Repository intelligence

colbymchenry/codegraph

A 100% local, high-speed semantic code intelligence platform and MCP server that parses 20+ languages to build an offline knowledge graph of symbols, call paths, and dependencies for AI coding agents.

CLOUDM0N decision

Trust FAIL · 0/100

Good fit if

AI coding agents (such as Claude Code, Cursor, Codex, and GitHub Copilot) requiring precise, structural code context and fast call-path resolution without manual file crawling [1, 2]

Watch out for

Consumes a larger persistent footprint in model context windows over multi-turn sessions (about 80% more retrieval context resident than standard file-reading agents) [4]

Practical intelligence

What matters before you adopt it

Decision first · detail on demand

Problem it solves

The high latency, token consumption, and expensive API fees incurred when AI coding agents perform slow, sequential file-by-file searches (using find/grep/read loops) to reconstruct codebase architecture [17, 24, 25]

Best for

AI coding agents (such as Claude Code, Cursor, Codex, and GitHub Copilot) requiring precise, structural code context and fast call-path resolution without manual file crawling [1, 2]

Software engineers looking to optimize API token budgets and decrease agent execution costs during multi-turn development sessions on large codebases [3, 4]

Main trade-offs

Consumes a larger persistent footprint in model context windows over multi-turn sessions (about 80% more retrieval context resident than standard file-reading agents) [4]

Fails to enable SQLite write-ahead logging (WAL) on older filesystems, network shares, or WSL2 Windows mount drives, leading to potential database blocking [13, 14]

Cannot share a single checkout directory (.codegraph/) concurrently between Windows and WSL without experiencing filesystem locking issues [15]

Why it stands out

Provides significant, benchmark-proven efficiency wins, yielding up to 62% fewer tokens, 44% lower cost, and 88% fewer tool calls [8]

Maintains an always-fresh local index by using native OS file-system events to trigger debounced auto-syncs on file changes [6, 9]

Ensures absolute data privacy with zero external API calls, cloud dependencies, or telemetry leaks [6, 10]

Trust & CVEs

Security evidence without the noise

Trust remains a decision signal; CVEs and scanner evidence explain what is driving the risk.

Security findings

CLOUDM0N scanner findings

Critical

High

Medium

Low

View trust evidence & security findings▼

Why this score

No trust rationale was stored for this scan.

CLOUDM0N findings

CRITICAL

1 critical dependency vulnerability/vulnerabilities reported by npm audit.

HIGH

Remote download piped or chained into a shell requires manual review. 5 sample match(es) found.

HIGH

4 high severity dependency vulnerability/vulnerabilities reported by npm audit.

MEDIUM

Dynamic code execution pattern detected. 5 sample match(es) found.

MEDIUM

The project can spawn operating-system processes; review command construction and input handling. 5 sample match(es) found.

MEDIUM

Broad permission or elevated-command pattern detected. 2 sample match(es) found.

Architecture from code25 modules · 80 edges▼

Structural evidence

Modules and dependency edges extracted from repository code. This is code evidence, not README inference.

Code files

628

Modules

Dependency edges

Core modules

(root)

2 files

__tests__

tests

300 files

assets

1 files

scripts

38 files

site

3 files

src

7 files

src/bin

executables

5 files

src/context

3 files

src/db

database layer

5 files

src/extraction

55 files

src/graph

8 files

src/installer

20 files

Dependency flow

__tests__→src

__tests__→src/bin

__tests__→src/context

__tests__→src/db

__tests__→src/extraction

__tests__→src/graph

__tests__→src/installer

__tests__→src/mcp

__tests__→src/resolution

__tests__→src/search

__tests__→src/sync

__tests__→src/telemetry

__tests__→src/ui

__tests__→src/ui-server

Detected languages

TypeScript · JavaScript · Shell · Rust · C · Go · Scala · C# · SQL · C++ · PHP · Python · Java · Kotlin · Ruby · Swift

Detected frameworks

Vitest

Architecture evidence details

flowchart TD
    %% @colbymchenry/codegraph — high-level architecture (DRAFT, refine me)
    n0["(root) · 2 files"]
    n1["__tests__ · tests · 300 files"]
    n2["assets · 1 file"]
    n3["scripts · scripts · 38 files"]
    n4["site · 3 files"]
    n5["src · 7 files"]
    n6["src/bin · executables · 5 files"]
    n7["src/context · 3 files"]
    n8["src/db · database layer · 5 files"]
    n9["src/extraction · 55 files"]
    n10["src/graph · 8 files"]
    n11["src/installer · 20 files"]
    n12["src/mcp · 23 files"]
    n13["src/resolution · 58 files"]
    n14["src/search · 4 files"]
    n15["src/sync · 5 files"]
    n16["src/telemetry · 1 file"]
    n17["src/ui · UI layer · 5 files"]
    n18["src/ui-server · 34 files"]
    n19["src/upgrade · 3 files"]
    n20["telemetry-dashboard · 9 files"]
    n21["telemetry-worker · 3 files"]
    n22["ui · UI layer · 36 files"]
    n1 --> n5
    n1 --> n6
    n1 --> n7
    n1 --> n8
    n1 --> n9
    n1 --> n10
    n1 --> n11
    n1 --> n12
    n1 --> n13
    n1 --> n14
    n1 --> n15
    n1 --> n16
    n1 --> n17
    n1 --> n18
    n1 --> n19
    n1 --> n22
    n5 --> n7
    n5 --> n8
    n5 --> n9
    n5 --> n10
    n5 --> n12
    n5 --> n13
    n5 --> n14
    n5 --> n15
    n6 --> n5
    n6 --> n8
    n6 --> n9
    n6 --> n11
    n6 --> n12
    n6 --> n14
    n6 --> n15
    n6 --> n16
    n6 --> n17
    n6 --> n18
    n6 --> n19
    n7 --> n5
    n7 --> n8
    n7 --> n9
    n7 --> n10
    n7 --> n14
    n8 --> n5
    n8 --> n9
    n8 --> n14
    n9 --> n5
    n9 --> n8
    n9 --> n13
    n10 --> n5
    n10 --> n8
    n10 --> n9
    n10 --> n12
    n10 --> n14
    n11 --> n5
    n11 --> n15
    n11 --> n16
    n11 --> n19
    n12 --> n5
    n12 --> n9
    n12 --> n10
    n12 --> n13
    n12 --> n14
    n12 --> n15
    n12 --> n16
    n12 --> n19
    n13 --> n5
    n13 --> n8
    n13 --> n9
    n13 --> n14
    n14 --> n5
    n15 --> n5
    n15 --> n9
    n18 --> n5
    n18 --> n8
    n18 --> n9
    n18 --> n10
    n18 --> n13
    n18 --> n14
    n18 --> n15
    n19 --> n11
    n19 --> n12
    n19 --> n17
    class n8 data
    class n3,n6 infra
    class n1 test
    class n17,n22 ui
    classDef data fill:#59a14f,color:#ffffff,stroke:#46803e
    classDef infra fill:#b35c00,color:#ffffff,stroke:#8f4a00
    classDef test fill:#499894,color:#ffffff,stroke:#397975
    classDef ui fill:#4e79a7,color:#ffffff,stroke:#3a5b80

