CHURNTwo-snapshot measurement
Quantifies added, deleted, changed, and unchanged lines between two versions of a project — per file and in aggregate.
--include-dist option reads the dist/ folders where published npm packages keep their code · used by the AI Threat Index
LOG KEEPER — v2.2.1: log keeper: keeps a copy of your coding agents’ logs before the agents delete them — Claude Code deletes its transcripts after 30 days by default — after log-in or daily, compressed, never deleting · protected folders refused · Agent Tracer on Windows now reads and writes UTF-8 · IT guide
AI AGENT TRACER — v2.2.0: reads the session logs your coding agents write — Claude Code, Codex, Cursor, Copilot CLI, Gemini CLI and Google Antigravity — and reports what they ran, deleted, pushed and sent, which model did it and what you refused, with a since-last-run block on top · offline, nothing sent
AGENT SCAN ACROSS 22 LANGUAGES — v2.1.1: every text file read at a stated level — full rules in 22 languages plus web-page scripts and notebooks · agent CLIs launched with their checks off, encoded prompts and hidden hosts, local models with no URL in the file: the three 2025 attack shapes found by name · churn now measures Julia, Lua and Elixir — 62 languages · tested on 25 public repositories · the licence check no longer stalls every run · the Agent Scan page · download
ENCODED PAYLOADS AND A FASTER, STRICTER AGENT SCAN — v2.0.2: a second pass decodes base64, hex and compressed literals and rates hidden AI code that the file executes CRITICAL · the rogue-agent pattern is CRITICAL in every scanned language · Ruby and C# false CRITICALs removed · agent scan start-up 25 s → 0.1 s on a 115 MB tree · Metrics + Agent Scan runs from the GUI again · every demo opens an in-tool source page verified against a frozen baseline · download
VERSION 2.0.1 — v2.0.1: the metric definitions moved (a move is not churn, braces never count, unclassified text out of the totals) so 1.9 and 2.0 numbers are not comparable · 114 known-answer fixtures behind the engine · every headless mode licence-gated · the Action reads its gate rules from the base branch · download
SECURITY RELEASE — v1.9.9: AI-BOM provider counts made exact (one provider however the code spells it; frameworks reported separately) · the agent map folds to match · committed credentials, build surface and the AI-vs-exec-only split now in the machine-readable JSON · download
CODE DELTA THREAT DETECTION AND CODE SECURITY TOOL PORTFOLIO — EXPANDED AND UPGRADED — v1.9.8: committed credentials found and shown redacted · merge gates for credentials, new install hooks and new remote-fetching build files · download-URL deltas on fetching build files · Agents mode in the Code Browser with the 3-D agent map as a first-class view · download
MULTI-CORE ENGINE — new in v1.9.7: scans use every core with byte-identical results — large scans roughly halved — plus Code Browser inheritance, a sortable class-complexity view and a density dial on the class visualiser · download
BUILD-FILE ALERTS — new in v1.9.6: a scan that compares two versions now flags every build/CI/packaging file that changed — the xz-utils entry route — install hooks first, in the GUI, the agent report and the PR comment · download
THE CODE BROWSER — new in v1.9.5: the diff and the whole project's structure in one page — Changes, Overview, Files, Classes and Visualiser tabs, a directory tree, a class index with methods at file:line, a 3D include map and a class ego view coloured by this scan's churn · download
THE AUDITED DIFF — new in v1.9.4: a rebuilt diff (now the Code Browser’s Changes tab) where every counter is a claim you can click, walk and cite — plus moves tracked across files and git overlays showing AI provenance, age of destroyed code and per-author churn · download
TRACEABLE NUMBERS — v1.9.3 fixes the PR comment’s generated-file count: it now counts only the generated files that churned in your PR, so the number traces to the diff · download
TRUE_CHURN IN CI — new in v1.9.2: pull-request comments now separate authored churn from generated churn — in a real npm/cli release, 80.1% of the churn came from one lockfile · read the paper
TRUE_CHURN — new in v1.9.1: separating authored code from generated code — lockfile and codegen churn subtotalled, TRUE_CHURN = what your developers actually wrote · plus Agent Infrastructure: rogue agents and committed agent credentials found in your tree · download
NEW PAPER — why LLOC is what really counts: a 35-line file holds 5 working statements, and a 12-line churn was really 1 · read the paper
NEW MEASUREMENT — 28.4% of NVIDIA’s open GPU driver tree is data, not code — single statements up to 3MB · read how it was found
NEW REPORT — six and a half years of Erlang/OTP, measured statement by statement — and what a line counter misses · read the report
WE SCANNED CHROMIUM — 43.5 million lines of code, one command, one laptop · read the report
NEW PAPER — AI-assisted development barely edits code, it replaces it: established projects rework 1 statement in 6, agent-built code 1 in 500 · read Paper C
v1.9.0 released — all non-specified programming languages churned as U_LOC · TOTAL LOC · spreadsheet report columns · full coverage accounting · download
LIVE DEMO — watch CodeDelta report on a real pull request · view on GitHub
BUSINESS LANGUAGE BUNDLE added for the finance industry — COBOL, JCL, PL/I · see the languages
STOP PRESS: free to test (full functionality) until 2027!
