65,000 pulls a day, one author: the AI coding stack's unpriced dependency

Safi Shamsi wrote Graphify alone over a single weekend and gave it away, and developers now pull it onto their machines about 65,000 times a day ^[1][2]. Claude Code, Cursor, Codex, Gemini CLI and more than fifteen other tools can call it ^[6], which puts one person's side project underneath at least nineteen products that enterprise buyers are paying for ^[20].

What it does is narrow. Graphify reads a codebase, draws a map of how every piece connects, and hands that map to whatever assistant the developer already runs ^[5]. Left alone, each assistant works out the shape of a project from scratch every time someone asks it a question; Graphify does the work once and lets all of them read the result ^[7]. That is a genuine saving, and it is also a single point of failure sitting in the agent path.

The traffic curve makes the exposure concrete. The busiest day was 79,000 pulls, roughly 21 percent above the daily average ^[3][21]. Cumulative pulls since April have passed 4 million ^[4], a total the current rate would reproduce in about 62 days ^[22]; annualised, today's volume is on the order of 23.7 million pulls a year ^[23]. Adoption is steepening, not settling.

The project is not a one-man band any more, but the asymmetry is still striking: more than 130 outside developers have sent code ^[13], and there have been more than 150 releases since April, at times more than one a day ^[14]. Rootly, an incident-response company, shipped a plugin in April that points Graphify at a team's outage history ^[12]. Shamsi has since taken Graphify Labs into Y Combinator's Summer 2026 batch without a cofounder, and the partners pressed him on whether he could build all of it himself ^[8][9]. Jared Friedman, a group partner, told the publication he was struck by how much Shamsi had accomplished as a one-person team, and invoked predictions of 100x engineers and the first one-person unicorn ^[10]. The company now has staff ^[11]. What Graphify Labs charges, and under what licence the code ships, is not disclosed in the source material ^[24].

That gap is the buyer's problem, not the founder's. The diligence question is not popularity: Graphify carries more than 100,000 GitHub stars, which Friedman says is a first for a YC company during the program, and stars are a debased currency ^[15][16]. The question is what the map layer costs, and who controls it, if the licence changes, one assistant vendor hires the maintainer, or the company is acquired. Shamsi's answer to the clone objection is research depth - "Even if Cursor builds it, they can't replicate the research I've already done" ^[17] - and, structurally, that every assistant needs a map and none wants to depend on a rival for it, leaving neutral ground as the position incumbents cannot occupy ^[18]. Gunjan Sinha, who sold WhoWhere to Lycos in 1998 and now helps run the MIT spin-off Project NANDA, argues that owning the neutral ground beats owning any product on top of it ^[19]. That thesis is good for the company and does nothing for the customer whose agent breaks.

Watch three things: whether a commercial tier or licence change appears alongside the free package, whether the daily pull rate holds after monetisation, and whether any of the named assistant vendors pins, forks or funds the dependency rather than calling it. The first vendor to publish a mitigation plan will tell you which of them actually reads its own dependency tree.