Depwire Is Not RAG: Why Deterministic Beats Probabilistic for AI Code Intelligence

There is a category confusion happening in the AI developer tools space. Every tool that helps an AI understand your codebase gets labeled the same way: “context injection,” “code intelligence,” “AI-powered code search.” The assumption is that they all work the same way — embed the code, store the vectors, retrieve the similar chunks, feed them to the LLM.

Depwire does not work that way. The difference matters more than most developers realize.

What RAG actually does to your codebase

Retrieval-Augmented Generation applied to code works like this:

1. Your source files are split into chunks
2. Each chunk is converted into a vector embedding — a list of floating-point numbers representing semantic similarity
3. When you ask a question, your query is also embedded
4. The system retrieves chunks whose vectors are closest to your query vector
5. Those chunks are injected into the LLM’s context window
6. The LLM generates an answer based on what it received

This works well for natural language questions about code concepts. It works poorly for questions that require structural precision — the kind of questions that matter most when AI is actually writing and modifying code.

Ask “what breaks if I delete encodeToken in auth/token.ts?" and a RAG system has to find chunks that are semantically similar to your query, hope that the relevant import statements happen to be in the retrieved chunks, and then ask the LLM to reason about dependency relationships from an incomplete context. The answer you get is a guess. A confident, well-formatted guess — but a guess.

DETERMINISTIC, NOT PROBABILISTIC

Depwire uses tree-sitter — the same parser that powers GitHub’s code intelligence and syntax highlighting across millions of repositories — to parse every file in your codebase and extract exact structural facts:

• Every function definition and where it is defined
• Every class, interface, and type export
• Every import statement and what it imports from where
• Every symbol reference and what it resolves to
• Every API route and what calls it

The result is a symbol-level dependency graph. Not an approximation. Not a semantic similarity index. An exact map of every connection in your codebase, represented as a directed graph where nodes are symbols and edges are dependency relationships.

When you ask “what breaks if I delete encodeToken in auth/token.ts?", Depwire traverses this graph. It follows every incoming edge toencodeToken, then every incoming edge to those symbols, recursively. It returns the complete, precise, verified list of 14 files that import this symbol. Not "probably 3-4 files." Exactly 14. Named. With their import chains shown.

This is not a language model reasoning about your code. This is a graph traversal over a verified data structure. The answer is as deterministic as a compiler — because it uses the same class of technique.

Why this distinction matters for AI coding assistants

AI coding assistants already have probabilistic reasoning baked in. The model itself is probabilistic. Adding a probabilistic retrieval layer on top of a probabilistic generator compounds the uncertainty at exactly the point where you need precision most.

When Claude or Cursor proposes a refactor, renames a function, or suggests deleting a file, you need to know — not estimate — what else that change affects. A RAG system gives the AI more context. Depwire gives the AI facts.

The practical difference:

With RAG: The AI retrieves chunks that look related to your file, reasons about likely dependencies, and proposes changes. It might miss the one import three levels deep in an adapter file that nobody looked at recently. It has no way to know what it doesn’t know.

With Depwire: The AI calls impact_analysis or simulate_change via MCP, receives the complete dependency chain, and reasons from verified structural facts. It knows exactly what it doesn't know because the graph is complete.

This is why Depwire’s What If simulation can tell you “deleting src/utils/encode.ts breaks 30 import chains across 18 files" with zero ambiguity. There is no similarity threshold. There is no retrieval cutoff. The graph either contains an edge or it does not.

The graph is not a built graph either

There is another common confusion worth addressing. Tools like Nx, Turborepo, and Grapher also build dependency graphs. But they operate at the package or module level — they track which packages depend on which others for build caching and monorepo orchestration.

Depwire operates at the symbol level. The difference is the difference between knowing that “package A depends on package B” versus knowing that “the UserService class in packages/api/src/services/user.ts imports hashPassword from packages/shared/src/crypto/pbkdf2.ts, and hashPassword is also imported by 6 other files, including packages/api/src/routes/auth.ts."

Symbol-level precision is what makes the What If simulation, the graph-aware security scanner, and the blast radius analysis possible. A package-level graph cannot tell you which specific function breaks when you change a specific export. A symbol-level graph can.

What the graph enables is that RAG cannot

What If simulation — simulate deleting or modifying any file and see the exact blast radius before touching your code. RAG cannot do this because it has no graph to traverse. It can only retrieve similar-looking context and ask the LLM to guess.

Graph-aware security elevation — a shell injection pattern in a file with zero external connections is Low severity. The same pattern reachable from an unauthenticated HTTP route is Critical. RAG has no way to know which code is reachable from which entry points. Depwire knows because it has the graph.

PR risk analysis — for every pull request, compute the exact health score delta, the exact number of broken imports, and the exact set of critical files touched. Not estimates. Exact values derived from graph traversal.

Persistent context across sessions — the graph lives in Depwire Cloud. When you switch models, switch machines, or start a new session, the AI connects to the same graph and has immediate structural knowledge of your architecture. No re-scanning. No re-embedding. No context window spent re-discovering what your codebase looks like.

How to use it

Install the CLI:

npm install -g depwire-cli

Connect to Claude Desktop or any MCP-compatible AI tool:

{
  "mcpServers": {
    "depwire": {
      "command": "npx",
      "args": ["-y", "depwire-cli", "mcp"]
    }
  }
}

From that point, every AI session has access to 17 graph-aware MCP tools. The AI can call get_file_context to get exact import/export relationships for any file, impact_analysis to get the complete blast radius of any change, simulate_change to run a What If scenario, and security_scan to get graph-aware vulnerability severity.

No embeddings. No vector database. No similarity threshold to tune. No chunks that might or might not contain the relevant import statement. Exact structural facts, served deterministically, on demand.

Install

npm install -g depwire-cli

GitHub: github.com/depwire/depwire

Supports TypeScript, JavaScript, Python, Go, Rust, C, C#, Java, C++, Kotlin, PHP. Works with Claude, Cursor, VS Code Copilot, and any MCP-compatible AI tool.