GraphFlowBLOCK
Local-first code knowledge graph and context harness for coding agents. MCP + DeepSeek Harness (dsh) plugin.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
English | 中文
[](https://www.npmjs.com/package/@roarpeng/graphflow) [](https://github.com/topics/dsh-plugin) [](https://modelcontextprotocol.io)
The memory & context harness for coding agents. Local-first code knowledge graph · bounded context compression (truly bounded responses: the package plus history echoes, which ship as short previews only; 92.2% fewer tokens than reading the top-10 files in full — a token ratio, not an answer-quality measure, see both baseline arms) · cross-session learning flywheel.
The community is converging on an "agent harness" vocabulary: memory + hooks + skills are the harness primitives that turn a stateless model into a reliable long-running agent. GraphFlow implements all three for coding agents and ships them through a portable MCP surface (Cursor, Claude Code, 15+ agents):
Pure TypeScript/Node. CLI + MCP + VS Code extension. Local-first: indexing, compressi
a9cd7c50a567OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add graphflow --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env API_KEY=${API_KEY} --env APP_SECRET=${APP_SECRET} --env BAILIAN_API_KEY=${BAILIAN_API_KEY} -- npx -y [email protected]{
"mcpServers": {
"graphflow": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
"API_KEY": "${API_KEY}",
"APP_SECRET": "${APP_SECRET}",
"BAILIAN_API_KEY": "${BAILIAN_API_KEY}"
}
}
}
}Exposed tools (22)
18 read · 4 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
A | read | keep |
D1-core-orchestration | read | Orchestrator, DAG engine, planner |
D2-graph-engine | read | File indexer, retrieval, context compression |
D3-learning-subsystem | read | Skill flywheel, episodic memory, training |
D4-config-routing | read | Configuration loader, model routing, providers |
D5-integrations | read | MCP server, bridge mode, VS Code extension |
f | read | d |
graphflow.compress | read | Compress codebase context using graph-based retrieval and token-efficient packaging. |
graphflow.expandAnchor | read | Expand a graph anchor node to get full content and source location. |
graphflow.index | read | Index a codebase into the knowledge graph for context-aware retrieval. |
graphflow.inspect | read | Inspect the current knowledge graph structure and statistics. |
graphflow.plan | read | Plan a coding task with graph context, producing structured task nodes with dependencies. |
graphflow.planInsight | read | Analyze a task using Six Thinking Hats + 5 Whys structured thinking framework. |
graphflow.run | write | Run a full task: plan + compress context + return execution descriptor (bridge mode). |
graphflow_artifact | write | [Maintenance] Export or import graph artifact files for team sharing. |
graphflow_context | read | Preview compressed GraphFlow context for a code question. Use before guessing about the codebase. |
graphflow_index | read | [Core] Index workspace into graph store. Use filePath for single-file, mode= |
graphflow_insight | write | [Advanced] Submit or merge agent insights. Mode |
graphflow_inspect | read | Return lightweight graph stats (node/edge counts). |
graphflow_run | write | [Core] Plan and package a task with compressed context, returning a structured execution descriptor for external coding agents (Cursor, Claude Code) to execute. Bridge mode by default. The response carries an |
graphflow_skill_insights | read | Return top learned GraphFlow skill insights. |
test_fn | read | test |
Trust audit
BLOCKgrade F · trust 23/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (7 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
exec() {exec() {exec() {exec() {exec() {"**/id_rsa*",
"**/id_ecdsa*",
"**/id_ed25519*",
"**/.netrc",
"**/.git-credentials",
```css
```
```css
```
.cursor/skills/animate
.cursor/skills/animation-vocabulary
.cursor/skills/apple-design
.cursor/skills/emil-design-eng
.cursor/skills/find-animation-opportunities
{ signal: "exfiltration", re: /\bexfiltrat/i },signal: "exfiltration",
{"id":"adv-006","kind":"injection","input":{"op":"detectInjection","source":"graphflow-summary","text":"Embedded payload: QUJDQUJDQUJDQUJDQUJDQUJDQUJDQUJDQUJDQUJDQUJDQUJDQUJDQUJDQUJDQUJDQUJDQUJDQUJDQUinput: "the model call used sk-ant-FIXTUREONLYnotarealkey and timed out",
secret: "sk-ant-FIXTUREONLYnotarealkey",
input: "use mysql://root:[email protected]:3306/shop for the migration",
Gates applied: no_behavioural_pass.
a9cd7c50a567full audit observations/trust-audit/mcp-server/roarpeng__graphflow.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | a9cd7c50a567 | BLOCK | F | 23 | first audit |
Questions
What is the @roarpeng/graphflow MCP server?
Local-first code knowledge graph and context harness for coding agents. MCP + DeepSeek Harness (dsh) plugin.
What tools does @roarpeng/graphflow expose?
22 in total: 18 read-only, 4 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @roarpeng/graphflow safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (23/100) and found 14 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does @roarpeng/graphflow need?
It reads ANTHROPIC_API_KEY, API_KEY, APP_SECRET, BAILIAN_API_KEY, DEEPSEEK_API_KEY, DOUBAO_API_KEY, GF_M150_KEY, GF_M150_TOKEN, GRAPHFLOW_CACHE_AB_INJECT_TOKENS, GRAPHFLOW_CACHE_AB_STABLE_TOKENS, GRAPHFLOW_EMBEDDING_PASS_LIMIT and GRAPHFLOW_LLM_SMOKE_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @roarpeng/graphflow run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as graphflow at 2.2.0.
How current is this page?
The grade is for one exact copy of the source (a9cd7c50a567), read on 2026-10-12. The repository is watched and re-audited when it changes.