{
  "slug": "io-github-vitali87-code-graph-rag",
  "name": "Code-Graph-RAG",
  "auditedAt": "2026-11-02T12:22:23Z",
  "version": "0.4.19",
  "ecosystem": "pypi",
  "package": "code-graph-rag",
  "disclaimer": "Automated smoke test, not a security guarantee.",
  "complete": true,
  "checks": {
    "versionPin": {
      "status": "pass",
      "detail": "Pinned pypi code-graph-rag@0.4.19",
      "version": "0.4.19"
    },
    "vulnerabilities": {
      "status": "pass",
      "detail": "No critical, high, or medium advisories were returned.",
      "critical": 0,
      "high": 0,
      "medium": 0,
      "low": 0,
      "packagesScanned": 1
    },
    "license": {
      "status": "pass",
      "detail": "MIT",
      "spdx": "MIT"
    },
    "installScripts": {
      "status": "pass",
      "detail": "No preinstall, install, postinstall, or prepare script.",
      "scripts": []
    },
    "secrets": {
      "status": "pass",
      "detail": "No credential patterns in the published artifact.",
      "findings": []
    },
    "packageSize": {
      "status": "pass",
      "detail": "2659678 bytes",
      "bytes": 2659678
    },
    "activity": {
      "status": "pass",
      "detail": "Active 9 days ago.",
      "ageDays": 9
    },
    "sandbox": {
      "status": "pass",
      "detail": "MCP handshake completed. 34 tools listed.",
      "starts": true,
      "handshake": true,
      "timeToReadyMs": 3535,
      "tools": [
        {
          "name": "list_projects",
          "description": "List all indexed projects in the knowledge graph database. Returns a list of project names that have been indexed."
        },
        {
          "name": "delete_project",
          "description": "Delete a specific project from the knowledge graph database. This removes all nodes associated with the project while preserving other projects. Use list_projects first to see available projects."
        },
        {
          "name": "wipe_database",
          "description": "WARNING: Completely wipe the entire database, removing ALL indexed projects. This cannot be undone. Use delete_project for removing individual projects."
        },
        {
          "name": "index_repository",
          "description": "WARNING: Clears all data for the current project including its embeddings. Parse and ingest the repository into the Memgraph knowledge graph. Use update_repository for incremental updates. Only use when explicitly requested."
        },
        {
          "name": "update_repository",
          "description": "Update the repository in the Memgraph knowledge graph without clearing existing data. Use this for incremental updates."
        },
        {
          "name": "reingest",
          "description": "Re-ingest specific files into the knowledge graph after editing them. Re-parses only the given files and the files that depend on them, and re-resolves calls in that set only; an edit that leaves a file's interface unchanged (a comment, or "
        },
        {
          "name": "resolve",
          "description": "Resolve a name or a location to qualified names in the graph. `target` is a qualified name, a bare name like `helper` or `Store.get`, or `path:line` (the file's path relative to the repository root or absolute inside it, a 1-based line, opt"
        },
        {
          "name": "definition",
          "description": "File, line span, decorators, docstring and source of one definition by qualified name (`found` is false when the graph has no such node). `start_line` and `source` open at the first decorator; `name_line` is the line of its name (the `def`/"
        },
        {
          "name": "callers",
          "description": "Call sites that invoke a qualified name, one row per site with the caller, file, line, column, argument count and keyword names taken from the CALLS edges; `depth` > 1 follows the callers' callers (`through` names the callee each site invok"
        },
        {
          "name": "callees",
          "description": "Call sites inside a qualified name, one row per site with the callee and the location of the call: `path` is the file holding the site's `line` and `col` (the caller's, named by `through`) and `callee_path` the file defining the callee; `de"
        },
        {
          "name": "implementors",
          "description": "Types that inherit from or implement a class, interface or trait (INHERITS / IMPLEMENTS edges). Direct subtypes only by default; `depth` > 1 also follows their own subtypes (every class implementing an interface through an abstract base), e"
        },
        {
          "name": "overrides",
          "description": "Methods overriding a method, and the method it overrides (OVERRIDES edges in both directions). Direct only by default; `depth` > 1 follows each direction on its own (the overriders' overriders, and what the overridden method overrides in tu"
        },
        {
          "name": "annotate",
          "description": "Attach a durable note (a Gloss) to one definition in the graph, never to the source file. `target` names the definition the way `resolve` does, optionally with `#getter`, `#setter` or `#deleter` after it to name one member of a property (a "
        },
        {
          "name": "glosses",
          "description": "Notes (Glosses) about one definition: `annotating` are filed on it, `mentioning` are filed on other definitions and refer to it. `target` is resolved as `annotate` resolves it. Each note's `anchor_state` is graded after each sync of its pro"
        },
        {
          "name": "importers",
          "description": "Modules that import a module, with each import statement's line, column, bound alias and imported symbol. Direct importers only, unless `through_reexports` is true: then also the modules that reach it through a re-export (a package `__init_"
        },
        {
          "name": "tests_reaching",
          "description": "Test functions and methods from which a qualified name is reachable through CALLS / REFERENCES / INSTANTIATES, with the distance and the symbol each test reaches it through: what to run after editing it. Deterministic: fixed graph queries, "
        },
        {
          "name": "endpoints",
          "description": "The endpoints a project exposes (routes, RPC methods, dispatch keys), one row per endpoint with its identity (`GET /users/{id}`), kind, handler, file and how many call sites in the whole graph reach it through RESOLVES_TO or a direct access"
