Generated banner for graphify
Generated logo for graphify

graphify

Memory server

First committed by safishamsi

Published in Graphify-Labs/graphify. Publisher page

145,900 GitHub stars

What it is

Turn any codebase, with its docs, SQL schemas, configs, and PDFs, into a queryable knowledge graph. A /graphify skill for Claude Code, Cursor, Codex, and Gemini CLI: local deterministic AST parsing, every edge explained, no vector store.
— the description by safishamsi

AutoGineer overview, from the brain’s own files

Graphify transforms complex codebases, documentation, and various file formats into a structured knowledge graph. Unlike traditional RAG systems that rely on vector embeddings, Graphify uses deterministic AST parsing via tree-sitter to map code relationships, ensuring high accuracy and transparency. It provides agents with a bird's-eye view of the project, enabling them to query specific concepts, trace paths between components, and understand system architecture without the overhead of re-reading files or relying on probabilistic vector searches. The system supports a wide range of AI coding assistants and can be extended with Graphify Cloud for continuous, cross-repo monitoring and formal verification.

How it works

Memory model: Hybrid

AutoGineer overview, from the brain’s own files

Graphify installs as a skill within your AI coding assistant. It parses your project files using tree-sitter to create a deterministic knowledge graph. Code relationships like imports, calls, and inheritance are extracted directly from the source code. For non-code assets like PDFs or documentation, it performs a semantic pass. The resulting graph is stored locally as a JSON file, which the agent can then query to explain concepts or find paths between nodes. Every connection in the graph is tagged as either explicitly extracted from the source or inferred by the system.

Folders
FolderRoleFiles
.githubagent-config13
docsdocs44
scriptsscripts1
teststests684
toolsscripts176
graphifyfolder236
workedfolder36

The agent reads

The agent writes

Requirements

Runtimes: Python >=3.10,<3.15

Databases: FalkorDB, Neo4j, PostgreSQL, SQLite

API keys (by name): ANTHROPIC_API_KEY, AZURE_OPENAI_API_KEY, DEEPSEEK_API_KEY, GEMINI_API_KEY, GOOGLE_API_KEY, MOONSHOT_API_KEY, OPENAI_API_KEY

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Google Antigravity, Kiro, OpenCode, Amp, Roo Code, Cline, JetBrains Junie, Devin (ex-Windsurf)

Set it up

  1. This brain runs code automatically: 3 scripts. Review README.md, graphify/install.py before opening the folder in Claude Code. No step below turns a hook on for you.

    • README.md: | uv *(recommended)* | any | `uv --version` | `curl -LsSf https://astral.sh/uv/install.sh \| sh` |
    • README.md: curl -LsSf https://astral.sh/uv/install.sh | sh
    • graphify/install.py: python graphify/install.py
  2. Not scanned by AutoGineerIts dependencies are installed by pip or uv when you run it and were not scanned by AutoGineer (31 declared). https://pypi.org/project/graphifyy/
  3. First committed by safishamsi. Published in Graphify-Labs/graphify. Licence: Apache License 2.0.

Usage

AutoGineer overview, from the brain’s own files

  • Querying the graph to explain specific code components.
  • Tracing the shortest path between two disparate code modules.
  • Identifying 'god nodes' or central concepts within a codebase.
  • Generating a high-level report of key concepts and connections.
  • Updating the graph incrementally after code changes.
  • Integrating with AI agents to reduce token usage by querying the graph instead of reading files.
“/graphify explain "APIRouter"”
Returns the node details for APIRouter, including its source location, community, degree, and all explicit or inferred connections.
“/graphify path "FastAPI" "ModelField"”
Displays the shortest path between the two nodes, showing the intermediate hops and the overall confidence of the path.

Documentation by safishamsi

<p align="center"> <a href="https://graphify.com"><img src="https://raw.githubusercontent.com/Graphify-Labs/graphify/v8/docs/graphify-logo.png" width="360" height="189" alt="Graphify"/></a> </p>

<p align="center"> <a href="https://trendshift.io/repositories/25296?utm_source=repository-badge&amp;utm_medium=badge&amp;utm_campaign=badge-repository-25296" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/repositories/25296" alt="Graphify-Labs%2Fgraphify | Trendshift" width="250" height="55"/></a> </p>

<div align="center"> <details><summary><b>Read this in other languages</b></summary>

<a href="README.md">English</a> | <a href="docs/translations/README.zh-CN.md">简体中文</a> | <a href="docs/translations/README.ja-JP.md">日本語</a> | <a href="docs/translations/README.ko-KR.md">한국어</a> | <a href="docs/translations/README.de-DE.md">Deutsch</a> | <a href="docs/translations/README.fr-FR.md">Français</a> | <a href="docs/translations/README.es-ES.md">Español</a> | <a href="docs/translations/README.hi-IN.md">हिन्दी</a> | <a href="docs/translations/README.pt-BR.md">Português</a> | <a href="docs/translations/README.ru-RU.md">Русский</a> | <a href="docs/translations/README.ar-SA.md">العربية</a> | <a href="docs/translations/README.fa-IR.md">فارسی</a> | <a href="docs/translations/README.it-IT.md">Italiano</a> | <a href="docs/translations/README.pl-PL.md">Polski</a> | <a href="docs/translations/README.nl-NL.md">Nederlands</a> | <a href="docs/translations/README.tr-TR.md">Türkçe</a> | <a href="docs/translations/README.uk-UA.md">Українська</a> | <a href="docs/translations/README.vi-VN.md">Tiếng Việt</a> | <a href="docs/translations/README.id-ID.md">Bahasa Indonesia</a> | <a href="docs/translations/README.sv-SE.md">Svenska</a> | <a href="docs/translations/README.el-GR.md">Ελληνικά</a> | <a href="docs/translations/README.ro-RO.md">Română</a> | <a href="docs/translations/README.cs-CZ.md">Čeština</a> | <a href="docs/translations/README.fi-FI.md">Suomi</a> | <a href="docs/translations/README.da-DK.md">Dansk</a> | <a href="docs/translations/README.no-NO.md">Norsk</a> | <a href="docs/translations/README.hu-HU.md">Magyar</a> | <a href="docs/translations/README.th-TH.md">ภาษาไทย</a> | <a href="docs/translations/README.uz-UZ.md">Oʻzbekcha</a> | <a href="docs/translations/README.zh-TW.md">繁體中文</a> | <a href="docs/translations/README.fil-PH.md">Filipino</a> | <a href="docs/translations/README.he-IL.md">עברית</a>

