Code-Graph-RAG

Install

uvx code-graph-rag==0.4.19

2 secret configuration fields are declared. Names and values are omitted here.

Built for

Any MCP client. Works as a standard MCP server, so it can be added to any MCP client, including Claude, Cursor and Codex. Based on the listing description and package type. This is not a certification from those products.

Transports: stdio.

Links

• Repository
• Project site
• pypi package code-graph-rag
• Registry record

Memory

Audit report

Audited by AddonAudit.

Sandbox handshake completed and the published checks passed.

Automated smoke test, not a security guarantee.

Version

0.4.19

Audited

2 Nov 2026

Package

pypi code-graph-rag

Advisories

0 critical, 0 high, 0 medium, 0 low

Time to ready

3535 ms

Network

Disabled

• Pass Version. Pinned pypi code-graph-rag@0.4.19
• Pass Known vulnerabilities. No critical, high, or medium advisories were returned.
• Pass License. MIT
• Pass Install scripts. No preinstall, install, postinstall, or prepare script.
• Pass Credential patterns. No credential patterns in the published artifact.
• Pass Package size. 2.5 MB
• Pass Maintainer activity. Active 9 days ago.
• Pass Sandbox. MCP handshake completed. 34 tools listed. Tool count measured offline in our sandbox; some servers load more tools when connected.

