code-graph-rag

Overview

From the repository's own README, as read at the audited commit.

<div align="center">  <picture>    <source media="(prefers-color-scheme: dark)" srcset="assets/logo-dark-any.png">    <source media="(prefers-color-scheme: light)" srcset="assets/logo-light-any.png">    <img src="assets/logo-light-any.png" alt="Code-Graph-RAG Logo" width="480">  </picture>  <p>    <a href="https://trendshift.io/repositories/99619" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/repositories/99619" alt="vitali87/code-graph-rag | Trendshift" width="250" height="55"/></a>  </p>  <p>  <a href="https://github.com/vitali87/code-graph-rag/actions/workflows/ci.yml">    <img src="https://img.shields.io/github/actions/workflow/status/vitali87/code-graph-rag/ci.yml?branch=main" alt="CI" />  </a>  <a href="https://codecov.io/gh/vitali87/code-graph-rag">    <img src="https://codecov.io/gh/vitali87/code-graph-rag/graph/badge.svg" alt="Codecov" />  </a>  <a href="https://sonarcloud.io/summary/overall?id=vitali87_code-graph-rag">    <img src="https://sonarcloud.io/api/project_badges/measure?project=vitali87_code-graph-rag&metric=alert_status" alt="Quality Gate Status" />  </a>  <a href="https://code-graph-rag.com">    <img src="https://img.shields.io/badge/Enterprise-Support%20%26%20Services-6366f1" alt="Enterprise Support" />  </a>  <a href="https://pypi.org/project/code-graph-rag/">    <img src="https://img.shields.io/pypi/v/code-graph-rag" alt="PyPI Version" />  </a>  <a href="https://pepy.tech/projects/code-graph-rag">    <img src="https://static.pepy.tech/personalized-badge/code-graph-rag?period=total&units=INTERNATIONAL_SYSTEM&left_color=BLACK&right_color=GREEN&left_text=downloads" alt="PyPI Downloads" />  </a>  <a href="https://skillsllm.com/security-check/DHsMGRb1Ysys">    <img src="https://skillsllm.com/security-check/badge.svg?owner=vitali87&repo=code-graph-rag" alt="SkillsLLM Security Check" />  </a>  <a href="https://scorecard.dev/viewer/?uri=github.com/vitali87/code-graph-rag">    <img src="https://api.scorecard.dev/

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude mcp add code-graph-rag --env ORCHESTRATOR_API_KEY=${ORCHESTRATOR_API_KEY} --env CYPHER_API_KEY=${CYPHER_API_KEY} -- uvx code-graph-rag==0.0.949 mcp-server

Details

Source

vitali87/code-graph-rag

npm

ts_oracle@0.1.0

PyPI

code-graph-rag

Transports

stdio · streamable-http

Credentials it reads

CYPHER_API_KEYGITHUB_TOKENGOOGLE_API_KEYJWT_SECRET_KEYKEYMY_KEYORCHESTRATOR_API_KEYREAD_KEYSECRETTOKEN

Tools

Registered at runtime; the list could not be read from source.

License

MIT

Stars

5,143 · pushed 0d ago

Trust audit

Install with care. The audit found things worth knowing before you trust its output.

What the source does

Filesystem

declared (5 observation(s))

Network

declared (7 observation(s))

Shell

declared (5 observation(s))

Dependencies

not all pinned

Secrets in source

found

Findings (25)

append_call.bin

delete.bin

delete_recreate.bin

empty_file.bin

multi_edit.bin

vendored = importlib.import_module(cs.TYPER_VENDORED_CLICK_EXCEPTIONS_MODULE)

module = importlib.import_module(module_name)

module = importlib.import_module(module_path)

module = importlib.import_module(module_name)

module = importlib.import_module(module_path)

logger.warning(ls.CAPTURE_UNKNOWN_TOKEN.format(token=token))

url = f"http://127.0.0.1:{port}/readyz"

sys.settrace(tracer)

sys.settrace(previous)

"bom": "def f():\n    return 1\n",

SECRET = "-----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAA"

.coderabbit.yaml

.gitmodules

.pre-commit-config.yaml

"    yaml.load(u); pickle.loads(u)\n"

"    eval(u); exec(u)\n"

"eval(userInput);\n"

"    eval($code);\n"

"    eval(code)\n"

exec(compile(source, str(path), "exec"), namespace)

Gates applied: no_behavioural_pass.

Audited 2026-09-17 · audit v0.4.0 · source sha 876d15073a6f · full audit: observations/trust-audit/mcp-server/vitali87__code-graph-rag.json · Report an issue or request a re-scan

Audit history

Alternatives

Other servers in the same categories, safer ones first.

Questions