v2.5.4 — released 13 October 2026 — Threat Index: spots a hijacked update — the same new, obfuscated code added to several files — and links each file to its churn and Agent Scan detail
v2.5.1 — released 12 October 2026 — AI Log Keeper: saves AI coding agents’ session logs and monitors token consumption · Threat Index
v2.3.2 — released 9 October 2026 — Agent Scan reads every file and finds code hidden in images · obfuscated-code check · CodeDelta GUI displays (option) the exact command line for every run · runs on Windows 11 on ARM
SCAN PUBLISHED PACKAGES — v2.2.2: scan published packages: new --include-dist option reads the dist/ folders where published npm packages keep their code · used by the AI Threat Index
LOG KEEPER — v2.2.1: log keeper: keeps a copy of your coding agents’ logs before the agents delete them — Claude Code deletes its transcripts after 30 days by default — after log-in or daily, compressed, never deleting · protected folders refused · Agent Tracer on Windows now reads and writes UTF-8 · IT guide
AI AGENT TRACER — v2.2.0: reads the session logs your coding agents write — Claude Code, Codex, Cursor, Copilot CLI, Gemini CLI and Google Antigravity — and reports what they ran, deleted, pushed and sent, which model did it and what you refused, with a since-last-run block on top · offline, nothing sent
AGENT SCAN ACROSS 22 LANGUAGES — v2.1.1: every text file read at a stated level — full rules in 22 languages plus web-page scripts and notebooks · agent CLIs launched with their checks off, encoded prompts and hidden hosts, local models with no URL in the file: the three 2025 attack shapes found by name · churn now measures Julia, Lua and Elixir — 62 languages · tested on 25 public repositories · the licence check no longer stalls every run · the Agent Scan page · download
ENCODED PAYLOADS AND A FASTER, STRICTER AGENT SCAN — v2.0.2: a second pass decodes base64, hex and compressed literals and rates hidden AI code that the file executes CRITICAL · the rogue-agent pattern is CRITICAL in every scanned language · Ruby and C# false CRITICALs removed · agent scan start-up 25 s → 0.1 s on a 115 MB tree · Metrics + Agent Scan runs from the GUI again · every demo opens an in-tool source page verified against a frozen baseline · download
VERSION 2.0.1 — v2.0.1: the metric definitions moved (a move is not churn, braces never count, unclassified text out of the totals) so 1.9 and 2.0 numbers are not comparable · 114 known-answer fixtures behind the engine · every headless mode licence-gated · the Action reads its gate rules from the base branch · download
SECURITY RELEASE — v1.9.9: AI-BOM provider counts made exact (one provider however the code spells it; frameworks reported separately) · the agent map folds to match · committed credentials, build surface and the AI-vs-exec-only split now in the machine-readable JSON · download
CODE DELTA THREAT DETECTION AND CODE SECURITY TOOL PORTFOLIO — EXPANDED AND UPGRADED — v1.9.8: committed credentials found and shown redacted · merge gates for credentials, new install hooks and new remote-fetching build files · download-URL deltas on fetching build files · Agents mode in the Code Browser with the 3-D agent map as a first-class view · download
MULTI-CORE ENGINE — new in v1.9.7: scans use every core with byte-identical results — large scans roughly halved — plus Code Browser inheritance, a sortable class-complexity view and a density dial on the class visualiser · download
BUILD-FILE ALERTS — new in v1.9.6: a scan that compares two versions now flags every build/CI/packaging file that changed — the xz-utils entry route — install hooks first, in the GUI, the agent report and the PR comment · download
THE CODE BROWSER — new in v1.9.5: the diff and the whole project's structure in one page — Changes, Overview, Files, Classes and Visualiser tabs, a directory tree, a class index with methods at file:line, a 3D include map and a class ego view coloured by this scan's churn · download