Tools

• list_projects List all indexed projects in the knowledge graph database. Returns a list of project names that have been indexed.
• delete_project Delete a specific project from the knowledge graph database. This removes all nodes associated with the project while preserving other projects. Use list_projects first to see available projects.
• wipe_database WARNING: Completely wipe the entire database, removing ALL indexed projects. This cannot be undone. Use delete_project for removing individual projects.
• index_repository WARNING: Clears all data for the current project including its embeddings. Parse and ingest the repository into the Memgraph knowledge graph. Use update_repository for incremental updates. Only use when explicitly requested.
• update_repository Update the repository in the Memgraph knowledge graph without clearing existing data. Use this for incremental updates.
• reingest Re-ingest specific files into the knowledge graph after editing them. Re-parses only the given files and the files that depend on them, and re-resolves calls in that set only; an edit that leaves a file's interface unchanged (a comment, or
• resolve Resolve a name or a location to qualified names in the graph. `target` is a qualified name, a bare name like `helper` or `Store.get`, or `path:line` (the file's path relative to the repository root or absolute inside it, a 1-based line, opt
• definition File, line span, decorators, docstring and source of one definition by qualified name (`found` is false when the graph has no such node). `start_line` and `source` open at the first decorator; `name_line` is the line of its name (the `def`/
• callers Call sites that invoke a qualified name, one row per site with the caller, file, line, column, argument count and keyword names taken from the CALLS edges; `depth` > 1 follows the callers' callers (`through` names the callee each site invok
• callees Call sites inside a qualified name, one row per site with the callee and the location of the call: `path` is the file holding the site's `line` and `col` (the caller's, named by `through`) and `callee_path` the file defining the callee; `de
• implementors Types that inherit from or implement a class, interface or trait (INHERITS / IMPLEMENTS edges). Direct subtypes only by default; `depth` > 1 also follows their own subtypes (every class implementing an interface through an abstract base), e
• overrides Methods overriding a method, and the method it overrides (OVERRIDES edges in both directions). Direct only by default; `depth` > 1 follows each direction on its own (the overriders' overriders, and what the overridden method overrides in tu
• annotate Attach a durable note (a Gloss) to one definition in the graph, never to the source file. `target` names the definition the way `resolve` does, optionally with `#getter`, `#setter` or `#deleter` after it to name one member of a property (a
• glosses Notes (Glosses) about one definition: `annotating` are filed on it, `mentioning` are filed on other definitions and refer to it. `target` is resolved as `annotate` resolves it. Each note's `anchor_state` is graded after each sync of its pro
• importers Modules that import a module, with each import statement's line, column, bound alias and imported symbol. Direct importers only, unless `through_reexports` is true: then also the modules that reach it through a re-export (a package `__init_
• tests_reaching Test functions and methods from which a qualified name is reachable through CALLS / REFERENCES / INSTANTIATES, with the distance and the symbol each test reaches it through: what to run after editing it. Deterministic: fixed graph queries,
• endpoints The endpoints a project exposes (routes, RPC methods, dispatch keys), one row per endpoint with its identity (`GET /users/{id}`), kind, handler, file and how many call sites in the whole graph reach it through RESOLVES_TO or a direct access
• endpoint_callers Call sites, in any indexed project, that reach one endpoint: `target` is the handler's qualified name or the endpoint identity (`GET /users/{id}`), whichever parameter syntax the route declares (`:id`, `<id>`); a concrete request (`GET /use
• remote_dependencies Every network access a project makes, one row per call site and URL, with the endpoint, handler and project it resolves to when one is indexed; a row with no endpoint is a dependency the graph cannot place (a dynamic URL, or a service not i
• rename Rename a function, method, class or other definition everywhere the graph knows it is referenced: the definition, every call, reference and instantiation site, import statements (aliases kept), overrides in both directions, and Python `__al
• change_signature Change a Python function's or method's parameter list and rewrite every call site the graph knows, on the definition and on every override in both directions. `new_params` lists the new parameters in order (`n: int`, `limit: int = 10`, or a
• context A graph-ranked minimal context slice for a task, within a token budget. `target` is a qualified name, a bare name, `path:line`, or free text (matched by embedding similarity when the semantic extra is installed). Returns the target's source
• query_code_graph Prefer the deterministic tools (resolve, definition, callers, callees, implementors, overrides, importers, tests_reaching) when you know the exact name or location: they run fixed queries with no LLM. Use this for open-ended questions. Quer
• get_code_snippet Retrieve source code for a function, class, or method by its qualified name. Returns the source code, file path, line numbers, and docstring.
• surgical_replace_code Surgically replace an exact code block in a file using diff-match-patch. Only modifies the exact target block, leaving the rest unchanged. After a successful write on an indexed project, the touched files are re-ingested and a structural de
• read_file Read the contents of a file from the project. Supports pagination for large files.
• write_file Write content to a file, creating it if it doesn't exist. After a successful write on an indexed project, the touched files are re-ingested and a structural delta is appended to the result as JSON: symbols added, removed and renamed, caller
• list_directory List contents of a directory in the project.
• find_duplicate_code Finds structurally duplicated functions and methods (copy-pastes, including renamed and lightly edited copies) by comparing AST fingerprints stored in the graph. Returns clone groups with file:line locations, largest first: 'exact' groups a
• get_function_source Retrieves the source code for a specific function or method using its internal node ID, typically obtained from a semantic search result.
• ask_agent Ask the Code Graph RAG agent a question about the codebase. Uses the full RAG pipeline to analyse the code graph and provide a detailed answer. Use this for general questions about architecture, functionality, and code relationships.
• flow_verdict Answer a source-to-sink data-flow reachability question with one of three verdicts: FOUND (a FLOWS_TO path exists, returned as qualified names), NO_FLOW (no path, and every module of the project was inside flow-analysis coverage), or UNKNOW
• explain_traceback Correlate a Python traceback with the code graph: each frame is resolved to its Function/Method/Module node and returned with its graph neighbourhood (callers, callees, and FLOWS_TO sources feeding it). FLOWS_TO sources require indexing wit
• rank_root_causes Rank the sites that can explain a Python traceback's failure, best first. The anchor (failing) is the innermost frame the graph resolves; anchor_is_crash_site is false when the actual crash line sits deeper (a library frame, or a frame the

11-02 09:22:23 | INFO     | FileWriter initialized with root: <sandbox>
2026-11-02 09:22:23 | INFO     | ShellCommander initialized with root: <sandbox>
2026-11-02 09:22:23 | INFO     | [MCP] Semantic search not available. Install with: uv sync --extra semantic
2026-11-02 09:22:23 | INFO     | [GraphCode MCP] Services initialized successfully
2026-11-02 09:22:23 | INFO     | [GraphCode MCP] Server created, starting stdio transport...
2026-11-02 09:22:23 | INFO     | [GraphCode MCP] Connected to Memgraph at localhost:7687

Raw audit JSON

Metadata checks

• Repository activity: Active in the last 180 days
• License: Recognized SPDX id
• Metadata quality: High

Score 100 uses public metadata only. It is separate from the audit tier. Payment never changes a score. How listings are checked.