CodeRAGBLOCK
Advanced graph-based code analysis for AI-assisted software development
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Advanced graph-based code analysis for AI-assisted software development
CodeRAG is a professional code intelligence platform that transforms complex software projects into searchable knowledge graphs. By mapping code structures, dependencies, and relationships, it enables AI development tools to provide contextually accurate assistance for enterprise-scale codebases.
What CodeRAG Does
CodeRAG creates a comprehensive graph database representation of your codebase using Neo4J, enabling sophisticated analysis and AI-powered insights:
- Automated Code Analysis - Scans and maps classes, methods, interfaces, dependencies, and architectural relationships across multiple programming languages
- Remote Repository Analysis - Directly analyze any GitHub, GitLab, or Bitbucket repository without local cloning, supporting both public and private repositories with secure authentication
- Intelligent Language Detection - Automatically identifies project languages, frameworks, and build configurations from metadata and build files
- Quality Assessment - Calculates industry-standard software metrics (CK metrics, package coupling, architectural patterns) to identify technical debt and improvement opportunities
- Semantic Code Search - Enables natural language queries to find code by functionality rather than syntax
- Multi-Project Management - Supports enterprise environments with multiple codebases, providing unified analysis and cross-project insights
Who Should Use CodeRAG
Enterprise Development Teams
- Large-scale projects with complex architectures requiring deep code understanding
- Legacy system maintenance where comprehensive codebase mapping is essential
- Code quality initiatives needing objective metrics and architectural analysis
AI-Assisted Development
- Development teams using AI coding assistants (Claude Code, GitHub Copilot, Cursor, Windsurf) who need e
e4e97b4ff7bcOBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add coderag --env BITBUCKET_APP_PASSWORD=${BITBUCKET_APP_PASSWORD} --env EMBEDDING_MAX_TOKENS=${EMBEDDING_MAX_TOKENS} --env GH_TOKEN=${GH_TOKEN} --env GITHUB_TOKEN=${GITHUB_TOKEN} -- npx -y [email protected]{
"mcpServers": {
"coderag": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"BITBUCKET_APP_PASSWORD": "${BITBUCKET_APP_PASSWORD}",
"EMBEDDING_MAX_TOKENS": "${EMBEDDING_MAX_TOKENS}",
"GH_TOKEN": "${GH_TOKEN}",
"GITHUB_TOKEN": "${GITHUB_TOKEN}"
}
}
}
}Exposed tools (51)
42 read · 6 write · 3 destructive. Blast radius: 3 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
add_edge | write | Add a relationship edge between two nodes |
add_file | write | Parse a single source file and add its entities to the graph |
add_node | write | Add a new code node (class, interface, method, etc.) to the graph |
analyze_codebase | read | Get guidance on analyzing a codebase using CodeRAG tools |
analyze_inheritance | read | Guide to analyze inheritance hierarchies and interface implementations |
analyze_testing_annotations | read | Analyze testing patterns and coverage based on test annotations/decorators |
calculate_ck_metrics | read | Calculate Chidamber & Kemerer metrics for a class (WMC, DIT, NOC, CBO, RFC, LCOM) |
calculate_package_metrics | read | Calculate package metrics (Afferent/Efferent Coupling, Instability, Abstractness, Distance) |
class_or_interface | read | Name of class or interface to analyze |
clear_git_cache | destructive | Clear all cached Git repositories to free up disk space. |
com.example.TestClass | read | Updated description |
com.example.TestClass.testMethod | read | A test method |
com.example.UserValidator | read | Validates user input data |
delete_edge | destructive | Delete an edge by ID |
delete_node | destructive | Delete a code node by ID |
find_architectural_issues | read | Find architectural issues (circular dependencies, god classes, high coupling) |
find_classes_calling_method | read | Find all classes that call a specific method |
find_classes_implementing_interface | read | Find all classes that implement a specific interface |
find_dependencies | read | Guide to find class dependencies and method calls |
find_deprecated_code | read | Find all code elements marked as deprecated and optionally their dependencies |
find_edges_by_source | read | Find all edges originating from a source node |
