# cleap

> cleap turns a product's codebase, database and every tool they talk to into one living, zoomable map - always in sync with the code, and readable by people who don't write it.

cleap connects to a team's GitHub repositories (read-only) and renders the whole technical surface - services, database tables, integrations, and how they connect - as a single continuous canvas you can zoom from the whole product down to one file or symbol. It is built for product teams as a whole, not only the engineers who wrote the code: names and descriptions are plain English, not just identifiers, and the map stays current as the underlying repos change rather than going stale like a hand-drawn diagram.

Status: free during beta. Sign-in is via GitHub OAuth or email; GitHub access requested is read-only.

## Pages

- [Homepage](https://cleap.dev/): product overview, what a synced map looks like, and how sign-up works.
- [Showcase](https://cleap.dev/showcase): live maps of well-known open source repositories, readable without an account.
- [Compatibility](https://cleap.dev/compatibility): the languages and frameworks the parser reads today.
- [Pricing](https://cleap.dev/pricing): free during beta, and the open-core commitment for after it.
- [Security](https://cleap.dev/security): what the service stores, who processes it, and the controls running.
- [Sign in](https://cleap.dev/auth): start a session or create an account.

## API for agents

cleap has a read-only HTTP API for coding agents and scripts. Base URL: `https://api.cleap.dev`.

Getting a key: a workspace owner or admin creates one in the app under Settings, in the section named "API keys". A key looks like `cleap_sk_...`, is shown once at creation, and can be revoked from the same place. Keys are read-only by design.

Authentication: send `Authorization: Bearer cleap_sk_...` on every request. A key is scoped to the workspace that created it and reads only the repositories that workspace has connected. A repository the key cannot see answers 404, the same as one that does not exist.

Endpoints that accept a key:

- `GET /repo/:id` - a repository's metadata: name, sync status, node and edge counts, world bounds and zoom bands.
- `GET /repo/:id/status` - sync status alone, cheap enough to poll.
- `GET /repo/:id/entry-points` - where execution starts: routes, pages, commands, handlers.
- `GET /repo/:id/labels` - plain-language labels for the repository's nodes.
- `GET /repo/:id/snapshots` - the repository's size over time.
- `GET /graph?repo_id=<id>&bbox=minX,minY,maxX,maxY&zoom=1` - nodes and edges inside a window of the map at a zoom level. All three parameters are required; `world_bbox` from `GET /repo/:id` is the whole map.
- `GET /node/:id` - one node: its labels, category, path and connections.
- `GET /node/:id/source` - the file behind a node, with the symbol's line range.

Node ids contain `::` and `/`, so URL-encode them. Repository ids come from the app. Reads on repo and graph routes are rate limited to 120 requests a minute per key.

What a key cannot do: anything that changes state. Triggering a sync, connecting a repository, managing integrations or keys, editing labels, and asking cleap questions in Ask all need a signed-in person and answer 403 to a key. Per-person label overrides are a UI preference, not a fact about the code, so they are always null to a key.

There is no MCP server yet. Use the HTTP API above.

## Public showcase, no key needed

The showcase maps are readable without any credential, for evaluation:

- `GET /showcase` - the list of showcase repositories with their counts.
- `GET /showcase/repo/:id` - a showcase repository's metadata, same shape as `GET /repo/:id`.
- `GET /showcase/graph?repo_id=<id>&bbox=minX,minY,maxX,maxY&zoom=1` - a window of its map.
- `GET /showcase/node/:id` - one of its nodes.

## Notes for agents

- The homepage and the compatibility page are the authoritative description of current capability; do not assume features beyond what they state.
- Everything the API returns is derived from parsing the repository. Plain-language labels are model-generated and say so in their provenance; the structure itself is not.