Codebase IndexBLOCK
17 MCP query tools for codebase navigation — functions, classes, imports, dependency graphs, change impact. Zero dependencies. 87% token reduction.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://pypi.org/project/mcp-codebase-index/) [](https://github.com/MikeRecognex/mcp-codebase-index/actions/workflows/ci.yml) [](https://www.python.org/downloads/) [](https://www.gnu.org/licenses/agpl-3.0) [](https://modelcontextprotocol.io) []()
A structural codebase indexer with an MCP server for AI-assisted development. Zero runtime dependencies — uses Python's ast module for Python analysis and regex-based parsing for TypeScript/JS, Go, Rust, and C#. Requires Python 3.11+.
What It Does
Indexes codebases by parsing source files into structural metadata -- functions, classes, imports, dependency graphs, and cross-file call chains -- then exposes 18 query tools via the Model Context Protocol, enabling Claude Code and other MCP clients to navigate codebases efficiently without reading entire files.
Automatic incremental re-indexing: In git repositories, the index stays up to date automatically. Before every query, the server checks git diff and git status (~1-2ms). If files changed, only those files are re-parsed and the dependency graph is rebuilt. No need to manually call reindex after edits, branch switches, or pulls.
Persistent disk cache: The index is saved to a pickle cache file (.codebase-index-cache.pkl) after every build. On subsequent server starts, the cache is loaded and validated against the current git HEAD — if the ref matches, startup is instant. If a small number of
5f61a0304631OBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add mcp-codebase-index -- None mcp-codebase-index==0.2.2
Exposed tools (18)
16 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
find_symbol | read | Find where a symbol (function, method, class) is defined. Returns file path, line range, type, signature, and a source preview (~20 lines). |
get_call_chain | read | Find the shortest dependency path between two symbols (BFS through the dependency graph). |
get_change_impact | read | Analyze the impact of changing a symbol. Returns direct dependents and transitive (cascading) dependents. |
get_class_source | read | Get the full source code of a class by name. Uses the symbol table to locate the file automatically. |
get_classes | read | List all classes (with name, lines, methods, bases, file). Filter to a specific file or get all project classes. |
get_dependencies | read | What does this symbol call/use? Returns list of symbols referenced by the named function or class. |
get_dependents | read | What calls/uses this symbol? Returns list of symbols that reference the named function or class. |
get_file_dependencies | write | List files that this file imports from (file-level import graph). |
get_file_dependents | write | List files that import from this file (reverse import graph). |
get_function_source | read | Get the full source code of a function or method by name. Uses the symbol table to locate the file automatically. |
get_functions | read | List all functions (with name, lines, params, file). Filter to a specific file or get all project functions. |
get_imports | read | List all imports (with module, names, line). Filter to a specific file or get all project imports. |
get_project_summary | read | High-level overview of the project: file count, packages, top classes/functions. |
get_structure_summary | read | Structure summary for a file (functions, classes, imports, line counts) or the whole project if no file specified. |
get_usage_stats | read | Session efficiency stats: tool calls, characters returned vs total source, estimated token savings. |
list_files | read | List indexed files. Optional glob pattern to filter (e.g. |
reindex | read | Re-index the entire project. Use after making significant file changes to refresh the structural index. |
search_codebase | read | Regex search across all indexed files. Returns up to 100 matches with file, line number, and content. |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- declared (1 observation(s))
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (1)
payload = pickle.load(f)
Gates applied: no_behavioural_pass.
5f61a0304631full audit observations/trust-audit/mcp-server/mikerecognex__codebase-index-1.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | 5f61a0304631 | BLOCK | D | 69 | first audit |
Questions
What is the Codebase Index MCP server?
17 MCP query tools for codebase navigation — functions, classes, imports, dependency graphs, change impact. Zero dependencies. 87% token reduction.
What tools does Codebase Index expose?
18 in total: 16 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Codebase Index safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does Codebase Index need?
No credential environment variables were found in its source, so it appears to need none.
How does Codebase Index run?
It speaks stdio, so it runs as a local process your client starts. It is published on PyPI as mcp-codebase-index.
How current is this page?
The grade is for one exact copy of the source (5f61a0304631), read on 2026-10-07. The repository is watched and re-audited when it changes.