tt-a1i / archify

What This Repo Claims

"Proof, not promises." Archify positions itself as an agent skill: describe a system in plain English, or point it at real code, and it produces a "polished, validated" diagram — schema-checked, evidence-linked when tracing real repos, and explicitly built to never invent topology it can't back up.

What I Tested

Environment: macOS, balajiloganathan user, Node.js v20.19.6, no Docker required.

Task: Install exactly as documented, run the tool's own health check, then build a real, personally-verifiable scenario — a proposed authentication architecture for repoverifier.dev itself (Supabase Auth → self-hosted Better Auth) — and check whether the output matched engineering reality, not just whether it looked polished.

Install

npx skills add tt-a1i/archify -g

Installer ran cleanly and even showed third-party security scan results before proceeding (Socket: 0 alerts, Snyk: Low Risk). But it defaulted to copying into 13 agent directories at once (Amp, Antigravity, Cline, Codex, and 9 more) despite no request to do so, and separately prompted to install an entirely unrelated package (find-skills, from a different GitHub org) via a one-time yes/no easy to click through without reading.

node archify/bin/archify.mjs doctor

All 14 checks passed, including confirming the real Node requirement: [ok] Node.js v20.19.6 (requires >=18) — directly contradicting the README's own DeepSeek-harness section, which implies Node ≥22.19 is needed.

The Test

Asked Claude Code, with Archify installed, to diagram a real proposed migration: repoverifier.dev's Supabase-based auth replaced by self-hosted Better Auth, sharing the existing Railway PostgreSQL instance, with the anonymous-user rate-limiting mechanism deliberately left unspecified as an open engineering question.

The output correctly:

• Modeled 12+ components with named trust boundaries (public internet, PKCE back-channel, single Railway deployment, shared database)
• Kept auth tables and existing pgvector tables in one database, one boundary — didn't invent a second database
• Identified the PKCE-vs-implicit-flow distinction correctly: "Auth code returns server-side only — never touches the browser. PKCE upgrade over implicit flow."

And, most importantly, rather than guessing at the one thing I left unspecified, it rendered its own card:

> Open design question: anonymous user tracking > Anonymous users get 1 free conversation — but how is 'anonymous' counted? Options: IP-based (no storage, spoofable), fingerprint cookie (lightweight, privacy tradeoff), in-memory counter (lost on restart, not Railway-safe at scale). Genuinely unresolved — choose a mechanism before implementing rate_limit logic.

That's the tool's central claim — evidence over invention — holding up on a scenario it had never seen before, not one of its own 11 self-selected gallery proofs.

The Gotcha

Two things worth knowing before you install:

1. Installer scope is broad by default. Even trying to select just one agent, it copies into all 13 "Universal" agent directories regardless.

2. It bundles an unrelated package via an easy-to-miss prompt. A one-time "Install the find-skills skill?" prompt defaults toward yes and pulls in a second, unrelated tool from a different repo entirely (vercel-labs/skills).

3. Documentation understates compatibility. The core tool runs fine on Node 18+; only one specific integration needs the newer version the README implies for everything.

Verdict: SOLID

Installs clean, renders exactly as promised, and — on the hardest, most falsifiable claim — correctly refused to invent an answer to a genuinely open question rather than confidently guessing wrong. The install-scope creep and bundled extra package are real, worth knowing gotchas, not disqualifying ones. Fits any workflow needing fast, trustworthy architecture diagrams straight from a Claude Code or Cursor session — especially useful for documenting proposed infrastructure changes before committing to them.