</details> </div>

<p align="center"> <a href="https://pypi.org/project/graphifyy/"><img src="https://img.shields.io/pypi/v/graphifyy" alt="PyPI"/></a> <a href="https://github.com/Graphify-Labs/graphify/actions/workflows/ci.yml"><img src="https://github.com/Graphify-Labs/graphify/actions/workflows/ci.yml/badge.svg?branch=v8" alt="CI"/></a> <a href="LICENSE"><img src="https://img.shields.io/badge/License-Apache%202.0-blue" alt="License: Apache-2.0"/></a> <a href="https://pepy.tech/project/graphifyy"><img src="https://img.shields.io/pepy/dt/graphifyy?color=blue&label=downloads" alt="Downloads"/></a> <a href="https://docs.graphify.com"><img src="https://img.shields.io/badge/Docs-docs.graphify.com-0b7285?style=flat&logo=readthedocs&logoColor=white" alt="Docs"/></a> <a href="https://app.graphify.com/login"><img src="https://img.shields.io/badge/Graphify%20Cloud-app.graphify.com-118d4f?style=flat&logoColor=white" alt="Graphify Cloud"/></a> <a href="https://discord.gg/graphify"><img src="https://img.shields.io/badge/Discord-Join-5865F2?style=flat&logo=discord&logoColor=white" alt="Discord"/></a> <a href="https://www.youtube.com/@graphifylabs"><img src="https://img.shields.io/badge/YouTube-Graphify%20Labs-FF0000?style=flat&logo=youtube&logoColor=white" alt="YouTube"/></a> <a href="https://www.linkedin.com/company/graphify-labs"><img src="https://img.shields.io/badge/LinkedIn-Graphify%20Labs-0077B5?logo=linkedin" alt="LinkedIn"/></a> <a href="https://www.ycombinator.com/companies/graphify-labs"><img src="https://img.shields.io/badge/Y%20Combinator-S26-F0652F?style=flat&logo=ycombinator&logoColor=white" alt="YC S26"/></a> </p>

<p align="center"> <b>Cut agent token spend by 80%.</b> Graphify Cloud is always-on memory that governs your agents, keeps code quality high, and proves correctness with formal verification. <a href="https://app.graphify.com/login"><b>Start a free 14-day trial &rarr;</b></a> </p>

Type /graphify in your AI coding assistant and it maps your entire project (code, docs, PDFs, images, videos) into a knowledge graph you can query instead of grepping through files.

  • Code maps for free, fully local. Code is parsed with tree-sitter AST: deterministic, no LLM, nothing leaves your machine. (Docs, PDFs, images and video use your assistant's model, or a configured API key, for a semantic pass.)

  • Every edge is explained. Each connection is tagged EXTRACTED (explicit in the source) or INFERRED (resolved by graphify), so you can tell what was read directly from what was inferred.

  • Not a vector index. No embeddings, no vector store: a real graph you traverse. Ask a question, trace the path between two things, or explain one concept.

NOTE
Want this always-on? Graphify Cloud keeps the graph live across your entire SDLC: monorepo and cross-repo support, formal verification, and code review with a bird's-eye view of your SDLC, plus connectors for Sentry, Jira, and more so incidents and tickets sit in the same graph as your code. Start a free 14-day trial at app.graphify.com.

<p align="center"> <img src="https://raw.githubusercontent.com/Graphify-Labs/graphify/v8/docs/graph-hero.png" alt="graphify's interactive graph.html showing the FastAPI codebase as a force-directed knowledge graph with a legend of detected communities" width="900"> </p> <p align="center"> <em>The FastAPI codebase mapped by graphify. Every node is a concept, colors are detected communities, and the whole thing is clickable in graph.html.</em> </p>

Get started (30 seconds). Needs Python 3.10+ and uv (or pipx):

uv tool install graphifyy      # install the CLI (or: pipx install graphifyy)
graphify install               # detects your assistant and registers the skill

Then, in your AI assistant:

/graphify .

That's it. You get three files:

graphify-out/
├── graph.html       open in any browser: click nodes, filter, search
├── GRAPH_REPORT.md  the highlights: key concepts, surprising connections, suggested questions
└── graph.json       the full graph: query it anytime without re-reading your files

The persisted graph includes graph.schema_version so integrations can detect incompatible format changes, plus graph.graphify_version identifying the Graphify release that produced it.

One install, any assistant, any OS. Claude Code, Cursor, Codex, Gemini CLI, GitHub Copilot, and 20+ more, on macOS, Linux, and Windows: pick your platform.


See it in action

<p align="center"> <img src="https://raw.githubusercontent.com/Graphify-Labs/graphify/v8/docs/demo-path.svg" alt="graphify path query: a terminal asks for the shortest path between FastAPI and ModelField, and the answer lights up hop by hop across the knowledge graph" width="900"> </p>

Once the graph is built you query it instead of reading files. Real output, graphify run on the FastAPI codebase shown above:

$ graphify explain "APIRouter"
Node: APIRouter
  Source:    routing.py L2210
  Community: 2
  Degree:    47

Connections (47):
  --> RequestValidationError [uses] [INFERRED]
  --> Dependant [uses] [INFERRED]
  --> .get() [method] [EXTRACTED]
  <-- __init__.py [imports] [EXTRACTED]
  ...

$ graphify path "FastAPI" "ModelField"
Shortest path (3 hops):
  FastAPI --uses--> DefaultPlaceholder <--references-- get_request_handler() --references--> ModelField

Every edge carries a confidence tag (EXTRACTED = explicit in the source, INFERRED = derived by resolution), so you can tell what was read directly from what was inferred. graphify query "<question>" returns a scoped subgraph for a plain-language question, and graphify path A B traces how any two things connect, ending with the path's overall confidence: that of its weakest hop.


What it does

What you get out of the box:

CapabilityWhat you get
God nodesThe most-connected concepts, so you see what everything flows through
CommunitiesThe graph split into subsystems (Leiden), with LLM-free labels
Cross-file linkscalls / imports / inherits / mixes_in resolved across ~40 languages via tree-sitter AST
Query, path, explainAsk a question, trace the path between two things, or explain one concept, all against graph.json
Rationale + doc refs# NOTE: / # WHY: comments and ADR/RFC citations become first-class nodes linked to the code
Beyond codeDocs, PDFs, images, and video/audio all map into the same graph
Local-firstCode is parsed locally with tree-sitter (no LLM, nothing leaves your machine); only the semantic pass over docs/media calls a backend, and only if you configure one

TIP
Running this across many repos or a monorepo? Graphify Cloud does it continuously and cuts agent token spend by 80%, with cross-repo links, SDLC-wide code review, formal verification, and Sentry/Jira connectors. Start a free 14-day trial &rarr;


Benchmarks: 0.497 recall@10, 0 LLM credits

BenchmarkMetricgraphifyField
LOCOMO (n=300)recall@100.497mem0 0.048, supermemory 0.149
LOCOMO (n=300)QA accuracy45.3%supermemory 49.7%, mem0 27.3%
LongMemEval-S (n=50)QA accuracy76%tied with dense RAG
ERPNext cross-tool (n=6)key-fact coverage82.0%grep/read baseline 70.8%
Graph buildLLM credits0per-token for most systems

Every system ran on the same harness with the same model and budgets, scored by a judge blind-validated against a second judge (90.6% agreement, Cohen's kappa 0.81). Full per-system tables, the code-intelligence result, and reproduction commands: BENCHMARKS.md.


Documentation

Full guides and reference live at docs.graphify.com:


Prerequisites

RequirementMinimumCheckInstall
Python3.10+python --versionpython.org
uv (recommended)anyuv --versioncurl -LsSf https://astral.sh/uv/install.sh | sh
pipx (alternative)anypipx --versionpip install pipx

macOS quick install (Homebrew):

brew install [email protected] uv

Windows quick install:

winget install astral-sh.uv

Ubuntu/Debian:

# uv manages its own Python, so this is the only step you need:
curl -LsSf https://astral.sh/uv/install.sh | sh
# or use the system Python with pipx:
sudo apt install python3 python3-pip pipx

Install

IMPORTANT
Official package: The PyPI package is graphifyy (double-y). Other graphify* packages on PyPI are not affiliated. The CLI command is still graphify.

The official source repository is Graphify-Labs/graphify.

The two-command quickstart is at the top of this README. This section covers the install methods, project-scoped installs, and every supported platform.

