Develra — Know what your code calls

Develra finds the external APIs, SDK operations, endpoints, webhooks, and MCP servers hiding in your repository—then locks the inventory for review and CI.

$ npx develra scan

View on GitHub See how it works

No account
No source upload
No telemetry

~/your-project offline

$ npx develra scan

Develra scanned 38 files

External contracts: 3

confirmed

OpenAI responses.create

confirmed

Stripe checkout.sessions.create

possible

Slack @slack/web-api

✓ Wrote develra.lock

SDK operations Raw endpoints Webhooks MCP configs JavaScript · TypeScript · Python

A package lockfile tells only half the story.

Remote services are dependencies too. Develra turns the evidence already in your repository into a stable external-contract inventory.

Discover

Scan manifests, imports, SDK calls, hosts, HTTP endpoints, and static MCP configuration—without executing project code.

Lock

Commit a canonical develra.lock with relative paths, explainable confidence, and no timestamps, secrets, or snippets.

Enforce

Run develra check locally or in the bundled GitHub Action to catch contract inventory changes before merge.

See exactly what your repository reaches.

Every finding keeps evidence types and repository-relative paths, so confidence is reviewable instead of magical.

✓ Confirmed operations and endpoints
✓ Probable package + import matches
✓ Unknown hosts stay visible
✓ Deterministic Markdown, SVG, JSON, and SARIF

Explore detection details

develra-graph.svg generated locally

External contract map connecting a repository to OpenAI, Slack, and Stripe

Your source never needs to leave your machine.

Default scans are offline and telemetry-free. Develra reads bounded static evidence, never imports repository modules, and never starts MCP servers.

Read the safety model

01
No account or API key
Useful output from the first command.
02
No project execution
No imports, lifecycle scripts, binaries, or MCP processes.
03
Secret-safe output
No environment values, auth headers, queries, or snippets.

Make contract drift a pull-request check.

Commit the lockfile once, then let Develra compare every change. The Action is bundled and read-only—there is no runtime install or hosted service.

Add to your repository

.github/workflows/develra.yml

name: Develra

on: [pull_request]

permissions:
  contents: read

jobs:
  contracts:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: develra-dev/develra@v0

Good questions, answered plainly.

Develra is intentionally small, conservative, and useful without a hosted product.

Does Develra upload my code?

No. Default scan and check are offline, telemetry-free, and do not instantiate a network client.

Is an installed SDK automatically considered active?

No. Package-only evidence is labeled possible. Imports, calls, endpoints, and supporting signals raise confidence.

What languages are supported?

The first release supports JavaScript, TypeScript, Python, raw HTTP endpoints, and static project-level MCP JSON configuration.

Can I add support for another provider?

Yes. Provider packs are declarative YAML validated against a public schema, with a template and contributor workflow in the repository.

Know what your code calls.

Scan locally. Commit the inventory. Review every change.