Graft

Overview

From the repository's own README, as read at the audited commit.

<div align="center"><img src="assets/graft-hero.png" alt="Graft — open-source context layer for large codebases" width="100%"/>### Turbocharge Claude Code, Cursor, Codex, Gemini & every coding agent: faster, cheaper, with contextual understanding specific to your codebase.<a href="https://trendshift.io/repositories/92209?utm_source=trendshift-badge&utm_medium=badge&utm_campaign=badge-trendshift-92209" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/92209/daily?language=TypeScript" alt="trailhq/Graft | Trendshift" width="250" height="55"/></a><p>  <a href="https://github.com/NanoNets/Graft"><img src="https://img.shields.io/github/stars/NanoNets/Graft?style=for-the-badge&logo=github&logoColor=white&label=Star%20on%20GitHub&color=FFC83D" /></a>  <a href="https://graft.nanonets.ai"><img src="https://img.shields.io/badge/website-graft.nanonets.ai-546FFF?style=for-the-badge" /></a>  <a href="https://discord.gg/zxmKweAA29"><img src="https://img.shields.io/badge/Discord-join-5865F2?style=for-the-badge&logo=discord&logoColor=white" /></a>  <a href="https://www.npmjs.com/package/@nanonets/graft"><img src="https://img.shields.io/npm/v/%40nanonets%2Fgraft?style=for-the-badge&logo=npm&logoColor=white&label=npm" /></a>  <a href="https://www.npmjs.com/package/@nanonets/graft"><img src="https://img.shields.io/npm/dm/%40nanonets%2Fgraft?style=for-the-badge&logo=npm&logoColor=white&label=downloads" /></a>  <a href="https://nodejs.org"><img src="https://img.shields.io/node/v/%40nanonets%2Fgraft?style=for-the-badge&logo=nodedotjs&logoColor=white" /></a>  <img src="https://img.shields.io/badge/TypeScript-strict-3178C6?style=for-the-badge&logo=typescript&logoColor=white" />  <img src="https://img.shields.io/badge/License-MIT-20C997?style=for-the-badge" />  <a href="TELEMETRY.md"><img src="https://img.shields.io/badge/telemetry-anonymous%2C%20opt--out-546FFF?style=for-the-badge" /></a>  <a href="https://scorecard.dev/viewer/?uri=

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude mcp add graft --env GH_TOKEN=${GH_TOKEN} --env GITHUB_TOKEN=${GITHUB_TOKEN} --env GRAFT_BRAIN_BUILD_SECRET=${GRAFT_BRAIN_BUILD_SECRET} --env GRAFT_BRAIN_TOKEN=${GRAFT_BRAIN_TOKEN} -- npx -y @nanonets/[email protected]

{
  "mcpServers": {
    "graft": {
      "command": "npx",
      "args": [
        "-y",
        "@nanonets/[email protected]"
      ],
      "env": {
        "GH_TOKEN": "${GH_TOKEN}",
        "GITHUB_TOKEN": "${GITHUB_TOKEN}",
        "GRAFT_BRAIN_BUILD_SECRET": "${GRAFT_BRAIN_BUILD_SECRET}",
        "GRAFT_BRAIN_TOKEN": "${GRAFT_BRAIN_TOKEN}"
      }
    }
  }
}

Exposed tools (10) 8 read · 2 write · 0 destructive

Details

Source

trailhq/Graft

npm

@nanonets/graft@0.18.0

Credentials it reads

GH_TOKENGITHUB_TOKENGRAFT_BRAIN_BUILD_SECRETGRAFT_BRAIN_TOKENGRAFT_POSTHOG_KEYGRAFT_PUBLIC_GITHUB_TOKEN

License

MIT

Stars

8,437 · pushed 0d ago

Trust audit

Install with care. The audit found things worth knowing before you trust its output.

What the source does

Filesystem

declared (3 observation(s))

Network

declared (5 observation(s))

Shell

declared (5 observation(s))

Dependencies

not all pinned

Secrets in source

none-found

Findings (16)

CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

const url = new URL(req.url ?? "/", "http://127.0.0.1");

url: `http://127.0.0.1:${port}`,

.ignore

.mailmap

import { relPosix } from "../../util/paths.js";

'import { depAValue } from "../../dep_a/src/api.js";\n' +

assert.equal(langsValue(['ts', '../../etc/passwd']), 'ts');

assert.equal(track('exfiltrate', { anything: 'here' }, { home, env: OPEN }), null);

url: `http://127.0.0.1:${port}`,

url: `http://127.0.0.1:${port}`,

@anthropic-ai/sdk, commander, dotenv, gray-matter, openai, tree-sitter, tree-sitter-go, tree-sitter-java

assets/graft-comparison-demo.gif

assets/graft-hook-blast-radius-demo.gif

assets/graft-site-act-demo.gif

assets/graft-viz-demo.gif

Gates applied: no_behavioural_pass.

Audited 2026-09-18 · audit v0.4.0 · source sha 6bd383c03303 · full audit: observations/trust-audit/mcp-server/trailhq__graft.json · Report an issue or request a re-scan

Audit history

Alternatives

Other servers in the same categories, safer ones first.

More from trailhq

Questions