Install methods (pick one):

uv tool install graphifyy   # recommended, isolated env (if 'graphify' isn't found after, run: uv tool update-shell)
pipx install graphifyy      # alternative
pip install graphifyy       # may need PATH setup, see Troubleshooting below

Then run graphify install once. It detects which assistant you run and registers the skill, so there is no per-assistant setup. Open your AI assistant and type /graphify .

To install the assistant skill into the current repository instead of your user profile, add --project:

graphify install --project
graphify install --project --platform codex

Project-scoped installs write under the current directory, for example .claude/skills/graphify/SKILL.md or .agents/skills/graphify/SKILL.md (plus a references/ sidecar the skill loads on demand), and print a git add hint for files that can be committed. Per-platform commands that support project-scoped installs accept the same flag, for example graphify claude install --project or graphify codex install --project.

TIP
Hitting command not found, a pip-on-Mac/Windows issue, PowerShell quoting, uvx usage, git-hook PATH quirks, or strict mode? See Installation and Troubleshooting.

<details> <summary><b>Pick your platform</b> (20+ assistants, click to expand)</summary>

PlatformInstall command
Claude Code (Linux/Mac)graphify install
Claude Code (Windows)graphify install (auto-detected) or graphify install --platform windows
CodeBuddygraphify install --platform codebuddy
Codexgraphify install --platform codex
OpenCodegraphify install --platform opencode
Kilo Codegraphify install --platform kilo
GitHub Copilot CLIgraphify install --platform copilot
VS Code Copilot Chatgraphify vscode install
Aidergraphify install --platform aider
OpenClawgraphify install --platform claw
Factory Droidgraphify install --platform droid
Traegraphify install --platform trae
Trae CNgraphify install --platform trae-cn
Gemini CLIgraphify install --platform gemini
Hermesgraphify install --platform hermes
Kimi Codegraphify install --platform kimi
Ampgraphify amp install
Agent Skills (cross-framework)graphify install --platform agents (alias --platform skills)
Kiro IDE/CLIgraphify kiro install
Pi coding agentgraphify install --platform pi, plus graphify pi guard install for the native guard
Cursorgraphify cursor install
Devin CLIgraphify devin install
Google Antigravitygraphify antigravity install
Google Antigravity (Windows)graphify antigravity install (auto-detected on Windows)

Codex users also need multi_agent = true under [features] in ~/.codex/config.toml for parallel extraction. CodeBuddy uses the same Agent tool and PreToolUse hook mechanism as Claude Code. Factory Droid uses the Task tool for parallel subagent dispatch. OpenClaw and Aider use sequential extraction (parallel agent support is still early on those platforms). Trae uses the Agent tool for parallel subagent dispatch and does not support PreToolUse hooks, so AGENTS.md is the always-on mechanism.

--platform agents (alias --platform skills) targets the generic cross-framework Agent-Skills locations: the spec's user-global ~/.agents/skills/ (read by npx skills and spec-compliant frameworks) for a global install, and ./.agents/skills/ for a project (--project) install. The bare graphify install stays single-platform (Claude Code) by design: use the named agents platform when you want the skill discoverable by any framework that reads .agents/skills.

Claude Code's graphify install --project --strict makes Read and dedicated Grep share one denial per session unless a recent graph query has oriented the agent (default 30 minutes). A Grep over a directory needs no indexed-file match; a Grep pinned to a single file is denied only when the graph indexes that file, as with Read. External and graph-output Grep targets produce neither a deny nor a nudge, in soft mode as well as strict mode, matching Read's scope. A graph marked needs_update never triggers a Grep denial. Bash searches and Glob stay advisory. GRAPHIFY_HOOK_STRICT=1 enables the policy without reinstalling; GRAPHIFY_HOOK_STRICT=0 disables it even when installed with --strict. Existing strict installs need a reinstall to add the search hook's --strict flag, or the environment override. Soft nudges are capped per session (GRAPHIFY_HOOK_NUDGE_CAP, default 5). After a context compaction, a SessionStart hook (matcher compact) resets that budget, the subagents' budgets and the strict denial, since the compacted context no longer holds the earlier nudges.

Pi has no PreToolUse hook, so graphify pi guard install registers a native Pi extension (via Pi's own pi install <package directory>) that runs the installed graphify hook-guard before Pi's read, grep, find and search-style bash calls. Fresh/stale graph decisions and the GRAPHIFY_HOOK_STRICT=1 once-per-session denial shared by indexed Read and dedicated Grep come from that same policy, so Pi matches Claude Code's hook behavior; Bash and file listing remain advisory. Guidance arrives as a <system-reminder source="graphify"> steering message. It needs Pi 0.58.4 or newer: earlier versions let a steering message skip the rest of a parallel tool-call batch. The package ships inside the Graphify installation, so install Graphify persistently (uv tool install graphifyy or pipx install graphifyy, not uvx), restart Pi after installing or upgrading, and remove it with graphify pi guard uninstall. Only local file targets are inspected; the hook needs graphify on an absolute PATH entry outside the project, is bounded to a two-second, 256 KiB-in/64 KiB-out call, and fails open. The same package also loads in Oh My Pi: omp plugin install "$(graphify pi guard path)". The registered path contains the Python version and venv, so re-run graphify pi guard install after changing either, and remove the old entry with pi remove <old path>.

Codex uses $graphify instead of /graphify.

</details>

<details> <summary><b>Optional extras</b> (install only what you need)</summary>

ExtraWhat it addsInstall
pdfPDF extractionuv tool install "graphifyy[pdf]"
office.docx and .xlsx supportuv tool install "graphifyy[office]"
googleGoogle Sheets renderinguv tool install "graphifyy[google]"
videoVideo/audio transcription (faster-whisper + yt-dlp)uv tool install "graphifyy[video]"
mcpMCP stdio serveruv tool install "graphifyy[mcp]"
watchAuto-rebuild on file changes (graphify watch)uv tool install "graphifyy[watch]"
neo4jNeo4j push supportuv tool install "graphifyy[neo4j]"
falkordbFalkorDB push supportuv tool install "graphifyy[falkordb]"
svgSVG graph exportuv tool install "graphifyy[svg]"
leidenLeiden community detection (graspologic on Python < 3.13; native backend on 3.13+)uv tool install "graphifyy[leiden]"
ollamaOllama local inferenceuv tool install "graphifyy[ollama]"
openaiOpenAI / OpenAI-compatible APIsuv tool install "graphifyy[openai]"
geminiGoogle Gemini APIuv tool install "graphifyy[gemini]"
anthropicAnthropic Claude API (--backend claude, uses ANTHROPIC_API_KEY)uv tool install "graphifyy[anthropic]"
bedrockAWS Bedrock (uses IAM, no API key)uv tool install "graphifyy[bedrock]"
azureAzure OpenAI Service (--backend azure, uses AZURE_OPENAI_API_KEY + AZURE_OPENAI_ENDPOINT)uv tool install "graphifyy[openai]"
sqlSQL schema extractionuv tool install "graphifyy[sql]"
postgresLive PostgreSQL introspection (--postgres DSN)uv tool install "graphifyy[postgres]"
dmBYOND DreamMaker .dm/.dme AST extraction (may need a C compiler + python3-dev if no wheel matches your platform)uv tool install "graphifyy[dm]"
terraformTerraform / HCL .tf/.tfvars/.hcl AST extractionuv tool install "graphifyy[terraform]"
pascalPascal / Delphi .pas/.dpr/.dpk/.inc AST extraction (more accurate calls/inherits edges; falls back to a regex extractor when absent)uv tool install "graphifyy[pascal]"
ocamlOCaml .ml/.mli AST extractionuv tool install "graphifyy[ocaml]"
commonlispCommon Lisp .lisp/.cl/.lsp/.asd AST extractionuv tool install "graphifyy[commonlisp]"
robotRobot Framework .robot/.resource extraction (suites, test cases, keywords, keyword-call and resource/library import edges)uv tool install "graphifyy[robot]"
chineseChinese query segmentation (jieba)uv tool install "graphifyy[chinese]"
allEverything aboveuv tool install "graphifyy[all]"

</details>


Make your assistant always use the graph

Run this once in your project after building a graph:

Run graphify <platform> install once in your project, for example graphify claude install or graphify codex install (or graphify install --platform <name>).

