Kartta — the map for vibe coders

See how your app is built, even if AI wrote it. Kartta maps your Next.js or Vite + React app (the kind Lovable and Bolt build) with Supabase — screens, API routes, tables, auth, storage and external services — and tells you what every change affects before you push or pull.

npx @karttadev/cli

Run it in your project folder. A map opens in your browser and updates live as you (or your AI) edit code.

What you get

• Features view — your app grouped as features (Bookings, Billing, Clients…). Click one to see Screens → APIs → Data → Services.
• Impact — click any table, API or file: "If you change this, 3 screens and 5 API routes could be affected."
• Bridge — your computer ↔ GitHub: uncommitted changes, commits to push and to pull, push/pull history, and:
  • Before you push: the screens to test, as a checklist.
  • Before you pull: new tables to migrate, missing env vars, npm install needed.
  • Conflict warnings and sensitive changes (payments, auth, database, permissions).
• Security check — Supabase tables without Row Level Security, policies open to everyone, secret keys exposed to the browser or hardcoded, API routes without a login check, unsigned webhooks, .env not ignored. Each issue comes with a fix and a prompt for your AI.
• Code health — unused files, very large files, the Supabase client created in many places, server code without error handling, localhost links, env vars missing from .env.example. Each tip comes with a prompt for your AI.
• Architecture advice — diagrams of how your app is organized now and a simpler, safer shape (one data hook per table, server keys only on the server, splitting giant files and screens), with the why, small steps and a prompt for step 1.
• AI context — one click to get a rules file for Cursor (.cursor/rules/kartta.mdc), Claude Code (CLAUDE.md), Copilot or AGENTS.md with your features, where things live, your tables and rules for safe changes — so your AI stops guessing.
• Technical map — System → Modules → Files, with search and "open in VS Code / Cursor".

Options

npx @karttadev/cli [folder] [--port 4321] [--no-open] [--json map.json] [--allow-origin <url>]

Privacy

• Runs on your computer. Your code is never uploaded.
• Read-only: never edits files, commits, pushes or pulls.
• Reads environment variable names, never their values.
• The local server only answers the Kartta web app (with a one-time pairing code) and pages on your own computer.

Requires Node.js 18+. No dependencies.

More: https://kartta.dev