RepoGraph is a Python-based developer tool that analyzes GitHub repositories by cloning them, parsing source files into a dependency graph (files as nodes, imports as edges), and then selecting a small subset of the most relevant files to feed into a large language model. It exposes this functionality through a FastAPI backend, a command-line interface, and a single-file HTML frontend with a force-directed graph visualization.

The problem it targets is LLM context bloat and cost. When users paste entire repositories into models like Claude or GPT to ask questions, they burn through tens of thousands of tokens per query. RepoGraph's pitch is that by building the dependency graph once and then doing keyword-scored, BFS-expanded selection per query, it can deliver ~8k tokens of relevant code instead of ~180k tokens of the whole repo, cutting input costs by roughly 50–70%.

The intended users are developers or AI-tool builders who want cheaper, more focused context injection when working with LLMs over medium-to-large codebases. Interaction happens three ways: a CLI (`analyze`, `query`, `savings`), REST endpoints (`/analyze`, `/query`, `/graph/{id}`, `/savings/{id}`) with auto-generated Swagger docs, and a browser-based graph visualizer where users can click nodes and copy an optimized context string to their clipboard.

Under the hood, `GitHubFetcher` does a shallow `git clone --depth=1` to a temp directory. `RepoGraphBuilder` walks the tree, using Python's `ast` module for accurate parsing of `.py` files and regex fallbacks for JS/TS/Java/Go/Rust/etc., producing `CodeNode` (functions, classes, imports, top-30-line snippet) and `CodeEdge` (import/call/inheritance) objects. Node importance is scored via in-degree centrality. `ContextPacker` scores nodes against the query text, seeds top matches, does BFS expansion through the graph, and renders compressed signatures until a configurable token budget is hit. Graphs are cached as JSON in a temp directory keyed by an MD5 of `repo_url:branch`.

The codebase is small, coherent, and matches its README closely. Notable limitations acknowledged in the code and docs: keyword-based (not embedding-based) retrieval, MD5-based cache IDs stored in the OS temp dir (not durable), CORS wide-open (`allow_origins=['*']`), and private-repo token injection via URL rewriting which works but leaks tokens into any process listing of git. Nothing in the code suggests malicious behavior.