Generated banner for CodeGraph
Generated logo for CodeGraph

CodeGraph

Brain app

First committed by colbymchenry

Published in colbymchenry/codegraph. Publisher page

77,372 GitHub stars

What it is

Supercharge AI coding agents with semantic code intelligence — surgical context, fewer tool calls, faster answers. 100% local.
— the description by colbymchenry

AutoGineer overview, from the brain’s own files

CodeGraph is a local-first code intelligence platform that transforms how AI coding agents interact with large codebases. By parsing code into a structured knowledge graph using tree-sitter, it enables agents to perform precise, semantic queries rather than relying on inefficient file-crawling or grep-based searches. It stores symbol definitions, call edges, and dependencies in a local SQLite database, allowing agents to retrieve exact, relevant code snippets and blast-radius summaries in a single round-trip. Designed for seamless integration, it acts as an MCP server that connects to various coding agents, significantly reducing token usage and tool calls while improving the accuracy of agentic code navigation.

How it works

Memory model: Hybrid

AutoGineer overview, from the brain’s own files

CodeGraph operates as a local-first service that indexes a project by parsing source code into a graph of symbols and relationships. It uses tree-sitter for deterministic extraction and stores the resulting data in a local SQLite database. When an agent needs information, it queries this graph via an MCP server to retrieve specific code segments and call paths. The system includes an auto-sync feature that monitors file changes to keep the index updated without manual intervention.

Folders
FolderRoleFiles
.claudeagent-config3
.cursoragent-config1
.githubagent-config2
__tests__tests1045
assetsattachments40
docsdocs76
scriptsscripts75
srcsource-code359
codegraph-kernelfolder59
sitefolder33
telemetry-dashboardfolder22
telemetry-workerfolder18
uifolder97

The agent reads

The agent writes

Requirements

Runtimes: Node.js >=20.0.0 <25.0.0

Databases: Redis, SQLite

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Google Antigravity, Kiro, OpenCode, Amp, Roo Code, Cline, JetBrains Junie, Devin (ex-Windsurf)

Set it up

  1. This brain runs code automatically: 5 scripts. Review README.md, install.ps1, install.sh before opening the folder in Claude Code. No step below turns a hook on for you.

    • README.md: curl -fsSL https://raw.githubusercontent.com/colbymchenry/codegraph/main/install.sh | sh
    • README.md: irm https://raw.githubusercontent.com/colbymchenry/codegraph/main/install.ps1 | iex
    • README.md: - **You're on an old (pre-0.9) install.** Reinstall to get the bundled runtime — `curl -fsSL https://raw.githubusercontent.com/colbymchenry/codegraph/main/install.sh | sh` (macOS/Linux), `irm https://raw.githubusercontent.com/colbymchenry/codegraph/main/install.ps1 | iex` (Windows), or …[+42 chars]
    • install.ps1: pwsh install.ps1
    • install.sh: sh install.sh
  2. Not scanned by AutoGineerIts dependencies are installed by npm when you run it and were not scanned by AutoGineer (6 declared). https://www.npmjs.com/package/@colbymchenry/codegraph
  3. First committed by colbymchenry. Published in colbymchenry/codegraph. Licence: MIT License.

Usage

AutoGineer overview, from the brain’s own files

  • Install the CLI tool to manage project indexing and agent configuration.
  • Initialize a project to build the local knowledge graph.
  • Connect the MCP server to supported AI coding agents.
  • Query the graph using natural language for structural code questions.
“How does the authentication flow work in this project?”
The agent uses codegraph_explore to retrieve the relevant call paths and source code for authentication-related symbols, providing a complete structural overview.
“What is the blast radius of changing this function signature?”
The agent queries the graph to identify all callers and dependent modules, returning a summary of affected files and logic.

Documentation by colbymchenry

<div align="center">

CodeGraph

Already installed? Run codegraph upgrade

Follow @getcodegraph on X for updates.

Supercharge Claude Code, Cursor, Codex, OpenCode, Hermes Agent, Gemini, Antigravity, Kiro, GitHub Copilot, and more with Semantic Code Intelligence

The fastest complete code graph · surgical context · built for how agents actually work · 100% local

<picture> <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/rust-logo-dark.svg?v=1"> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/rust-logo.svg?v=1" height="30" alt="Rust" align="center"> </picture>&nbsp; **Kernel powered by Rust**

Documentation & Website →

Image: npm version Image: License: MIT Image: Self-contained Image: npm provenance Image: Attested builds

Image: Windows Image: macOS Image: Linux

Image: Claude Code Image: Cursor Image: Codex Image: opencode Image: Hermes Agent Image: Gemini Image: Antigravity Image: Kiro Image: GitHub Copilot Image: IBM Bob Image: Factory Droid Image: Windsurf Image: Qwen Code Image: DeepSeek Harness Image: Grok Build Image: Kimi Code Image: Qoder Image: Pi

<br>

The CodeGraph platform is coming — for every PR, know exactly what to test, what could break, which flows are affected, and whether business logic is compromised.

<a href="https://getcodegraph.com"><img alt="Join the waitlist for early beta access" src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/waitlist.svg?v=2" height="52"></a>

<sub>Get <b>early beta access</b> to the hosted product · <a href="https://getcodegraph.com">getcodegraph.com</a></sub>

</div>

Contents

  • Get Started

  • Language Support

  • Why CodeGraph?

  • Key Features

  • Framework-aware Routes

  • Mixed iOS / React Native / Expo bridging

  • Quick Start

  • How It Works

  • CLI Reference

  • MCP Tools

  • Library Usage

  • Configuration

  • Telemetry

  • Verified releases

  • Supported Platforms

  • Supported Agents

  • Supported Languages

  • Measured cross-file coverage

  • Troubleshooting

  • Contributing

  • License

Get Started

1. Install the CLI

No Node.js required — one command grabs the right build for your OS:

# macOS / Linux
curl -fsSL https://raw.githubusercontent.com/colbymchenry/codegraph/main/install.sh | sh

# Windows (PowerShell)
irm https://raw.githubusercontent.com/colbymchenry/codegraph/main/install.ps1 | iex

<details> <summary><b>Already have Node? Use npm instead (works on any version)</b></summary>

npm i -g @colbymchenry/codegraph

<sub>CodeGraph bundles its own runtime — nothing to compile, no native build, works the same everywhere. The installer puts codegraph on your PATH but doesn't change your current shell — open a new terminal before the next step so the command resolves.</sub>

<sub>Upgrade any time with codegraph upgrade — it detects how you installed (bundle, npm, or npx) and updates in place. Add --check to see if an update is available, or codegraph upgrade <version> to pin one.</sub>

</details>

2. Wire up your agent(s)

In a new terminal, run the installer to connect CodeGraph to the agents you use:

codegraph install

<sub>Detects and auto-configures Claude Code, Cursor, Codex CLI, opencode, Hermes Agent, Gemini CLI, Antigravity IDE, Kiro, GitHub Copilot (VS Code, Copilot CLI, JetBrains IDEs), IBM Bob, Factory Droid, Windsurf, Qwen Code, DeepSeek Harness, Grok Build, Kimi Code, Qoder CLI, and Pi — wiring the CodeGraph MCP server into each. This is the step that connects CodeGraph to your agent; installing the CLI in step 1 does not do it on its own. It only wires up your agent — it does not index any code; building each project's graph is the separate codegraph init in step 3. (Shortcut: npx @colbymchenry/codegraph downloads and runs this in one go.)</sub>

3. Initialize each project
cd your-project
codegraph init

<sub>codegraph init creates the local .codegraph/ directory and builds the full graph in the same step — one command, done.</sub>

<div align="center">

Image: 1_C_VYnhpys0UHrOuOgpgoyw

</div>

4. No more syncing!

Auto-sync is enabled by default. CodeGraph watches the project and updates the graph on every file change — while your agent edits code, or you add, modify, or delete files. The index is never stale, and there is nothing to re-run.

Uninstall

Changed your mind? One command removes CodeGraph from every agent it configured and the CLI itself — every install it finds (standalone bundle, npm global package, launcher link), shown to you before anything is deleted:

codegraph uninstall

Pass --keep-cli to remove only the agent configurations and keep the CLI installed.

<sub>Reverses the installer — strips CodeGraph's MCP server config, instructions, and permissions from each configured agent. Your project indexes (.codegraph/) are left untouched; remove those per-project with codegraph uninit. Use --target to remove from specific agents, or --yes to run non-interactively.</sub>


Language Support

Every language below gets the same treatment — full structural extraction and cross-file resolution into one graph, no per-language setup:

<p align="center"> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/typescript.svg?v=1" width="104" height="104" alt="TypeScript" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/javascript.svg?v=1" width="104" height="104" alt="JavaScript" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/arkts.svg?v=1" width="104" height="104" alt="ArkTS" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/python.svg?v=1" width="104" height="104" alt="Python" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/go.svg?v=1" width="104" height="104" alt="Go" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/rust.svg?v=1" width="104" height="104" alt="Rust" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/java.svg?v=1" width="104" height="104" alt="Java" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/csharp.svg?v=1" width="104" height="104" alt="C#" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/php.svg?v=1" width="104" height="104" alt="PHP" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/ruby.svg?v=1" width="104" height="104" alt="Ruby" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/c.svg?v=1" width="104" height="104" alt="C" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/cpp.svg?v=1" width="104" height="104" alt="C++" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/objective-c.svg?v=1" width="104" height="104" alt="Objective-C" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/metal.svg?v=1" width="104" height="104" alt="Metal" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/cuda.svg?v=1" width="104" height="104" alt="CUDA" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/swift.svg?v=1" width="104" height="104" alt="Swift" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/kotlin.svg?v=1" width="104" height="104" alt="Kotlin" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/scala.svg?v=1" width="104" height="104" alt="Scala" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/dart.svg?v=1" width="104" height="104" alt="Dart" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/svelte.svg?v=1" width="104" height="104" alt="Svelte" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/vue.svg?v=1" width="104" height="104" alt="Vue" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/astro.svg?v=1" width="104" height="104" alt="Astro" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/liquid.svg?v=1" width="104" height="104" alt="Liquid" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/delphi.svg?v=1" width="104" height="104" alt="Pascal / Delphi" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/lua.svg?v=1" width="104" height="104" alt="Lua" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/r.svg?v=1" width="104" height="104" alt="R" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/luau.svg?v=1" width="104" height="104" alt="Luau" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/cfml.svg?v=1" width="104" height="104" alt="CFML" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/cobol.svg?v=1" width="104" height="104" alt="COBOL" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/vbnet.svg?v=1" width="104" height="104" alt="Visual Basic .NET" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/erlang.svg?v=1" width="104" height="104" alt="Erlang" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/solidity.svg?v=1" width="104" height="104" alt="Solidity" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/terraform.svg?v=1" width="104" height="104" alt="Terraform / OpenTofu" /> <img src="https://raw.githubusercontent.com/colbymchenry/codegraph/main/assets/languages/nix.svg?v=1" width="104" height="104" alt="Nix" /> </p>

<sub>Per-language details — extensions, frameworks, and what exactly gets extracted — in Supported Languages.</sub>


Why CodeGraph?

When an AI agent needs to understand code — to answer a question or make a change — it discovers structure the slow way: grep, glob, and Read, one file at a time, rebuilding call paths and dependencies by hand. That's a pile of tool calls and round-trips before it even starts the real work.

CodeGraph hands the agent the exact code it needs in one call. It's a pre-built knowledge graph of every symbol, call edge, and dependency in your codebase — so instead of crawling files, the agent asks one question and gets back the relevant source, the call paths between those symbols (including dynamic-dispatch hops grep can't follow), and the blast radius of a change. Surgical context, not a file-by-file search — which means fewer tool calls and faster answers on every codebase, large or small.

<img width="1536" height="1024" alt="token-cost-savings-scale" src="https://github.com/user-attachments/assets/eb74a11a-a3ab-4b01-80a6-19f78352ae8e" />

A note on cost: CodeGraph's win on every codebase is precision — the agent stops crawling files and answers from the graph. On current models that precision is also a large direct saving: the 2026-08 re-measurement, on a harness that blocks the CLI in both arms, put it at 44% lower cost and 62% fewer tokens on average across the seven benchmark repos, because a strong model without the graph burns its budget re-deriving structure. Cost tracks how much discovery a question demands more than raw repo size: 57–78% on questions the file-reading agent needed 28–43 tool calls to answer, near-even where it got there in 7.

A note on context: the numbers above measure throughput — tokens processed, tools called, dollars spent to reach one answer. They don't measure what is still sitting in your context window afterward, and on that axis CodeGraph costs more, not less. Across the same seven repos in multi-turn sessions, CodeGraph's responses leave about 80% more retrieval context resident at the end of a session than a file-reading agent's do — on VS Code, 67k tokens against 18k. The mechanism is the same one that makes it fast: CodeGraph returns one dense, verbatim payload that answers the question and then stays in the window, where a grep-and-read agent churns through many small results that get evicted. Fewer tokens processed and a larger persistent footprint are both real at once. If you run long sessions in a small window, budget for it. Measured per-repo: docs/benchmarks/residual-context-occupancy.md.

Benchmark Results

Tested across 7 real-world open-source codebases spanning 7 languages, comparing an agent (Claude Code, headless) answering one architecture question with and without CodeGraph, at the median of 4 runs per arm. Re-measured 2026-08-05 on Claude Opus 4.8 against the current build, on a harness that blocks the codegraph CLI in both arms — contamination row: 0 of 28 without-arm runs.

The universal win — every repo, every size: 88% fewer tool calls · 53% faster · 62% fewer tokens · 44% cheaper · file reads cut to zero on all seven repos.

With the index available, the agent answers from one to four codegraph_explore calls and stops. Without it, the agent burns its budget on discovery — up to 43 tool calls and 19 file reads re-deriving what the graph already knew. Every repo was faster with CodeGraph in this measurement — by 35% on the narrowest question, by 3.6× on the widest.

