Ecosystem-scale dependency intelligence for MoonBit packages.

dependency-graph

ecosystem

mooncakes

analysis

Download zip

Author

Atman-Angle

Version

0.1.0

License

Apache-2.0

Repository

github.com/Atman-Angle/moonatlas

Last updated

16 hours ago

Downloads

Dependencies

moonbitlang/async0.21.0

#MoonAtlas

See how the MoonBit package ecosystem is connected.

MoonAtlas builds a dependency graph from public Mooncakes metadata and computes ecosystem-level structural metrics such as reverse dependencies, transitive blast radius, strongly connected components, PageRank, and dependency concentration.

The graph, snapshot parser, metrics, and report serialization are implemented in MoonBit. Python is limited to reproducible data collection and differential verification.

#What MoonAtlas Found

The 2026-08-20 UTC snapshot contains 2,062 packages and 2,512 valid dependency edges.

mizchi/brotli has 1 direct dependent but 29 transitive dependents.
mizchi/layout has 2 direct dependents but a blast radius of 37.
tonyfettes/nat ranks 535th by direct dependents but 16th by PageRank (0.0028836911831947635).
moonbitlang/x and moonbitlang/async together receive 31.37% of all dependency edges.
No multi-package SCC was present in the captured latest-version graph.

The evidence, definitions, snapshot identity, and reproduction commands are in the findings report. The large live snapshot is intentionally not committed; regenerate it from the public endpoints with the versioned fetcher below. A real compact subset is committed at fixtures/mooncakes-sample.json.

#Analyze a snapshot

Requirements: the current MoonBit toolchain and Python 3.11+ only when fetching or running the differential oracle.

moon build --target native
moon run cmd/moonatlas --target native -- analyze .\fixtures\mooncakes-sample.json
moon run cmd/moonatlas --target native -- analyze .\fixtures\mooncakes-sample.json --json
moon run cmd/moonatlas --target native -- analyze .\fixtures\mooncakes-sample.json --output .\analysis.json

After building, the executable accepts the same public command shape:

moonatlas analyze snapshot.json
moonatlas analyze snapshot.json --json
moonatlas analyze snapshot.json --output analysis.json

The JSON report contains complete per-package direct dependency, direct dependent, blast-radius, PageRank, and SCC-size values, not only top lists.

#Explore the web visualization

The static Web MVP consumes analysis emitted by the MoonBit CLI. JavaScript is limited to deterministic Canvas layout, rendering, and interaction; it does not recompute graph metrics.

moon run cmd/moonatlas --target native -- analyze .\poc\data\snapshot-<UTC-date>-all.json --output .\web\data\analysis.json
python -m http.server 8765 --directory .\web

Open http://127.0.0.1:8765/ to inspect overview metrics, switch structural rankings, search packages, pan or zoom the ecosystem graph, and view package dependencies, dependents, metrics, and available metadata.

#Regenerate live data

The staged fetcher preserves raw endpoint evidence and uses retry, timeout, failure recording, caching, and at most eight workers:

python .\poc\fetch_registry.py --limit 100 --workers 4
python .\poc\fetch_registry.py --limit 500 --workers 4
python .\poc\fetch_registry.py --limit all --workers 8

Then analyze the generated full snapshot:

moon run cmd/moonatlas --target native -- analyze .\poc\data\snapshot-<UTC-date>-all.json

Mooncakes currently ignores limit, page, and offset parameters on the module-list endpoint, so the fetcher selects staged coordinates locally and caches each manifest.

#Verification

moon fmt --check
moon check --deny-warn
moon test --deny-warn
python .\tests\differential\compare.py --moon "$env:USERPROFILE\.moon\bin\moon.exe"

The differential oracle compares every package in the same snapshot across Python and MoonBit: node count, edge count, direct dependents, blast radius, SCC size, and PageRank within 1e-10.

#Scope

MoonAtlas answers: “Where is this package in the MoonBit dependency ecosystem?”

It is not a security scanner, vulnerability database, license adviser, trust score, package recommender, resolver, installer, SBOM tool, or maintainer reputation system.

#Documentation

#License

Apache-2.0

Site source Report issue Packages Build queue Skills Statistics