Callee Coverage
Framework coverage for Noir's best-effort per-endpoint 1-hop callee extraction.
Noir can attach best-effort 1-hop handler callees to endpoints. A callee is a function, method, or framework call observed directly inside the route handler body. It helps AI SAST tools and code reviewers decide where to inspect next.
Turn it on with --include callee:
noir scan . --include callee
The flag applies to every output format, not just plain text. JSON, JSONL, YAML, and TOML fill each endpoint's callees field (it stays empty without the flag). OpenAPI 2.0 and 3.0 add an operation-level x-noir-callees extension, SARIF stores callees in result.properties.noir.callees, and Postman adds a readable list to the item description. Command and filter outputs such as cURL, HTTPie, PowerShell, only-url, and only-param leave callees out so their main output stays the same.
The path and line values are best-effort locations. Most analyzers report the call site. Analyzers that can resolve definitions report where the callee is defined when they can find it, and fall back to the call site otherwise.
Coverage Matrix
This matrix lists the frameworks where Noir extracts callees per endpoint. It is generated from Noir's tech metadata (the same source as the framework callee chips and noir list techs), so it stays in sync with the analyzers. Frameworks not listed here may still have endpoint detection, but expect no callee output from them.
| Language | Frameworks with callee coverage |
|---|---|
| C | CivetWeb, Mongoose, libmicrohttpd |
| C# | ABP Framework, ASP.NET Core MVC, ASP.NET Core Minimal API, ASP.NET MVC, Carter, FastEndpoints, ServiceStack, System.Net.HttpListener, Wolverine.Http |
| C++ | Crow, Drogon, cpp-httplib, oat++ |
| Clojure | Compojure, Pedestal, Reitit |
| Crystal | Amber, Grip, Kemal, Lucky, Marten |
| Dart | Alfred, Angel3, Dart Frog, GetServer, Serverpod, Shelf |
| Elixir | Bandit, Phoenix, Plug |
| F# | Giraffe |
| Go | Beego, Chi, Echo, Fiber, Gin, GoFrame, Gorilla Mux, Goyave, Hertz, Huma, Iris, Kratos, PocketBase, fasthttp, go-restful, go-zero, httprouter, net/http |
| Groovy | Grails |
| Haskell | Scotty, Servant, Yesod |
| Java | Apache Struts 2, Apache Wicket, Armeria, Dropwizard, Helidon MP, Helidon SE, JAX-RS, JDK HttpServer, Javalin, Micronaut, Play Framework, Quarkus, Spark Java, Spring, Vert.x |
| JavaScript | AdonisJS, Apollo Server, Astro, Cloudflare Pages Functions, Egg.js, Elysia, Expo Router, Express, Fastify, Feathers, Fresh, Hapi, Hono, HonoX, Koa, NestJS, Netlify Functions, Next.js, Nitro, NuxtJS, Oak, Qwik City, React Router, Remix, Restify, SolidStart, SvelteKit, Vercel Functions |
| Kotlin | Ktor, Spring, http4k |
| Lua | Lapis, lor |
| PHP | CakePHP, CodeIgniter, Hyperf, Laminas, Laravel, Lumen, Phalcon, Pure, Slim, Symfony, ThinkPHP, Yii2 |
| Perl | Catalyst, Dancer2, Mojolicious |
| Python | AWS Lambda Powertools, Bottle, Chalice, CherryPy, Django, Django Ninja, Falcon, FastAPI, FastHTML, Flask, Frappe, Litestar, Masonite, Odoo, Pyramid, Quart, Robyn, Sanic, Starlette, Tornado, aiohttp, http.server |
| R | Plumber |
| Ruby | Grape, Hanami, Padrino, Rails, Roda, Sinatra, WEBrick |
| Rust | Actix Web, Axum, Dioxus, Gotham, Leptos, Loco, Poem, RWF, Rocket, Salvo, Tide, Warp, ntex |
| Scala | Akka HTTP / Pekko HTTP, Finatra, Play Framework, Scalatra, Tapir, ZIO HTTP, http4s |
| Swift | Hummingbird, Kitura, Vapor |
| TypeScript | LoopBack, Midway, NestJS, TanStack Router, Ts.ED, Wasp, inversify-express-utils, routing-controllers, tRPC, tsoa |
| Zig | Jetzig, Tokamak, Zap, httpz, std.http.Server |
Completeness Notes
- Callees are 1-hop only. Noir does not build a transitive call graph.
- Dynamic dispatch, middleware chains, decorators, macro expansion, generated code, and reflection can hide calls from static extraction.
- Named handler frameworks usually have better callee coverage than heavily dynamic or inline callback-heavy frameworks.
- Definition resolution is incremental and currently analyzer-specific.
- Calls are deduplicated and capped per endpoint so the output stays small for downstream tools.
- Framework helpers such as renderers and request accessors are intentionally kept because they describe how the endpoint handles input and output.