@emtai/xray-agent

Local agent for XRay Vision — extracts code metadata from your machine and pushes it to the XRay server. Source code never leaves your machine.

Installation

npm install -g @emtai/xray-agent

Requires Node.js 20+.

Quick Start

# 1. Get your API key from Settings > Agent Keys in the XRay dashboard

# 2. Initialize the agent
xray-agent init --api-key xray_agent_ak_your_key_here

# 3. Index a repository
xray-agent index /path/to/your/repo

# 4. Watch for changes (sentinel mode)
xray-agent watch /path/to/your/repo

Commands

xray-agent init

Configure the agent with your API key and server URL.

xray-agent init --api-key <key> [--server <url>]

• --api-key — Your agent API key (starts with xray_agent_ak_)
• --server — XRay server URL (default: https://mcp.emtailabs.com)

xray-agent index

Extract metadata from a repository and push to the server.

xray-agent index <repo-path> [options]

Options:

• --full — Force full re-index (default on first run)
• --incremental — Only index changed files
• --analyze — Run local security and infrastructure analysis
• --dry-run — Show what would be extracted without pushing
• -v, --verbose — Verbose output

xray-agent watch

Watch a repository for changes and automatically push updates.

xray-agent watch <repo-path> [options]

Options:

• --debounce <ms> — Debounce interval (default: 2000ms)
• --idle-sync <ms> — Background sync interval for other repos (default: 300000ms)
• --sync-all — Enable idle background sync of all configured repos
• -v, --verbose — Verbose output

xray-agent status

Show current configuration, synced repositories, and server connection status.

xray-agent status

How It Works

The agent runs entirely on your machine:

1. Extracts metadata — Functions, imports, call graph, string literals, type definitions
2. Computes hashes — Body hashes and AST fingerprints for change detection
3. Pushes to server — Only metadata and function bodies are sent (over HTTPS)
4. Server processes — Neo4j graph sync, encrypted storage, analysis

Source files are never uploaded. The server receives structured metadata that enables all XRay analysis features (complexity, architecture, security scanning, etc.) without needing the original source.

What Gets Sent

| Data | Purpose | |------|---------| | Function signatures | Graph nodes, call tracking | | Function bodies | Encrypted storage for fnid_source | | Import statements | Dependency graph | | Call relationships | Call graph analysis | | String literals | Route detection, API contract analysis | | File paths | File-level metrics |

What Stays Local

• Full source files
• .git history
• Environment variables and secrets
• Build artifacts
• Node modules

Supported Languages

TypeScript, JavaScript, Python, Go, Rust, Java, C#, C/C++, Ruby, PHP, Swift, Kotlin, Scala, Dart, Terraform, Ansible, CloudFormation, Kubernetes YAML.

Configuration

Config is stored at:

• macOS: ~/Library/Application Support/xray-vision/agent-config.json
• Linux: ~/.config/xray-vision/agent-config.json
• Windows: %APPDATA%\xray-vision\agent-config.json

Requirements

• Node.js >= 20.0.0
• XRay Vision account with agent API key
• Network access to XRay server

License

MIT