CodebaseLanguageTool callsTimeFile readsTokensCost
VS CodeTypeScript · ~11k files2 vs 282.2× faster (58s vs 2m 10s)0 vs 1277% fewer71% cheaper
ExcalidrawTypeScript · ~6402 vs 433.6× faster (45s vs 2m 42s)0 vs 1884% fewer78% cheaper
DjangoPython · ~3k3 vs 1435% faster (54s vs 1m 23s)0 vs 8.541% fewer13% cheaper¹
TokioRust · ~7903 vs 292.6× faster (1m 3s vs 2m 43s)0 vs 1965% fewer64% cheaper
OkHttpJava · ~6451 vs 643% faster (33s vs 58s)0 vs 254% fewer21% cheaper
GinGo · ~1101 vs 739% faster (28s vs 46s)0 vs 452% fewer~even¹
AlamofireSwift · ~1104 vs 332.6× faster (54s vs 2m 22s)0 vs 16.559% fewer57% cheaper

<sub>¹ Cost tracks how much discovery the question demanded, which is why it varies far more than the other columns: 57–78% on repos where the file-reading arm needed 28–43 tool calls, but only 13% on Django and even on Gin, where it got there in 14 and 7. The with-arm still answered in 3 and 1 calls with zero file reads. File reads = median files opened — the surgical-context win in one column: the agent never reads a file on any of the seven repos when CodeGraph is present.</sub>

<details> <summary><strong>Per-repo breakdown — WITH vs WITHOUT (median of 4)</strong></summary>

CodebaseMetricWITH cgWITHOUT cg
VS CodeTime / Tools / Tokens / Cost58s / 2 / 155k / $0.532m 10s / 28 / 670k / $1.80
ExcalidrawTime / Tools / Tokens / Cost45s / 2 / 156k / $0.542m 42s / 43 / 991k / $2.43
DjangoTime / Tools / Tokens / Cost54s / 3 / 183k / $0.551m 23s / 14 / 309k / $0.63
TokioTime / Tools / Tokens / Cost1m 3s / 3 / 201k / $0.662m 43s / 29 / 573k / $1.83
OkHttpTime / Tools / Tokens / Cost33s / 1 / 107k / $0.3958s / 6 / 230k / $0.50
GinTime / Tools / Tokens / Cost28s / 1 / 87k / $0.3146s / 7 / 180k / $0.31
AlamofireTime / Tools / Tokens / Cost54s / 4 / 209k / $0.542m 22s / 33 / 505k / $1.27

</details>

<details> <summary><strong>Full benchmark details</strong></summary>

Methodology. Each arm is claude -p (Claude Opus 4.8, claude-opus-4-8) run headlessly against the repo with --strict-mcp-config: WITH = CodeGraph's MCP server enabled, WITHOUT = an empty MCP config. Built-in Read/Grep/Bash stay available to both. Same question per repo, 4 runs per arm, median reported. Cost = the run's total_cost_usd; Tokens = total tokens processed, summed per assistant turn (input incl. cache reads + cache creation + output); Time = wall-clock; Tool calls = every tool invocation, including those inside any sub-agents the model spawns. Repos cloned at --depth 1 and indexed by the same CodeGraph build that served them. Re-measured 2026-08-05 on the current build.

The codegraph CLI is blocked in both arms. A sanitized PATH plus a PreToolUse hook denies any Bash invocation of the CLI, in the WITHOUT arm as well as the WITH arm. This matters: without that block the control arm is not a control. On an unblocked harness we measured the WITHOUT agent finding the CLI on PATH and reaching CodeGraph through Bash in 26 of 28 runs — which distorts the comparison in both directions, since a CLI call is not counted as a tool call and its output still enters the window. Earlier published figures were produced without this block. In the run reported above, all 28 WITHOUT runs attempted the CLI and all 28 were blocked — 0 contaminated.

Queries:

CodebaseQuery
VS Code"How does the extension host communicate with the main process?"
Excalidraw"How does Excalidraw render and update canvas elements?"
Django"How does Django's ORM build and execute a query from a QuerySet?"
Tokio"How does tokio schedule and run async tasks on its runtime?"
OkHttp"How does OkHttp process a request through its interceptor chain?"
Gin"How does gin route requests through its middleware chain?"
Alamofire"How does Alamofire build, send, and validate a request?"

Why CodeGraph wins: with the index available, the agent answers directly — usually one codegraph_explore returns the relevant source — and stops, with zero file reads on every benchmark repo. Without it, the agent spends most of its budget on discovery (find/ls/grep) before reading the right code. CodeGraph only helps when queried directly, so its instructions steer agents to answer directly rather than delegate exploration to file-reading sub-agents — otherwise a sub-agent reads files regardless and CodeGraph becomes overhead.

</details>


Built for speed — the Rust kernel

CodeGraph's parsing engine is a native Rust kernel: 20 languages — TypeScript, JavaScript, Java, Python, Go, C, C++, Rust, C#, Ruby, PHP, Swift, Kotlin, Scala, Dart, R, Lua, Luau (Metal and CUDA ride the C++ path) — parse in compiled code with one boundary crossing per file. Every language shipped only after its graphs proved byte-for-byte identical to the reference engine on real repositories, from small libraries up to the Linux kernel; platforms without a prebuilt binary and files with syntax errors fall back per-file automatically, same graph either way.

And it scales itself to the machine it's on. Worker pools, parallel resolution, and analysis caches are sized from what the system actually has — real core counts (container/cgroup-aware, so a VPS that grants 2 cores gets sized for 2, not the host's 64), honestly-measured available RAM on macOS and Linux, and the measured cost of your project's resolution work:

  • On a workstation: the full parallel pipeline — native parse workers, a multi-worker resolver pool that engages the moment it pays for itself, memory-gated analysis caches. The Swift compiler repository (27k files of Swift and C++) fresh-indexes in about 100 seconds; a one-file edit re-syncs in ~4.

  • On a 2-core / 6GB VPS: the same graph, from a pipeline tuned to finish — the Linux kernel (70k files, 2M symbols, 6.4M relationships) indexes to completion in under 12 minutes where RAM-first designs run out of memory before reaching 1%.

  • Every day after day one: saving a file updates the graph in well under a second — the watcher fires 300ms after a lone save and syncs exactly what changed (~0.3s of work on a 4,400-file project, ~0.4s on the 27,000-file Swift compiler repo), never re-scanning the tree. Measured against the fastest competing indexer's re-index-on-change: 2–7× faster on medium and larger repos across a 31-repo, 30-language benchmark — and the gap widens with repo size, because their cost grows with the repository and ours grows with the change.


Key Features

Native Rust KernelParsing and extraction run in a compiled Rust engine for 20 languages — with graphs verified byte-for-byte identical to the reference engine, and automatic per-file fallback so nothing ever breaks
Adapts to Your MachineSizes its worker pools and caches from what the system actually has — real core counts (container-aware), honest available RAM, measured per-project cost. A workstation gets the full parallel pipeline; a 2-core VPS gets one tuned to finish reliably
Surgical ContextOne tool call returns entry points, related symbols, and code snippets — no slow file-by-file exploration
Full-Text SearchFind code by name instantly across your entire codebase, powered by FTS5
Impact AnalysisTrace callers, callees, and the full impact radius of any symbol before making changes
Always FreshFile watcher uses native OS events (FSEvents/inotify/ReadDirectoryChangesW) with debounced auto-sync — the graph stays current as you code, zero config
20+ LanguagesTypeScript, JavaScript, ArkTS, Python, Go, Rust, Java, C#, VB.NET, PHP, Ruby, C, C++, CUDA, Objective-C, Metal, Swift, Kotlin, Scala, Dart, Lua, Luau, R, Nix, Erlang, CFML, COBOL, Solidity, Terraform/OpenTofu, Svelte, Vue, Astro, Liquid, Pascal/Delphi
Framework-aware RoutesRecognizes web-framework routing files and links URL patterns to their handlers across 17 frameworks
Mixed iOS / React Native / ExpoCloses cross-language flows that static parsing misses: Swift ↔ ObjC bridging, React Native legacy bridge + TurboModules + Fabric view components, native → JS event emitters, Expo Modules
TauriFollows a desktop app across its web frontend and Rust core: invoke('save_file'), tauri-specta's typed commands.saveFile(), your own wrappers around invoke, and events in both directions
100% LocalNo data leaves your machine. No API keys. No external services. SQLite database only

<details> <summary><strong>How auto-syncing works — and why you don't need to run <code>codegraph sync</code> manually</strong></summary>

When your agent (Claude Code, Cursor, Codex, opencode) launches codegraph serve --mcp, three layers keep the index in step with your code — and make sure the agent never gets a silent wrong answer in the brief window between an edit and the next sync:

  1. File watcher with debounced auto-sync. A native FSEvents / inotify / ReadDirectoryChangesW watcher captures every source-file create / modify / delete and triggers a re-index after a debounce window (default 2000ms, tunable via CODEGRAPH_WATCH_DEBOUNCE_MS, clamped to [100ms, 60s]). Bursts of edits collapse into a single sync. On a large TypeScript or Vue repo nearly every edit also asks for a repo-wide rebuild of the synthesized callback and event edges; CODEGRAPH_SYNTH_MIN_INTERVAL_MS (1s to 24h) bounds how often that runs, and a rebuild a sync puts off runs when the interval is up. Until then those edges can be that far behind the code, and tool output doesn't say so.

  2. Per-file staleness banner. During the brief debounce window, MCP tool responses that would reference a still-pending file prepend a ⚠️ banner naming it and telling the agent to Read it directly. Pending files NOT referenced by the response surface as a small footer instead. Either way, the agent gets an explicit signal — validated with Claude Code, where the agent literally says "Reading the file directly for the live content" before opening it.

  3. Connect-time catch-up. When the MCP server (re)connects, codegraph runs a fast (size, mtime) + content-hash reconciliation against the working tree before answering the first query — so edits made while no MCP server was running (a git pull from the terminal, edits from another editor, a previous agent session that exited) get absorbed on the next session's first tool call.

agent writes src/Widget.ts
  → watcher fires (<100ms)
  → debounce (default 2s)
  → sync; Widget.ts is in the index
  → next agent query sees it

Verify any time with codegraph status (CLI). If anything is pending, you'll see a ### Pending sync: section naming the files and their edit age.

The handful of cases where manual codegraph sync makes sense: the watcher is disabled (sandboxed environments, or CODEGRAPH_NO_DAEMON=1), or you're scripting against the index outside an agent session and want a pre-flight sync at the start of your script.

→ Full deep-dive in Guides → Indexing a Project.

</details>


Framework-aware Routes

CodeGraph detects web-framework routing files and emits route nodes linked by references edges to their handler classes or functions. Querying callers of a view/controller now surfaces the URL pattern that binds it.

FrameworkShapes recognized
Djangopath(), re_path(), url(), include() in urls.py (CBV .as_view(), dotted paths)
Flask@app.route('/path', methods=[...]), blueprint routes
FastAPI@app.get(...), @router.post(...), all standard methods
Expressapp.get(...), router.post(...) with middleware chains
NestJS@Controller + @Get/@Post/... (with RouterModule prefixes, setGlobalPrefix and URI versioning), GraphQL @Resolver + @Query/@Mutation, @MessagePattern/@EventPattern, @SubscribeMessage
LaravelRoute::get(), Route::resource(), Controller@action, tuple syntax
Drupal*.routing.yml routes (_controller, _form, entity handlers); hook_* implementations in .module/.theme/.install/.inc and #[Hook] methods; *.services.yml services, and calls through \Drupal::service(); plugin definitions, as attributes or annotations
CodeIgniter 3Every public controller method by convention, $route[...] in routes.php, HMVC modules; $this->load models, libraries and views
Railsget '/x', to: 'users#index', hash-rocket => syntax
Spring@GetMapping, @PostMapping, @RequestMapping on methods
PlayGET/POST/… verb routes in conf/routes → Controller.method actions (Scala + Java)
Gin / chi / gorilla / muxr.GET(...), router.HandleFunc(...)
Axum / actix / Rocket.route("/x", get(handler))
ASP.NET[HttpGet("/x")] attributes on action methods
Vaporapp.get("x", use: handler)
Astrosrc/pages/ file-based routes (.astro pages + .ts endpoints, [param]/[...rest] syntax)
Routers — routes and the navigation between them

These frameworks additionally emit navigates edges: the function that sends a user somewhere is linked to the screen it names, so "where does tapping this go" is one hop in the graph rather than a search. Each reads a literal destination — a computed one, or a path no route serves, is left unresolved rather than guessed — and a link written in markup is marked as inferred.

RouterRoutes fromNavigation from
Expo RouterEvery screen file under app/ (app/item/[id].tsx → /item/[id], groups stripped), bound to its default-export component; +api files are endpoints (GET /hello) bound to their handlersrouter.push / replace / navigate, template hrefs, { pathname } objects, and a helper's returned href
Next.jsApp Router app/**/page.tsx and Pages Router pages ((group) stripped, [slug] → :slug); app/api/**/route.ts exports and pages/api/* are endpoints, not screensrouter.push / replace / prefetch, redirect() / permanentRedirect() in a server action or page, NextResponse.redirect(new URL(…)) in middleware, <Link href> and internal <a href>
React Router<Route path component/element> (v5 and v6) and createBrowserRouter([{ path, element }])history.push / replace, useNavigate's navigate, a loader's redirect, <Link to> / <NavLink to> / <Navigate to> / v5's <Redirect to> / react-router-bootstrap's <LinkContainer to>, and a styled(Link) wrapper
TanStack RoutercreateFileRoute('/posts/$postId') (file-based) and createRoute({ path, getParentRoute }) composed up its parent chain (code-based); _pathless segments, (group) folders, __root and <Outlet/> layouts are not addressesnavigate({ to }), a thrown redirect({ to }), <Link to> / <Navigate to> — where to is the route PATTERN and the values ride beside it in params
Vue Router / NuxtcreateRouter({ routes: [...] }) / new Router(...) and the route tables it's given (export const constantRoutes = [...], per-module route files), with the view each entry names — a lazy () => import(…) bound to its file — and children joined onto their parent's path, the parent being the layout around them; plus Nuxt pages/ file-based routes, server/api/ endpoints and route middlewarerouter.push / replace, this.$router.push, Nuxt's navigateTo, <router-link> / <RouterLink> / <NuxtLink> — by route name (push({ name: 'profile' })) as well as by path
SvelteKitsrc/routes/**/+page.svelte ([slug] → :slug, [[opt]] → :opt?, [id=matcher] → :id, (group) folders stripped), joined to the +page.server.js beside it so a loader's guard belongs to its pagegoto('/x'), redirect(status, '/x') from a load or form action, and the plain <a href> that is a link in a SvelteKit app
AngularRoutes arrays (RouterModule.forRoot / forChild, provideRouter, a routes file's default export) with component or a lazy loadComponent; children and lazy loadChildren (an NgModule's through its routing module) joined into full paths; paths written as route constants or $localize strings; a route with children is a layout around the screens inside itrouter.navigate([...]), navigateByUrl, a guard's createUrlTree / parseUrl — a command array, a route constant, or a component property holding one — routerLink / [routerLink] in the component's template, and redirectTo. Each template's child components (<app-foo>) are linked to the component that renders them

In a repository holding several apps, each app's routes are matched only against navigation written inside that app.


