Features
Everything your team needs
to understand the product
From comprehensive feature guides to security audits, tracking plans to E2E test scenarios — all extracted from your codebase, grounded in real code.
Feature guides
Comprehensive documentation for every product feature, generated from the code. Not a summary — the full picture.
- Business narrative explaining what the feature IS
- Design principles that recur across the codebase
- End-to-end lifecycle state flows
- Data model with column-level detail
- Route map with auth requirements
- Scheduled jobs with cron expressions
- Business risks with severity and mitigation
- Vendor dependencies with failure impact
- User journey as a product story
- Compliance flags (PII, financial, credentials)
- Known limitations and tech debt
AI chat
Ask questions about your product in natural language. Every answer cites specific rules from the knowledge base.
- Grounded answers — never invents, always cites
- Cross-feature queries: ask about any part of the product
- Fact tables rendered from real mechanical facts
- Proactive Linear ticket drafting for change requests
- Bug, improvement, and feature ticket templates
Tracking plan
Manage your analytics event inventory. Reconcile what your code tracks against what it SHOULD track.
- Auto-detect events: Segment, PostHog, Amplitude, Mixpanel, GA4
- Event properties, trigger, provider, and category extraction
- Suggested events for uncovered mutation endpoints
- Misalignment detection: plan vs code drift
- One-click Linear ticket for the diff
Flag plan
Feature flag lifecycle management. Track every flag's purpose, owner, cleanup date, and staleness.
- Auto-detect flags: LaunchDarkly, Unleash, GrowthBook, PostHog, Statsig
- Lifecycle types: temporary, permanent, experiment, ops, kill switch
- Cleanup date tracking with overdue warnings
- Gate site count from the codebase
- Linear tickets for flag maintenance
Experiments
A/B test inventory. See every experiment with its variants, hypothesis, metric, and whether it should be cleaned up.
- Auto-detect: Optimizely, GrowthBook, PostHog, Statsig, Split, VWO
- Variant extraction from code branches
- Hypothesis inference from nearby comments
- Active vs concluded status detection
- Concluded experiment cleanup warnings
Security audit
Static analysis findings mapped to OWASP Top 10. Find hardcoded secrets, injection risks, and auth gaps.
- 17 checks mapped to 8 OWASP Top 10 categories: injection, broken access control, crypto failures, auth failures
- Severity levels: critical, high, medium, low, info
- Remediation guidance for each finding
- Code evidence with file:line references
- False-positive reduction via exonerating patterns
Testing plan
E2E test scenarios generated from the knowledge base. Prioritized, with steps, and gap detection.
- Scenarios from every flow, edge case, and state transition
- Priority: critical (money/auth), high (core), normal, low
- Existing test detection (automated vs manual)
- Testing gaps: flows with no coverage
- Per-persona scenarios (member, admin, system)
Code-first discovery
Analyze your codebase structure to propose a product taxonomy. No running app required.
- 9 signal collectors: routes, navigation, schemas, guards, i18n, modules, ownership, GraphQL, directories
- Optional browser crawl for visual navigation data
- Shaped re-discovery: conforms to your approved structure
- Human approval gate: nothing is published without review
Trust system
Every claim carries a trust status. Verified means a test proves it. Asserted means the code says so. Drifted means it changed.
- Verified: passing test exercises the behavior
- Asserted: extracted from code, no test coverage
- Drifted: was verified, code changed since
- CI integration for automatic trust updates
- Coverage metrics per feature
Work command
Pick up a pending change and implement it as a review-ready PR. With vertical slice planning for features.
- /kanon:work --next picks the highest-priority open change
- Bug/improvement: straight to implementation
- Feature: vertical slice plan first, then slice-by-slice execution
- Self-review, typecheck, lint, test verification
- Structured PR body with acceptance criteria
Linear integration
Draft tickets from the AI chat, create tickets from tracking gaps, track spec changes from tickets.
- Proactive ticket drafting when you discuss changes
- Bug, improvement, and feature templates with full context
- Tracking plan diff tickets
- Flag maintenance tickets
- Spec change tracking from Linear issues
Mechanical facts
Deterministic data extracted from code: tables, routes, jobs, constants, flags, events, experiments, security findings.
- Column-level data model with types and constraints
- HTTP routes with auth and role requirements
- Scheduled jobs with cron expressions
- Constants and configuration values
- Always correct: pattern-matched, not LLM-generated
Frequently asked questions
How does Kanon extract information from code?
Kanon uses a combination of static analysis (regex-based pattern matching for mechanical facts like routes, flags, and events), tree-sitter parsing (for code structure), and LLM-powered extraction (for business rules and narrative synthesis). Mechanical facts are always deterministic — they're pattern-matched from the source, not LLM-generated.
How accurate is the knowledge base?
Mechanical facts (tables, routes, jobs, constants) are correct by construction — they're directly extracted from the code. LLM-generated content (narratives, principles, edge case descriptions) is grounded in the source code with file:line citations. The trust system distinguishes between verified (test-proven), asserted (code-extracted), and drifted (stale) claims.
Does Kanon work with any tech stack?
Kanon works with any codebase. Route detection supports Next.js, Express, and Rails. Schema detection supports Prisma and Rails. Feature flag detection supports LaunchDarkly, Unleash, GrowthBook, PostHog, Statsig, and env vars. Event detection supports Segment, PostHog, Amplitude, Mixpanel, and GA4. The LLM extraction works with any language.
How does the trust system work?
Every claim has a trust status. 'Verified' means a test in your CI suite exercises the behavior. 'Asserted' means the claim was extracted from code but has no test. 'Drifted' means the claim was previously verified but the code or test changed. Trust is updated automatically when you connect your CI pipeline.
Can I use Kanon without the Claude Code plugin?
The web app works independently for reading the knowledge base, managing tracking plans, and using the AI chat. The Claude Code plugin is needed for discovery (analyzing codebase structure), scanning (extracting claims and generating guides), and the /kanon:work command (implementing changes). You can also trigger discovery and scanning via the API.
Ready to see what your product actually does?
Point Kanon at a repository. Read the knowledge base it generates. Ask it questions.