THE AUDITED DIFF — new in v1.9.4: a rebuilt diff (now the Code Browser’s Changes tab) where every counter is a claim you can click, walk and cite — plus moves tracked across files and git overlays showing AI provenance, age of destroyed code and per-author churn · download
TRACEABLE NUMBERS — v1.9.3 fixes the PR comment’s generated-file count: it now counts only the generated files that churned in your PR, so the number traces to the diff · download
TRUE_CHURN IN CI — new in v1.9.2: pull-request comments now separate authored churn from generated churn — in a real npm/cli release, 80.1% of the churn came from one lockfile · read the paper
TRUE_CHURN — new in v1.9.1: separating authored code from generated code — lockfile and codegen churn subtotalled, TRUE_CHURN = what your developers actually wrote · plus Agent Infrastructure: rogue agents and committed agent credentials found in your tree · download
NEW PAPER — why LLOC is what really counts: a 35-line file holds 5 working statements, and a 12-line churn was really 1 · read the paper
NEW MEASUREMENT — 28.4% of NVIDIA’s open GPU driver tree is data, not code — single statements up to 3MB · read how it was found
NEW REPORT — six and a half years of Erlang/OTP, measured statement by statement — and what a line counter misses · read the report
WE SCANNED CHROMIUM — 43.5 million lines of code, one command, one laptop · read the report
NEW PAPER — AI-assisted development barely edits code, it replaces it: established projects rework 1 statement in 6, agent-built code 1 in 500 · read Paper C
v1.9.0 released — all non-specified programming languages churned as U_LOC · TOTAL LOC · spreadsheet report columns · full coverage accounting · download
LIVE DEMO — watch CodeDelta report on a real pull request · view on GitHub
BUSINESS LANGUAGE BUNDLE added for the finance industry — COBOL, JCL, PL/I · see the languages
Your diffs got enormous, your tools count lines, and machines now write half the code. CodeDelta measures what actually changed — every statement added, deleted, or repaired, from one pull request to forty-three million lines of Chromium.
↓ keep scrolling ↓New to the terms? The Management Brief — every term in 60 seconds, printable →
Built on 20 years of churn-measurement heritage. Its predecessor was used by
CodeDelta does two things from a single analysis: it measures exactly what changed between two versions — changed LLOC, SLOC and files — and it scans that same code for where it uses AI, flagging the risky patterns. Both run locally, both produce verifiable per-file reports.
Quantifies added, deleted, changed, and unchanged lines between two versions of a project — per file and in aggregate.
Counts both SLOC (physical) and LLOC (statement-level) with per-language tokenizers, so reformatting doesn't inflate the result.
Every classification is inspectable in a per-line report. The numbers can be audited, not just trusted.
Audits added and changed code for stylometric signals consistent with machine generation, and reports how much of a change is likely AI-written.
Flags individual files and reports the proportion of new code matching machine-generation signals — surfacing where to focus human review.
Reported as signals for review, with the method and its limits documented in an open technical paper — not presented as infallible proof.
C/C++, Java, C#, Python, JavaScript/TypeScript, Go and more, detected automatically by extension. See all 36 →
Runs entirely on your machine. No source code leaves your environment. Results accumulate in a local store for trend analysis.
Churn metrics and AI-audit findings appear together in a single per-file HTML report you can inspect and share internally.
CodeDelta is a command-line instrument first. It reads straight from git, runs headless in CI, gates merges on churn or new AI findings, and exposes itself to AI coding agents — so its deterministic numbers land in the tools your developers and reviewers already use, not in a separate dashboard nobody opens.