Mixed iOS / React Native / Expo bridging

Real iOS and React Native codebases live across multiple languages — a Swift caller invokes an Objective-C selector that's been auto-bridged, a JS file calls into a native module via the React Native bridge, a JSX component delegates to a native view manager. Static tree-sitter extraction stops at each language boundary. CodeGraph bridges them so codegraph_explore connects the flow end-to-end across the gap — call paths and blast radius cross the boundary instead of stopping at it.

BoundaryJS / Swift sideNative sideHow
Swift → ObjCSwift obj.foo(bar:)ObjC selector -fooWithBar:@objc auto-bridging rules (including init/property/protocol forms) + Cocoa preposition prefixes (With/For/By/In/On/At/…)
ObjC → SwiftObjC [obj fooWithBar:]Swift @objc func foo(bar:)Reverse-bridge name candidates; verifies @objc exposure from source
React Native legacy bridgeJS NativeModules.X.fn(...)ObjC RCT_EXPORT_METHOD / RCT_REMAP_METHOD · Java/Kotlin @ReactMethodParses macro/annotation declarations to build a JS-name → native-method map
React Native TurboModulesJS import M from './NativeM'; M.fn(...)Native impl matching the Codegen specTreats the Native<X>.ts spec interface as ground truth
RN native → JS eventsJS new NativeEventEmitter(...).addListener('e', cb)ObjC [self sendEventWithName:@"e" body:...] · Swift sendEvent(withName: "e", ...) · Java/Kotlin .emit("e", ...)Synthesized cross-language event channel keyed by literal event name
Expo ModulesJS requireNativeModule('X').fn(...), directly or through a binding (export default requireNativeModule<T>('X'))Swift / Kotlin Module { Name("X"); AsyncFunction("fn") { ... } }Parses the Expo DSL literals into method nodes; a call on a binding resolves to module X's fn on both platforms, else to the method on the binding's declared type
Fabric view componentsJSX <MyView prop={v}/>TS Codegen spec + native impl classSpec → component node; convention-based name+suffix lookup (View/ComponentView/Manager/ViewManager) bridges to native
Legacy Paper view managersJSX <MyView prop={v}/>, through a requireNativeComponent('X') moduleObjC RCT_EXPORT_VIEW_PROPERTY · Java/Kotlin @ReactPropSame as Fabric — requireNativeComponent('X') is a JS component node, and Paper-era declarations also produce component + property nodes

Validated on real codebases (small + medium + large for each bridge):

BridgeSmallMediumLarge
Swift ↔ ObjCChartsrealm-swiftWikipedia-iOS
RN legacy bridgeAsyncStoragereact-native-svgreact-native-firebase
RN native → JS eventsRNGeolocation—react-native-firebase
Expo Modulesexpo-hapticsexpo-cameraexpo SDK sweep (7 packages)
Fabric / Paper viewsreact-native-segmented-controlreact-native-screensreact-native-skia

Every bridge hop says how it got into the graph. A hop matched by a bridge resolver carries metadata.resolvedBy: 'framework' and metadata.framework naming the resolver (swift-objc-bridge, react-native-bridge, expo-modules-js, fabric-view). A synthesized channel is tagged provenance:'heuristic' with metadata.synthesizedBy (rn-event-channel, fabric-native-impl).


Quick Start

1. Run the Installer
npx @colbymchenry/codegraph

The installer will:

  • Ask which agent(s) to configure — auto-detects installed ones from: Claude Code, Cursor, Codex CLI, opencode, Hermes Agent, Gemini CLI, Antigravity IDE, Kiro, GitHub Copilot (VS Code, Copilot CLI, JetBrains IDEs), IBM Bob, Factory Droid, Windsurf, Qwen Code, DeepSeek Harness, Grok Build, Kimi Code, Qoder CLI, and Pi

  • Prompt to install codegraph on your PATH (so agents can launch the MCP server)

  • Ask whether configs apply to all your projects or just this one

  • Write each chosen agent's MCP server config, plus a small marker-fenced CodeGraph section in the agent's instructions file (CLAUDE.md / AGENTS.md / GEMINI.md / QWEN.md) — that's how subagents and non-MCP agents learn the codegraph explore command, since the MCP server's own guidance only reaches the main agent. Removed cleanly by codegraph uninstall.

  • Set up auto-allow permissions when Claude Code or Qwen Code is one of the targets

The installer wires up your agents only — it does not index your code. After it finishes, build each project's graph yourself with codegraph init (step 3). One global codegraph install covers every project; you run codegraph init once per project.

Non-interactive (scripting / CI):

codegraph install --yes                              # auto-detect agents, install global
codegraph install --yes --init                       # same, then build the current project's index (one-shot bootstrap)
codegraph install --target=cursor,claude --yes       # explicit target list
codegraph install --target=auto --location=local     # detected agents, project-local
codegraph install --target=copilot-vscode,copilot-cli,copilot-jetbrains --yes  # GitHub Copilot everywhere
codegraph install --print-config codex               # print snippet, no file writes
codegraph install --print-config copilot-vscode      # same, for Copilot in VS Code
FlagValuesDefault
--targetauto, all, none, or csv (claude,cursor,...)prompt
--locationglobal, localprompt
--yes(boolean)prompt every step
--init(boolean) run codegraph init in the current directory after wiring agents—
--no-permissions(boolean) skip the auto-allow list (Claude Code, Qwen Code)permissions on
--print-config <id>dump snippet for one agent and exit—
2. Restart Your Agent

Restart your agent (Claude Code / Cursor / Codex CLI / opencode / Hermes Agent / Gemini CLI / Antigravity IDE / Kiro / VS Code, the Copilot CLI, or your JetBrains IDE for GitHub Copilot / IBM Bob / Factory Droid / Windsurf / Qwen Code / DeepSeek Harness / Grok Build / Kimi Code / Qoder CLI / Pi) for the MCP server to load.

3. Initialize Projects
cd your-project
codegraph init

Builds the per-project knowledge graph index, which then auto-syncs on every file change. A single global codegraph install works in every project you open — no need to re-run the installer per project. Add --yes to skip every prompt (scripts / CI / container bootstraps).

That's it — your agent will use CodeGraph tools automatically when a .codegraph/ directory exists.

<details> <summary><strong>Manual Setup (Alternative)</strong></summary>

Install globally:

npm install -g @colbymchenry/codegraph

Add to ~/.claude.json:

{
  "mcpServers": {
    "codegraph": {
      "type": "stdio",
      "command": "codegraph",
      "args": ["serve", "--mcp"],
      "alwaysLoad": true
    }
  }
}

alwaysLoad keeps codegraph_explore loaded from the first prompt. Claude Code otherwise defers every MCP tool behind a tool-search step, so a fresh session sees only the tool's name until the model searches for it.

Add to ~/.claude/settings.json (optional, for auto-allow):

{
  "permissions": {
    "allow": [
      "mcp__codegraph__*"
    ]
  }
}

<sub>One wildcard auto-approves every CodeGraph tool — codegraph_explore is the only one listed by default, but if you re-enable others via CODEGRAPH_MCP_TOOLS they're already permitted, no prompt.</sub>

</details>

<details> <summary><strong>Agent Tool Guidance</strong></summary>

CodeGraph's MCP server delivers its usage guidance to your agent automatically, in the MCP initialize response. In short, it tells the agent to:

  • Answer structural questions directly with CodeGraph — it is the pre-built index, so a grep/read loop just repeats work it already did. Treat the returned source as already read.

  • Reach for codegraph_explore for almost anything — "how does X work", a flow/"how does X reach Y", or surveying an area. One call returns the relevant symbols' verbatim source grouped by file, the call paths between them (dynamic-dispatch hops included), and a blast-radius summary. Name a file or symbol in the query to read its current line-numbered source.

  • Trust the results — don't re-verify with grep, and check the staleness banner after edits.

  • Works per project: query any project that has a .codegraph/ index by passing projectPath — so a monorepo where only some services are indexed, or a second repo, works in one session. A path with no index returns clean guidance to use built-in tools; indexing stays your decision.

The exact text is src/mcp/server-instructions.ts — the single source of truth for the main agent. Because subagents and non-MCP harnesses never see the MCP guidance, the installer also writes a short marker-fenced section into the agent's instructions file pointing at the codegraph explore CLI equivalent.

</details>


How It Works

┌───────────────────────────────────────────────────────────────────┐
│                            Claude Code                            │
│                                                                   │
│   "How does a request reach the database?"                        │
│       calls CodeGraph tools directly — no Explore sub-agent       │
│                                 │                                 │
└─────────────────────────────────┬─────────────────────────────────┘
                                  │
                                  ▼
┌───────────────────────────────────────────────────────────────────┐
│                        CodeGraph MCP Server                       │
│                                                                   │
│ explore  ·  one call → verbatim source + call flow + blast radius │
│                                 │                                 │
│                                 ▼                                 │
│                       SQLite knowledge graph                      │
│          symbols · edges · files · FTS5 full-text search          │
└───────────────────────────────────────────────────────────────────┘
  1. Extraction — a native Rust kernel parses source with tree-sitter grammars compiled into it, extracting nodes (functions, classes, methods) and edges (calls, imports, extends, implements) for 20 languages; remaining languages and per-file fallbacks use the same extraction logic on the portable engine, producing identical graphs.

  2. Storage — Everything goes into a local SQLite database (.codegraph/codegraph.db) with FTS5 full-text search.

  3. Resolution — After extraction, references are resolved: function calls → definitions, imports → source files, class inheritance, and framework-specific patterns.

  4. Auto-Sync — The MCP server watches your project using native OS file events. Changes are debounced (2-second quiet window), filtered to source files only, and incrementally synced. The graph stays fresh as you code — no configuration needed.


CLI Reference

codegraph                         # Run interactive installer
codegraph install                 # Run installer (explicit)
codegraph uninstall               # Remove CodeGraph from your agents AND the CLI (--keep-cli for configs only)
codegraph init [path]             # Initialize a project + build its graph (one step; --local-only keeps .codegraph/ out of git)
codegraph uninit [path]           # Remove CodeGraph from a project (--force to skip prompt)
codegraph index [path]            # Full index (--force to re-index, --quiet for less output)
codegraph sync [path]             # Incremental update
codegraph status [path]           # Show statistics (--json, --strict)
codegraph unlock [path]           # Remove a stale lock file that's blocking indexing
codegraph query <search>          # Search symbols (--kind, --limit, --json)
codegraph explore <query>         # Relevant symbols' source + call paths in one shot (same output as the codegraph_explore MCP tool)
codegraph node <symbol|file>      # One symbol's source + callers, or read a file with line numbers (same output as codegraph_node)
codegraph files [path]            # Show file structure (--format, --filter, --max-depth, --tests, --json)
codegraph callers <symbol>        # Find what calls a function/method (--limit, --json)
codegraph callees <symbol>        # Find what a function/method calls (--limit, --json)
codegraph impact <symbol>         # Analyze what code is affected by changing a symbol (--depth, --json)
codegraph implementations <symbol> # List the types that implement or extend a type (--depth, --json)
codegraph affected [files...]     # Find test files affected by changes (see below)
codegraph cycles [path]           # List circular imports between files (--json); exits 1 when there are any
codegraph daemon                  # Manage background daemons — pick one to stop (alias: daemons)
codegraph telemetry [on|off]      # Show or change anonymous usage telemetry
codegraph upgrade [version]       # Update to the latest release (--check, --force)
codegraph version                 # Print the installed version (also -v, --version)
codegraph help [command]          # Show help, optionally for one command
codegraph affected

Traces import dependencies transitively to find which test files are affected by changed source files.

codegraph affected src/utils.ts src/api.ts         # Pass files as arguments
git diff --name-only | codegraph affected --stdin   # Pipe from git diff
codegraph affected src/auth.ts --filter "e2e/*"     # Custom test file pattern
OptionDescriptionDefault
--stdinRead file list from stdinfalse
-d, --depth <n>Max dependency traversal depth5
-f, --filter <glob>Custom glob to identify test filesauto-detect
-j, --jsonOutput as JSONfalse
-q, --quietOutput file paths onlyfalse

CI/hook example:

#!/usr/bin/env bash
AFFECTED=$(git diff --name-only HEAD | codegraph affected --stdin --quiet)
if [ -n "$AFFECTED" ]; then
  npx vitest run $AFFECTED
fi

MCP Tools

When running as an MCP server, CodeGraph exposes a single tool — codegraph_explore. Measured agent behavior showed that one strong tool steers agents better than a menu of narrower ones — fewer mis-picks, and it saves context every session:

ToolPurpose
codegraph_exploreAnswer almost any question in one call — "how does X work", a flow ("how does X reach Y"), or surveying an area — returning the relevant symbols' verbatim source grouped by file, plus the call paths between them and a blast-radius summary. Surfaces dynamic-dispatch hops (callbacks, React re-render, interface→impl) grep can't follow. Name a file or symbol in the query to read its current line-numbered source, the same shape the Read tool gives you.

The other tools (codegraph_node, codegraph_search, codegraph_callers, codegraph_callees, codegraph_impact, codegraph_files, codegraph_status) stay fully functional but unlisted by default — everything they return already arrives inline on codegraph_explore (its blast-radius section, the relationship map, a symbol's body as its callee list). Re-enable any of them for the MCP surface with the CODEGRAPH_MCP_TOOLS environment variable (e.g. CODEGRAPH_MCP_TOOLS=explore,node,search,callers), or use their CLI equivalents (codegraph node / query / callers / callees / impact / files / status).

Even when the server's own root has no .codegraph/ index, the tools stay available: pass projectPath to query any indexed project — a sub-service in a monorepo, or a second repo — in the same session. A path that has no index returns clean guidance to use built-in tools instead, so nothing fails loudly, and indexing stays your decision.


