convex-explain-app
get-convex/agent-skills
Analyze your Convex app's data model, functions, auth, and request flows without modifying it.
What is convex-explain-app?
This skill reads your Convex schema and function surface to produce a complete map of your app: tables and relationships, public vs. internal functions, auth/ownership model, components, and end-to-end request flows. Use it before making changes, during audits, or to onboard new team members.
- Extracts the data model from schema.ts with all table relationships and indexes
- Enumerates all exported functions split into PUBLIC (client-reachable) and INTERNAL (server-only)
- Documents the auth/ownership model: how identity is established and enforced
- Lists installed Convex components, HTTP routes, crons, and external API calls
- Traces 1-2 representative end-to-end flows showing how requests move through the system
- Flags ambiguities rather than guessing at undocumented behavior
How to install convex-explain-app
npx skills add https://github.com/get-convex/agent-skills --skill convex-explain-app- A Convex project with convex/ directory and schema.ts
- Node.js and npm installed (to run npx skills add)
How to use convex-explain-app
- 1.Install the skill: npx skills add https://github.com/get-convex/agent-skills --skill convex-explain-app
- 2.Point the agent at your Convex project root or convex/ directory
- 3.Request an explanation of the app (e.g., 'Explain this Convex app')
- 4.Review the output map: data model, function surface, auth model, components, and flows
- 5.Use the recommendations to decide next steps: audit, score, extend, or fix
Use cases
- Onboard a new developer by explaining the current architecture in minutes
- Audit an app before making changes to understand the full surface and dependencies
- Score launch-readiness by mapping all public functions and auth boundaries
- Plan extensions by seeing which tables, indexes, and auth patterns already exist
- Detect unintended public exposure or missing ownership checks
- Backend developers joining an existing Convex project
- Architects planning changes or extensions to a Convex app
- Security reviewers auditing auth and data-access patterns
- Team leads onboarding new engineers
convex-explain-app FAQ
No. It is read-only. It reads schema.ts and function specs but never changes code or deployments.
The skill will state plainly 'there is no auth foundation' and describe the ownership model (or lack thereof). Auditing for holes is a separate step.
Yes. If a deployment exists, it reads the live functionSpec and tables via the official MCP for the authoritative current surface.
Use it as input to convex-reviewer or convex-authz for security audit, launch-readiness to score the app, or design/convex-expert to plan extensions.
It gives a one-line summary of what each function does and what it touches. For deeper code review, use convex-reviewer.
Full instructions (SKILL.md)
Source of truth, from get-convex/agent-skills.
name: convex-explain-app description: "Explain an existing Convex app — data model + relationships, public vs internal functions, auth/ownership model, components, a request→data flow — read from the schema and function surface. Read-only."
<!-- GENERATED from convex-agents content/capabilities/explain-app.json — do not edit by hand. -->Explain this Convex app
Before you can safely change an app you have to know what it is — and reading 15 function files top-to-bottom is slow and error-prone. This capability produces the map fast and accurately by reading the two sources that can't lie: the schema (the data model) and the function surface (functionSpec / the exported queries/mutations/actions). It is deliberately DESCRIPTIVE — it explains what IS, hands judgment to the audit capabilities and changes to the fixers. It is also the natural first step of an optimize or self-heal session, and the reusable 're-explain the current architecture' that 'change what you built' depends on.
Workflow
- DETECT the app: the
convex/directory,schema.ts, and whether a deployment exists (if one does,functionSpec/tablesvia the official MCP give the authoritative live surface; if not, read the source directly). deploy-guard classifies any deployment read as read-only. - DATA MODEL: from
schema.ts, list every table with its fields and, crucially, its RELATIONSHIPS — whichv.id("other")fields point where, and which indexes exist (indexes reveal the intended access paths). Draw the foreign-key graph in words: 'tasks belong to projects (projectId) and users (ownerId); messages belong to conversations'. - FUNCTION SURFACE: enumerate every exported function, split PUBLIC (query/mutation/action — the attack/API surface) from INTERNAL (internalQuery/... — not client-reachable), and for each give a one-line 'what it does + what it touches'. The public/internal split is the single most important thing a newcomer needs and the thing source-skimming most often gets wrong.
- AUTH / OWNERSHIP MODEL: state how identity is established (auth.config.ts provider? a users table keyed by tokenIdentifier?) and how ownership is enforced (is there a requireOwner-style check? which field is the owner?). Say plainly if there is NO auth foundation — that is load-bearing context for anyone about to change the app. (Describe the model; do not audit it for holes — that's convex-authz.)
- COMPONENTS + EXTERNAL EDGES: list the
@convex-dev/*components installed (convex.config.ts) and what they provide, the HTTP routes (http.ts) and crons, and any external calls in actions (which APIs, which env vars). - FLOW: trace 1-2 representative end-to-end paths ('client calls createTask → validates → inserts into tasks scoped to the caller → listMyTasks reads it back by the by_owner index') so the reader sees the moving parts connected, not just catalogued.
- PRESENT as a scannable map (data model → public/internal functions → auth model → components/edges → a flow or two), accurate to the source. End by pointing at the next verbs: convex-reviewer/convex-authz to audit it, launch-readiness to score it, design/convex-expert to extend it. Never invent behavior the source doesn't show; if something is ambiguous, say so rather than guessing.
Rules
- Read the schema + function surface (functionSpec/source) as the source of truth — never describe behavior the code doesn't show; flag ambiguity instead of guessing.
- Lead with the two things a newcomer most needs and skimming most often gets wrong: the data-model relationship graph and the public-vs-internal function split.
- State the auth/ownership model plainly, including 'there is no auth foundation' when that's the case — but DESCRIBE it; auditing it for holes is convex-authz's job.
- Descriptive, not evaluative: explain-app maps what IS and hands judgment to the audit capabilities and changes to the fixers.
- Read-only: any deployment introspection is read-only (deploy-guard); the app is not modified.
- End by pointing at the right next verb (audit → reviewer/authz, score → launch-readiness, extend → design/expert).
Related skills
More from get-convex/agent-skills and the wider catalog.

convex-improve-convex-plugin
Send your coding session to Convex for AI-powered system improvements and quickstart refinement.

convex-insights
Query Convex app logs and health in natural language with evidence-backed answers and dashboard links.

convex-launch-readiness
Unified backend readiness score with prioritized fix plan—run all Convex audits, dedupe findings, and dispatch fixes.

convex-migrate
Safely migrate schema and backfill data on live Convex apps without downtime.

convex-migrate-rehearse
Rehearse schema changes on a preview deployment before promoting to production with snapshot rollback.

convex-migration-helper
Plan and execute safe Convex schema migrations with widen-migrate-narrow pattern and batched data backfills.