Find the riskiest code
in any repo.

Know which functions to fix before your next incident. One command, any codebase, no config.

TypeScript · JavaScript · Rust · Go · Python · Java

$ hotspots analyze scripts/

18.8  send_digest.py   send_digest    critical
14.4  core.py          _load_content  critical
 6.9  enrich_git.py    _rel_path      moderate

Install free View on GitHub

Install in 30 seconds

One command. No daemon. No config file required.

$ brew install Stephen-Collins-tech/tap/hotspots

$ curl -fsSL https://raw.githubusercontent.com/Stephen-Collins-tech/hotspots/main/install.sh | sh

$ npm install -g @stephencollinstech/hotspots

$ pip install hotspots-cli

$ cargo install hotspots-cli

Run

$ hotspots analyze scripts/

Output

Top risk functions
18.8  send_digest.py   send_digest    critical
14.4  core.py          _load_content  critical
 6.9  enrich_git.py    _rel_path      moderate

What you get

In under a minute, on any repo.

Block complexity regressions

Run in delta mode with --policy. CI fails if a PR introduces a new critical function or spikes an existing one.

Score

Prioritize with a risk score

Every function gets a numeric score. No guessing — a ranked list you can act on in the next sprint.

Bugs

Find what's causing incidents

Combines cyclomatic complexity with churn history to surface functions that are hard to understand and frequently changing.

Recent analyses

Browse all →

eclipse-vertx/vert.x

vert.x's TLS and JSON codec layers carry the highest activity risk — 5 functions first

Sep 20, 2026

pallets/jinja

Jinja's lexer and compiler carry the highest activity risk — 5 functions to fix first

Sep 19, 2026

ktorio/ktor

Ktor's WebRTC bridge holds the highest structural risk — 5 dormant functions to review

Sep 18, 2026

Highest risk

Full leaderboard →

mudler/LocalAI

LocalAI's static asset layer carries the highest activity risk

42.3

DioxusLabs/dioxus

DioxusLabs/dioxus: harness.rs carries the highest risk — 5 functions to address

41.1

redis/redis

redis/redis's module and networking layer carries the highest structural debt — 5 functions to address first

38.6

Real output. Real repos.

Every analysis on this site was run automatically against a real open-source repo — same tool, same command, nightly. You can reproduce any post locally in one command.

100+

repos analyzed

nightly

new analyses added

1 cmd

to reproduce any post

Reproduce any analysis locally

$ hotspots analyze <path> --mode snapshot --format json --explain-patterns --force