Library Usage

CodeGraph can be embedded directly. The npm package re-exports its programmatic API, so both import and require resolve the CodeGraph class in your own process — handy for embedding it in an app (e.g. an Electron main process).

import CodeGraph from '@colbymchenry/codegraph';
// CommonJS works too:
//   const { CodeGraph } = require('@colbymchenry/codegraph');

const cg = await CodeGraph.init('/path/to/project');
// Or: const cg = await CodeGraph.open('/path/to/project');

await cg.indexAll({
  onProgress: (p) => console.log(`${p.phase}: ${p.current}/${p.total}`)
});

const results = cg.searchNodes('UserService');
const callers = cg.getCallers(results[0].node.id);
const context = await cg.buildContext('fix login bug', { maxNodes: 20, includeCode: true, format: 'markdown' });
const impact = cg.getImpactRadius(results[0].node.id, 2);

cg.watch();   // auto-sync on file changes
cg.unwatch(); // stop watching
cg.close();

Lower-level building blocks are exported from the same entry point for callers that drive the graph directly: DatabaseConnection, QueryBuilder, getDatabasePath, initGrammars / loadGrammarsForLanguages, and FileLock.

Embedding requirements

  • Install from npm (npm i @colbymchenry/codegraph) so the matching per-platform package — which carries the compiled library and its dependencies — is fetched alongside the shim.

  • The API runs on your runtime, so it needs Node 22.5+ for the built-in node:sqlite (Electron qualifies when its bundled Node is 22.5+). The CLI and MCP server are unaffected — they run on the self-contained bundled runtime.

  • TypeScript types ship with the package. As with any Node-targeting library, keep @types/node available and skipLibCheck: true (the common default).


Configuration

Next to none — CodeGraph is zero-config by default, with nothing to write or keep in sync to get started. Language support is automatic from the file extension; there's nothing to wire up per language. The one optional file is for mapping custom file extensions.

What it skips out of the box:

  • Dependency, build, and cache directories — node_modules, vendor, dist, build, target, .venv, Pods, .next, and the like across every supported stack — so the graph is your code, not third-party noise. This holds even with no .gitignore. A build folder inside src/ is the exception: no build step writes TypeScript, JSX, Vue, Svelte, Astro, Go, C# or Rust files into one, so those are indexed from it, and a Java, Kotlin or Scala package named build is indexed whole.

  • Anything in your .gitignore — honored in git repos via git, and in non-git projects by reading .gitignore directly (root and nested).

  • Files larger than 1 MB — generated bundles, minified JS, vendored blobs.

To keep something else out, add it to .gitignore. To pull a default-excluded directory back in (say you really do want a vendored dependency indexed), add a negation — !vendor/. The defaults apply uniformly, so committing a dependency or build directory doesn't force it into the graph; the .gitignore negation is the explicit opt-in.

.gitignore can't drop a directory you've committed, though. For a vendored theme or SDK that's checked into the repo (e.g. a Metronic theme under static/), list it under exclude in codegraph.json — gitignore-style patterns, matched against repo-root-relative paths, honored on index, sync, and watch:

{
  "exclude": ["static/", "**/vendor/**"]
}

Conversely, when real source is gitignored on purpose — a project under a second VCS (SVN, Perforce) that .gitignores its own source so it stays out of Git — force it back in with include (the opposite of exclude; includeIgnored only revives embedded git repos, not plain source):

{
  "include": ["Tools/", "Local/typescript/"]
}

CodeGraph discovers those files off disk, overriding .gitignore, on index, sync, and watch. An explicit exclude still wins, and built-in skips (node_modules, dist, .git) are never re-included.

Sometimes a directory shouldn't leave the index — you still want to find things in it — it just shouldn't outrank your real code. A scripts/ or optional-skills/ tree whose helpers use generic names (usage, status, run) can win on an exact name match and crowd out the product code that actually answers the query. Name those trees under deprioritize:

{
  "deprioritize": ["optional-skills/", "scripts/"]
}

This is the ranking counterpart to exclude: those paths stay indexed and findable — searching for them directly still works — they just stop winning against first-party code. It applies to query / search and to explore's ranking. It is not a filter: unlike the built-in example/, sample/, fixture/, benchmark/ and demo/ handling — which also drops those files from some result sets outright — deprioritize only ever changes rank. Reach for exclude when you want something gone.

Custom file extensions

If your project uses a non-standard extension for a supported language — say .dota_lua for Lua, or .tpl for PHP — those files are skipped by default, because the extension isn't one CodeGraph recognizes. Map them with an optional codegraph.json at your project root:

{
  "extensions": {
    ".dota_lua": "lua",
    ".tpl": "php"
  }
}

Each value is a supported language id. The mappings merge on top of the built-in defaults and win on conflict, so you can also re-point a built-in (e.g. ".h": "cpp"). Commit the file to share the mapping with your team. A typo'd language or a malformed file is warned about and skipped — it never breaks indexing — and a project with no codegraph.json behaves exactly as before. Re-index (codegraph index) after adding or changing mappings.

Telemetry

CodeGraph collects anonymous usage statistics — which tools and commands get used, which languages get indexed — to guide where language and agent support work goes. Never any code, paths, file or symbol names, queries, or IP addresses; usage is aggregated locally into daily totals before anything is sent, and the ingest endpoint is public code in this repo that enforces the documented field list. The installer asks up front; turn it off any time:

codegraph telemetry off    # or: CODEGRAPH_TELEMETRY=0, or DO_NOT_TRACK=1

TELEMETRY.md lists every field, with the off-switches and the full data-handling story.

Verified releases

Every artifact is built and published by the public Release workflow — never from a laptop — and carries cryptographic proof of it:

  • npm packages are published via trusted publishing (OIDC — no long-lived npm tokens exist that could be stolen) with provenance attestations linking every version to the exact commit and workflow run that built it. Verify what's installed:

    npm audit signatures
  • GitHub Release bundles (and SHA256SUMS) carry signed build attestations (SLSA v1.0 Build Level 2). Verify any downloaded bundle:

    gh attestation verify codegraph-darwin-arm64.tar.gz -R colbymchenry/codegraph

Releases published before July 2026 predate this pipeline and don't carry attestations.

Supported Platforms

Every release ships a self-contained build (bundled Node runtime — nothing to compile) for all three desktop OSes, on both Intel/AMD (x64) and ARM (arm64):

PlatformArchitecturesInstall
Windowsx64, arm64PowerShell installer or npm
macOSx64, arm64shell installer or npm
Linuxx64, arm64shell installer or npm

See Get Started for the one-line install commands.

Supported Agents

The interactive installer auto-detects and configures each of these — wiring up the MCP server, which delivers its own usage guidance. For Claude Code, Codex CLI, Gemini CLI, opencode, Factory Droid, Qwen Code, DeepSeek Harness, Grok Build, Kimi Code and Pi it also writes a short marker-fenced CodeGraph section into the agent's instructions file (CLAUDE.md / AGENTS.md / GEMINI.md / QWEN.md, or rules/codegraph.md for Grok Build), so subagents and non-MCP agents learn the codegraph explore command:

  • Claude Code

  • Cursor

  • Codex CLI — the Codex IDE extension reads the same config: a global install writes $CODEX_HOME/config.toml (default ~/.codex/config.toml), and a local install writes .codex/config.toml, which Codex uses only in a project you've marked as trusted

  • opencode — MCP entry is OpenCode 2's mcp.servers.codegraph with codemode: false (keeps codegraph_explore on the native tool list; codegraph install migrates the older mcp.codegraph shape)

  • Hermes Agent

  • Gemini CLI

  • Antigravity IDE

  • Kiro

  • GitHub Copilot — Copilot Chat in VS Code (copilot-vscode), the Copilot CLI (copilot-cli), and the Copilot plugin in JetBrains IDEs (copilot-jetbrains)

  • IBM Bob (bob) — Bob IDE and Bob Shell: ~/.bob/settings/mcp.json, or .bob/mcp.json in a project

  • Factory Droid (droid) — ~/.factory/mcp.json, or .factory/mcp.json, which is meant to be committed; Droid reloads the file on its own

  • Windsurf (windsurf) — global only: ~/.codeium/windsurf/mcp_config.json, which Devin, Windsurf's new name, imports by default

  • Qwen Code (qwen) — settings.json in $QWEN_HOME (default ~/.qwen) or .qwen/, keeping any comments in it

  • DeepSeek Harness (dsh) — global only: one entry in $DSH_HOME/cordis.patch.yml (default ~/.dsh) covers every profile

  • Grok Build (grok) — $GROK_HOME/config.toml (default ~/.grok), or .grok/config.toml, which Grok uses only in a trusted folder

  • Kimi Code (kimi) — $KIMI_CODE_HOME/mcp.json (default ~/.kimi-code), or .kimi-code/mcp.json, which Kimi Code uses only in a trusted folder

  • Qoder CLI (qoder) — $QODER_CONFIG_DIR/settings.json (default ~/.qoder), or .qoder/settings.local.json; in the Qoder IDE, add the server under Settings > MCP

  • Pi (pi) — mcp.json in Pi's agent directory (default ~/.pi/agent), or .pi/mcp.json, which Pi reads once you trust the project; exposure: "direct" keeps codegraph_explore on the model's tool list

Supported Languages

LanguageExtensionStatus
TypeScript.ts, .tsxFull support
JavaScript.js, .jsx, .mjsFull support
ArkTS (HarmonyOS).etsFull support (everything TypeScript has, plus @Component/@ComponentV2 structs with their ArkUI decorators (@State/@Prop/@Link/@Local/@Builder/…), build() view trees — parent→child component edges, chained-attribute links to @Extend/@Styles functions, .onClick(this.handler) event bindings — dynamic-dispatch bridges for state→build() re-renders, @ohos.events.emitter emit→subscriber pairs (static event keys only), and router.pushUrl literal urls → the target page struct; ohpm workspace modules resolve bare import { X } from "data" through oh-package.json5 file: dependencies, honoring each module's main entry)
Python.pyFull support
Go.goFull support
Rust.rsFull support
Java.javaFull support
C#.csFull support
PHP.phpFull support
Ruby.rbFull support
C.c, .hFull support
C++.cpp, .hpp, .ccFull support
Objective-C.m, .mm, .hPartial support (classes, protocols, methods, @property, #import, message sends; .mm ObjC++ may parse incompletely)
Metal.metalFull support (vertex/fragment/kernel functions, structs, type aliases, call edges — MSL parses as C++, with [[attribute]] annotations handled)
CUDA.cu, .cuhFull support (kernels and device/host functions, structs, classes, host→kernel call edges through <<<grid, block>>> launch syntax — templated launches, function-pointer launches (auto kernel = &fn<...>), dim3{...} configs, and macro-defined kernels included; __global__/__device__/__launch_bounds__ specifiers handled; CUDA in plain .h/.hpp headers recognized by content)
Swift.swiftFull support
Kotlin.kt, .ktsFull support
Scala.scala, .scFull support (classes, traits, methods, type aliases, Scala 3 enums)
Dart.dartFull support
Svelte.svelteFull support (script extraction, Svelte 5 runes, SvelteKit routes)
Vue.vueFull support (script + script-setup extraction, Nuxt page/API/middleware routes)
Astro.astroFull support (frontmatter + script extraction, template component/call references, src/pages/ routes)
Liquid.liquidFull support
Pascal / Delphi.pas, .dpr, .dpk, .lprFull support (classes, records, interfaces, enums, DFM/FMX form files)
Lua.luaFull support (functions, methods with receivers, local variables, require imports, call edges)
R.R .rFull support (functions in every assignment form, S4/R5/R6 classes with methods, library/require imports, source() file references, call edges)
Luau.luauFull support (everything in Lua, plus type/export type aliases, typed signatures, and Roblox instance-path require)
CFML.cfc, .cfm, .cfsFull support (tag-based <cfcomponent>/<cffunction> and bare-script component { ... } styles, extends/implements, embedded <cfscript> delegation, call edges)
COBOL.cbl, .cob, .cpyFull support (programs, sections/paragraphs with PERFORM/GO TO call edges, CALL 'literal' cross-program calls, COPY copybook imports — including standalone .cpy files — DATA DIVISION records/fields/88-levels, EXEC CICS LINK/XCTL and EXEC SQL INCLUDE targets; fixed and free format)
Visual Basic .NET.vbFull support (classes, Modules, interfaces, structures, enums, properties, events, Declare P/Invoke, Handles/WithEvents, Inherits/Implements edges, call edges through VB's call/index paren ambiguity, As New instantiation, interpolated strings, LINQ, Unicode identifiers)
Erlang.erl, .hrl, .escript, .app.src, .appFull support (functions with multi-clause/multi-arity grouping, -spec signatures, records with fields, -type/-opaque aliases, -define macros, -include/-include_lib/-import edges, local and mod:fn remote call edges, fun name/arity references, spawn/apply/proc_lib/timer/rpc MFA-argument call edges, gen_server:call/cast(?MODULE) → own handle_call/handle_cast links, -behaviour links, -export-based visibility)
Solidity.solFull support (contracts, libraries, interfaces, structs, enums, modifiers, events, errors, state variables, import/using directives, emit/revert calls)
Terraform / OpenTofu.tf, .tfvars, .tofuFull support (resources, data sources, modules, variables, outputs, providers incl. aliases, locals; var./local./module./resource references with Terraform's per-directory scoping enforced; module calls bridged across the boundary — inputs to the child module's variables, module.M.out to the child's output, source to the module's files; cloudposse/atmos remote-state cross-component wiring when the component is statically named; provider = aws.east selections resolved up the module tree; moved/import/removed/check block references; .tfvars assignments linked to the variables they set)
Nix.nixFull support (functions with simple/destructured/curried params, let/attrset bindings, inherit, import ./path file edges — ./dir resolving through default.nix — plus NixOS module imports = [ ./x.nix ] lists and callPackage ./pkg.nix file edges; call edges; module-system option wiring — a config write like launchd.user.agents.x = { ... } links to the module declaring options.launchd.user.agents, so option flows trace across modules)

Measured cross-file coverage

Impact and blast-radius queries are only as good as the dependency graph behind them, so coverage is measured rather than asserted. Fair coverage = the share of symbol-bearing source files that have at least one resolved cross-file dependent — something that imports, calls, references, or (through a framework convention) routes to them — on a real-world benchmark repo per language. The residual is always a genuine static-analysis frontier (runtime dynamic dispatch, reflection / DI containers, framework-convention entry points, vendored third-party code), never hidden by gaming the denominator.