Evidence, security & integrations▼

Integrations

Claude CodeCursorCodex CLIopencodeHermes AgentGemini CLIAntigravity IDEKiro

Security notes

• Operating 100% locally prevents code, file paths, symbol names, and search parameters from leaving the local machine [6, 10]

• The embedded visual web dashboard (codegraph ui) listens exclusively on the local loopback IP (127.0.0.1) and immediately rejects foreign host headers [10]

• Artifacts are built via verified public GitHub Release workflows and include secure SLSA v1.0 Build Level 2 build attestations and OIDC npm provenance statements [38]

Still unknown

• The README does not provide the precise curl or PowerShell command URLs to execute the initial CLI installer, pointing instead to its documentation website [1, 22, 26]

• No resource limits, hardware configuration minimums, or baseline RAM/CPU metrics are documented for workstation builds [29]

• Does not specify which files are automatically audited or tracked inside the local cache directories apart from '.codegraph/codegraph.db' [16]

Adoption guidance▼

Adopt if

+ You run extensive coding sessions on large, multi-language codebases using agents like Claude Code or Cursor and want to minimize model fees and latency [3, 6, 8]

+ You have strict data-privacy constraints that mandate that all indexing and intelligence pipelines remain 100% offline [6, 10]

+ Your codebases combine diverse language boundaries, including hybrid mobile apps (Swift/Objective-C or React Native legacy and Fabric components) [6, 7, 20]

Avoid if

– You run developer sessions in highly constrained context windows and cannot tolerate CodeGraph's 80% higher persistent retrieval context footprints [4]

– You require an entirely cloud-hosted enterprise codebase graph viewer that does not require installing local binaries on developer workstations [6, 10]

How it works & getting started▼

How it works

1.The user installs the standalone CodeGraph CLI which bundles its own runtime [26]

2.The user configures the target development agents to wire up the CodeGraph MCP server [2]

3.The user initializes the codebase index locally, which parses symbols and stores them in a local SQLite database [16, 27]

4.The AI agent queries the CodeGraph MCP server during coding sessions, receiving dense structural paths and code definitions in a single call [2, 17, 28]

5.An integrated file watcher monitors the workspace and incrementally updates the local graph in sub-seconds [9, 29]

Getting started

→ Download and run the installer command specific to your operating system to place CodeGraph on your PATH [26]

→ Open a new terminal session so the CLI command resolves [26]

→ Run the interactive installer to connect CodeGraph to your installed AI agents and register the MCP server [2]

→ Restart your AI agent or IDE to load the newly registered MCP configurations [31]

→ Navigate to your project root folder and index the codebase by running the command: codegraph init [27, 31]

Agent handoff

Use with any agent

JSON API

Alternatives

Nearby repositories worth comparing before adoption.

Compare top options →

codebase-memory-mcp

DeusData/codebase-memory-mcp

Fit

This MCP server transforms how developers interact with codebases by building a persistent knowledge graph that indexes repositories in milliseconds across 155 programming languages. With sub-millisecond query speeds and 99% token reduction, it enables AI coding assistants like Cursor, Claude Code, and Windsurf to understand your entire codebase context without drowning in context windows. Built as a single static binary with zero dependencies, it runs anywhere.

Trust REVIEW · 55

Compare →

graphify

Graphify-Labs/graphify

Fit

Turn any codebase, with its docs, SQL schemas, configs, and PDFs, into a queryable knowledge graph. A /graphify skill for Claude Code, Cursor, Codex, and Gemini CLI: local deterministic AST parsing, every edge explained, no vector store.

Trust REVIEW · 45

Compare →

code-review-graph

tirth8205/code-review-graph

Fit

This project solves the token overhead problem when using Claude Code on large codebases by building a persistent knowledge graph that helps the AI understand only the relevant parts of your code. With impressive metrics like 6.8× fewer tokens on reviews and up to 49× reduction on daily coding tasks, it's a must-have tool for developers working with Claude Code on medium to large-scale projects.

Trust REVIEW · 80

Compare →