codegraph-brainCAUTION
Code graph for AI agents: impact analysis and call tracing over MCP (Python, TypeScript). Local, deterministic, SQLite.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A code graph your AI agent can query instead of guess
[](https://github.com/zaebee/codegraph-brain/actions/workflows/ci.yml) [](https://github.com/zaebee/codegraph-brain/actions/workflows/autodoc.yml) [](https://pypi.org/project/codegraph-brain/)
Ask "what breaks if I change this?" and get the call chain, not a guess.
CGIS parses a repository with tree-sitter into a graph of fully qualified symbols and the calls, imports and containment between them, stores it in SQLite, and serves it to AI agents over MCP. An agent that would otherwise grep and read whole files asks the graph instead.
- Languages: Python · TypeScript / TSX
- Runs: locally — no account, no telemetry; the graph never leaves your disk (the one opt-in exception)
$ cgis ingest src --output graph.db $ cgis impact cgis.query.engine.QueryEngine.get_flow_graph --db graph.db --depth 2 🔍 Analyzing transitive upstream callers of: cgis.query.engine.QueryEngine.get_flow_graph METHOD cgis.query.engine.QueryEngine.get_flow_graph (cgis/query/engine.py:215) ├── FUNCTION cgis.query.context.context_service._collect_callees (cgis/query/context/context_service.py:44) │ └── FUNCTION cgis.query.context.context_service.build_context (cgis/query/context/context_service.py:96) └── METHOD cgis.guardian.collector.ContextCollector._graph_sections (cgis/guardian/collector.py:174) ├── METHOD cgis.guardian.collector.ContextCollector.collect_graph_context (cgis/guardian/collector.py:213) └── METHOD cgis.guardian.collector.Conte
f4349eb94dd9OBSERVED · 2026-10-14Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add codegraph-brain -- uvx codegraph-brain==0.28.0
Exposed tools (2)
2 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
cgis_alpha | read | First tool. |
cgis_beta | read | Second tool. |
Trust audit
CAUTIONgrade B · trust 83/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (13 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (25)
curl -fsS http://127.0.0.1:11434/api/version >/dev/null 2>&1 && break
curl -fsS http://127.0.0.1:11434/api/version >/dev/null
==> visitor up: http://127.0.0.1:${BIND_PORT} -> ollama-worker-${WORKER_ID} (loopback only)export GUARDIAN_OLLAMA_HOST=http://127.0.0.1:${BIND_PORT}.pre-commit-config.yaml
.release-please-manifest.json
.env.development
.prettierignore
return hashlib.md5(content.encode("utf-8"), usedforsecurity=False).hexdigest()target. Demonstrated: a symlink to a non-existent .ssh/authorized_keys was
victim = tmp_path / "authorized_keys.jsonl"
_record(tmp_path / "authorized_keys")
target = tmp_path / "secrets" / "authorized_keys"
target = tmp_path / "authorized_keys"
json.dumps({"guardian_sha": "../../etc/passwd", "finder_model": "gemini-2.5-flash"}) + "\n""path", ["/etc/passwd", "../outside.py", "src/../../escape.py", "C:\\windows\\a.py"]
_web_app(tmp_path, {"@components/*": ["../../../outside/*"]})"apps/web/tsconfig.json": _tsconfig(extends="../../tsconfig.base"),
{"baseUrl": "./src"}, extends="../../configs/base.json"export GUARDIAN_OLLAMA_HOST=http://127.0.0.1:11435
@xyflow/react, dagre, html-to-image, react, react-dom, react-error-boundary, zustand, @eslint/js
ui/public/graph.json
CGIS reads source files under the path you point it at. It does not read your SSH keys, cloud credentials, browser data, keychain, clipboard, shell history, or files outside the directory you ingest.
1. **Access.** A read-only clone or a tarball. No production access, no credentials, no environment.
| `scripts/guardian_review.py` (modify) | `--record-finder PATH` |
Gates applied: no_behavioural_pass.
f4349eb94dd9full audit observations/trust-audit/mcp-server/zaebee__codegraph-brain.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-14 | f4349eb94dd9 | CAUTION | B | 83 | first audit |
Questions
What is the codegraph-brain MCP server?
Code graph for AI agents: impact analysis and call tracing over MCP (Python, TypeScript). Local, deterministic, SQLite.
What tools does codegraph-brain expose?
2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is codegraph-brain safe to connect to an agent?
With care. The audit graded it B (83/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does codegraph-brain need?
No credential environment variables were found in its source, so it appears to need none.
How does codegraph-brain run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as graph-debugger at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (f4349eb94dd9), read on 2026-10-14. The repository is watched and re-audited when it changes.