ModelsAtlas
Explore
Atlas / MCP servers / shashankss1205 / CodeGraphContext

CodeGraphContextBLOCK

mcp/shashankss1205/codegraphcontext
MCP server by shashankss1205 · codegraph · codegraphcontext · hacktoberfest2025 · Audited 2026-10-03
⚑ Report / re-scanSource ↗

An MCP server plus a CLI tool that indexes local code into a graph database to provide context to AI assistants.

Verdict
BLOCK
Grade
F
Trust score
51 /100
Exposed tools
10 10r · 0w · 0d
Transport
—
License
MIT
Stars
4,242
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Turn code repositories into a queryable graph for AI agents.

🌐 Languages:

  • 🇬🇧 English
  • 🇨🇳 中文
  • 🇰🇷 한국어
  • 🇺🇦 Українська
  • 🇷🇺 Русский
  • 🇯🇵 日本語
  • 🇮🇳 தமிழ்
  • 🇪🇸 Español (Soon)

🌍 Help translate CodeGraphContext to your language by raising an issue & PR on [GitHub Issues](https://github.com/CodeGraphContext/CodeGraphContext/issues)!

Bridge the gap between deep code graphs and AI context.

Read from source at commit 407160b67728OBSERVED · 2026-10-03
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add vite_react_shadcn_ts --env ATLASCLOUD_API_KEY=${ATLASCLOUD_API_KEY} --env ATLAS_CLOUD_API_KEY=${ATLAS_CLOUD_API_KEY} --env BUNDLE_TRIGGER_API_KEY=${BUNDLE_TRIGGER_API_KEY} --env CGC_BUNDLE_PASSWORD=${CGC_BUNDLE_PASSWORD} -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "vite_react_shadcn_ts": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "ATLASCLOUD_API_KEY": "${ATLASCLOUD_API_KEY}",
        "ATLAS_CLOUD_API_KEY": "${ATLAS_CLOUD_API_KEY}",
        "BUNDLE_TRIGGER_API_KEY": "${BUNDLE_TRIGGER_API_KEY}",
        "CGC_BUNDLE_PASSWORD": "${CGC_BUNDLE_PASSWORD}"
      }
    }
  }
}
03

Exposed tools (10)

10 read · 0 write · 0 destructive.

ToolRiskDescription
ClassicreadStandard colored circles
FlowchartreadSVG diagram with Bezier edges
GalaxyreadOrbital rings by connections
IconreadEmoji icons by node type
analyze_code_relationshipsreadInspects coupling references, inherits, imports, and calls between symbols.
calculate_cyclomatic_complexityreadComputes cyclomatic complexity scores for all functions in the codebase.
find_dead_codereadLocates unreferenced classes and functions inside the repository codebase.
find_most_complex_functionsreadRetrieves the functions with the highest cyclomatic complexity scores.
get_repository_statsreadRetrieves general repository graph statistics (counts of files, classes, methods, and relationship linkages).
list_indexed_repositoriesreadLists all repositories indexed in the user
04

Trust audit

BLOCKgrade F · trust 51/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (8 observation(s))
Network
declared (5 observation(s))
Shell
declared (4 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
extensions/vscode/src/webview/setupPanel.ts:67
exec(cmd, async (error: any, stdout: string, stderr: string) => {
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
src/codegraphcontext/core/__init__.py:320
module = importlib.import_module(_LAZY_IMPORTS[name], __package__)
MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
src/codegraphcontext/core/database_embedded_kuzu.py:217
backend = importlib.import_module(spec.python_module)
MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
src/codegraphcontext/core/database_embedded_kuzu.py:683
importlib.import_module(spec.python_module)
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
tests/unit/utils/test_secret_scanner.py:71
detected, pattern = is_likely_secret("api_key = 'sk-1234567890abcdef1234567890abcdef'")
MEDIUMHard-coded secrets · secret.github · CWE-798, CWE-321
tests/unit/utils/test_sanitize_secrets.py:38
props = {"value": "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefgh"}
MEDIUMHard-coded secrets · secret.github · CWE-798, CWE-321
tests/unit/utils/test_sanitize_secrets.py:40
assert result["value"] == "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefgh"
MEDIUMHard-coded secrets · secret.github · CWE-798, CWE-321
tests/unit/utils/test_sanitize_secrets.py:43
props = {"value": "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefgh"}
MEDIUMHard-coded secrets · secret.github · CWE-798, CWE-321
tests/unit/utils/test_sanitize_secrets.py:50
props = {"value": "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefgh"}
MEDIUMHard-coded secrets · secret.github · CWE-798, CWE-321
tests/unit/utils/test_sanitize_secrets.py:55
props = {"value": "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefgh"}
MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321
tests/unit/utils/test_secret_scanner.py:63
detected, pattern = is_likely_secret("-----BEGIN RSA PRIVATE KEY-----")
LOWInventory / provenance · inv.binary · CWE-1104
tests/fixtures/sample_projects/sample_project_c/cgc_sample
cgc_sample
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.binary · CWE-1104
tests/fixtures/sample_projects/sample_project_cpp/main.exe
main.exe
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.binary · CWE-1104
tests/fixtures/sample_projects/sample_project_cpp/sample_project.exe
sample_project.exe
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.binary · CWE-1104
tests/fixtures/sample_projects/sample_project_java/out/com/example/app/Main.class
Main.class
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.binary · CWE-1104
tests/fixtures/sample_projects/sample_project_java/out/com/example/app/annotations/Logged.class
Logged.class
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.hidden_file · CWE-1104
extensions/vscode/.vscodeignore
.vscodeignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
tests/fixtures/sample_projects/sample_project/.cgcignore
.cgcignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
tests/fixtures/sample_projects/sample_project_c/.cgc_compile_commands.json
.cgc_compile_commands.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
tests/fixtures/sample_projects/sample_project_c/.cgcignore
.cgcignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
tests/fixtures/sample_projects/sample_project_cpp/.cgc_compile_commands.json
.cgc_compile_commands.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
tests/fixtures/sample_projects/sample_project/dynamic_dispatch.py:33
mod = importlib.import_module(mod_name)
LOWCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
tests/fixtures/sample_projects/sample_project/dynamic_imports.py:11
mod = __import__(name)
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
website/public/wasm/web-tree-sitter.js:2343
ASM_CONSTS[start] = eval(func);
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
website/public/wasm/web-tree-sitter.js:2366
moduleExports[name] = eval(func);
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table

Gates applied: no_behavioural_pass.

Audited 2026-10-03 · audit v0.4.1 · source sha 407160b67728full audit observations/trust-audit/mcp-server/shashankss1205__codegraphcontext.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-03407160b67728BLOCKF51first audit
06

Questions

What is the CodeGraphContext MCP server?

An MCP server plus a CLI tool that indexes local code into a graph database to provide context to AI assistants.

What tools does CodeGraphContext expose?

10 in total: 10 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is CodeGraphContext safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (51/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What credentials does CodeGraphContext need?

It reads ATLASCLOUD_API_KEY, ATLAS_CLOUD_API_KEY, BUNDLE_TRIGGER_API_KEY, CGC_BUNDLE_PASSWORD, CGC_BUNDLE_VERIFY_KEY, FALKORDB_PASSWORD, GEMINI_API_KEY, GH_TOKEN, GITHUB_TOKEN, HF_ADMIN_WRITE_TOKEN, HF_TOKEN and HUGGING_FACE_HUB_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How current is this page?

The grade is for one exact copy of the source (407160b67728), read on 2026-10-03. The repository is watched and re-audited when it changes.

Advertisement