mcpField
C
code-graph

code-graph

Local
code-graph.cyberchronos00.workers.devDeveloper Tools4Updated 1w ago
RepositoryVisit website

About code-graph

code-graph is a local dependency-graph tool for developers and AI agents, available through a CLI and MCP server. Its deterministic analysis traces routes, calls, tables, and configuration with file-and-line evidence, without using an LLM to build the graph.

Key features

  1. 01Trace callers, routes, and table dependencies
  2. 02Show file-and-line evidence for graph edges
  3. 03Analyze change impact and relevant tests
  4. 04Link client calls to server routes across repos
  5. 05Report attack surfaces and security findings
  6. 06Provide a visual graph and plan checks

Use cases

  1. 01Find affected routes and callers before a change
  2. 02Identify tests reached by a code change
  3. 03Check for unguarded routes that write data
  4. 04Review cross-repository HTTP calls and server routes

MCP support

code-graph provides the cg-mcp MCP server, allowing agents to query dependency graphs instead of grepping code; one server can serve multiple graphs.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "cyberchronos00-cg-code-graph": {
      "command": "uvx",
      "args": [
        "cg-code-graph"
      ]
    }
  }
}
Run commanduvx cg-code-graph

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
pypicg-code-graph0.23.13

Tools

13

Saved tool list · updated 1w ago

ParameterTypeRequiredDescription
pathsbooleanNo
targetsarrayYes
group_bystringNo
platformanyNo
connectionanyNo
include_gatedbooleanNo
max_per_groupintegerNo
min_confidencestringNo

Details

From the project README

code-graph

See everything a change affects before you make it: a local, deterministic dependency graph of routes, calls, tables and config, with file:line evidence for every hop.

For you and your AI agent (CLI + MCP). No LLM in the graph.

PyPI Downloads Python 3.11+ License: MIT Docs

Docs · Quick start · CLI · MCP · Changelog

cg visual view: the graph around the warehouse connection, a selected node with its evidence paths and source, then the planned-change overlay for the preorders plan

Quick start

pipx install cg-code-graph          # or: uv tool install cg-code-graph
cg index . --db out/graph.db        # prints starter queries for your repo
cg install --host cursor    # or claude, codex, vscode, …: registers the MCP server and a "use cg first" agent rule
cg reaches table:orders --db out/graph.db   # any table, connection or config key

Try it on a bundled sample, link a frontend to a backend, or connect an agent over MCP: Quick start guide. Other install options (install.sh, Windows, exact-mode toolchains): Install.

cg reaches table:store_books on the bundled Django sample:

dependents: 18 nodes  (code: 6, entry points: 9, other: 3)
== RUNTIME (reached from http_route / ... / queue_job / listener): 5 functions/methods
    catalog.api.create_book  depth=1 conf=resolved  http_route(1)
        path: function:catalog.api.create_book
          -WRITES_TABLE[resolved @ catalog/api.py:27]-> table:store_books
    catalog.signals.review_saved  depth=3 conf=resolved  listener(1)
        path: function:catalog.signals.review_saved
          -DISPATCHES[exact @ catalog/signals.py:12]-> job:catalog.tasks.recompute_rating
          -HANDLED_BY[exact @ catalog/tasks.py:13]-> function:catalog.tasks.recompute_rating
          -READS_TABLE[resolved @ catalog/tasks.py:14]-> table:store_books

Terminal demo: cg indexes the bundled Laravel and Nuxt sample apps, links them, then runs reaches, path, impact and plan check

Supported languages

LanguageFrameworks and factsCallsDocs
PythonDjango (+ DRF, django-ninja), FastAPI / Starlette, Flask, Celeryexact (stdlib ast)Python
TypeScript JavaScriptNuxt / Vue, NestJS, Next.js, Astro, Express, Fastify, Koa, Hono, Elysia, React Router / Remixexact (TypeScript compiler API)TS frameworks
PHPLaravel (routes, route attributes, middleware, queues, broadcasting, outbound HTTP)exact (nikic/php-parser; needs PHP 8.2+)PHP
DartFlutterexact (Dart analyzer; needs the Dart SDK)Platforms
KotlinAndroid, Kotlin Multiplatform, Springheuristic; exact with scip-java (opt-in)Kotlin
JavaSpring (routes, guards, beans, tables, clients)heuristic; exact with scip-java (opt-in)Java
SwiftiOS / SwiftPMheuristic; exact with the Swift index store (opt-in)Swift
Rust C C++crates / modules, entry points, FFI, #[cfg] / #if gatesheuristic; exact with rust-analyzer / scip-clangRust, C and C++

Go and others: import a SCIP index with cg index --scip FILE. Run cg doctor to see exact / heuristic per language on your machine.

What you get

  • reaches, impact, path: every caller, route, job and page that reaches a table, config key or method.
  • cg affected --base main: the tests and entry points a change reaches (--quiet feeds your test runner).
  • Across repos: cg link matches client HTTP calls (frontends and Laravel / Guzzle backends) to server routes, and checks request keys (Laravel FormRequest, Elysia schemas, Nuxt / TypeScript bodies).
  • Route guards: cg routes --writes --unguarded lists routes that write with no auth guard. Laravel checks inside the action count as inline guards unless --strict.
  • Security views: cg surface lists the inbound / outbound attack surface and findings (hardcoded credentials, plaintext protocols, unverified webhooks, unguarded handlers, listeners on all interfaces, disabled TLS / SSH verification, plaintext gRPC, exposed IPC, outbound URLs built from request input) as text, JSON or SARIF, with --fail-on for CI.
  • MCP server (cg-mcp) so agents query the graph instead of grepping. One server can serve many graphs (graphs plus an optional graph argument); a single --db stays one graph. See MCP.
  • Visual view (cg serve) and plan checks (cg plan check) for planned changes.

Docs

Install · Quick start · CLI · MCP · Configuration · Architecture · Limitations

Changelog · Contributing · Security · MIT License

More recordings: docs/media.

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.