Atlas / MCP servers / manojmallick / sigmap

sigmapCAUTION

Name: sigmap
Author: manojmallick

mcp/manojmallick/sigmap

MCP server by manojmallick · ai · ai code review · ai grounding · Audited 2026-10-11

⚑ Report / re-scan Source ↗

~97% token reduction for AI coding sessions — zero deps, 38 languages, MCP server

Verdict

CAUTION

Grade

Trust score

48 /100

Exposed tools

22 20r · 2w · 0d

Transport

—

License

MIT

Stars

646

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

SigMap is the deterministic, verifiable grounding layer for AI code work.

[](https://www.npmjs.com/package/sigmap) [](https://www.npmjs.com/package/sigmap) [](https://github.com/manojmallick/sigmap/actions/workflows/ci.yml) [](package.json) [](LICENSE) [](https://github.com/manojmallick/sigmap/stargazers) [](https://starmapper.bruniaux.com/manojmallick/sigmap) [](https://shypd.ai/tools/sigmap)

[](https://mseep.ai/app/manojmallick-sigmap) [](https://mseep.ai/app/193cd37f-1ef3-43c3-8

Read from source at commit 87bdf4d58589OBSERVED · 2026-10-11

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add sigmap-core --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env GEMINI_API_KEY=${GEMINI_API_KEY} --env GOOGLE_API_KEY=${GOOGLE_API_KEY} --env MINIMAX_API_KEY=${MINIMAX_API_KEY} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "sigmap-core": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "GEMINI_API_KEY": "${GEMINI_API_KEY}",
        "GOOGLE_API_KEY": "${GOOGLE_API_KEY}",
        "MINIMAX_API_KEY": "${MINIMAX_API_KEY}"
      }
    }
  }
}

Exposed tools (22)

20 read · 2 write · 0 destructive.

Tool	Risk	Description
`create_checkpoint`	write	Create a session checkpoint summarising current project state.
`explain_file`	read	Explain a specific file: returns its extracted signatures, direct imports
`get_architecture_overview`	read	A high-level map of the codebase in one call: module breakdown (files/tokens), the most
`get_budget`	read	Session spend ledger — estimated tokens SigMap has emitted this session
`get_callee_signatures`	read	Return the EXACT current signature(s) of named symbols (functions, classes,
`get_diff_context`	read	For every changed file in the working tree (or staged, or vs a base ref), return its
`get_impact`	read	Show every file that is impacted when a given file changes — direct importers,
`get_lines`	read	Fetch an exact line range from a source file on demand — the Surgical Context
`get_map`	write	Read a section from PROJECT_MAP.md — import graph, class hierarchy, or route table.
`get_method_impact`	read	Method-level blast radius for a symbol: every FUNCTION that (transitively) calls it —
`get_routing`	read	Get model routing hints for this project — which files belong to which complexity
`list_modules`	read	List all top-level modules (srcDirs) present in the context file,
`query_context`	read	Rank and return the most relevant files for a specific task or question.
`query_knowledge_map`	read	Query the unified knowledge map — typed nodes (file, symbol, library@version, route,
`read_context`	read	Read extracted code signatures for the project or a specific module path.
`read_memory`	read	Recall the project decision log — recent notes left by humans or agents
`search_signatures`	read	Search extracted code signatures for a keyword, function name, or class name.
`sigmap_notify_file_created`	read	Tell SigMap a file was created or modified so its signatures are indexed
`sigmap_notify_file_deleted`	read	Tell SigMap a file was deleted so its symbols are dropped from the live index.
`sigmap_notify_symbol_added`	read	Fast path: register a single new symbol signature directly in the live
`squeeze_output`	read	Compress noisy tool, command, or agent output before it enters context — a stack
`verify_suggestion`	read	Ground an AI code suggestion before writing it: verify a snippet or answer against the

Trust audit

CAUTIONgrade F · trust 48/100 Install with care. The audit found things worth knowing before you trust its output.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	WARN
L2	Instruction surface (what it tells the agent)	WARN
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (10 observation(s))
Network: declared (5 observation(s))
Shell: declared (5 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532

scripts/run-xrepo-gate.mjs:266

console.log(`\n    of the ${noToken.length} no-token misses, the answer holds: a distinctive word only in its source ${noTokenAt('distinctive')} · only common words ${noTokenAt('common-only')} · no wo

MEDIUMHard-coded secrets · secret.aws · CWE-798, CWE-321

test/integration/redact.test.js:71

const r = redactText('before AKIA1234567890ABCDEF after');

MEDIUMHard-coded secrets · secret.aws · CWE-798, CWE-321

test/integration/redact.test.js:201

fs.writeFileSync(tmp, 'x AKIA1234567890ABCDEF y\n');

MEDIUMHard-coded secrets · secret.aws · CWE-798, CWE-321

test/integration/review-pr.test.js:55

readFile: () => 'const k = "AKIAABCDEFGHIJKLMNOP";\n', // AWS-access-key shaped

MEDIUMHard-coded secrets · secret.aws · CWE-798, CWE-321

test/integration/review-pr.test.js:237

fs.writeFileSync(path.join(dir, 'src', 'config.js'), 'module.exports = { key: "AKIAABCDEFGHIJKLMNOP" };\n');

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

test/integration/secret-scan.test.js:43

const sigs = ['const token = "ghp_abcdefghijklmnopqrstuvwxyz123456789012"'];

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

test/integration/secret-scan.test.js:80

const sigs = ['const password = "supersecretpassword123"'];

MEDIUMHard-coded secrets · secret.github · CWE-798, CWE-321

test/integration/live-overlay.test.js:284

handlers.notifySymbolAdded({ signature: 'function leak(t = "ghp_abcdefghijklmnopqrstuvwxyz0123456789")', file: 'src/s.js' }, dir);

MEDIUMHard-coded secrets · secret.github · CWE-798, CWE-321

test/integration/secret-scan.test.js:43

const sigs = ['const token = "ghp_abcdefghijklmnopqrstuvwxyz123456789012"'];