This writes a small config file that tells your assistant to consult the knowledge graph for codebase questions, preferring scoped queries like graphify query "<question>" over reading the full report or grepping raw files.

  • Hook platforms (Claude Code, Gemini CLI): a hook fires automatically before search-style tool calls (and, on Claude Code, before reading source files one by one via the Read/Glob tools, or via cat, head, tail, sed -n and similar readers in Bash) and nudges your assistant toward the graph path.

  • Instruction-file platforms (Codex, OpenCode, Cursor, etc.): persistent instruction files (AGENTS.md, .cursor/rules/, etc.) provide the same query-first guidance.

GRAPH_REPORT.md is still available for broad architecture review.

Exactly which files each platform writes (CodeBuddy's CODEBUDDY.md + PreToolUse hooks, Codex's AGENTS.md, Kilo's native .kilo plugin, Cursor's alwaysApply rule, and so on) is covered in Always-on setup.

To remove graphify from all platforms at once: graphify uninstall (add --purge to also delete graphify-out/). Or use the per-platform command (e.g. graphify claude uninstall).

CLI skills or MCP instructions?

The instructions installed by graphify install and those supplied with a Graphify MCP connection describe different ways to query a graph:

SetupGuidance to useQuery access
Local CLI and installed assistant skillThe platform instructions written by graphify installRun graphify query, graphify path, and graphify explain against the local graph (graphify-out/ by default).
Connected Graphify MCP serverThe connection's instructions and the tools listed by that serverCall the listed MCP tools against the graph served by that connection. Tool names and descriptions come from the server.

Both encourage scoped graph queries before broad source searches. Choose the instructions that match the tools your assistant can actually access; neither block establishes a universal precedence rule for your assistant's instruction files. If you use both integrations, identify which graph each queries and choose a primary query path instead of copying two unconditional instruction blocks into AGENTS.md.

graphify install installs the local assistant integration; it does not establish an MCP connection. An MCP client does not need to run local CLI queries to use its connected server. A locally hosted server still needs its own Graphify installation and graph, while a hosted connection may serve a graph that is not present in the client's working directory. If the expected tools are missing, check the relevant CLI installation or MCP connection rather than treating the other setup's instructions as interchangeable.


What's in the report

GRAPH_REPORT.md summarizes the god nodes, communities, and key paths for broad architecture review. How the graph is built and what it contains: How graphify works.


What files it handles: ~40 languages

graphify parses ~40 programming languages locally with tree-sitter AST, and maps docs, PDFs, images, and audio/video through an optional semantic pass. Full list: Supported inputs.


Common commands

/graphify .                        # build graph for current folder
/graphify ./docs --update          # re-extract only changed files
/graphify . --cluster-only         # rerun clustering without re-extracting
/graphify . --cluster-only --resolution 1.5      # more granular communities
/graphify . --cluster-only --exclude-hubs 99     # suppress utility super-hubs from god-node rankings
/graphify . --no-viz               # skip the HTML, just the report + JSON
/graphify . --wiki                 # build a markdown wiki from the graph
graphify export callflow-html      # Mermaid architecture/call-flow HTML (auto-regenerates on every git commit if hook is installed)

/graphify query "what connects auth to the database?"
/graphify path "UserService" "DatabasePool"
/graphify explain "RateLimiter"

/graphify add https://arxiv.org/abs/1706.03762   # fetch a paper and add it
/graphify add <youtube-url>                       # transcribe and add a video

graphify hook install              # auto-rebuild on commit + branch checkout (run `graphify update .` after `git pull`: see "Recommended workflow" below)
graphify merge-graphs a.json b.json              # combine two graphs

graphify prs                       # PR dashboard: CI state, review status, worktree mapping
graphify prs 42                    # deep dive on PR #42 with graph impact
graphify prs --triage              # AI ranks your review queue (uses whatever backend is configured)
graphify prs --conflicts           # PRs sharing graph communities: merge-order risk

See the full command reference below.


Labeling and rendering limits

  • --batch-size: 100 communities per labeling call by default, sized for a ~16k-token context (~150 tokens/community). Use --batch-size 40 for an 8k window. Context overflow is not split-retried; failed batches keep hub-derived names.

  • --missing-only: label --missing-only keeps existing labels and names only unnamed / Community N entries. Use label (full relabel) to refresh names after the community set changes.

  • .graphify_labels.json.sig: records the community membership signature; labels survive a re-cluster only while it matches.

  • export html: 5,000-node default; above it graphify renders an aggregated community view. Use --node-limit N. GRAPHIFY_VIZ_NODE_LIMIT / .graphifyrc viz_node_limit=N apply to cluster-only, update, watch, and hooks, not export html.

  • Leiden fallback: without the leiden extra, clustering silently uses networkx Louvain. Switching later reshuffles every community, so plan a full relabel.


Ignoring files

graphify honors .gitignore and supports --exclude patterns and a project .graphifyignore. Details: Configuration.

graphify extract reports paths skipped by ignore rules, with up to three sorted examples relative to the scan root. Each pruned directory counts once; its contents are not enumerated. Default noise directories such as node_modules are excluded from this summary. If source is missing, review the ignore rules. --no-gitignore bypasses VCS ignore rules only; .graphifyignore and --exclude remain effective.

Project configuration

Create a .graphifyrc in the scan root for settings that belong to the project rather than to one run. One key=value per line; lines beginning with # are comments.

Ambiguous extensions. Some extensions mean different languages in different projects: .inc is PHP on pfSense, Pascal in a Delphi tree, SQL or assembly elsewhere; .h is C or C++; .m is Objective-C or MATLAB. graphify has to pick one global default, and when it picks wrong the file does not fail: it parses as the wrong language and yields a handful of incidental nodes, so the graph looks populated while the real symbols are missing. Declare what the extension means in your repo:

# .graphifyrc
# A language name:
language.inc=php
# Or an extension graphify already knows:
language.tpl=.ts
# Baked into the git hooks (see Team setup):
viz_node_limit=0

The declaration flows through classification, extractor selection, grammar and resolution, imports, graphify watch, and the AST cache (a file re-parsed under a different language never reuses the old entry), and the same .graphifyrc is read by extract, update, the hooks, the MCP server, and the /graphify skill. A typo is reported once on stderr and the scan continues with the defaults. How declarations interact with caching, incremental rebuilds, and import resolution: Configuration.

Query defaults. Set query_budget to a positive integer and query_depth to an integer from 1 to 6:

query_budget=4000
query_depth=3

For graphify query, explicit --budget N / --budget=N and --depth N / --depth=N override these settings independently. Without a project setting or explicit option, the defaults remain budget 2000 and depth 2. These keys do not change the MCP server's defaults.

