Atlas / MCP servers / codefromkarl / ContextAtlas

ContextAtlasSAFE

Name: ContextAtlas
Author: codefromkarl

mcp/codefromkarl/contextatlas

MCP server by codefromkarl · ai agent · ai tools · claude code · Audited 2026-10-08

ContextAtlas — context infrastructure for AI coding agents: hybrid retrieval, project memory and retrieval observability via CLI, MCP server or embeddable library. Tree-sitter indexing, LanceDB vector search, FTS5 and token-aware context packing.

Verdict

SAFE

Grade

Trust score

85 /100

Exposed tools

30 28r · 1w · 1d

Transport

stdio

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

ContextAtlas

Stable, reusable, and observable code context infrastructure for AI agents

Hybrid Retrieval · Project Memory · MCP Server · Retrieval Observability

=20" />

简体中文 · Docs · First Use · Deployment · CLI · MCP

ContextAtlas is an open-source context infrastructure for AI coding agents — providing hybrid code retrieval, project memory, and retrieval observability as a CLI, MCP server, or embeddable library. It combines tree-sitter semantic chunking, LanceDB vector search, SQLite FTS5 full-text search, and token-aware context packing to deliver structured, high-quality code context to tools like Claude Code, Codex, and custom agent workflows.

Updates

2026-04-15: added git hook auto-maintenance with --quick health check (260x speedup), stale index cleanup CLI, and three

Read from source at commit 31337e0eca77OBSERVED · 2026-10-08

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add context-atlas --env EMBEDDINGS_API_KEY=${EMBEDDINGS_API_KEY} --env EMBEDDING_GATEWAY_API_KEYS=${EMBEDDING_GATEWAY_API_KEYS} --env EMBEDDING_GATEWAY_REDIS_KEY_PREFIX=${EMBEDDING_GATEWAY_REDIS_KEY_PREFIX} --env OLLAMA_RERANK_MAX_TOKENS=${OLLAMA_RERANK_MAX_TOKENS} -- npx -y @codefromkarl/[email protected]

claude-desktop

{
  "mcpServers": {
    "context-atlas": {
      "command": "npx",
      "args": [
        "-y",
        "@codefromkarl/[email protected]"
      ],
      "env": {
        "EMBEDDINGS_API_KEY": "${EMBEDDINGS_API_KEY}",
        "EMBEDDING_GATEWAY_API_KEYS": "${EMBEDDING_GATEWAY_API_KEYS}",
        "EMBEDDING_GATEWAY_REDIS_KEY_PREFIX": "${EMBEDDING_GATEWAY_REDIS_KEY_PREFIX}",
        "OLLAMA_RERANK_MAX_TOKENS": "${OLLAMA_RERANK_MAX_TOKENS}"
      }
    }
  }
}

Exposed tools (30)