LanguageBenchmark repoCoverage
TypeScript / JavaScriptthis repo95.8%
Pythonpsf/requests100%
Gogin-gonic/gin96.6%
RustBurntSushi/ripgrep86.7%
Javagoogle/gson93.3%
C#jbogard/MediatR85.2%
PHPguzzle/guzzle100%
Rubysidekiq/sidekiq100%
Credis/redis92.2%
C++google/leveldb94.8%
Objective-CSDWebImage91.6%
SwiftAlamofire95.3%
Kotlinsquare/okhttp96.2%
Scalagatling/gatling91.2%
Dartflutter/packages92.4%
Svelte / SvelteKitsveltejs/realworld100%
Vue / Nuxtnuxt/movies93.5%
Astroxingwangzhe/stalux93.0%
Luanvim-telescope/telescope.nvim84.2%
Luaudphfox/Fusion92.2%
LiquidShopify/dawn73.8%
Pascal / DelphiPascalCoin77.4%

Framework routing is validated the same way, on a canonical app per framework: Express 100%, FastAPI 98%, Flask 100%, NestJS 96.8%, Gin 96.5%, Axum 100%, Rocket 93.8%, Vapor 100%, Laravel 92%, Rails 89.6%, React Router 100% — and the convention/reflection-heavy ones at their honest static-analysis ceiling: ASP.NET 83.9%, Spring 83.3%, Drupal 78.9%, Play 76.3%, Django 74.1%. SvelteKit, Vue/Nuxt, and Astro use file-based routing, so their page/endpoint coverage is the Svelte/SvelteKit (100%), Vue/Nuxt (93.5%), and Astro (93.0% — every src/pages/ file maps to a route node on the two validation repos) figures in the table above.

Troubleshooting

"CodeGraph not initialized" — Run codegraph init in your project directory first.

Indexing is slow — Check that node_modules and other large directories are excluded. Use --quiet to reduce output overhead.

MCP hits database is locked — current builds shouldn't: CodeGraph bundles its own Node runtime and uses Node's built-in node:sqlite in WAL mode, where concurrent reads never block on a writer. If you still see it:

  • You're on an old (pre-0.9) install. Reinstall to get the bundled runtime — curl -fsSL https://raw.githubusercontent.com/colbymchenry/codegraph/main/install.sh | sh (macOS/Linux), irm https://raw.githubusercontent.com/colbymchenry/codegraph/main/install.ps1 | iex (Windows), or npm i -g @colbymchenry/codegraph@latest.

  • codegraph status shows Journal: other than wal — WAL couldn't be enabled on this filesystem (common on network shares and WSL2 /mnt), so reads can block on writes. Move the project (with its .codegraph/ folder) onto a local disk.

MCP server not connecting — Your agent starts the server itself, so you don't launch it by hand. Make sure the project is initialized and indexed (codegraph status) and that the path in your MCP config is correct. If it still won't connect, re-run codegraph install to rewrite the config.

Two codegraph serve --mcp on one project fight over the index / auto-sync stops — CodeGraph allows one live MCP writer per project (the shared background daemon, or a single direct-mode process). Extra clients should proxy to that daemon. If you set CODEGRAPH_NO_DAEMON=1, run only one serve --mcp for that project; a second instance exits with a clear writer-lock error (see writer.pid under .codegraph/). Prefer leaving the daemon enabled so multiple MCP hosts share one watcher.

MCP tool calls fail with Transport closed while codegraph status/sync are healthy — almost always WSL2 with the project on a Windows drive (a /mnt/c or /mnt/d path), where the local socket CodeGraph uses to share one background server across sessions is unreliable. CodeGraph works around this itself now: when the project's filesystem can't host that socket, the shared server puts it in the system temp directory instead, and when the shared server still can't be reached, or drops, the session is served in-process instead of losing the connection. If you still hit it, set CODEGRAPH_NO_DAEMON=1 in your MCP server's environment to skip the shared server entirely (each session runs in its own process). Moving the project onto the Linux-native filesystem (e.g. under ~/ instead of /mnt/) restores the shared server.

Missing symbols — The MCP server auto-syncs on save (wait a couple seconds). Run codegraph sync manually if needed. Check that the file's language is supported and isn't inside a .gitignored or default-excluded directory (e.g. node_modules, dist).

Sharing one checkout between Windows and WSL — Don't point both at the same .codegraph/: the background-server lock and the SQLite index are tied to the OS that wrote them, and SQLite locking across the WSL2/Windows filesystem boundary is unreliable (WSL reports it as a disk I/O error). For a project on a Windows drive (a /mnt/c/… path), WSL keeps its own index automatically: an index first built from WSL goes in .codegraph-wsl/, leaving .codegraph/ to Windows. An index already in .codegraph/ stays where it is, so if Windows built that one, give WSL its own by setting CODEGRAPH_DIR=.codegraph-wsl in WSL and running codegraph init there. CODEGRAPH_DIR always picks the name when set, on either side. CodeGraph skips any sibling .codegraph-* directory when indexing and watching, so the two never trip over each other.

Very large repositories (hundreds of thousands of files), or a large .codegraph/codegraph.db-wal file — The -wal file is SQLite's write-ahead log: writes waiting to be folded into codegraph.db. While a big index is being built, CodeGraph lets it grow in proportion to the index (soft threshold = the larger of 256 MB and a quarter of the index size, up to 2 GB) before folding it back, because folding too often is what made large indexes slow on ordinary disks. At rest it is trimmed to 64 MB, and a leftover from a killed session is folded and trimmed the next time the project opens — the index itself has no size limit. Two environment variables tune this: CODEGRAPH_WAL_VALVE_MB (the soft threshold during indexing) and CODEGRAPH_WAL_HEAL_MB (the resting size and the trim threshold). CODEGRAPH_WAL_VALVE_DEBUG=1 prints every decision to stderr.

Contributing

See CONTRIBUTING.md to build from source, test a change and prepare a pull request. The documentation index links to the project's guides and design notes.

License

MIT


<div align="center">

Made for AI coding agents — Claude Code, Cursor, Codex CLI, opencode, Hermes Agent, Gemini CLI, Antigravity IDE, Kiro, GitHub Copilot, IBM Bob, Factory Droid, Windsurf, Qwen Code, DeepSeek Harness, Grok Build, Kimi Code, Qoder CLI, and Pi

Report Bug · Request Feature

</div>

AGENTS.md

AGENTS.md

Canonical project guidance for coding agents working in this repository (Codex/Astra, Claude Code via @AGENTS.md, Cursor, etc.).

Codex size note: root AGENTS.md is intentionally kept near ~35 KiB (critical build/test/arch/retrieval rules retained). Longer validation methodology + the Excalidraw worked example live in docs/AGENTS.md. This environment sets project_doc_max_bytes = 49152 so root (and root+docs/ when cwd is under docs/) are not silently truncated at the 32 KiB default.

Project Overview

CodeGraph is a local-first code intelligence library + CLI + MCP server. It parses any supported codebase with tree-sitter, stores symbols/edges/files in SQLite (FTS5), and exposes a knowledge graph to AI agents (Claude Code, Cursor, Codex CLI, opencode) over MCP. Per-project data lives in .codegraph/. Extraction is deterministic — derived from AST, not LLM-summarized.

Distributed as @colbymchenry/codegraph on npm; same binary serves as installer, indexer, and MCP server.

Build, Test, Run

npm run build           # tsc + copy schema.sql and *.wasm + build the viewer into dist/; chmods dist/bin/codegraph.js
npm run build:lib       # the viewer's components as @colbymchenry/codegraph-ui (ui/dist) — NOT part of `build`
npm run dev             # tsc --watch
npm run clean           # rm -rf dist

npm test                # vitest run (all)
npm run test:watch
npm run test:eval       # only __tests__/evaluation/
npm run eval            # build then run __tests__/evaluation/runner.ts via tsx

npm run cli             # build then run the local dist binary

# Single test file / pattern
npx vitest run __tests__/installer-targets.test.ts
npx vitest run __tests__/extraction.test.ts -t "TypeScript"

copy-assets (called from build) copies src/db/schema.sql and all src/extraction/wasm/*.wasm files into dist/. Any new SQL or grammar wasm must be copied or it won't ship.

One other build step writes into dist/ and is subject to the same rule: build:ui builds the browser viewer into dist/viewer/ (never dist/ui/ — that's the terminal ui). scripts/check-ui-build.mjs asserts both dist/viewer/ and the copied grammars in dist/extraction/wasm/ after every build and inside every release archive — the viewer's syntax highlighting reads a file with the same grammar the engine indexed it with, so a missing wasm is an unhighlighted screen as well as an extraction gap.

npm run build:lib is separate and does NOT run as part of npm run build: it compiles the same ui/src tree a second way, with svelte-package, into ui/dist — the @colbymchenry/codegraph-ui component library the Pro app imports (task CG-61). scripts/check-ui-package.mjs then prunes the standalone app's shell out of it, resolves the extensionless import specifiers svelte-package leaves behind, and asserts the seam: nothing outside lib/adapter.js may reach the network. The package is prepared, not published — ui/package.json carries "private": true deliberately, and scripts/pack-npm.sh only packs a tarball when CODEGRAPH_PACK_UI=1.

Tests run as two Vitest projects (test.projects in vitest.config.mts): engine (node) and ui (jsdom, the Svelte plugin, resolve.conditions: ['browser']) for the single __tests__/ui-package.test.ts. npm test still runs both. The split is not cosmetic — browser is a package-resolution condition, and applied globally it hands the engine's suites the browser builds of web-tree-sitter and friends. The root config (vitest.config.mts, .mts because the plugin is ESM-only and the repo is CJS) is the shared base; note that a project with extends: true concatenates the base's include with its own, which is why the ui project sets extends: false.

Node engines: >=20.0.0 <25.0.0. There is a hard exit on Node 25.x and below 20 (see src/bin/node-version-check.ts). That range is what users run. Working in this repo needs Node 22.12 or newer: devEngines makes npm ci and npm run stop on anything older, for Vite 7 and Vitest 4.

Architecture

Layered pipeline
files → ExtractionOrchestrator (tree-sitter) → DB (nodes/edges/files)
              ↓
       ReferenceResolver (imports, name-matching, framework patterns)
              ↓
       GraphQueryManager / GraphTraverser (callers, callees, impact)
              ↓
       ContextBuilder (markdown/JSON for AI consumption)

The public API surface is src/index.ts — the CodeGraph class wires all the layers and re-exports types. Library users only touch this file; the MCP server and CLI also drive it.

Module layout
  • src/index.ts — CodeGraph class: init/open/close, indexAll, sync, searchNodes, getCallers/getCallees, getImpactRadius, buildContext, watch/unwatch. It must stay light to load: a read command, a query worker and the prompt hook all load it, and never index. What only indexing needs (extraction, resolution, the watcher) goes through engine() (src/lazy-engine.ts, listed in src/engine.ts), never an import of its own; __tests__/lazy-engine.test.ts fails otherwise.

  • src/db/ — DatabaseConnection, QueryBuilder (prepared statements), schema.sql, sqlite-adapter.ts. Backed by Node's built-in node:sqlite (DatabaseSync) — real SQLite with WAL + FTS5, exposed through a thin better-sqlite3-shaped adapter. The bundled runtime always ships Node ≥22.5, so node:sqlite is always available: no native build step and no wasm fallback. (Running from source needs Node ≥22.5.) codegraph status reports the live backend (node-sqlite, the sole backend).

  • src/extraction/ — ExtractionOrchestrator, tree-sitter wrappers, per-language extractors under languages/ (one file per language), plus standalone extractors for non-tree-sitter formats (svelte-extractor.ts, vue-extractor.ts, liquid-extractor.ts, dfm-extractor.ts for Delphi). parse-worker.ts runs heavy parsing off the main thread.

  • src/resolution/ — ReferenceResolver orchestrates import-resolver.ts (with path-aliases.ts for tsconfig path aliases + cargo workspace member globs), name-matcher.ts, and frameworks/ (Express, Laravel, CodeIgniter 3, Rails, FastAPI, Django, Flask, Spring, Gin, Axum, ASP.NET, Vapor, React Router, Next.js — nextjs.ts: pages and route.ts handlers from files, router.push / redirect / NextResponse.redirect as navigates edges, with next-router-synthesizer.ts for <Link href> and for the routes a proxy's config.matcher accepts, read by next-proxy.ts — Expo Router, SvelteKit, Vue/Nuxt, Cargo workspaces). Frameworks emit route nodes and references edges. parameter-flow.ts (the engine, its SQL in db/parameter-flow-queries.ts) and ruby-parameter-flow.ts (one language's adapter) move a call on a parameter to the method of the one class every call site passes, after the calls edges persist. A sync looks only as far as what it changed reaches, from a record the last pass left in one metadata key, and whatever it can't settle from that falls back to a pass over the project. callback-synthesizer.ts holds the whole-graph synthesis passes (SYNTH_PASSES, merged in registry order — first-seen wins a duplicate pair) with the language gates; tier-synthesizer.ts is the cross-tier pass (a client's literal fetch/axios path onto its own route, a queue job onto its consumer, a bus / socket event onto its handler — channel, tier, registeredAt on every edge; registered before the in-process emitter pass so its more specific edge wins); synth-utils.ts has the helpers they share (enclosingFn, enclosingValue, makeLineAt). Express's postExtract composes app.use('/prefix', router) mounts onto a mounted file's route names, idempotently (the original path stays in qualifiedName).

  • src/graph/ — GraphTraverser (BFS/DFS, impact radius, path finding) and GraphQueryManager (high-level queries), plus the shared query-time derivations more than one surface renders: named-symbol-flow.ts (the one path finder, behind codegraph_explore's Flow section and the viewer's Flow strip), dynamic-boundary-report.ts (where the graph stops), type-hierarchy.ts (ancestors/subtypes and the implementation count explore prints and the viewer draws), dead-code.ts (unreferenced symbols, and every reason a candidate is NOT claimed), synthesized-hop.ts (how a synthesized hop reads, in explore's Flow, the codegraph_node trail and ContextBuilder's call paths — a new synthesizer's wording goes here), file-cycles.ts (circular imports, in codegraph cycles and the viewer's map). A derivation that two callers render must live here, not in ToolHandler — two derivations eventually disagree.

  • src/context/ — ContextBuilder + formatter for markdown/JSON output.

  • src/search/ — full-text query parser and helpers for FTS5.

  • src/sync/ — FileWatcher (native FSEvents/inotify/RDCW) with debounce + filter, and git-hook helpers.

  • src/mcp/ — MCP server (MCPServer, tools.ts, transport.ts). server-instructions.ts is what the server returns in the MCP initialize response — keep it in sync with the user-facing tool guidance.

  • src/installer/ — see below.

