Languages and frameworks
The languages inkdex reads, and the frameworks whose routes, inputs and authentication it knows.
inkdex reads Python, TypeScript, JavaScript, Rust, Go, Elixir and Java. Other files are listed (for secrets and settings) but not parsed. Secrets and crypto rules apply to every language.
Entry points by framework
An entry point is where outside data comes in: an HTTP route, a CLI command, a job, a message listener. inkdex knows these frameworks; their handlers' parameters become sources and their authentication becomes a fact (inkdex routes --unauthenticated).
| Language | Frameworks |
|---|---|
| Python | Flask, FastAPI, Django, Django REST Framework, Graphene, Click, Celery, Dramatiq, RQ, http.server |
| TypeScript / JavaScript | Express, Fastify, NestJS, Next.js (App Router, API routes), Remix, Node http, node-cron, BullMQ |
| Rust | axum, actix-web, Rocket, Salvo, Poem |
| Go | net/http, gorilla/mux, chi, gin, echo, fiber, httprouter |
| Elixir | Phoenix (router, controllers, LiveView, channels), Absinthe, Plug |
| Java | Spring MVC, JAX-RS, servlets, @Scheduled, Kafka / RabbitMQ / JMS listeners, main |
Authentication
| Language | What counts as authentication |
|---|---|
| Python | decorators, FastAPI Depends, router dependencies, DRF permissions |
| TypeScript / JavaScript | route and router middlewares, NestJS guards |
| Rust | authentication extractors in handler parameters |
| Go | router middlewares, handler wrappers |
| Elixir | pipe_through pipelines, on_mount hooks, plugs that require a user |
| Java | @PreAuthorize, @Secured, @RolesAllowed |
Data access
inkdex knows the database APIs of each language (Django ORM, SQLAlchemy, Prisma, TypeORM, diesel, sqlx, database/sql, gorm, Ecto, JDBC, JPA / Hibernate…). That covers raw queries for injection, and writes and deletes for authorization facts.
Dependencies
Manifests read: requirements*.txt, pyproject.toml, package.json, Cargo.toml, go.mod, mix.exs, pom.xml, build.gradle, build.gradle.kts. Lockfiles read: poetry.lock, uv.lock, pdm.lock, package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, Cargo.lock, mix.lock, gradle.lockfile. For each dependency, inkdex records whether your code imports it.