28 read · 1 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`Consumer`	read	consumer project
`ContextAtlas`	read	Semantic retrieval
`Producer`	read	source project
`assemble_context`	read	Assemble phase-aware context from checkpoint, module memory, and derived code retrieval. Use this to build a minimal context package for overview/debug/implementation/verification/handoff workflows.
`codebase-retrieval`	read	IMPORTANT: This is the PRIMARY tool for searching the codebase. It uses a hybrid engine (Semantic + Exact Match) to find relevant code. Think of it as the
`contract_analysis`	read	contract check
`create_checkpoint`	write	Create a durable task checkpoint for later resume or handoff. Use this after research, debugging, or implementation milestones when you want to preserve current task state outside the conversation transcript.
`delete_memory`	destructive	Delete a feature memory for the current project. This removes the feature memory and cleans coordinated derived state.
`detect_changes`	read	Analyze git diff changes and map changed lines back to indexed graph symbols, then summarize direct upstream/downstream impact.
`find_agent_diary`	read	Search diary entries by keyword, with optional agent/topic filters.
`get_dependency_chain`	read	[CROSS-PROJECT] Get all dependencies (recursive) for a module. Uses recursive CTE to traverse the full dependency graph. Great for understanding impact of changes or debugging cascading issues. Examples: - Get all dependencies of AuthService → get_dependency_chain({ project:
`get_project_profile`	read	Get the project profile containing tech stack, structure, and conventions. Returns comprehensive project information including: - Technology stack - Project structure - Key modules - Development conventions - Build/test commands
`graph_context`	read	Return the immediate graph neighborhood for one exact symbol name, including parent, upstream, and downstream relations.
`graph_impact`	read	Analyze downstream / upstream code graph impact for one exact symbol name. Use this after indexing when you need to inspect immediate relations and resolved local impact.
`graph_query`	read	Trace graph paths from one exact entry symbol across resolved relations such as CALLS and HAS_METHOD.
`list_checkpoints`	read	List durable task checkpoints saved for the current repository.
`load_checkpoint`	read	Load a previously saved task checkpoint for resume or handoff.
`maintain_memory_catalog`	read	Perform maintenance operations for the current project
`manage_projects`	read	[CROSS-PROJECT] Manage projects in the memory hub (register, list, stats). Actions: - register: Register a new project (requires path) - list: List all registered projects - stats: Get memory hub statistics Examples: - manage_projects({ action:
`old-profile`	read	old profile
`prepare_handoff`	read	Assemble a handoff-ready bundle from an existing checkpoint. Use this when an agent needs a compact, structured package for resume or transfer.
`read_agent_diary`	read	Read recent diary entries for one agent.
`record_agent_diary`	read	Append one agent diary entry as journal memory.
`record_decision`	read	Record an architectural decision. Use this to document important design decisions, alternatives considered, and rationale. Creates a persistent record for future reference. Required fields: - id: Unique identifier (e.g.,
`record_long_term_memory`	read	Record explicit long-term memory, including journal, evidence, and temporal facts. Use this to save durable non-code knowledge with scope and optional validity windows.
`record_memory`	read	Record a new feature memory for a module. Use this to document module responsibilities, APIs, dependencies, and data flow. This creates a persistent memory that can be quickly retrieved later. Required fields: - name: Module name - responsibility: What the module does - dir: Source directory
`record_result_feedback`	read	Record lightweight result feedback for retrieval quality and memory governance. Use this to mark helpful/unhelpful results, stale memories, or wrong module bindings. Feedback is stored as project-scoped long-term memory with type=
`suggest_memory`	read	[AUTO-RECORD] Suggest memory recording for a specific module. Use this when you want to record a memory but need AI to help extract details. Examples: - suggest_memory({ moduleName:
`suggest_phase_boundary`	read	Suggest the next workflow phase boundary from current checkpoint and context signals. Use this to decide whether to stay in the current phase or move into implementation, verification, or handoff.
`unmapped-tool`	read	Missing handler

Trust audit

SAFEgrade B · trust 85/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (10 observation(s))
Network: declared (4 observation(s))
Shell: declared (5 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (19)

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

delete_memory

Why it matters. 1 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.hidden_file · CWE-1104

.node-version

.node-version

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.suspicious_name · CWE-1104

tests/payload-too-large.test.ts

payload-too-large.test.ts

Why it matters. member named after an attack tool

Fix. remove or justify

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/application/memory/executeCheckpoints.ts:120

id: `chk_${crypto.createHash('sha1').update(`${args.repo_path}:${args.title}:${args.goal}:${now}`).digest('hex').slice(0, 12)}`,

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/application/retrieval/resultCard.ts:1472

id: `checkpoint:${crypto.createHash('sha1').update(`${repoPath}:${informationRequest}`).digest('hex').slice(0, 12)}`,

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/db/index.ts:48

return crypto.createHash('md5').update(projectPath).digest('hex').slice(0, 10);

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/memory/MemoryAutoRecorder.ts:468

return `${prefix}-${crypto.createHash('sha1').update(input).digest('hex').slice(0, 12)}`;

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/application/memory/assembleContextFormatter.ts:13

} from '../../memory/types.js';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/application/memory/assembleContextFormatter.ts:14

import type { AssemblyProfileName } from '../../memory/MemoryRouter.js';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/application/memory/assembleContextStrategy.ts:15

} from '../../memory/types.js';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/application/memory/assembleContextStrategy.ts:16

import type { AssemblyProfileName } from '../../memory/MemoryRouter.js';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/application/memory/assembleContextStrategy.ts:17

import { MemoryStore } from '../../memory/MemoryStore.js';