Settings come from the project owning the selected --graph, even when the command runs from another directory. An existing absolute directory in the graph's sibling .graphify_root marker identifies that project. Otherwise a matching relative GRAPHIFY_OUT suffix identifies it; absolute, empty, traversal-containing or nonmatching output paths fall back to the graph file's directory. Relative markers are ignored.

The query command always reads that project's .graphifyrc. An invalid recognized setting or an unreadable file produces one stderr warning and discards all project settings for that query; explicit options still apply. The settings parser stays strict for its other callers. Existing explicit budget values retain their behavior; persisted query_budget values must be positive.


Team setup

Commit or share the graph so your whole team queries the same context, and review pull requests with graph context. See Share context with your team and Review pull requests.


Using the graph directly

Beyond your AI assistant, query graph.json straight from the CLI with graphify query, graphify path, and graphify explain. A name that matches several nodes is refused with the candidates listed rather than guessed. Scripts can read the outcome from the exit code: 0 an answer, 3 an ambiguous name, 4 no matching node. See Ask better graph questions and the query reference.


Environment variables

Backends, API keys, hook behavior, and tuning are controlled by environment variables. Full table: Configuration.

  • Claude API prompt caching: GRAPHIFY_CLAUDE_PROMPT_CACHE controls system-prompt caching for --backend claude. Unset or blank keeps caching enabled; 1, true, yes, or on explicitly enables it, and 0, false, no, or off disables it (case-insensitive, surrounding whitespace ignored). Invalid values raise an error before sending a request. For example, run GRAPHIFY_CLAUDE_PROMPT_CACHE=0 graphify extract . --backend claude when an Anthropic-compatible endpoint rejects cache_control. Disabling sends the original plain-text system prompt. The setting applies equally to official Anthropic and custom ANTHROPIC_BASE_URL / ANTHROPIC_MODEL endpoints, including deep mode; it does not affect Bedrock, Claude CLI, or Graphify's local extraction cache. Enabling requests caching but cannot guarantee cache hits: the endpoint/model must support it and the prompt must meet its minimum length. Unsupported caching errors are not silently retried without caching.

  • Claude CLI model: GRAPHIFY_CLAUDE_CLI_MODEL overrides the model for the claude-cli backend (default: Opus). haiku or sonnet are usually enough for community naming; the semantic extraction pass benefits from a larger model.


Privacy

  • Code files: processed locally via tree-sitter. Nothing leaves your machine. A code-only corpus requires no API key: graphify extract runs fully offline. On a mixed repo, add --code-only to index just the code and skip the docs/PDFs/images that would otherwise need an LLM.

  • Video / audio: transcribed locally with faster-whisper. Nothing leaves your machine.

  • Docs, PDFs, images: sent to your AI assistant for semantic extraction (via the /graphify skill, using whatever model your IDE session runs). Headless graphify extract requires GEMINI_API_KEY / GOOGLE_API_KEY (Gemini), MOONSHOT_API_KEY (Kimi), ANTHROPIC_API_KEY (Claude), OPENAI_API_KEY (OpenAI), DEEPSEEK_API_KEY (DeepSeek), a running Ollama instance (OLLAMA_BASE_URL), AWS credentials via the standard provider chain (Bedrock - no API key needed, uses IAM), or the claude CLI binary (Claude Code - no API key needed, uses your Claude subscription). The --dedup-llm flag uses the same key.

  • Data residency: graphify extract auto-detects which provider to use based on which API key is set (priority: Gemini → Kimi → Claude → OpenAI → DeepSeek → Azure → Bedrock → Ollama). When it auto-detects, it prints the exact environment variable that chose the provider, so a run is never a surprise. To choose explicitly, pass --backend, or set GRAPHIFY_BACKEND=<name>; set GRAPHIFY_BACKEND=none to disable all LLM backends (semantic extraction and the claude -p labeling fallback) and keep a code-only graph. For code with data-residency requirements, use GRAPHIFY_BACKEND=ollama / --backend ollama (fully local). Kimi (MOONSHOT_API_KEY) routes to Moonshot AI servers in China.

  • No telemetry, no usage tracking, no analytics.

  • Query logging: every graphify query, graphify path, graphify explain, and MCP query_graph call is logged to ~/.cache/graphify-queries.log in JSON Lines format (timestamp, question, corpus, nodes returned, duration). Full subgraph responses are not stored by default. Set GRAPHIFY_QUERY_LOG_DISABLE=1 to opt out, or GRAPHIFY_QUERY_LOG=/dev/null to silence without disabling the code path.


Troubleshooting

Common install and extraction issues and their fixes: Troubleshooting.


Full command reference

Every command and flag, with examples: CLI reference.


Learn more


Graphify Cloud

Graphify Cloud is the always-on layer built on top of graphify. Instead of a graph you rebuild on demand per folder, it keeps one live graph across your entire software development lifecycle:

  • 80% fewer tokens: always-on memory means your agents stop re-reading and re-explaining the codebase every session.

  • Monorepo and cross-repo: one connected graph across every service and repository, not a graph per folder.

  • Formal verification: check architectural and dependency invariants against the live graph.

  • Code review with a bird's-eye view of your SDLC: see how a change ripples across the whole system before you merge.

  • SDLC connectors: pull in Sentry, Jira, and more, so incidents, tickets, and code live in one graph.

  • Always-on: updates continuously in the background across code, docs, and meetings.

Start a free 14-day trial at app.graphify.com &rarr;


Contributing

Contributions are welcome. See CONTRIBUTING.md for the development setup, the test and CI-parity commands, the git workflow, and what makes a strong contribution (worked examples and extraction bug reports are the most useful). Architecture and how to add a language: ARCHITECTURE.md.

New here? Say hi on Discord or in GitHub Discussions.


Contributors

<a href="https://github.com/Graphify-Labs/graphify/graphs/contributors"> <img src="https://contrib.rocks/image?repo=Graphify-Labs/graphify" alt="graphify contributors" /> </a>

Made with contrib.rocks.


Translations

The README is available in 32 languages. Use the language switcher at the top of this file to read it in yours, or browse docs/translations/. To improve a translation or add a new one, open a pull request against the matching file there.


Building on graphify

Building something in the graphify ecosystem? That is encouraged. If your project uses "graphify" in its name (for example graphify-dashboard or graphify-action), please add a short note to your README clarifying that it is community-built and not affiliated with or endorsed by Graphify Labs. "graphify" and the graphify logo are marks of Graphify Labs; please do not use them in a way that implies official status.


<p align="center"> <a href="https://graphify.com"><img src="https://img.shields.io/badge/Website-graphify.com-4c1?style=flat&logo=googlechrome&logoColor=white" alt="Website"/></a> <a href="https://discord.gg/graphify"><img src="https://img.shields.io/badge/Discord-Join-5865F2?style=flat&logo=discord&logoColor=white" alt="Discord"/></a> <a href="https://x.com/graphify"><img src="https://img.shields.io/badge/X-graphify-000000?logo=x&logoColor=white" alt="X"/></a> <a href="https://www.youtube.com/@graphifylabs"><img src="https://img.shields.io/badge/YouTube-Graphify%20Labs-FF0000?style=flat&logo=youtube&logoColor=white" alt="YouTube"/></a> <a href="https://github.com/sponsors/safishamsi"><img src="https://img.shields.io/badge/sponsor-safishamsi-ea4aaa?logo=github-sponsors" alt="Sponsor"/></a> <a href="https://safishamsi.gumroad.com/l/qetvlo"><img src="https://img.shields.io/badge/Book-The%20Memory%20Layer-2ea44f?style=flat&logo=gitbook&logoColor=white" alt="The Memory Layer"/></a> </p>

ARCHITECTURE.md

Architecture

graphify is a Claude Code skill backed by a Python library. The skill orchestrates the library; the library can be used standalone.

