AI for code analysis: how to understand someone else's project faster

AI for code analysis is most useful on your first day in a new project, when you need to understand what lives where and how a request travels from entry point to database. Instead of hours of reading files you can get a module map, a list of entry points and explanations of unclear functions in an evening, then check them against real lines. Below are the workflow, ready-made prompts, a script for small repositories and a cost estimate.

AI for code analysis: an agent or all the code in the request

An agent in the repository. Claude Code, opencode and similar tools search the project, open files and answer questions. They suit large repositories where all the code will not fit in one message. Claude Code setup is described in the documentation↗: the variables ANTHROPIC_BASE_URL=https://api.zukko.pro (without /v1) and ANTHROPIC_AUTH_TOKEN=fetch_.... For analysis, enable a read-only or planning mode if your tool has one (in opencode that is the Plan agent, in Claude Code planning mode; check the documentation of your version). That way you avoid accidental edits while exploring.

All the code in the request. For a small project you can assemble the files into one text and send it through the API. The window for most catalog models is 1M tokens (256K for Grok, 128K for GLM), so a repository of tens of thousands of lines sometimes fits. Upside: the model sees everything at once and will not miss a file the agent did not open. Downside: every following question sends all the code again unless cache is on.

Count tokens first

Before sending a whole project, find out how many tokens it has. The count_tokens↗ method does that:

curl https://api.zukko.pro/v1/messages/count_tokens \
  -H "x-api-key: fetch_your_key" \
  -H "anthropic-version: 2023-06-01" \
  -H "content-type: application/json" \
  -d '{"model":"claude-sonnet-5-5","messages":[{"role":"user","content":"your project text"}]}'

The response contains the number of input tokens. Compare it with the window: if it is above 1M (or above 128K for GLM), use an agent or analyze in parts.

Step 1. A project map

The first request should give the overall picture. Start with the file tree and key configs (README, package.json or pyproject.toml, docker-compose.yml), not with the sources:

Here is the project's file tree and configs. Build a map:
1. What kind of application this is and what it is written in.
2. The main modules/packages and what each does (one line each).
3. Where the entry points are: server start, CLI, handlers, background jobs.
4. Which external systems it talks to (DB, queues, APIs).
Cite a file for every claim. If you are not sure, say so.

The "cite a file" requirement is the main one. It turns a retelling into a checkable list, and you get "not sure" instead of a confident invention.

Step 2. Tracing a scenario

The most useful kind of question is to trace one scenario end to end.

Trace the path of a POST /orders request from the router to the database write.
For each step: file, function, what it does, what it passes on.
At the end list the side effects (emails, events, cache).

Such a trace gives you a starting point for reading the code: you know which files to open and in what order. For each step open the file and make sure the function is there, which shows right away where the model went wrong.

Step 3. Unclear places

Three different requests are useful for a specific function:

• "Explain what reconcile() does, in plain words and step by step."
• "Which inputs break this function? List the edge cases."
• "Who calls reconcile() and what changes if its signature changes?"

An agent answers the third by searching the project, while in "all code in the request" mode the model answers from what it sees. Remind it that it may not see calls in dynamic places (reflection, string names, plugins).

A script for a small repository

We assemble the files into one text with path headers and ask a question through the OpenAI-compatible format:

import sys
from pathlib import Path
from openai import OpenAI

EXT = {".py", ".ts", ".js", ".go", ".md", ".toml", ".json", ".yml", ".yaml"}
SKIP = {".git", "node_modules", "dist", "__pycache__", ".venv"}

def collect(root: Path) -> str:
    parts = []
    for p in sorted(root.rglob("*")):
        if p.is_file() and p.suffix in EXT and not (set(p.parts) & SKIP):
            parts.append(f"=== {p.relative_to(root)} ===\n{p.read_text(errors='ignore')}")
    return "\n\n".join(parts)

Run it with python ask.py ./myproject "Where are the entry points and how does authorization work?". Do not send files with secrets (.env, keys): add them to SKIP or filter by name.

How to check the answers

A model can confidently describe something that is not in the code. Three defenses:

1. Demand a file path and function name and verify by search: grep -rn "def reconcile" ..
2. Ask for a quote of a few lines the conclusion is based on.
3. Run it. If the model says "this function is called at startup", add a log line or a breakpoint and check.

Treat conclusions about architecture ("this code is too tightly coupled") as opinion, not fact.

What it costs

Suppose the project is 150,000 tokens (measure yours with count_tokens). You make 11 requests in a row: the first builds the map, the next ten refine it. The answer averages 1,000 tokens. Zukko prices as of October 18, 2026, $ per 1M tokens.

Without cache: every request sends 150,000 tokens. Input is 11 × 0.15 = 1.65M, output 11 × 0.001 = 0.011M.

With Claude cache (Anthropic format, the code is written to cache once and read ten times): write 0.15 × 0.5 = 0.075; read 1.5 × 0.05 = 0.075; output 0.011 × 2 = 0.022. Total about $0.17 instead of $0.68. We ignore the questions themselves, they are tiny next to the code.

A caveat: the cache discount for Claude works in the Anthropic format (/v1/messages, Claude Code, Anthropic SDK), and in the raw API you must switch cache on explicitly. Details: how cache reads and writes are billed↗. Agents like Claude Code handle cache themselves, but their spend still grows with session length.

FAQ

Can a neural network check code, not just explain it?

Yes, the same techniques work for review: "find potential bugs in this module, give the line and the reason". But conclusions must be verified by running and tests. Automation is covered in the article on code review via API↗.

Which model suits code analysis?

We do not claim that one reads or writes better than the others. Go by price, window and strength index (claude-opus-5-5 has 58, gpt-6.1-sol 52, claude-sonnet-5-5 48) and test on your repository.

What if the project does not fit in the window?

Use an agent that searches the project itself, or split the code: first a module map from the file tree, then separate requests about the modules you need.

Is it safe to send code to an API?

That is a decision for your organization. Exclude secrets, license-restricted material and personal data, and check the data-handling terms with your security team.

Both the script and the agent need one fetch_... key from the dashboard↗; the balance is topped up via SBP, MasterCard or crypto.