  • src/bin/codegraph.ts — CLI (commander). Subcommands: install, uninstall, init, uninit, index, sync, status, unlock, query, explore, context, node, files, callers, callees, impact, affected, cycles, daemon, telemetry, upgrade, version. Hidden from --help: serve --mcp, prompt-hook, and ui/web unless CODEGRAPH_UI=1.

  • src/ui/ — terminal UI (shimmer progress, worker).

  • src/ui-server/ -- read-only JSON API for the codegraph ui browser viewer (api/: node, flow, map, screens, steps, deadcode, trails, program, ...) plus static server; Svelte viewer lives in ui/ (see docs/design/codegraph-ui-design-spec.md). screens/steps/program share one fold (via/when via graph/branch-guards.ts); api/effects.ts curates calls that leave the index; api/route-roots.ts names where a route's code starts. Derivations rendered by more than one surface belong in src/graph/, not ToolHandler. Not released yet: codegraph ui / web are refused (and hidden from --help) unless CODEGRAPH_UI=1 is set — src/bin/viewer-gate.ts. Viewer changelog entries wait in docs/viewer-launch-changelog.md, not under [Unreleased]. At launch: delete the gate, move those entries back, drop the "not released yet" notes from site/.

NodeKind / EdgeKind

Defined in src/types.ts. Both extractors and resolvers must use these exact strings.

  • NodeKind: file, module, class, struct, interface, trait, protocol, function, method, property, field, variable, constant, enum, enum_member, type_alias, namespace, parameter, import, export, route, component, union.

  • EdgeKind: contains, calls, imports, exports, extends, implements, references, type_of, returns, instantiates, overrides, decorates.

Multi-agent installer

src/installer/ is the entry point for codegraph install (and the bare codegraph/npx @colbymchenry/codegraph invocation). Architecture:

  • targets/registry.ts lists every supported agent.

  • targets/types.ts defines the AgentTarget interface — adding another agent (Continue, Zed…) is one new file in targets/ + one entry in registry.ts. Each target owns its config-file location and MCP-server JSON/TOML/JSONC writing. (Claude, Codex, Gemini, opencode, Droid, Qwen, DSH, Grok, Kimi and Pi also write a short instructions-file block — see below.)

  • Current targets: claude.ts, cursor.ts, codex.ts, opencode.ts, hermes.ts, gemini.ts, antigravity.ts, kiro.ts, copilot-vscode.ts, copilot-cli.ts, copilot-jetbrains.ts, bob.ts, droid.ts, windsurf.ts, qwen.ts, dsh.ts, grok.ts, kimi.ts, qoder.ts, pi.ts.

  • targets/toml.ts is a hand-rolled TOML serializer scoped to [mcp_servers.codegraph] (used by Codex and Grok, through writeTomlTable / deleteTomlTable). Sibling tables and [[array_of_tables]] are preserved verbatim. No new dependency.

  • targets/json-config.ts edits mcpServers.codegraph in place through jsonc-parser, for Bob, Droid, Windsurf, Qwen, Kimi, Qoder and Pi. An entry already in the file is the user's: agents write switches into it and users pin a command or cwd, so a re-install or --refresh only fills in missing keys. DSH's and Grok's writers keep to the same rule. Use it for a new agent with that file shape; a file with nothing left in it is deleted on uninstall, through removeFileUnlessLinked.

  • *_HOME-style overrides (QWEN_HOME, KIMI_CODE_HOME, GROK_HOME, DSH_HOME, QODER_CONFIG_DIR, PI_CODING_AGENT_DIR) go through configDirFromEnv in targets/shared.ts; each must also be cleared in __tests__/setup-home-sandbox.ts and in the suite's setHome.

  • opencode reads opencode.jsonc by default; the installer prefers existing .jsonc, falls back to .json, and creates .jsonc for greenfield installs. Edits are surgical via jsonc-parser so user comments and formatting survive install/re-install/uninstall round-trips. The MCP entry is OpenCode 2's native mcp.servers.codegraph with disabled: false and codemode: false (so codegraph_explore stays on the native tool list); a pre-#1698 mcp.codegraph + enabled entry is migrated on re-install and removed by uninstall.

  • instructions-template.ts holds CODEGRAPH_INSTRUCTIONS_BLOCK, a deliberately short marker-fenced (<!-- CODEGRAPH_START -->/<!-- CODEGRAPH_END -->) ## CodeGraph block. The Claude, Codex, Gemini, opencode, Droid, Qwen, DSH, Grok, Kimi and Pi targets write it into their instructions file (CLAUDE.md / ~/.codex/AGENTS.md / ~/.gemini/GEMINI.md / ~/.config/opencode/AGENTS.md / ~/.factory/AGENTS.md / ~/.qwen/QWEN.md / ~/.dsh/AGENTS.md / ~/.grok/rules/codegraph.md / ~/.kimi-code/AGENTS.md / ~/.pi/agent/AGENTS.md) via upsertInstructionsEntry, and uninstall removes it. History: #529 removed the old full playbook because it duplicated the MCP initialize instructions; #704 brought back this small block because the instructions file reaches two audiences initialize cannot — Task-tool subagents and non-MCP harnesses (the codegraph explore CLI). Cursor and Kiro write no block; their install only strips one a previous install left behind. Bob, Windsurf and Qoder are MCP config only. Keep the block to command names and the two surfaces; tool guidance itself still belongs in server-instructions.ts.

  • All installer changes need matching coverage in __tests__/installer-targets.test.ts — there are ~47 parameterized contract tests covering install idempotency, sibling preservation, uninstall reverses install, byte-equal re-runs returning unchanged, and partial-state recovery for Codex.

Cursor MCP working-directory quirk

Cursor launches MCP subprocesses with the wrong cwd and doesn't pass rootUri in initialize. The installer injects --path into Cursor's MCP args — absolute path for local installs, ${workspaceFolder} for global installs. If you touch Cursor wiring, preserve this.

MCP server instructions

src/mcp/server-instructions.ts is sent back to the agent in the MCP initialize response. This is the first thing every agent sees about how to use the tools, and as of issue #529 it is the single source of truth for agent-facing tool guidance. The installer's instructions-file block (instructions-template.ts, see above) only names the tool and the CLI for subagents and non-MCP agents; it does not repeat this guidance. Edit tool guidance here and nowhere else.

Retrieval performance & dynamic-dispatch coverage (do not regress)

CodeGraph's core value is letting an agent answer structural/flow questions ("how does X reach Y", trace, impact, callers) with a few fast codegraph calls and zero Read/Grep. The optimization target is wall-clock latency + tool-call count — don't optimize for token cost. (Cost is lower, not "flat" as earlier framing claimed: a current-build with-vs-without A/B across the 7 README repos, median of 4, saved on average 35% cost · 57% tokens · 46% time · 71% tool calls — reproducing the published README. The mechanism is far fewer turns over a much smaller accumulated context — NOT cache-ability: the without-arm's huge token volume is mostly cheap cache-reads, which is why token-count savings (57%) look bigger than cost savings (35%). Measure tokens by summing per-turn assistant usage, not result.usage (last-turn only in current Claude Code). See docs/benchmarks/call-sequence-analysis.md.) The mechanism that drives everything here: an agent falls back to Read/Grep the instant a codegraph answer is insufficient. So every change is judged by one question — is codegraph's answer sufficient enough to stop the agent from reading?

Target behavior: a flow question resolves in 1 codegraph call on small repos, scaling to 3–5 on large, with Read/Grep = 0. When reviewing a PR or trying something new, do not regress this.

Adapt the tool to the agent — don't try to change the agent

The lever that decides whether a retrieval change lands. Test before building anything here: does this make a tool the agent already calls do more with the input it already gives? If it instead needs the agent to behave differently — pick a different tool, query differently, learn from examples — it hits the low-salience wall and won't land.

CodeGraph's only channels to influence the agent are low-salience: the MCP initialize instructions (server-instructions.ts) and the tool descriptions. Changing them does not reliably move the agent's tool choice or query style — validated: trace-first steering ported into the server-instructions + tool descriptions (3 wording variants) never reproduced what a CLI --append-system-prompt achieved, and regressed wall-clock vs baseline. New tools fare worse (rarely chosen — the agent under-picks even trace); "better examples" is the same steering. The agent's tool-choice does improve on its own as host models get better at tool use — but that is not ours to force.

What works is meeting the agent where it already is:

  • explore-flow — codegraph_explore is the PRIMARY tool the agent reliably calls; its query is a precise bag of symbol names (incl. qualified Class.method) spanning the flow the agent is after; explore finds the call path among those named symbols (riding synthesized edges) and leads its output with it. (buildFlowFromNamedSymbols: segment/co-naming disambiguation; ≤1 unnamed bridge so it never wanders a god-function's fan-out. Overload-aware: a PascalCase type token in the query biases an overloaded name to that type's own def — DataRequest task → DataRequest's task, not the abstract base; named-symbol files sort first.)

  • Sufficiency — make the tool's output complete enough that the agent stops. codegraph_node returns the full body + the caller/callee trail, and for an AMBIGUOUS name returns every overload's body in one call (so the agent never Reads a file to find the right overload — validated on Alamofire/gin). This is the after-explore depth tool (labeled SECONDARY).

  • Errors teach abandonment — one or two isError: true responses early in a session and the agent stops calling codegraph entirely (maintainer-observed, repeatedly). isError is reserved for genuine "stop trying" cases: security refusals (PathRefusalError) and real malfunctions (which carry a retry-once note). Every expected/recoverable condition — project not indexed, symbol not found, file not in the index — returns a SUCCESS-shaped response carrying the guidance (NotIndexedError → textResult, see ToolHandler.execute's catch). The same principle is why the tool surface is always exposed, even at an un-indexed root (the old empty-tools/list gate was removed in #964 — it broke monorepos where only sub-projects carry a .codegraph/, and hid the tools from a session that started before codegraph init): safety comes from the response SHAPE (success-shaped guidance, never isError), not from hiding tools. An un-indexed root's initialize sends a per-project variant (SERVER_INSTRUCTIONS_NO_ROOT_INDEX — "pass projectPath to a project that has a .codegraph/"), not an "inactive" note; indexing is still deliberately the user's call, never the agent's.

What fails is the inverse — folding a precise answer into a fuzzy-input tool: the now-removed codegraph_context took a description, not symbols, so it couldn't disambiguate a flow's endpoints and surfaced the wrong feature (which is why it was cut). Precise output needs precise input — explore takes a symbol bag for exactly this reason. (codegraph_trace was likewise removed: explore-flow does its job and the agent under-picked it.)

The remaining lever under this axis is coverage: every flow made to connect statically (a new dynamic-dispatch synthesizer, or extracting symbols static parsing skipped — e.g. object-literal store actions in create((set,get)=>({...}))) is then surfaced automatically by explore-flow, no agent change needed. Reactive/reconciler runtimes (Halo's ReactiveExtensionClient, MediatR, Vue Proxy) are the frontier — flows there have no static edges, so nothing surfaces (correctly — silent beats wrong). Full investigation + A/B record: docs/benchmarks/call-sequence-analysis.md + auto-memory project_codegraph_read_displacement.

Explore budget — keep BOTH budgets monotonic with repo size

Two functions in src/mcp/tools.ts scale explore with indexed file count. This is the expected resolution (a regression here silently forces agents back to Read):

Repofilesexplore callschars/callper-file
express (small)147118K3800
excalidraw/django (medium)643–3043228K6500
vscode (large)10446335K7000
~20k / ~40k—4 / 538K7000
  • getExploreBudget(fileCount) → call budget: <500→1, <5000→2, <15000→3, <25000→4, ≥25000→5 (max 5).

  • getExploreOutputBudget(fileCount) → per-call output (chars / files / per-file). Invariant: a larger tier must never get a smaller maxCharsPerFile than a smaller tier. (Regression that motivated this doc: the <5000 tier's 2500 was below the <500 tier's 3800, so on a god-file repo — excalidraw's 415 KB App.tsx — one explore returned <1% of the file and forced a Read.)

  • Explore output must never tell the agent to "use Read" — steer to another codegraph_explore and "treat returned source as already Read."

Dynamic-dispatch coverage — the flow must EXIST in the graph end-to-end

Static tree-sitter extraction misses computed/indirect calls, so flows break at dynamic dispatch and the agent reads to reconstruct them. Synthesizers/resolvers bridge these so codegraph_explore connects them end-to-end (src/resolution/callback-synthesizer.ts, src/resolution/frameworks/). Channels today: callback/observer, EventEmitter, React re-render (setState→render), JSX child (render→child component), React Native native→JS events (sendEvent(withName:) / JVM emit → the addListener handler, named or inline, rn-event-channel), django ORM descriptor. The JS→native direction is a resolver (frameworks/react-native.ts: RCT_EXPORT_METHOD, RCT_EXTERN_MODULE Swift shims, TurboModules), which trusts receiver evidence — an alias bound to NativeModules.X — over the import resolver. All synthesized edges are provenance:'heuristic' with metadata.synthesizedBy + registeredAt (the wiring site), surfaced inline in codegraph_explore's Flow section and the codegraph_node trail.

Principle: partial coverage is WORSE than none. Bridging one boundary but not the next reveals a hop the agent then drills + reads to finish. Measured on excalidraw: react-render alone raised reads to 5–7; only completing the flow (adding the jsx-child hop) dropped it to 0–1. Always close the flow end-to-end and re-measure — never ship a half-bridged flow.

Validation methodology & worked examples

Required for every new language/framework: validate on small/medium/large real repos with >=3 flow prompts; deterministic probes (scripts/agent-eval/probe-*.mjs) then agent A/B (scripts/agent-eval/run-all.sh / ab-new-vs-baseline.sh). Pass bar: ~0 Read/Grep within the explore-call budget, faster than without-codegraph, no control-repo regression.

Full methodology (feedback metrics, CLI contamination guard, Sonnet/--effort high model policy, daemon pre-warm), the Excalidraw worked example, and coverage matrix live in:

  • docs/AGENTS.md (nested; also loaded when cwd is under docs/)

  • docs/design/dynamic-dispatch-coverage-playbook.md

  • docs/design/callback-edge-synthesis.md

  • docs/benchmarks/call-sequence-analysis.md / docs/benchmarks/agent-eval-feedback-metrics.md

Tests live in __tests__/ and mirror the module they cover. Notable ones beyond the obvious:

  • installer-targets.test.ts — parameterized contract suite across every registered target (ALL_TARGETS); see the installer notes above.

