codegraphBLOCK
CLI, MCP and TS library that turns source code into a map of files, symbols, references, and dependencies using tree-sitter.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Give your coding agent a map of the repository, not a pile of search results.
codegraph is a local CLI and TypeScript library that turns a source tree into a resolved map of files, symbols, references, and dependencies. Ask where an implementation lives, how components connect, what a change can break, or which tests are relevant, then get bounded source evidence and copyable next steps.
codegraph is not an AST, a compiler, or a linter. People can use codegraph review and codegraph deps to inspect changes and dependencies without an agent.
Without structural context, an agent burns early turns listing directories, guessing search terms, opening candidate files, and reconstructing relationships. codegraph does that discovery once so the context window can stay focused on the problem.
With Node.js 22.16 or newer, install from npm:
npm install -g @lzehrung/codegraph codegraph doctor codegraph install codegraph explore "build review report" --root .
No Node.js or npm? The standalone installers download a se
16e94c325a14OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add pkg-ts-consumer --env GIT_AUTHOR_EMAIL=${GIT_AUTHOR_EMAIL} --env GIT_AUTHOR_NAME=${GIT_AUTHOR_NAME} -- npx -y @acme/[email protected]{
"mcpServers": {
"pkg-ts-consumer": {
"command": "npx",
"args": [
"-y",
"@acme/[email protected]"
],
"env": {
"GIT_AUTHOR_EMAIL": "${GIT_AUTHOR_EMAIL}",
"GIT_AUTHOR_NAME": "${GIT_AUTHOR_NAME}"
}
}
}
}Exposed tools (27)
24 read · 3 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
artifact_build | write | Build Codegraph artifacts when write tools are explicitly enabled. |
callees | read | Legacy alias for calls with direction callees. |
callers | read | Legacy alias for calls with direction callers. |
calls | read | Find proven semantic callers or callees and exact grouped callsites for a portable symbol handle. Use refs for every symbol reference and file_deps for file-level dependencies. |
deps | read | Legacy alias for file_deps with direction deps. |
explore | read | One hybrid search plus context from top results. Not a first step; use refs or calls for known symbols. |
file_deps | read | List file dependencies or reverse file dependencies by file path, qualified file::symbol path, or portable handle. |
get_file | read | Read a bounded project file by relative path with line pagination and optional graph context. |
get_symbol | read | Resolve a stable search or explain handle. |
goto | read | Resolve a definition by portable handle, qualified file::symbol path, or file position. |
impact | read | Build compact impact context for a git range. |
implementations | read | Find proven implementations for a type or supported interface/trait member handle without name-only inference. |
orient | read | Build a compact first-turn packet for agent repo context. |
packet_get | read | Retrieve a bounded evidence packet by file path, symbol name, SQL object name, or stable target. |
path | read | Find the shortest dependency path between two files. |
query_sqlite | write | Run a bounded read-only SQL query against the graph SQLite artifact. |
rdeps | read | Legacy alias for file_deps with direction rdeps. |
refactor_plan | read | Build a read-only refactor evidence packet by symbol handle from one snapshot. Optional rename evidence is authoritative and no apply tool exists. |
refresh_index | read | Invalidate the in-memory Codegraph session and optionally rebuild it. |
refs | read | Find references by portable handle, qualified file::symbol path, or file position. |
rename_preview | write | Preview a semantic rename by portable symbol handle without changing files. Filename results are suggestions only; no apply tool exists. |
review | read | Build review context for a git range. |
search | read | Deterministic ranked search across files, symbols, chunks, SQL objects, and graph context. |
subtypes | read | Legacy alias for type_hierarchy with direction subtypes. |
supertypes | read | Legacy alias for type_hierarchy with direction supertypes. |
type_hierarchy | read | Find proven direct or transitive supertypes or subtypes for a portable symbol handle. Returns currently extracted extends and implements relationships only. |
workspace_symbols | read | Deterministic symbol-identity lookup with exact locations and filters. Use hybrid search instead for paths, prose, SQL, snippets, or graph evidence. |
Trust audit
BLOCKgrade D · trust 63/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (11 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (4 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (25)
exec(sql: string): void {if (basename === ".npmrc" || basename === ".pypirc" || basename === ".netrc") {.prettierignore
.prettierrc.json
compact-payload.json
legacy-payload.json
'__import__(r"pkg.builtin")',
'importlib.import_module(f"pkg.canonical")',
const hash = crypto.createHash("sha1");const hash = crypto.createHash("sha1");const hash = crypto.createHash("sha1");const hash = crypto.createHash("sha1");const linkedFile = path.join(root, "id_rsa");
const redacted = await getCodegraphFileView({ root, file: "id_rsa", limit: 10, maxBytes: 100 });file: "id_rsa",
file: ".netrc",
import { LANG_CONFIGS } from "../../bootstrap/tree-sitter-languages.js";import { chunkFile } from "../../chunking/chunk-file.js";import { supportForFile, supportForFileWithSource, type LanguageSupport } from "../../languages.js";import { assertFilePathWithinRoot, isAbsoluteFilePath, isFilePathWithinRoot, normalizePath } from "../../util/paths.js";import { SqliteDatabase } from "../../sqlite-driver.js";...Array.from({ length: fillerCount }, () => "beacon filler"),"quasar beacon",
const disk = await searchCodegraph({ root, query: "quasar beacon", mode: "text", limit: 3 });query: "quasar beacon",
Gates applied: no_behavioural_pass.
16e94c325a14full audit observations/trust-audit/mcp-server/lzehrung__codegraph.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 16e94c325a14 | BLOCK | D | 63 | first audit |
Questions
What is the codegraph MCP server?
CLI, MCP and TS library that turns source code into a map of files, symbols, references, and dependencies using tree-sitter.
What tools does codegraph expose?
27 in total: 24 read-only, 3 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is codegraph safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (63/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does codegraph need?
It reads GIT_AUTHOR_EMAIL and GIT_AUTHOR_NAME from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does codegraph run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @acme/pkg-ts-consumer at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (16e94c325a14), read on 2026-10-11. The repository is watched and re-audited when it changes.