Compare any two refs — --git v1.7..v1.8 or HEAD~10..HEAD — with no working-copy juggling. Snapshot dates come from commit history, so a whole release timeline backfills in one pass.
The Code Browser’s side-by-side diff colours every statement by what happened to it — added, deleted, edited in place — so a review starts from the change map, not a wall of green and red.
A drop-in GitHub Action (code-delta-app/action@v1) wires CodeDelta into any repo in a dozen lines. Builds branch on its exit codes — fail on excess churn, on AI percentage, or only on findings newer than a committed baseline — and results post as SARIF plus a PR summary, inline on the diff and in the code-scanning tab.
TRUE_CHURN subtotals generated files — lockfiles, bundles, generator output — out of the headline number, rule by named rule, so the figure describes what your team wrote.
Export an inventory of every AI provider, endpoint and jurisdiction your code reaches — native or CycloneDX — and gate the build on policy: block egress to foreign-hosted models or unapproved providers. The artifact auditors and AI-governance programmes ask for.
Agent Scan inventories the agent infrastructure in your tree — workspaces, MCP configs, rogue-agent residue, committed credentials — each a named path in the report and AI-BOM. Produced from source, offline; gate the build on it only if your policy says so.
An MCP server lets Claude Code, Cursor and other assistants run CodeDelta directly — so "how much churn since v1.7?" returns the tool's reproducible numbers, not an improvised guess.
Every analysis exports CSV and JSON beside the HTML report — feed trend dashboards, spreadsheets, or your own scripts. Nothing is locked inside the report.
Runs accumulate in a local database; a one-page summary charts churn and AI% across releases for the people who approve the work, not only those who run the scan.
CodeDelta is a command-line engine first. Drop the GitHub Action into a repo and every pull request gets churn and AI findings posted back as a comment — with an optional gate that blocks the merge. Or run the same binary from cron for a nightly trend. Nothing is installed on a developer's machine, and the code never leaves your runner.
A single run generates a per-file HTML report covering churn, the AI code scan and the agent scan, plus the Code Browser (tree, classes, and a side-by-side diff) — all inspectable, all local. Every figure below is real output from the tool.
folly, across 51 files), its methods round it — red where this scan churned them — and the classes its code mentions as satellites; every link cites the file and line of the mention. A pointer for review, not a resolved call graph.
rogue_executor.py (AIS 100), with exec() on model output caught as the rogue-agent pattern.
dnn from a real 4.8 → 4.10 churn scan — 240 of its 770 methods drawn, ranked by churn then size, red and amber where this release changed them, the classes it mentions ringed around. Step the density up or down; every dot names itself on hover.Real output from CodeDelta — every figure above is produced by the tool from an actual scan, not a mock-up.
Churn: CodeDelta reports changed, added and deleted logical lines (LLOC), physical lines (SLOC) and files between two snapshots. It aligns each file pair with a longest-common-subsequence algorithm — once over physical lines, once over a logical-statement token stream — with a second pass disambiguating repeated tokens using scope-qualified anchors, so reformatting never inflates the count.
Agent Scan: the same code is scanned for where it calls AI — agent-SDK imports, model endpoints, exec-on-model-output and prompt-injection patterns — and rolled into an AI Bill of Materials covering every provider, endpoint and jurisdiction. Findings are flagged for security review, not asserted as malicious.
The churn algorithm and the AI detection methods — with their limits — are documented in open technical papers written to be independently verifiable.
Logical (LLOC) and physical (SLOC) lines modified in place between two snapshots — the core signal.
New logical and physical lines, and newly-added files, in the later snapshot.
Logical and physical lines, and whole files, removed from the earlier snapshot.
Changed + added + deleted — per file and across the whole project, in both LLOC and SLOC.
How much of the change was wholesale replacement rather than edits in place — (added + deleted) ÷ total churn, bounded 0–1. A high ratio can indicate AI-generated code, where whole blocks are regenerated rather than edited.
Finds where code calls AI — SDK imports, model endpoints, exec-on-model-output — and inventories it as an AI Bill of Materials. The Agent Scan page.
Download a time-limited trial license and run CodeDelta locally. No source code is transmitted.
Try CodeDelta