Opinion

Does your AI coding assistant know who uses your API?

Last checked 2026-11-095 min read

Usually not. An AI coding assistant knows the code and files it can open, and the teams that call your endpoint keep their code somewhere else. So when you ask it whether a change is safe, it answers from your side of the contract only. The map of who calls what has to come from outside the repository: from logs, contracts, or the consumer teams themselves.

ExampleGraphwake MCP
Who consumes GET /orders/{id}?
→ graphwake · get_endpoint("GET /orders/{id}")
Owned by payments-team. Consumed by 2 teams, 1 more suggested:
  • checkout · 4 peopleSlack
  • mobile-app · 6 peopleSlack
  • storefront · suggested 72%maybe
Check my changes to openapi.yaml.
→ graphwake · preview_impact(local spec)
2 breaking changes, 2 teams, impact 54 Medium
  • removed totalcheckout, mobile-app
  • required currencycheckout, mobile-app

Checked only. Nothing was stored and nobody was alerted.

Your AI assistant asks Graphwake before you change an endpoint. Works with Claude Code, Cursor, GitHub Copilot and other clients that accept an API key.
On this page
  1. Your assistant reads your code. It can’t read the other team’s.
  2. What the assistant sees, and what it does not
  3. Why it guesses instead of saying “I don’t know”
  4. Where the map can come from
  5. Give the assistant the map, not more code
  6. Questions to ask before you change an endpoint
  7. When your assistant alone is enough
  8. Questions

Your assistant reads your code. It can’t read the other team’s.

Ask an AI coding assistant to remove a field from a response and it will do a careful job. It searches the repository, finds no reader of that field, updates the spec, fixes the tests and writes a tidy commit message. From inside the repository, that is the right answer.

The mobile app that reads the field lives in another repository, owned by another team, and nobody told the assistant it exists. The change is correct for the code it could see and wrong for the code it could not.

What the assistant sees, and what it does not

It can seeIt cannot see
Your repository and the files you openRepositories it has no access to
Your OpenAPI spec and your testsWhich teams call each endpoint, and how often
Docs and tickets you paste or connectWhat another team agreed to in a thread last year
Tools you connect to itAnything those tools do not know either

None of this is a flaw in the model. It is a question of input. A better model reasons better about the same files; it does not see more of them.

Why it guesses instead of saying “I don’t know”

When the answer is not in what it can read, an assistant fills the gap with what is likely. “No usages found” becomes “unused”. “Looks internal” becomes “safe to change”. That is fine for a private helper function. For an API it is exactly the assumption that breaks another team in production.

The fix is not a better prompt. It is giving the assistant a source that actually knows who the consumers are.

Where the map can come from

SourceWhat it knowsWhere it falls short
Code searchCallers in the code you can openMisses every other repository
Static analysis across repositoriesCall sites in every repository it scansNeeds read access to every consumer’s code
Gateway or access logsWhich clients called recentlyClient ids, not teams; misses rare callers
Contract tests (Pact)Consumers that wrote a contractOnly those that wrote one
A service catalogWhat someone wrote downGoes stale when nobody updates it
SubscriptionsTeams that declared the endpoints they callNeeds each team to subscribe once; gaps show as blind spots

Give the assistant the map, not more code

Graphwake keeps the map from your OpenAPI specs and from subscriptions: each consumer team declares the endpoints it calls, and owners are named per service or endpoint. Graphwake never reads code. It needs only the spec.

With Graphwake MCP, your AI assistant asks that map directly. Graphwake has no language model of its own: the model is your assistant, and Graphwake answers its questions with data. Works with Claude Code, Cursor, GitHub Copilot and other clients that accept an API key.

  • Who consumes this?

    The owner and the consumer teams of an endpoint, with the channel each one is alerted in.

  • What would this break?

    A dry run of your local spec against the live one. Nothing is stored and nobody is alerted.

  • Who might we be missing?

    Discovery suggests teams that may use an endpoint, from clear rules, with the reason for each.

  • Only the spec

    Graphwake never sees your code. A local check sends only the OpenAPI file, which is compared and deleted.

Questions to ask before you change an endpoint

  • Who owns this endpoint, and who consumes it?
  • Which of those teams would this change break, and how badly?
  • Is there an endpoint here that nobody has claimed?
  • Is another open pull request already breaking the same endpoint?

Your assistant can answer what changes from your repository; who it reaches, and who owns it, needs the map. The setup guide connects it in a few minutes, and API breaking change alerts covers what happens after you push.

Good to know

When your assistant alone is enough

  • A monorepo. If every caller lives in the same repository, a code search finds them.
  • Contract tests in place. If your consumers publish Pact contracts, the Pact Broker shows who depends on you.
  • Logs you trust. If every caller identifies itself at the gateway and you can tie each client to a team, recent traffic is a good list.
See who your next breaking change reaches.Paste a spec URL or add one CI step. 7-day free trial. Cancel before day 7 and you pay nothing.
Start free trial

Questions

Can an AI coding assistant find every caller of my API?

Only the callers in code it can open. Callers in other repositories, and the teams behind them, are outside its view unless a tool gives it that list.

Does Graphwake use a language model?

No. Graphwake has no language model of its own. Your assistant is the model; Graphwake answers its questions with data from your specs and subscriptions. Discovery suggestions come from fixed rules, not a model.

Does Graphwake read my code?

No. Graphwake needs only your OpenAPI specs. When your assistant checks a local spec, only that file is sent, and it is compared and then deleted.

Which assistants can ask Graphwake?

Works with Claude Code, Cursor, GitHub Copilot and other clients that accept an API key.

Pick an endpoint. See who it reaches. 7-day free trial. Cancel before day 7 and you pay nothing.

Start free trial

Sources and last verified

Sources checked on 2026-11-09.