Pipeline

detect()  →  extract()  →  build()  →  cluster()  →  analyze helpers  →  report.generate()  →  export.to_*()

Each stage lives in its own module and they communicate through plain Python dicts and NetworkX graphs. While designed to minimize shared state, some stages (like extractors) rely on ambient module-level state around the active scan root. Most stages are a single function; analyze.py and export.py are sets of sibling functions rather than one entry point.

Module responsibilities

Signatures below are the real ones - tests/test_architecture_doc.py imports every symbol named here, so this table cannot drift from the code.

ModuleEntry point(s)Input → Output
detect.pydetect(root)directory → scan summary dict: files grouped by category, plus total_files, total_words, warning, scan_root, …
extract.pyextract(paths, *, root=None, ...), collect_files(target)list of file paths → {nodes, edges} dict. collect_files expands a directory into that list, and lives here, not in detect.py
build.pybuild(extractions), build_from_json(extraction)extraction dict(s) → nx.Graph
cluster.pycluster(G)graph → {community_id: [node_id, ...]} (the graph is not mutated)
analyze.pygod_nodes(G), surprising_connections(G), suggest_questions(G, communities, community_labels), find_import_cycles(G), graph_diff(G_old, G_new)graph → one list/dict per analysis. There is no single analyze() entry point
report.pygenerate(G, communities, cohesion_scores, community_labels, ...)graph + analysis → GRAPH_REPORT.md string
export.pyto_json, to_html, to_obsidian, to_svg, to_graphml, to_canvas, to_cyphergraph → graph.json, graph.html, Obsidian vault, graph.svg, … one function per format
wiki.pyto_wiki(G, communities, output_dir, ...)graph → one markdown article per community + index.md
callflow_html.pywrite_callflow_html(...)graphify-out files → Mermaid architecture/call-flow HTML
ingest.pyingest(url, target_dir, ...)URL → file saved to corpus dir
cache.pycheck_semantic_cache(files, root), save_semantic_cache(nodes, edges, ...)files → cached nodes / edges / hyperedges + the list of files still needing extraction
security.pyvalidate_url, safe_fetch, validate_graph_path, sanitize_labelURL / path / label → validated value, or raises
validate.pyvalidate_extraction(data), assert_valid(data)extraction dict → list of schema error strings (validate_extraction returns them; assert_valid raises)
serve.pyserve(graph_path), serve_http(graph_path, *, host, port, ...)graph file path → MCP stdio server / HTTP server
watch.pywatch(watch_path, debounce=3.0), check_update(watch_path)directory → rebuild on change; check_update reports whether a re-extraction is pending
benchmark.pyrun_benchmark(graph_path)graph file → corpus vs subgraph token comparison

Detection counts words from text and converted documents. Supported raster images, audio and video stay in the discovered corpus, but their raw bytes are never decoded for word counting; detection also bypasses any older cached counts for them. SVG remains text-readable, and PDF/Office files retain their existing text converters. This avoids reading and splitting entire binary media files just to size the corpus.

Calling extract() from your own code

extract() takes a list of paths, and root is keyword-only and optional:

from pathlib import Path
from graphify.extract import extract

paths = [Path("src/lib/content.ts"), Path("src/pages/index.astro")]
result = extract(paths, root=Path(".").resolve())   # pass root explicitly

Always pass root. Node ids and source_file values are derived relative to it; when it is omitted, extract() infers one from the paths you passed, which is the common parent of that list rather than your project root. A single-file call therefore anchors to that file's own directory, and ids can end up carrying path segments from the machine they were extracted on.

Extraction output schema

Maven manifest ingestion parses XML namespace declarations before normalizing tags in the root namespace for package and dependency lookups. Default and prefixed declarations share the same package identity; foreign namespaces and managed/plugin dependency scopes do not become project dependencies.

Terraform/HCL per-file AST results record the scope used to mint their node IDs. After a cache hit, extraction consumes that scope to rewrite node IDs and edge endpoints relative to the current scan root, including when the cache was copied from another checkout. Module-source topology is still resolved against the current permitted corpus. The scope marker is internal and is not exported in the graph. AST cache schema 33 retires entries without this marker; the semantic cache is unchanged. Existing graphs with stale absolute Terraform IDs need a full code rebuild: graphify extract . --code-only --force.

Every extractor returns:

{
  "nodes": [
    {"id": "unique_string", "label": "human name", "source_file": "path", "source_location": "L42"}
  ],
  "edges": [
    {"source": "id_a", "target": "id_b", "relation": "calls|imports|uses|...", "confidence": "EXTRACTED|INFERRED|AMBIGUOUS"}
  ]
}

validate.py enforces this schema before build() consumes it.

Validation reports list/object enum values as schema errors. Graph assembly repairs structured file_type values to concept and structured confidence values to INFERRED, without fabricating a confidence score, so malformed semantic fields cannot abort an otherwise usable build.

JS/TS calls through default imports of directly default-exported object literals reuse existing static method nodes. Members match the imported module path, exact label and source line. Lexically shadowed receivers, constructor calls, spread, computed keys, accessors, duplicate keys and dynamic aliases are not inferred. These files bypass the per-file AST cache, so resolving these cross-file calls does not require an AST cache schema bump.

Semantic provenance during file-node folding

build_from_json() normally folds an evidence-free semantic mention of a filename into its unique AST file-self node (Pass 2b, #3344); references to that mention are rewired to the AST node. A cross-source semantic record that contains its own rationale, source URL, author/contributor, capture time, or metadata is not a disposable mention: a label-only fold would discard its explanation or attribution. Such records remain separate even when their label matches a unique AST file node. This is intentionally conservative: a richly annotated mention may remain distinct until an explicit provenance-preserving merge is available. The saved-semantic-node shrink guard uses the same rule and still rejects any unexplained loss. Same-source AST/semantic twins that are evidence-free keep their existing exact-path merge rule (#4389/#4391), but an independently evidenced semantic YAML/document record is retained across a later AST extractor upgrade. If AST disambiguation path-qualifies a file-node label, the shrink guard accounts for a plain same-source fold using the exact source identity instead of accepting a mere basename collision.

Edge direction in graph.json

graph.json is written "directed": false, but every link is directed: arc order is the direction (source → target, #563). Older canonicalized files carry it in _src/_tgt markers instead, and those win where present (#2309).

A plain json_graph.node_link_graph() load loses this: an undirected graph re-orders each edge's endpoints by node-list position. Load through paths.load_node_link_graph() (or apply paths.restore_arc_direction() to the raw dict first), which stamps _src/_tgt on every edge. Then read direction as data.get("_src", u) / data.get("_tgt", v), never from u, v. Anything that writes graph.json back out pops the markers into arc order first, as export.to_json() does.

