Map a multi-repo codebase with three Claude Code diagram plugins and test them

A developer ran Floorplan, Archify and Understand Anything in Claude Code on a five-repo app in one day, then quizzed each map; a plain code-reading agent found an OAuth hole none of the maps showed.

Done withClaude Code· Nov 6, 2026

What they did

Valentina Koniukhova wanted a trustworthy picture of worklore, an app spread across five repositories: a Python backend on AWS Lambda, a plain JavaScript site, an MCP connector and helper repos. In one day the author ran three open-source Claude Code plugins on it. Floorplan built a clickable map of parts, endpoints and user flows. Archify produced a single architecture diagram with every box tied to lines of code at a pinned commit. Understand Anything, run headless, built a knowledge graph of files, functions and classes with a guided tour. Koniukhova then asked each tool the same three questions about permissions, usage counters and logging, and had a plain Claude Code agent with no map read the code to write an answer key.

How it went

Floorplan first found zero endpoints because the routes live in one table; after the author sent a fix upstream it found 66. Its self-written user flows came from the agent's memory and two were wrong, so the author deleted them and asked Floorplan to trace 17 flows through code; 14 of 16 tested ones worked and the 17th exposed a nightly job that had been failing. Archify took about an hour with two failed runs. Understand Anything took 14 minutes, 16 helper agents and $13.01 at API prices for 732 nodes. None of the three made things up in the quiz, but the plain agent found that OAuth tokens ignored their read and write scopes and could reach the REST API, plus gaps between the privacy page and the code. The author fixed the hole before publishing.

Worth knowing

Ask any generated map a few questions you already know the answers to before trusting it: parts the agent wrote from memory look identical to parts it traced. Archify pins a single repository. Understand Anything's session hook can rebuild the graph without asking if auto-update is on, and its first run burns a lot of tokens. The author runs worklore and links their own write-ups from the post.

Try it

With Claude Code· 6 parts to fill in

Read the code in [my repo or repos] and answer these questions using only what the code does, not what docs or your memory say: [question 1, e.g. how is access checked for each action], [question 2], [question 3]. For every claim, cite the file and line. Then check whether [my privacy page or README] matches the code and list each mismatch. Also check what an issued [OAuth token or API key] can actually reach. Do not change any code; stop and show me the findings so I can decide what to fix.

Square brackets are the parts to fill in. The prompt is ours; the story is theirs.

Where they said it

Related