  • evaluation/ — runner.ts + test-cases.ts exercise codegraph against synthetic projects and score the results; run via npm run eval (builds first). Not part of npm test.

  • sqlite-backend.test.ts / node-sqlite-backend.test.ts — pin that node:sqlite is the sole backend: getBackend() reports node-sqlite and the DB comes up in WAL.

  • name-matcher-memo-clears.test.ts — every module-level memo in name-matcher.ts is dropped by clearNameMatcherMemos or named in its short allow-list. A resolver outlives a sync, so a memo that isn't dropped goes stale in a long-lived server alone, where no single-index test sees it (sync-memo-lifetime.test.ts edits and syncs on one object). A project-level read too large to repeat (a Cargo workspace, a compile database) stays out of the clear functions and joins the module-config snapshot instead.

  • pr19-improvements.test.ts, frameworks-integration.test.ts — regression coverage for specific past PRs/incidents; don't rename these, the names anchor to git history.

Tests create temp dirs with fs.mkdtempSync and clean up in afterEach. They write real files and exercise real SQLite — there is no DB mocking.

Every engine test file runs in a throwaway home dir (__tests__/setup-home-sandbox.ts, a setupFiles entry): HOME/USERPROFILE (+ Windows vars), XDG_CONFIG_HOME and GIT_CONFIG_GLOBAL point into it, and CLAUDE_CONFIG_DIR/CODEX_HOME/… are cleared; spawned children inherit it. It's a backstop — still inject writes to global state (e.g. UpgradeDeps.wirePromptHook, #2275).

Windows-gated tests

Behavior that differs by platform (path resolution, drive letters, SENSITIVE_PATHS, %APPDATA% config dirs, CRLF) must be gated, not assumed. Use it.runIf(process.platform === 'win32')(...) for Windows-only assertions and it.runIf(process.platform !== 'win32')(...) for POSIX-only ones — e.g. /etc is sensitive on POSIX but resolves to C:\etc (non-existent) on Windows, so an ungated /etc assertion fails on Windows. Validate the Windows side for real (see below); don't merge a Windows-gated test you haven't seen run.

Cross-platform validation

The dev machine — and the default npm test target — is macOS, so local runs cover the macOS path. The other two platforms aren't here; when a change is platform-sensitive (file watching, sockets / named pipes, path & symlink handling, process lifecycle, inotify budget) validate them for real rather than guessing.

Linux (Docker)

When asked to test or validate on Linux, use Docker — there's no Linux box, but Docker runs on the macOS host. Build a throwaway image from the repo and run the suite inside it:

  • FROM node:22-bookworm; COPY the repo with a .dockerignore excluding node_modules/dist/.git/.codegraph; RUN npm ci && npm run build. Don't reuse the Mac node_modules — esbuild/rollup ship platform-specific binaries.

  • Run with docker run --rm --init. The --init is load-bearing for any process-lifecycle test (daemon reaping, the #277 PPID watchdog, idle-timeout): without a zombie-reaping PID 1, a SIGKILL'd/exited process lingers as a zombie and process.kill(pid, 0) still reports it alive, so exit-detection assertions false-fail even though the process did exit.

  • Linux is where the inotify watch budget actually bites: count a process's watches via /proc/<pid>/fdinfo/* (sum ^inotify lines on the fd whose readlink is anon_inode:inotify).

Windows (Parallels VM + SSH)

For any Windows-specific PR, bug, or implementation, validate it on the real Windows VM rather than guessing. Connection details live in the gitignored .parallels file at the repo root (VM name, guest IP, SSH user/key). prlctl exec needs Parallels Pro and is unavailable, so SSH is the bridge.

  • Connect / run from the Mac host: ssh <user>@<guest_ip> "...". For multi-line work, pipe PowerShell over stdin and refresh PATH from the registry first (sshd's session has a stale PATH after winget installs):

    ssh [email protected] "powershell -NoProfile -ExecutionPolicy Bypass -Command -" <<'PS'
    $env:Path = [Environment]::GetEnvironmentVariable("Path","Machine") + ";" + [Environment]::GetEnvironmentVariable("Path","User")
    Set-Location C:\dev\codegraph
    PS
  • Clone fresh into a Windows-local path (C:\dev\codegraph) and npm ci there — never run npm against the shared Mac repo, since esbuild/rollup ship platform-specific binaries.

  • Guest toolchain (winget): Node LTS, Git, and the VC++ ARM64 redistributable (required by @rollup/rollup-win32-arm64-msvc, which vitest pulls in).

  • Fetch a contributor PR head straight from their fork to dodge pull/<n>/head lag: git fetch <fork-url> <branch> then git checkout -f FETCH_HEAD.

  • Windows baseline: as of #2053 the full suite passes on the Windows 11 (ARM64) VM. The only expected exception is security.test.ts > Session marker symlink resistance > does not follow a pre-planted symlink, which needs symlink privileges (Developer Mode) — confirm any other failure against origin/main before blaming your PR. The former mcp-initialize.test.ts / mcp-roots.test.ts EPERM teardown failures came from tests spawning serve --mcp without the runtime flags (its --liftoff-only re-exec grandchild kept the cwd / SQLite file open); spawn it with WASM_RUNTIME_FLAGS and await the child's exit before removing the temp dir. Windows checkouts may be CRLF — split source lines on /\r?\n/ in tests.

  • Windows worker crashes: a worker thread that ends (terminate(), its own process.exit(), or the process exiting) while V8's concurrent marker is marking its heap kills the process with exit 3221225477 (0xC0000005) and leaves no error or dump. It's worst while the worker is still loading its modules. Owners must not terminate a worker before its first message (workerStarted / terminateOnceStarted, or the pool's own handshake), and a worker that exits itself calls collectBeforeExit() first — both in src/worker-teardown.ts. --no-concurrent-marking also stops it, but measured about a third slower indexing on the Windows VM, so it is not used.

Releases

Released to npm and mirrored as GitHub Releases. CHANGELOG.md is the source of truth; GitHub Release notes are extracted from it.

Writing changelog entries

Default: write entries under ## [Unreleased] — that's the section reserved for work landing between releases. Don't pre-create a ## [X.Y.Z] block for the next release: the Release workflow's first step is scripts/prepare-release.mjs, which automatically promotes everything under [Unreleased] into a new ## [X.Y.Z] - <YYYY-MM-DD> block at release time (or merges into a pre-existing [X.Y.Z] block if one exists — but you don't need one). Pre-staging is what caused the v0.9.5 sparse-release-notes incident: a sparse [0.9.5] block hand-added before the rest of the work landed got picked by the extractor over the much-larger [Unreleased] section above it. Don't do that.

Formatting rules for any entry (anywhere — [Unreleased] or otherwise):

  1. Write friendly, user-facing notes — not engineer-facing ones. Group under ### New Features and ### Fixes (sentence-case). Surface ### Breaking Changes and ### Security as their own sections only when the release has them; fold improvement-flavored changes into New Features. Omit empty sections. (This replaces the old Keep-a-Changelog Added/Changed/Fixed/Removed/Deprecated grouping: the GitHub Release page extracts each version block verbatim via scripts/extract-release-notes.mjs, and the old dense, implementation-focused entries rendered as an unreadable wall of text — so the whole CHANGELOG was rewritten to this format and every published release re-noted to match.)

  2. One plain-language sentence per bullet: what changed and why it matters to a user. Lead with the capability, or with the symptom that's now fixed.

  3. Strip the internals. No internal file paths (src/...), no internal symbol / function / class names, no benchmark numbers / percentages / node-or-edge counts. Keep: language & framework names (Go, Spring, NestJS, …), things a user types or sets (codegraph install, codegraph_explore, the CODEGRAPH_* env vars), agent / IDE names (Claude Code, Cursor, opencode, Kiro, …), and a brief Thanks @user when a contributor is credited.

  4. Issue / PR references in entries are by number ((#403) etc.); the GitHub renderer auto-links them in the published release notes.

  5. Don't add a [X.Y.Z]: https://... link reference yourself — prepare-release.mjs appends it automatically when it promotes the version (idempotent: a re-run is a no-op if it already exists).

  6. Every release opens with a ### Highlights block — the only part most people read. At most ~8 one-line bullets, in plain language for someone who doesn't read code, ordered by what a typical user notices first (new agent/IDE support and setup changes, then answer quality, then reliability), plus a one-sentence upgrade note when a re-index is needed. Write or refresh it in [Unreleased] when a release is being prepared — not per PR — and keep the detailed ### New Features / ### Fixes entries below it. When ### Fixes grows past ~15 entries, group them under #### sub-headings (Better answers from codegraph_explore, Finding your project, live updates, and the CLI, Indexing reliability and disk usage, Language and framework accuracy) so a skimmer can find their area.

Multi-word headings like ### New Features are safe on the normal release path: prepare-release.mjs Case A moves the whole [Unreleased] body verbatim into [X.Y.Z]. (Only its rarely-used Case B merge splits sub-sections with a single-word ^### (\w+)$ regex that wouldn't match them — and Case B fires only if a [X.Y.Z] block was pre-created, which rule above already forbids.)

Release flow (the user runs these)

Releases are built and published by the GitHub Actions "Release" workflow (.github/workflows/release.yml). It runs scripts/prepare-release.mjs to promote [Unreleased] into [<version>] (and auto-commit + push that CHANGELOG change back to main so on-disk truth matches the published notes), then bundles a Node runtime per platform (scripts/build-bundle.sh) and publishes both the GitHub Release and the npm thin-installer (scripts/pack-npm.sh: a shim package + per-platform packages). Publishing manually is wrong now — a plain npm publish ships the root package (non-bundled), which breaks anyone on Node < 22.5.

Claude does NOT bump the version unless explicitly asked. The maintainer typically does it themselves — often by editing package.json directly via the GitHub web UI. Don't proactively commit a version bump as part of unrelated work, and don't propose one when summarizing a PR.

When the maintainer DOES bump the version, the only edit strictly required is to package.json — the workflow's "Sync package-lock.json" step detects a mismatch between package.json and package-lock.json, runs npm install --package-lock-only --ignore-scripts to rewrite the lock file's version fields (top-level + packages.""), and auto-commits + pushes the result back to main with [skip ci]. So a GitHub-web-UI single-file edit to package.json is enough to kick off a clean release. (If they edit both files locally, that's fine too — the sync step no-ops.) Bump ui/package.json to the same version in that change: the component library is versioned with the engine, ui-package.test.ts pins it, and the workflow does not sync it — the 1.6.1 bump left main red on exactly that.

Once package.json is at the target version on main, trigger Actions → Release → Run workflow (on main). The workflow:

  1. Syncs package-lock.json to package.json's version if they've drifted; commits + pushes that change.

  2. Runs prepare-release.mjs <X.Y.Z> → promotes [Unreleased] → [X.Y.Z] - <today> in CHANGELOG.md, appends the link reference, commits + pushes the move with [skip ci].

  3. Builds every platform bundle on one runner, generates SHA256SUMS.

  4. Creates the GitHub Release with notes from the freshly-promoted [X.Y.Z] block.

  5. Publishes the npm shim + per-platform packages. Requires the NPM_TOKEN repo secret.

Do not run npm publish, git push, or git tag yourself — these are publish actions on shared state. Write the files, hand the user the commands.

House rules

  • The 0.7.x line is in active multi-agent rollout. Any change to src/installer/ (especially targets/) needs corresponding test coverage and a CHANGELOG entry — installer regressions break every new install silently.

  • When changing what the MCP tools do or how agents should use them, edit src/mcp/server-instructions.ts — it is the single source of truth for agent-facing tool guidance (issue #529). The installer's short instructions-file block (instructions-template.ts) only names codegraph_explore and the codegraph explore CLI; update it only when a tool or CLI command is renamed or removed. (The repo's own checked-in .cursor/rules/codegraph.mdc is dogfooding config — update it too if you use Cursor on this repo, but it ships nowhere.)

  • Before adding or extending a router, a web framework, or a language's WHEN rules, read docs/design/framework-coverage.md. It is the standing answer to "what is supported and what is left" across the three axes (route nodes → Entry points, navigates edges → Screens, branch-guard rules → the WHEN labels), with what each remaining item needs, the traps that have already cost debugging time, and the queries to re-verify it. Update it in the same change that moves a row.

  • CodeGraph provides code context, not product requirements. For new features, ask the user about UX, edge cases, and acceptance criteria — the graph won't tell you.

  • When the user references issues, PR comments, or external reports, anchor them to a date and version before drawing conclusions. Check the comment's createdAt against:

    • The last released version — grep -m1 '^## \[' CHANGELOG.md shows the top-of-file version (older releases follow). A comment dated before the latest ## [X.Y.Z] - YYYY-MM-DD is reacting to released state — work that's only on main or on an unmerged branch doesn't apply.

    • The last main commit — git log --first-parent main -1 --format='%ai %h %s'. A comment after the last release but before a fix on main may already be addressed there but unreleased.

    • The current branch's tip — your own unmerged work obviously can't be what the comment is reacting to. Always disambiguate "released," "merged-but-unreleased," and "in-progress" before agreeing that a user-reported problem is unfixed (or that a fix is incomplete). A user saying "your fix only covers X" about a recent PR is usually pointing at the released shortcomings — your in-flight branch may already address them but they have no way to know that.

  • Version-tag every image referenced in README.md. GitHub caches README images (raw.githubusercontent.com with a 5-minute TTL; third-party hosts sit behind the long-lived camo proxy), so updating an asset in place can keep showing the stale version. Give each README image URL a ?v=N query tag and bump N in the same commit whenever the asset bytes change — e.g. assets/waitlist.svg?v=2. The changed URL sidesteps every cache so the new image shows immediately instead of waiting on a TTL to expire.

