code-graphBLOCK
A deterministic code graph for codebases: every caller, route, page and table a change touches, with file:line evidence. CLI, MCP server and web view for AI agents and reviewers.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
See everything a change affects before you make it: a local, deterministic dependency graph of routes, calls, tables and config, with `file:line` evidence for every hop.
For you and your AI agent (CLI + MCP). No LLM in the graph.
[](https://pypi.org/project/cg-code-graph/) [](https://pepy.tech/project/cg-code-graph) [](https://pypi.org/project/cg-code-graph/) [](https://github.com/cyberchronos00/code-graph/blob/main/LICENSE) [](https://code-graph.cyberchronos00.workers.dev/)
Docs · Quick start · CLI · MCP · Changelog
[](https://github.com/cyberchronos00/code-graph/blob/main/docs/media/cg-view-demo.mp4)
Quick start
pipx install cg-code-graph # or: uv tool install cg-code-graph cg index . --db out/graph.db # prints starter queries for your repo cg install --host cursor # or claude, codex, vscode, ...: registers the MCP server cg reaches table:orders --db out/graph.db # any table, connection or config key
Try it on a bundled sample, link a frontend to a backend, or connect an agent over MCP: [Quick start guide](https://code-graph
b5ae598f91b8OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add ws-switch-other --env ACME_SECRET=${ACME_SECRET} --env APNS_KEY_ID=${APNS_KEY_ID} --env APNS_KEY_PATH=${APNS_KEY_PATH} --env AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} -- npx -y [email protected]{
"mcpServers": {
"ws-switch-other": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"ACME_SECRET": "${ACME_SECRET}",
"APNS_KEY_ID": "${APNS_KEY_ID}",
"APNS_KEY_PATH": "${APNS_KEY_PATH}",
"AWS_ACCESS_KEY_ID": "${AWS_ACCESS_KEY_ID}"
}
}
}
}Exposed tools (10)
5 read · 3 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
add_note | write | Store a note. |
delete_note | destructive | |
drop | destructive | return id |
echo | read | return x |
fetch | read | d |
name | read | |
read_note | read | |
refund | write | Refund an order through the shop. |
search | read | return lookup(q) |
sync-warehouse | write | Re-sync all stock with the warehouse |
Trust audit
BLOCKgrade F · trust 40/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | FAIL |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (6 observation(s))
- Network
- declared (19 observation(s))
- Shell
- declared (3 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
payload.py
if t and " Function(" in t:return ("fnret", self.type_of_text(t.split(" Function(")[0], lib, depth + 1))("tls-verify-off", ("py",), re.compile(r"\bverify\s*=\s*False\b"), "@pylib", "certificate verification is switched off (verify=False)", "@pyconf"),("tls-verify-off", ("js",), re.compile(r"\brejectUnauthorized\s*:\s*false\b"), "@jslib", "rejectUnauthorized: false accepts any certificate", "exact"),("tls-verify-off", ("js",), re.compile(r"\bprocess\s*\.\s*env\s*(?:\.\s*|\[\s*['\"])" + NODE_TLS), "node", "NODE_TLS_REJECT_UNAUTHORIZED=0 in code: certificate checks are off for the whole process", "("tls-verify-off", ("script", "docker", "yaml", "pkgjson", "envex", "ci"), re.compile(NODE_TLS), "node", "NODE_TLS_REJECT_UNAUTHORIZED=0: certificate checks are off for the whole process", "exact"),def export_plan_html(db: str, out: str, plan: str, plans_root=None, verify=False) -> str:
"""`postgres://user:pw@db:5432/app?sslmode=require`, `jdbc:mysql://h/db`, `rediss://:pw@cache:6380/0` ... ->
.env
docs-site/public/media
importlib.import_module(m.name)
URL_KEYS = r"url|target_url|targetUrl|subscriber_url|subscriberUrl|webhook_url|webhookUrl|endpoint|endpoint_url|endpointUrl|callback_url|destination_url|payload_url"
CALLBACK_KEYS = ("callback_url", "callbackUrl", "callback", "notify_url", "notifyUrl", "notification_url", "notificationUrl",const base = (process.argv[2] || 'http://127.0.0.1:8177/').replace(/#.*$/, '')
const base = process.argv[2] || 'http://127.0.0.1:8199/'
amqp_url: str = "amqp://app:s3cret-kafka@rabbitmq:5672/shop"
DATABASE_URL="postgresql://shop:[email protected]:5432/shop?sslmode=require"
POSTGRES_URL="postgresql://shop:[email protected]:5432/shop"
DATABASE_URL=postgres://shop:[email protected]:5432/shop
secret = "fake-bookstore-django-key-0000"
app.use(session({ secret: 'fake-bookstore-secret-0000' }))"fake_bookstore_token", "xoxb-fake-bookstore-token", "fakebookstore", # lowercase words only
delete_note, drop
index.scip
Gates applied: no_behavioural_pass.
b5ae598f91b8full audit observations/trust-audit/mcp-server/cyberchronos00__code-graph.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | b5ae598f91b8 | BLOCK | F | 40 | first audit |
Questions
What is the code-graph MCP server?
A deterministic code graph for codebases: every caller, route, page and table a change touches, with file:line evidence. CLI, MCP server and web view for AI agents and reviewers.
What tools does code-graph expose?
10 in total: 5 read-only, 3 that write, and 2 that can delete or overwrite (delete_note, drop). Every one is listed on this page with its risk.
Is code-graph safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (40/100) and found 9 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does code-graph need?
It reads ACME_SECRET, APNS_KEY_ID, APNS_KEY_PATH, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AZURE_CLIENT_SECRET, DJANGO_SECRET_KEY, DOCKER_KEY, EXPO_ACCESS_TOKEN, GH_SECRET, GOOGLE_APPLICATION_CREDENTIALS and KEY_VAULT_URL from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (b5ae598f91b8), read on 2026-10-11. The repository is watched and re-audited when it changes.