{
  "id": 5233386,
  "title": "Building an AST Code Verifier Without NetworkX, GitPython, or Any Dependencies",
  "url": "https://urgent.news/2026/09/03/building-an-ast-code-verifier-without-networkx-gitpython-or-any",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-03T03:00:40.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/urjit_upadhyay/building-an-ast-code-verifier-without-networkx-gitpython-or-any-dependencies-20dd"
  },
  "original_language": "en",
  "account": "Proofline is a pure Python static analysis tool that serves as a verification gate for code changes, built without relying on any third-party dependencies. The tool parses Python code using the AST and builds information about functions, classes, callers, routes, and file changes. Proofline aims to detect potential issues such as changed exception behavior, orphaned routes, broken caller relationships, and unexpected changes between scans. The tool is not designed to replace tools like Ruff or Flake8, but rather to provide additional insights into the blast radius of a code change and the confidence in that assessment.\n\nInstead of using external libraries like GitPython or NetworkX, Proofline builds its own functionality using Python's standard library. It uses pathlib.rglob() to walk through the project and calculates SHA-256 hashes with hashlib to detect file changes. The symbol map is built using the built-in ast module and ast.NodeVisitor to collect functions, classes, and other symbols. The caller graph is implemented as an adjacency list, which is simpler than a full graph library but sufficient for Proofline's needs. The tool runs as a pre-commit git hook to verify code before it is committed.\n\nA built-in dashboard uses Python's http.server and Server-Sent Events for live updates. The project faced challenges with dynamic dispatch, where the AST does not necessarily reflect the runtime behavior of the program. To address this, the project added a route_detector.py module that flags common route/decorator patterns, but clearly marks the results as INFERRED rather than PROVEN. The performance of Proofline is lower than Git's internal implementation due to the file hashing process, but a caching mechanism is added to improve subsequent scans. Proofline is most useful in situations where AI-generated code is reviewed regularly, as an additional verification step before merging, or when a small internal tool is desired without the overhead of large dependency trees.",
  "summary": "You end up learning why those packages exist in the first place. For the Zero Dependency Hackathon 2026, I built Proofline, a pure Python static analysis tool that works as a verification gate for code changes. The main rule for the project was simple: No third-party dependencies. So there was no networkx, no GitPython, no pre-commit, no fastapi, and no watchdog. Everything had to be built using…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}