        },
        {
          "name": "endpoint_callers",
          "description": "Call sites, in any indexed project, that reach one endpoint: `target` is the handler's qualified name or the endpoint identity (`GET /users/{id}`), whichever parameter syntax the route declares (`:id`, `<id>`); a concrete request (`GET /use"
        },
        {
          "name": "remote_dependencies",
          "description": "Every network access a project makes, one row per call site and URL, with the endpoint, handler and project it resolves to when one is indexed; a row with no endpoint is a dependency the graph cannot place (a dynamic URL, or a service not i"
        },
        {
          "name": "rename",
          "description": "Rename a function, method, class or other definition everywhere the graph knows it is referenced: the definition, every call, reference and instantiation site, import statements (aliases kept), overrides in both directions, and Python `__al"
        },
        {
          "name": "change_signature",
          "description": "Change a Python function's or method's parameter list and rewrite every call site the graph knows, on the definition and on every override in both directions. `new_params` lists the new parameters in order (`n: int`, `limit: int = 10`, or a"
        },
        {
          "name": "context",
          "description": "A graph-ranked minimal context slice for a task, within a token budget. `target` is a qualified name, a bare name, `path:line`, or free text (matched by embedding similarity when the semantic extra is installed). Returns the target's source"
        },
        {
          "name": "query_code_graph",
          "description": "Prefer the deterministic tools (resolve, definition, callers, callees, implementors, overrides, importers, tests_reaching) when you know the exact name or location: they run fixed queries with no LLM. Use this for open-ended questions. Quer"
        },
        {
          "name": "get_code_snippet",
          "description": "Retrieve source code for a function, class, or method by its qualified name. Returns the source code, file path, line numbers, and docstring."
        },
        {
          "name": "surgical_replace_code",
          "description": "Surgically replace an exact code block in a file using diff-match-patch. Only modifies the exact target block, leaving the rest unchanged. After a successful write on an indexed project, the touched files are re-ingested and a structural de"
        },
        {
          "name": "read_file",
          "description": "Read the contents of a file from the project. Supports pagination for large files."
        },
        {
          "name": "write_file",
          "description": "Write content to a file, creating it if it doesn't exist. After a successful write on an indexed project, the touched files are re-ingested and a structural delta is appended to the result as JSON: symbols added, removed and renamed, caller"
        },
        {
          "name": "list_directory",
          "description": "List contents of a directory in the project."
        },
        {
          "name": "find_duplicate_code",
          "description": "Finds structurally duplicated functions and methods (copy-pastes, including renamed and lightly edited copies) by comparing AST fingerprints stored in the graph. Returns clone groups with file:line locations, largest first: 'exact' groups a"
        },
        {
          "name": "get_function_source",
          "description": "Retrieves the source code for a specific function or method using its internal node ID, typically obtained from a semantic search result."
        },
        {
          "name": "ask_agent",
          "description": "Ask the Code Graph RAG agent a question about the codebase. Uses the full RAG pipeline to analyse the code graph and provide a detailed answer. Use this for general questions about architecture, functionality, and code relationships."
        },
        {
          "name": "flow_verdict",
          "description": "Answer a source-to-sink data-flow reachability question with one of three verdicts: FOUND (a FLOWS_TO path exists, returned as qualified names), NO_FLOW (no path, and every module of the project was inside flow-analysis coverage), or UNKNOW"
        },
        {
          "name": "explain_traceback",
          "description": "Correlate a Python traceback with the code graph: each frame is resolved to its Function/Method/Module node and returned with its graph neighbourhood (callers, callees, and FLOWS_TO sources feeding it). FLOWS_TO sources require indexing wit"
        },
        {
          "name": "rank_root_causes",
          "description": "Rank the sites that can explain a Python traceback's failure, best first. The anchor (failing) is the innermost frame the graph resolves; anchor_is_crash_site is false when the actual crash line sits deeper (a library frame, or a frame the "
        }
      ],
      "toolCount": 34,
      "resourceCount": 0,
      "promptCount": 0,
      "stderrExcerpt": "11-02 09:22:23 | INFO     | FileWriter initialized with root: <sandbox>\n2026-11-02 09:22:23 | INFO     | ShellCommander initialized with root: <sandbox>\n2026-11-02 09:22:23 | INFO     | [MCP] Semantic search not available. Install with: uv sync --extra semantic\n2026-11-02 09:22:23 | INFO     | [GraphCode MCP] Services initialized successfully\n2026-11-02 09:22:23 | INFO     | [GraphCode MCP] Server created, starting stdio transport...\n2026-11-02 09:22:23 | INFO     | [GraphCode MCP] Connected to Memgraph at localhost:7687",
      "network": "disabled",
      "networkAttemptedWhileOffline": false,
      "outboundHosts": [],
      "requiresCredentials": false
    }
  },
  "tier": "gold",
  "tierReason": "Sandbox handshake completed and the published checks passed.",
  "logExcerpt": "11-02 09:22:23 | INFO     | FileWriter initialized with root: <sandbox>\n2026-11-02 09:22:23 | INFO     | ShellCommander initialized with root: <sandbox>\n2026-11-02 09:22:23 | INFO     | [MCP] Semantic search not available. Install with: uv sync --extra semantic\n2026-11-02 09:22:23 | INFO     | [GraphCode MCP] Services initialized successfully\n2026-11-02 09:22:23 | INFO     | [GraphCode MCP] Server created, starting stdio transport...\n2026-11-02 09:22:23 | INFO     | [GraphCode MCP] Connected to Memgraph at localhost:7687"
}