find_implementations | read | |
find_inheritance_hierarchy | read | |
find_method_callers | read | |
find_nodes_by_annotation | read | Find code nodes (classes, methods, etc.) that have specific annotations/decorators |
find_nodes_by_type | read | Find nodes by their type |
find_untestable_code | read | Find code patterns that may be difficult to test (private methods, static methods, etc.) |
find_usage_of_deprecated_code | read | Find code that uses deprecated elements and assess migration impact |
get_annotation_usage | read | Get comprehensive statistics on annotation/decorator usage patterns across the codebase |
get_edge | read | Get an edge by ID |
get_framework_usage | read | Get statistics on framework usage based on annotations/decorators across the codebase |
get_inheritance_hierarchy | read | Get the inheritance hierarchy for a class |
get_node | read | Get a code node by ID |
get_project_summary | read | Get overall project metrics summary and quality assessment |
get_similar_code | read | Find code entities that are semantically similar to a specific node |
git_cache_stats | read | Get statistics about the Git repository cache, including number of cached repositories and total size. |
initialize_semantic_search | read | Initialize semantic search infrastructure including vector indexes |
language | read | Programming language of the project |
list_projects | read | List all projects in the CodeRAG graph database with optional statistics |
project_type | read | Type of project (java, typescript, python, etc.) |
scan_dir | read | Scan a directory for source files and populate the graph |
scan_remote_repo | read | Scan a remote Git repository and populate the graph database. Supports GitHub, GitLab, Bitbucket, and custom Git servers. |
search_nodes | read | Search nodes by name, qualified name, or description |
semantic_search | read | Search for code using natural language queries to find functionality by meaning rather than syntax |
setup_code_graph | write | Step-by-step guide to set up a code graph for a new project |
target_class | read | The class to analyze dependencies for |
update_embeddings | write | Generate or update semantic embeddings for code entities to enable semantic search |
update_node | write | Update an existing code node |
utils.testFunction | read | A test function |
utils.validateEmail | read | Validates email addresses |
validate_remote_repo | read | Validate that a remote Git repository is accessible and can be scanned. |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (10 observation(s))
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (12)
const privateKeyPath = path.join(sshDir, 'id_rsa');
github: { token: 'ghp_valid_token_123456789012345678901234567890' }github: { token: 'ghp_valid_token_123456789012345678901234567890' }clear_git_cache, delete_edge, delete_node
import { Neo4jClient } from '../../graph/neo4j-client.js';import { EdgeManager } from '../../graph/edge-manager.js';import { CodeEdge } from '../../types.js';import { Neo4jClient } from '../../graph/neo4j-client.js';import { Neo4jClient } from '../../graph/neo4j-client.js';OLLAMA_BASE_URL=http://192.168.1.100:11434
@modelcontextprotocol/sdk, @types/tmp, @typescript-eslint/parser, @typescript-eslint/types, commander, dotenv, express, glob
curl -fsSL https://ollama.ai/install.sh | sh
Gates applied: no_behavioural_pass.
e4e97b4ff7bcfull audit observations/trust-audit/mcp-server/jonnoc__coderag.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | e4e97b4ff7bc | BLOCK | D | 69 | first audit |
Questions
What is the CodeRAG MCP server?
Advanced graph-based code analysis for AI-assisted software development
What tools does CodeRAG expose?
51 in total: 42 read-only, 6 that write, and 3 that can delete or overwrite (clear_git_cache, delete_edge, delete_node). Every one is listed on this page with its risk.
Is CodeRAG safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 3 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does CodeRAG need?
It reads BITBUCKET_APP_PASSWORD, EMBEDDING_MAX_TOKENS, GH_TOKEN, GITHUB_TOKEN, GITLAB_TOKEN, GL_TOKEN, MCP_TOKEN_LIMIT, NEO4J_PASSWORD and OPENAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does CodeRAG run?
It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as coderag at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (e4e97b4ff7bc), read on 2026-10-08. The repository is watched and re-audited when it changes.