Blast-radius impact analysis for code review, powered by the GitLab Knowledge Graph (Orbit).

orbit-impact is an MCP server that gives AI agents the one question every reviewer actually asks — "if I change this, what breaks?" — answered from a real call graph, not a text search.

It turns GitLab Orbit (the Knowledge Graph) into high-level impact tools, and ships with a GitLab Duo Agent Platform flow that posts the answer straight onto your merge request.

Built for the GitLab Transcend hackathon (Showcase track).

When you change a function, the dangerous question is who depends on it? Today reviewers answer this with grep and vibes:

• grep over-matches — every comment, string, and unrelated same-named symbol.
• grep under-matches — it can't follow the call graph two hops out, so the scary indirect callers (the ones that actually break in prod) stay invisible.
• LLM reviewers hallucinate dependents because they only see the diff, not the whole repository's structure.

Orbit already knows the truth: it parses your repo into a property graph with real CALLS edges between definitions. But Orbit Local only exposes a raw run_sql interface, and agents are bad at writing correct recursive graph SQL.

orbit-impact wraps Orbit's graph into five typed tools an agent can actually use, with the recursive call-graph traversal baked in:

Because it reads Orbit's CALLS edges, the answer is exact: no false positives from same-named symbols, and it follows the call chain as many hops as you ask for.

A reviewer (or an agent reviewing an MR) already has the diff. analyze_diff parses it, intersects the changed line ranges with Orbit's definition spans, and picks the innermost enclosing definition for each change — so you analyze exactly what the MR touched, pinned to one file and line. The name-ambiguity problem just disappears.

Real example — the requests library. A diff that edits one line inside Session.send:

git diff | orbit-impact diff

🛰️ Orbit Impact Analysis

Resolved 1 changed definition across 1 file directly from the diff. Overall risk: 🔴 high — 40 dependent definitions across 2 files…

The name send matches 5 definitions in requests (two in adapters.py, two in sessions.py, one in a test). A plain grep send drowns you in matches; naming the symbol by hand is ambiguous. The diff pins it to exactly sessions.py:752 and walks the real call graph from there — catching indirect callers many hops out that grep never shows, and flagging every test in the radius 🧪.

orbit-impact-demo is a tiny billing app whose tests cover the pricing layer but not the order/invoice layer. Editing order_total and running orbit-impact diff:

Overall risk: 🟡 medium — 3 dependent definitions across 2 files.

Dependent	Location	Hops
create_invoice	shopfast/invoicing.py:6	1
checkout	shopfast/orders.py:12	1
monthly_statement	shopfast/invoicing.py:12	2

✅ Tests to run

⚠️ No test files appear anywhere in the blast radius — this change is effectively untested.

monthly_statement is two hops out — an indirect caller — and the tool proves the change is untested. That's the answer reviewers actually need.

            ┌─────────────────────────┐
   git repo │  GitLab Orbit (local)   │  tree-sitter parse → DuckDB property graph
   ─────────►  `orbit index`          │  nodes: gl_definition / gl_file …
            │  `orbit sql`  (CALLS)   │  edges: gl_edge (relationship_kind='CALLS')
            └───────────┬─────────────┘
                        │ read-only SQL (stdin)
            ┌───────────▼─────────────┐
            │   orbit-impact (MCP)    │  recursive blast-radius + risk scoring
            │  index_repo find_symbol │
            │  blast_radius analyze_* │
            └───────────┬─────────────┘
                        │ MCP tools
            ┌───────────▼─────────────┐
            │  GitLab Duo Agent /Flow │  "Orbit Impact Analyzer" (AI Catalog)
            │  → posts MR comment     │  performs an action, not just chat
            └─────────────────────────┘

curl -fsSL "https://gitlab.com/gitlab-org/orbit/knowledge-graph/-/raw/main/install.sh" | bash
export PATH="$HOME/.local/bin:$PATH"
orbit --version

git clone <this-repo> orbit-impact && cd orbit-impact
npm install
npm run build

orbit index /path/to/your/repo        # or use the index_repo tool

The fastest way to feel it — pipe a diff straight in:

git diff main | node dist/index.js diff      # → the Markdown impact report
node dist/index.js analyze order_total       # by symbol name
node dist/index.js blast send src/requests/sessions.py
node dist/index.js help

Add --json for structured output, --max-depth N to control traversal depth.

Claude Code / Cursor / any MCP client — add to your MCP config:

{
  "mcpServers": {
    "orbit-impact": { "command": "node", "args": ["/abs/path/orbit-impact/dist/index.js"] }
  }
}

GitLab Duo (IDE) — drop the same block into .gitlab/duo/mcp.json in your project. See catalog/ for the published agent + flow definitions.

npm run smoke -- send        # impact report for a symbol in the indexed repo

• Impact is computed from Orbit's CALLS edges, which are resolved per the languages Orbit supports (Python, TS/JS, Go, Ruby, Java, Rust, C/C++, C#, PHP…). Dynamic dispatch and reflection aren't statically resolvable — same caveat as any call-graph tool.
• Common symbol names can resolve to multiple definitions; the report flags this as ambiguous and file_path disambiguates.
• Orbit Local indexes a single repo's code; cross-repo impact needs Orbit Remote.

MIT © 2026 Ali Zulfiqar. See LICENSE.