Confidence labels

LabelMeaning
EXTRACTEDRelationship is explicitly stated in the source (e.g., an import statement, a direct call)
INFERREDRelationship is a reasonable deduction (e.g., call-graph second pass, co-occurrence in context)
AMBIGUOUSRelationship is uncertain; flagged for human review in GRAPH_REPORT.md

Go member calls, including same-file calls, resolve through declared receiver types and carry INFERRED confidence. Bare calls to package-level functions remain EXTRACTED; unknown or ambiguous receivers do not bind by method name alone. AST cache schema 37 retires Go entries created before these receiver-binding rules.

C++ member chains such as client.actions->Execute() use lexical local/parameter bindings and class-scoped field declarations, including fields in unchanged headers. Raw pointers and single-type-argument std::unique_ptr<T> / std::shared_ptr<T> receivers are supported; . does not unwrap a smart pointer. Resolved instance calls are INFERRED static-type relationships, not proof of runtime dispatch. Unknown/shadowed types, ambiguous class identities, unresolved aliases, custom pointer wrappers, containers, and computed receivers are not guessed. AST cache schema 41 retires entries without receiver chains and persistent class fields.

C++ receiver types also follow ordinary using and typedef aliases, including raw-pointer and supported smart-pointer aliases. Lookup preserves spelling, lexical block/namespace/class scope and declaration order, and only traverses explicit includes preceding the receiver declaration. Alias targets resolve in their declaring scope; unsupported aliases still hide outer declarations. Qualified-name prefixes also block outer lookup. Namespace aliases and later class-scoped declarations in complete-class contexts remain unresolved. Anonymous namespaces retain their enclosing named lexical scope through an internal lookup placeholder. This placeholder never becomes a class identity; anonymous-local types and unknown aliases still block outer lookup. Direct namespace directives and qualified using declarations participate in this lookup. Alias templates, dependent targets, transitive using directives, arbitrary template types and cyclic or ambiguous aliases remain unresolved. Alias expansion stops after 32 steps. Conditional aliases remain unknown shadowing declarations, except inside a whole-file #ifndef/#define header guard without alternatives or an #undef. File nodes persist lexical type/alias facts and include offsets; class nodes persist field declaration offsets, so unchanged headers support incremental receiver resolution. C++ parsing normalizes CRLF to LF before collecting lookup facts and call sites, keeping their byte coordinates consistent across line endings without editing source files. Mixed LF/CRLF files use the same coordinates. Field spellings and aliases resolve where declared; an exact forward-declared type may then be completed by a unique definition visible at the member call. Definition facts preserve same-file declaration order. Missing, unincluded or ambiguous definitions remain unresolved, and base types still require completeness at their declaring class rather than at a later call. Includes nested in namespace, class or function scopes do not supply global type visibility; their injected declarations are not modeled. Header guards and global linkage wrappers preserve ordinary include visibility.

C++ inherited receiver fields and methods follow literal, explicitly reachable base types. A class declaration hides the same name in every base, including unknown fields, aliases, nested types and enum constants. Multiple inheritance resolves only one unambiguous member path; diamonds, unknown/dependent bases, virtual-base paths, inherited overload families and walks exceeding 32 classes stay unresolved. Calls retain their declared static receiver target, without inferring runtime virtual dispatch. AST cache schema 51 retires entries without the lexical type and inheritance facts or with pre-normalization byte offsets. This pass covers explicit receiver calls and field chains; unqualified bare calls retain the existing lexical resolver. Smart-pointer recognition requires an unshadowed std prefix (or explicit ::std); custom wrappers remain unresolved. Rebuild existing graphs with graphify extract . --code-only --force to populate unchanged headers before relying on changed-file-only updates.

C++ plain class/struct forwards fold into a unique exactly qualified definition only when one declaration file reaches the other through unconditional, exactly resolved quoted includes in the scanned corpus. The definition keeps its ID and source site; metadata.cpp_declaration_sites retains every folded forward site. _cpp_reconcile_files records the source and include-proof files so CLI/watch updates re-extract the live group after an edit, deletion, or exclusion. New pairs refresh exact-identity candidates from the permitted unchanged corpus before the same proof checks run. A whole-file #ifndef NAME / #define NAME guard is recognized structurally; feature expressions are never evaluated. Unrelated same-name files, multiple definitions, templates/specializations, nested/local or anonymous scopes, and other conditional declarations/includes stay separate. A common third file including both declarations does not establish equivalence in this pass. Non-template members with empty parameter lists also fold a unique declaration/body pair under one proven owner when literal return type, return pointer/reference shape, cv/ref qualifiers and noexcept spelling match, backed by the same exact include proof. The declaration keeps its ID and source site, and the body site remains in definition_file / definition_location; body calls are rewired to that ID. Persisted _cpp_member_records retain unsupported or multiple syntax records so overload families, normalized-name collisions, multiple bodies, conditional members, pure/defaulted/deleted methods and uncertain signatures do not fold. Parameter-bearing methods, equivalent type aliases/spellings, templates and general overload resolution remain outside this repair. AST cache schema 43 retires records without class/member facts and exact include proofs; rebuild existing graphs with graphify extract . --code-only --force.

C++ template wrappers preserve member ownership, including reference-returning declarations and matching same-file qualified definitions. Explicit calls such as worker.Tick<int>() resolve through the existing declared-receiver rules; dependent, unknown and ambiguous receivers do not acquire guessed targets. This includes dependent typename locals/fields and template-template parameters; an inner template's own parameter names do not shadow the surrounding corpus. These are method-family nodes, not overload/specialization resolution. Same-file primary owners such as template<class T> void Box<T>::Run() reuse a declared member only with unique owner/member declarations, plain ordered type parameters, and matching parameterless primitive-returning signatures (including cv/ref and bare noexcept qualifiers). Specializations, overloads, dependent signatures, constrained/defaulted/variadic templates, nested or shadowed owners, and cross-file template declaration/definition merging remain outside this bounded normalization.

When conditional directives break an initializer or argument list, C++ extraction can recover separate, byte-preserving branch views. It does not evaluate defines, read includes, invoke a preprocessor or enumerate configuration combinations. Recovery is bounded to 128 conditional groups and 32 branch views; malformed, still-invalid, conflicting, unattributable or over-budget inputs retain their original parse errors. File-node metadata.cpp_conditional_recovery records original errors, branch ranges and coverage; guarded records carry metadata.cpp_conditions. The file range map also applies to later resolver-created edges and parked C++ calls; cross-repository linking carries the representative callsite's guards to its inferred edge while retaining the existing callee/receiver deduplication. This is static branch-wise syntax coverage, not proof that all branches execute together. AST cache schema 43 invalidates older template and conditional recovery records.

Adding a new language extractor

  1. Add an extract_<lang>(path: Path) -> dict function following the existing pattern (tree-sitter parse → walk nodes → collect nodes and edges → call-graph second pass for INFERRED calls edges). New languages go in their own module under graphify/extractors/ - see graphify/extractors/MIGRATION.md; extract.py re-exports them while the existing ones are ported out of it.

  2. Register the file suffix in extract()'s dispatch table and in collect_files() (both in extract.py).

  3. Add the suffix to CODE_EXTENSIONS in detect.py and _WATCHED_EXTENSIONS in watch.py.

  4. Add the tree-sitter package to pyproject.toml dependencies.

  5. Add a fixture file to tests/fixtures/ and tests to tests/test_languages.py.

Search hook scope

The search hook omits project hints when a structured Grep path or every literal target of a simple grep/rg command resolves outside the project. Mixed targets, implicit paths, shell composition/expansion, wrappers, unknown options and unmapped Windows shell drive paths retain the advisory hint. It does not execute shell input or change search permissions.

