropy based, so expect false positives and misses. The headline savings figure compares the brief against every unignored text file, which says more about repository size than brief quality.
How to use it well
It suits a developer inheriting an unfamiliar codebase, or anyone who wants an agent to start with a map instead of raw files. Run one full scan, read the where-to-start checklist, then use incremental mode against the base branch on pull requests. When scanning code you did not write, disable third-party plugins; on air-gapped machines, skip the vulnerability check. Wire the MCP server into your editor so the agent can ask for risks or hotspots on demand. It does not explain what the code does: it summarises metadata, history and heuristics, so it complements reading the core modules rather than replacing it.
Technical notes+
The console entry point is rebrief.cli:main in pyproject.toml; required dependencies are click, rich and a tomli backport below Python 3.11, with extras mcp, tokens, chat and web. rebrief/core/scan.py runs four steps: StackParser, RulesParser and FreshnessParser; GitLogParser and OwnershipParser; resolve_plugins plus run_risk_plugins and check_vulnerabilities; then count_repo_tokens and ReportGenerator. rebrief/core/vulnerabilities.py posts to the OSV querybatch endpoint in chunks of 1000 with DEFAULT_TIMEOUT_SECONDS of 3.0 and fetches details on an 8-worker thread pool. rebrief/core/tokens.py uses cl100k_base via tiktoken, CHAR_RATIO 4 otherwise, and MAX_FILE_BYTES of 10 MiB. rebrief/mcp/server.py registers four tools, a rebrief://summary resource and a prompt. PLUGINS.md documents BaseRiskDetector and the rebrief.plugins entry point group. .github/workflows/ci.yml runs pytest on Python 3.12 and compiles and packages the VS Code extension from rebrief-vscode/package.json.
Observed
- License
- MIT (LICENSE file and pyproject.toml)
- Language
- Python, requires 3.10 or newer; VS Code extension in TypeScript
- Packaging
- PyPI package with optional extras for MCP, tokenizer, chat and web UI
- Interfaces
- CLI, MCP stdio server, VS Code extension, local web UI, chat REPL
- Output formats
- Markdown, JSON, XML, standalone HTML
- Network use
- OSV vulnerability lookup on by default, skippable by flag, 3-second deadline
- Extensibility
- Python risk-detector plugins from a repo-local folder or pip entry points
- Tests
- pytest suite run in CI on push and pull request (.github/workflows/ci.yml)
- Chat providers
- Anthropic, OpenAI, Gemini, OpenRouter, Ollama; bring your own key
Read from README.md, pyproject.toml, LICENSE, PLUGINS.md, rebrief/cli.py, rebrief/core/scan.py, rebrief/core/tokens.py, rebrief/parsers/risks.py, rebrief/core/vulnerabilities.py, rebrief/mcp/server.py, rebrief/chat/credentials.py, rebrief-vscode/package.json, .github/workflows/ci.yml.
What it can do
Scan a local or remote codebase for stack, git history, ownership, and security/test risks
Codebase repository → Risk and context analysis
Generate a structured handoff report
Codebase scan results → REBRIEF.md file
Export handoff report in multiple formats
Scan results → Markdown, JSON, XML, or HTML file
Filter noisy commits from git history
Git commit history → Filtered relevant commits
Estimate token savings compared to raw source
Codebase and generated report → Token savings estimate
Query the generated brief via chat mode
User question → Answer based on brief content
Tags
Tech Stack
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.