512 files · 493 not served here

Advantages

  • Reduces token usage and tool calls by providing surgical, pre-indexed code context. evidence: README.md
  • Operates 100% locally with no external dependencies or cloud data transmission. evidence: README.md
  • Maintains an up-to-date index automatically through file-system watching. evidence: README.md

Limitations

  • Requires an initial indexing step per project which may take time for very large codebases. evidence: README.md
  • Increases the persistent context window footprint in long-running agent sessions. evidence: README.md

Security

Risk level: High risk

This brain runs

Agent instructions that run or fetch something (75)

  • .claude/skills/add-lang/SKILL.md: Run from the codegraph repo root.
  • .claude/skills/add-lang/SKILL.md: node scripts/add-lang/check-grammar.mjs <lang> path/to/valid-sample.<ext>
  • .claude/skills/add-lang/SKILL.md: npm pack @tree-sitter-grammars/tree-sitter-<lang> # often ships a prebuilt *.wasm
  • .claude/skills/add-lang/SKILL.md: then add the token to the vendored branch in Step 4 and re-run check-grammar on the vendored path until it PASSes.
  • .claude/skills/add-lang/SKILL.md: or `curl` a raw file from a known repo), then: · uses the network
  • .claude/skills/add-lang/SKILL.md: node scripts/add-lang/dump-ast.mjs <lang> path/to/sample.<ext>
  • .claude/skills/add-lang/SKILL.md: node scripts/add-lang/dump-ast.mjs src/extraction/wasm/tree-sitter-<lang>.wasm sample.<ext>
  • .claude/skills/add-lang/SKILL.md: npm run build # tsc + copy-assets (copies any vendored *.wasm into dist/)
  • .claude/skills/add-lang/SKILL.md: node scripts/add-lang/verify-extraction.mjs <sample-repo> <lang>
  • .claude/skills/add-lang/SKILL.md: On FAIL or a thin WARN: re-run `dump-ast.mjs` on a richer file, fix the mappings in `<lang>.ts`, `npm run build`, re-index, re-verify.
  • .claude/skills/add-lang/SKILL.md: npx vitest run __tests__/extraction.test.ts
  • .claude/skills/add-lang/SKILL.md: npm run build && ./scripts/local-install.sh
  • .claude/skills/add-lang/SKILL.md: `bench.sh` clones (shared `/tmp/codegraph-corpus`), wipes + indexes, runs `verify-extraction.mjs`, then the with/without retrieval A/B via `scripts/agent-eval/run-all.sh` (skips the paid A/B if extraction is broken).
  • .claude/skills/add-lang/SKILL.md: Read each `parse-run.mjs` summary printed by `run-all.sh`: tool calls, file `Read`s, Grep/Bash, codegraph-tool calls, duration, and **cost** — for both the `with` and `without` arms.
  • .claude/skills/add-lang/SKILL.md: After the loop, restore the dev link if needed: `./scripts/local-install.sh`.
  • .claude/skills/add-lang/SKILL.md: Any new `*.wasm` must live in `src/extraction/wasm/` — `copy-assets` (run by `npm run build`) ships it;
  • .claude/skills/agent-eval/SKILL.md: Run from the codegraph repo root.
  • .claude/skills/agent-eval/SKILL.md: - [ ] 5. Run audit.sh in the background
  • .claude/skills/agent-eval/SKILL.md: **Step 4 — harness.** Ask with `AskUserQuestion` which harness to run, and map the answer to a MODE token:
  • .claude/skills/agent-eval/SKILL.md: **Step 5 — run.** Launch in the background (sets the version, clones if missing, wipes + re-indexes, runs the chosen arms — several minutes):
  • .claude/skills/agent-eval/SKILL.md: Headless (`parse-run.mjs`): total tool calls, file `Read`s, Grep/Bash, codegraph-tool calls, duration, **total cost**.
  • .claude/skills/agent-eval/SKILL.md: The index is rebuilt every run (`audit.sh` wipes `.codegraph`) — different versions extract differently, so an index must be served by the same binary that built it.
  • .claude/skills/agent-eval/SKILL.md: `audit.sh` temporarily mutates the global `codegraph` install for the test, then restores your dev link via `local-install.sh`.
  • .cursor/rules/codegraph.mdc: Indexing is the user's decision: tell them they can run `codegraph init` to build the index, but don't run it yourself.
  • AGENTS.md: npm run build # tsc + copy schema.sql and *.wasm + build the viewer into dist/; chmods dist/bin/codegraph.js
  • AGENTS.md: npm run build:lib # the viewer's components as @colbymchenry/codegraph-ui (ui/dist) — NOT part of `build`
  • AGENTS.md: npm run dev # tsc --watch
  • AGENTS.md: npm run clean # rm -rf dist
  • AGENTS.md: npm test # vitest run (all)
  • AGENTS.md: npm run test:watch
  • AGENTS.md: npm run test:eval # only __tests__/evaluation/
  • AGENTS.md: npm run eval # build then run __tests__/evaluation/runner.ts via tsx
  • AGENTS.md: npm run cli # build then run the local dist binary
  • AGENTS.md: npx vitest run __tests__/installer-targets.test.ts
  • AGENTS.md: npx vitest run __tests__/extraction.test.ts -t "TypeScript"
  • AGENTS.md: `npm run build:lib` is separate and does NOT run as part of `npm run build`: it compiles the same `ui/src` tree a second way, with `svelte-package`, into `ui/dist` — the `@colbymchenry/codegraph-ui` component library the Pro app imports (task CG-61).
  • AGENTS.md: Tests run as **two Vitest projects** (`test.projects` in `vitest.config.mts`): `engine` (node) and `ui` (jsdom, the Svelte plugin, `resolve.conditions: ['browser']`) for the single `__tests__/ui-package.test.ts`.
  • AGENTS.md: `npm test` still runs both.
  • AGENTS.md: That range is what users run.
  • AGENTS.md: Working in this repo needs Node 22.12 or newer: `devEngines` makes `npm ci` and `npm run` stop on anything older, for Vite 7 and Vitest 4.
  • AGENTS.md: Subcommands: `install`, `uninstall`, `init`, `uninit`, `index`, `sync`, `status`, `unlock`, `query`, `explore`, `context`, `node`, `files`, `callers`, `callees`, `impact`, `affected`, `cycles`, `daemon`, `telemetry`, `upgrade`, `version`.
  • AGENTS.md: `src/installer/` is the entry point for `codegraph install` (and the bare `codegraph`/`npx @colbymchenry/codegraph` invocation).
  • AGENTS.md: An entry already in the file is the user's: agents write switches into it and users pin a `command` or `cwd`, so a re-install or `--refresh` only fills in missing keys.
  • AGENTS.md: Edits are surgical via `jsonc-parser` so user comments and formatting survive install/re-install/uninstall round-trips.
  • AGENTS.md: a pre-#1698 `mcp.codegraph` + `enabled` entry is migrated on re-install and removed by uninstall.
  • AGENTS.md: their `install` only strips one a previous install left behind.
  • AGENTS.md: All installer changes need matching coverage in `__tests__/installer-targets.test.ts` — there are ~47 parameterized contract tests covering install idempotency, sibling preservation, uninstall reverses install, byte-equal re-runs returning `unchanged`, and partial-state recovery for Codex.
  • AGENTS.md: Every expected/recoverable condition — project not indexed, symbol not found, file not in the index — returns a **SUCCESS-shaped response carrying the guidance** (`NotIndexedError` → `textResult`, see `ToolHandler.execute`'s catch).
  • AGENTS.md: deterministic probes (`scripts/agent-eval/probe-*.mjs`) then agent A/B (`scripts/agent-eval/run-all.sh` / `ab-new-vs-baseline.sh`).
  • AGENTS.md: run via `npm run eval` (builds first).
  • AGENTS.md: Not part of `npm test`.
  • AGENTS.md: The dev machine — and the default `npm test` target — is **macOS**, so local runs cover the macOS path.
  • AGENTS.md: Build a throwaway image from the repo and run the suite inside it:
  • AGENTS.md: `RUN npm ci && npm run build`.
  • AGENTS.md: Run with **`docker run --rm --init`**.
  • AGENTS.md: Connect / run from the Mac host: `ssh <user>@<guest_ip> "..."`. · uses the network
  • AGENTS.md: ssh [email protected] "powershell -NoProfile -ExecutionPolicy Bypass -Command -" <<'PS' · uses the network
  • AGENTS.md: Clone fresh into a **Windows-local** path (`C:\dev\codegraph`) and `npm ci` there — never run npm against the shared Mac repo, since `esbuild`/`rollup` ship platform-specific binaries.
  • AGENTS.md: Fetch a contributor PR head straight from their fork to dodge `pull/<n>/head` lag: `git fetch <fork-url> <branch>` then `git checkout -f FETCH_HEAD`. · uses the network
  • AGENTS.md: **Keep:** language & framework names (Go, Spring, NestJS, …), things a user types or sets (`codegraph install`, `codegraph_explore`, the `CODEGRAPH_*` env vars), agent / IDE names (Claude Code, Cursor, opencode, Kiro, …), and a brief `Thanks @user` when a contributor is credited.
  • AGENTS.md: Publishing manually is **wrong** now — a plain `npm publish` ships the root package (non-bundled), which breaks anyone on Node < 22.5.
  • AGENTS.md: When the maintainer DOES bump the version, the only edit strictly required is to `package.json` — the workflow's "Sync package-lock.json" step detects a mismatch between `package.json` and `package-lock.json`, runs `npm install --package-lock-only --ignore-scripts` to rewrite the lock …[+120 chars]
  • AGENTS.md: Once `package.json` is at the target version on `main`, trigger **Actions → Release → Run workflow** (on `main`).
  • AGENTS.md: Any change to `src/installer/` (especially `targets/`) needs corresponding test coverage and a CHANGELOG entry — installer regressions break every new install silently.
  • AGENTS.md: The **last main commit** — `git log --first-parent main -1 --format='%ai %h %s'`.
  • docs/AGENTS.md: **Agent A/B** (`scripts/agent-eval/run-all.sh <repo> "<Q>"`): with vs without codegraph, **≥2 runs/arm** (run-to-run variance is large — never conclude from n=1).
  • docs/AGENTS.md: **Every run also reports three feedback metrics** — residual context occupancy, explore sufficiency (what the agent did NEXT after each explore), and allocation efficiency (share of returned bytes the answer cited) — under each run, plus a side-by-side arm table (`compare-arms.mjs`).
  • docs/AGENTS.md: Check the contamination row before believing any number: `CLI calls that RETURNED output` > 0 invalidates the run (in a new-vs-baseline A/B it silently drops calls from all three metrics, since a CLI explore is not a tool call).
  • docs/AGENTS.md: (b) **Sonnet is the deliberate floor model** — codegraph's real users attach it to whatever agent they already run (Cursor Composer, Gemini, etc.), so we validate on a "dumber" model on purpose: a stronger model's tool-use covers up the salience/sufficiency problems a weaker one exposes.
  • docs/AGENTS.md: **MCP attach is a startup-latency issue, not a hard block.** On a multi-step task the agent dives into Read/grep before codegraph finishes its ~2-3s startup (worse when the eval is itself run nested inside a Claude session, under CPU contention), so it runs with no codegraph.
  • docs/AGENTS.md: judge by actual codegraph usage in `parse-run.mjs`'s `by type`.
  • docs/AGENTS.md: To isolate a change — **new-build vs baseline-build, both codegraph-on** (vs run-all.sh's with-vs-without) — use `scripts/agent-eval/ab-new-vs-baseline.sh <indexed-repo> "<task>" [baseline-ref]` (it bakes in the pre-warm).
  • docs/AGENTS.md: After steering flow questions to `codegraph_trace` first: **best run 0 Read / 0 Grep / 3 codegraph / 51s**;
  • docs/AGENTS.md: Run-to-run variance is still real;
  • docs/AGENTS.md: node count stable at 9,289;

MCP servers (1)

  • README.md (codegraph): codegraph serve --mcp

Install scripts (5)

  • README.md: curl -fsSL https://raw.githubusercontent.com/colbymchenry/codegraph/main/install.sh | sh · uses the network
  • README.md: irm https://raw.githubusercontent.com/colbymchenry/codegraph/main/install.ps1 | iex · uses the network
  • README.md: - **You're on an old (pre-0.9) install.** Reinstall to get the bundled runtime — `curl -fsSL https://raw.githubusercontent.com/colbymchenry/codegraph/main/install.sh | sh` (macOS/Linux), `irm https://raw.githubusercontent.com/colbymchenry/codegraph/main/install.ps1 | iex` (Windows), or …[+42 chars] · uses the network
  • install.ps1: pwsh install.ps1 · uses the network
  • install.sh: sh install.sh · uses the network

Binaries (29)

  • src/extraction/wasm/tree-sitter-arkts.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-c.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-c_sharp.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-cfml.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-cfquery.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-cfscript.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-cobol.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-cpp.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-dart.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-erlang.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-go.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-java.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-javascript.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-kotlin.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-lua.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-luau.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-nix.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-pascal.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-php.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-python.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-r.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-ruby.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-rust.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-scala.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-swift.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-terraform.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-tsx.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-typescript.wasm: ships native binaries
  • src/extraction/wasm/tree-sitter-vbnet.wasm: ships native binaries
  • High risk: runs-install-script-remote-exec (install.ps1)
  • High risk: remote-exec (install.ps1:72)
  • Medium risk: runs-instruction-instruction-network (.claude/skills/add-lang/SKILL.md:82)
  • Medium risk: runs-instruction-instruction-network (AGENTS.md:209)
  • Medium risk: runs-instruction-instruction-network (AGENTS.md:211)
  • Medium risk: runs-instruction-instruction-network (AGENTS.md:218)
  • Medium risk: runs-install-script-remote-exec (README.md:91)
  • Medium risk: runs-install-script-remote-exec (README.md:94)
  • Medium risk: runs-install-script-remote-exec (README.md:915)
  • Medium risk: remote-exec-pipe (install.ps1:72)
  • Medium risk: network-variable-host (install.ps1:146)
  • Medium risk: runs-install-script-network-variable-host (install.sh)
  • Medium risk: network-variable-host (install.sh:76)
  • Low risk: scripts-present (__tests__/evaluation/runner.ts)
  • Low risk: scripts-present (install.ps1)
  • Low risk: scripts-present (install.sh)
  • Low risk: scripts-present (scripts/add-lang/check-grammar.mjs)
  • Low risk: scripts-present (scripts/add-lang/dump-ast.mjs)
  • Low risk: scripts-present (scripts/add-lang/verify-extraction.mjs)
  • Low risk: scripts-present (scripts/check-ui-build.mjs)

Attribution and licence

First committed by
GitHub avatar of colbymchenrycolbymchenry
Publisher
Colby Mchenry (Community)
Source
colbymchenry/codegraph · commit f72c9d2
Licence
MIT License (files served here)
  • ATTRIBUTION.md (written by AutoGineer)
Synced
Contributors
colbymchenry, JosefAschauer, inth3shadows, maxmilian, GeneralClaw

AutoGineer is not affiliated with or endorsed by colbymchenry.

Install from source

493 of its files are not served here, so there is no ZIP. colbymchenry/codegraph at f72c9d2