Security

All external input passes through graphify/security.py before use:

  • URLs → validate_url() (http/https only) + _NoFileRedirectHandler (blocks file:// redirects)

  • Fetched content → safe_fetch() / safe_fetch_text() (size cap, timeout)

  • Graph file paths → validate_graph_path() (must resolve inside graphify-out/)

  • Node labels → sanitize_label() (strips control chars, caps 256 chars)

See SECURITY.md for the full threat model.

Testing

analyze.suggest_questions() interleaves candidates across question types before applying its result limit (seven by default). This keeps ambiguous relationships from hiding bridge, inferred-relationship, isolation, and low-cohesion signals. The existing candidate order within each type is preserved; if the limit is smaller than the number of available types, their generation order determines priority.

One test file per module under tests/. Run with:

pytest tests/ -q

The test suite is designed to avoid network access and uncontrolled filesystem effects; most tests are isolated with temporary directories and environment fixtures.

Python nested class ids include their enclosing class id. Same-named nested classes under different parents retain separate definitions, methods, and containment edges; top-level class ids are unchanged. AST cache schema 7 prevents older cached definitions from retaining the collapsed identities.

Python injected fields retain an unchanged parameter/local's declared class through self.field = value. A local assigned a member-call result can use the resolved method's single scalar return-type reference. The link uses the exact producer call's byte span, not a same-line argument or a bare method name. Unknown types, conflicting assignments, shadowed names, container returns, and ambiguous return references emit no inferred call. Resulting call edges remain INFERRED. Changed-caller rebuilds carry unchanged methods' return-type references as resolver context. Changes to a producer's return annotation require a full rebuild to recompute unchanged callers' inferred relationships.

Python direct module-level constructor assignments (g = Service()) retain the class for member-call resolution inside functions, including an imported alias or a lowercase class rebound to its instance. The constructor must be declared or imported before the assignment and resolve to a unique visible class by exact spelling. Local shadowing, other module bindings, conditional assignments and dynamic namespace mutation leave these calls unresolved. Qualified constructors and decorated classes are not inferred by this pass. Edges remain INFERRED; AST cache schema 37 retires Python entries without the instance marker.

C# partial types merge across files by their path inside the namespace, enclosing types first and each with its arity (Outer`1.Inner), within one assembly. Nested halves merge only under the same enclosing chain, and Foo and Foo<T> stay separate types. AST cache schema 9 retires cached C# results that lack this path. The merge runs after colliding ids are salted apart by path, so a half whose file stem collides with another file's (Spec.cs and _Spec.cs, Cfg/Helpers.cs and Cfg_Helpers.cs) still merges and keeps its members.

C# constructors (instance, static and a type's primary constructor) are nodes owned by their type through a method edge, labeled .TypeName() with metadata kind: "constructor". The id is the one a method named after the type would get, _make_id(type_id, TypeName); each further signature is salted like a method overload, a static constructor is its own static signature, and when a member spelled like the type in another case (foo() in Foo) already owns that id, the constructor takes a salted one, so no existing id moves. Calls in a constructor's body and : base(...)/: this(...) arguments are its calls. new X(...) keeps its edge to the type and also links the constructor whose parameter count fits, as do : base(...)/: this(...); two fitting overloads, an unresolved base or an unbound type give no constructor edge. Constructors stay out of every name-keyed call index. AST cache schema 40 retires C# entries without them.

C# property and indexer accessor bodies (and expression bodies) are walked with the member as the caller, and the member counts as owned by its type for unqualified, this./base. and partial-type lookups, like a method. It is never a call target by name. An indexer is a this[] node (defines, context field) with id _make_id(type_id, "this"), salted per signature and away from a member spelled This. A user-defined operator or conversion is a .operator +() / .operator int() node owned through method, with id _make_id(type_id, "operator", sha1(signature)[:6]), since several conversions share one parameter list. Existing ids do not move. AST cache schema 40.

R extraction preserves symbol-only bindings such as %||% as separate nodes. When normal ID normalization removes an entire binding name, its UTF-8 bytes provide a deterministic operator suffix within the same lexical owner. Its double underscore separators cannot collide with an ordinary normalized binding ID. Local call resolution stops if malformed scope metadata cycles.

Same-ID AST / semantic provenance during extractor upgrades (#4896)

A newly supported AST extractor can mint an ID that is already owned by an independently evidenced semantic node in a saved graph, even when the two nodes refer to the same file. Watch reconciliation retains the saved semantic ID and its rationale/attribution, assigns the fresh AST record a deterministic ID-derived AST suffix, and rewrites only fresh AST edge/hyperedge references. This applies to full and incremental re-extractions; incrementally rebuilt sources are not positive evidence of semantic deletion. The shrink guard refuses same-ID losses of semantic provenance even when the total node count grows, preventing the ordinary missing-ID guard from being bypassed. If multiple new AST records already share that ID, all use one deterministic AST successor ID: this retains their preexisting AST coalescing behavior while ensuring they cannot overwrite independent semantic provenance.

512 files · 494 not served here

Advantages

  • Deterministic parsing using tree-sitter ensures no LLM is required for code structure extraction. evidence: README.md
  • Reduces agent token spend by providing a queryable graph instead of requiring full file reads. evidence: README.md
  • Provides explicit confidence tags for every edge, distinguishing between extracted and inferred connections. evidence: README.md

Limitations

  • Semantic passes for non-code assets like PDFs or images may require a configured API key or the assistant's model. evidence: README.md
  • Requires manual or automated updates to the graph after significant code changes to maintain accuracy. evidence: AGENTS.md

Security

Risk level: Medium risk

This brain runs

Git hooks (2)

  • .pre-commit-config.yaml: python -m tools.skillgen --check
  • .pre-commit-config.yaml: pre-commit hooks from https://github.com/astral-sh/ruff-pre-commit at v0.15.14 (contributor tooling: runs only after pre-commit install) · uses the network

Agent instructions that run or fetch something (1)

  • AGENTS.md: After modifying code files in this session, run `graphify update .` to keep the graph current (AST-only, no API cost)

Install scripts (3)

  • README.md: | uv *(recommended)* | any | `uv --version` | `curl -LsSf https://astral.sh/uv/install.sh \| sh` | · uses the network
  • README.md: curl -LsSf https://astral.sh/uv/install.sh | sh · uses the network
  • graphify/install.py: python graphify/install.py
  • Medium risk: runs-git-hook-remote-exec (.pre-commit-config.yaml:18)
  • Medium risk: runs-install-script-remote-exec (README.md:163)
  • Medium risk: runs-install-script-remote-exec (README.md:179)
  • Medium risk: unicode-zero-width (graphify/install.py:495)
  • Low risk: scripts-present (graphify/install.py)

Attribution and licence

First committed by
GitHub avatar of safishamsisafishamsi
Publisher
Graphify Labs (Community)
Source
Graphify-Labs/graphify · commit 35d1d20
Licence
Apache License 2.0 (files served here)
  • ATTRIBUTION.md (written by AutoGineer)
Synced
Contributors
safishamsi, xRedLeader, Deepjyoti-Sarmah, rohit-jsfreaky, Adityakk9031

AutoGineer is not affiliated with or endorsed by safishamsi or Graphify Labs.

Install from source

494 of its files are not served here, so there is no ZIP. Graphify-Labs/graphify at 35d1d20