MCP server and CLI toolkit that indexes local code into a graph database so Claude can query functions, call chains, dependencies, and repository structure.
Open the source and read safety notes before installing.
Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.
Decision playbook
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
0
63
—
No baseline selected
No major trust-signal divergence detected in the current selection.
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Source provenance statusRequired
Marked as source-backed.
Metadata reviewed
No reviewed flag detected in metadata.
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Trust level risk gateRequired
Trust level does not block evaluation.
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Package verification flag
No package verification flag provided.
Checksum metadata
No checksum provided for downloaded artifact.
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
Baseline comparison available
No baseline peer selected yet.
Diverging trust signals identified
No major trust-signal divergence found.
Setup at a glance
Copy-ready — paste the snippet to get started.
Adoption plan
Current risk score 24/100. Use staged verification before broader rollout.
Validate source and review signals before any execution.
Confirm source provenanceRequired
Source URL/provenance metadata is present.
Confirm metadata review state
No review metadata found; increase manual validation.
Verify install payload
Install/config payload exists and can be inspected.
Confirm safety, privacy, and package integrity signals.
Review safety notesRequired
Safety notes are present.
Review privacy notesRequired
Privacy notes are present.
Verify package integrity metadata
No package verification/checksum metadata.
Adopt in controlled steps based on the selected plan.
Run in isolated sandbox firstRequired
Use a constrained sandbox and observe behavior across multiple tasks.
Roll out graduallyRequired
Roll out to a small cohort before wider usage.
Set monitoring and fallback
Define rollback path and monitor errors after adoption.
Evidence readiness
Missing required evidence: Metadata review. Risk score 31.
Source repository/provenance is listed.
Required in this preset
Review metadata is missing.
Required in this preset
Safety notes are present.
Required in this preset
Privacy notes are present.
Optional in this preset
Package integrity metadata is missing.
Optional in this preset
Install payload is available.
Required in this preset
Required gaps: Metadata review
Decision timeline
Blocking gaps: Check metadata review status. Risk 28.
triage
Source/provenance metadata is available.
triage
Review metadata is missing.
verify
Safety notes are available.
verify
Privacy notes are available.
verify
Package integrity metadata is missing.
rollout
Install payload is available.
Blockers: Check metadata review status
Prerequisite readiness
5 prerequisites to line up before setup. Have accounts and credentials ready first. Includes a review or approval gate.
Safety & privacy surface
5 safety and 4 privacy notes across 4 risk areas. Review closely: credentials & tokens, permissions & scopes, third-party handling.
{
"mcpServers": {
"codegraphcontext": {
"command": "codegraphcontext",
"args": ["mcp", "start"],
"env": {
"NEO4J_URI": "YOUR_GRAPH_DATABASE_URI",
"NEO4J_USER": "YOUR_GRAPH_DATABASE_USER",
"NEO4J_PASSWORD": "YOUR_GRAPH_DATABASE_PASSWORD"
}
}
}
}CodeGraphContext is an MCP server and CLI toolkit for turning repositories into queryable code graphs. Claude can use it to ask about callers, callees, class hierarchies, call chains, complexity, dead code, search results, and repository structure after a project has been indexed.
The upstream README documents both CLI mode and MCP server mode. The Python
package exposes the codegraphcontext command, with codegraphcontext mcp setup
for client configuration and codegraphcontext mcp start for launching the MCP
server.
These sources were reviewed on 2026-06-05. Prefer the live repository, README, security policy, and PyPI metadata for current package version, supported commands, database backend options, language support, and MCP setup behavior.
Install the Python package:
pip install codegraphcontext
Run the setup wizard, then start the MCP server:
codegraphcontext mcp setup
codegraphcontext mcp start
For MCP clients that launch stdio servers manually:
{
"mcpServers": {
"codegraphcontext": {
"command": "codegraphcontext",
"args": ["mcp", "start"]
}
}
}
Restart the MCP client after adding the server.
CodeGraphContext is useful because it indexes real source trees. That also means it can expose private code, filenames, architecture, comments, fixtures, test data, generated files, and accidentally committed secrets to an MCP client and model provider.
Limit indexing to repositories and directories approved for model access. Review ignore rules before enabling live file watching, and avoid indexing broad workspace roots that contain unrelated private projects.
If you use an external graph database, treat it as a secondary copy of source metadata. Review authentication, network access, backups, and retention before using it with proprietary code.
No CodeGraphContext/CodeGraphContext entry, codegraphcontext package entry,
or matching source URL was found in content/mcp.
Show that CodeGraphContext MCP Server is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/mcp/codegraphcontext-mcp-server)CodeGraphContext MCP Server side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
| Field | MCP server and CLI toolkit that indexes local code into a graph database so Claude can query functions, call chains, dependencies, and repository structure. Open dossier | High-performance MCP server that indexes codebases into a persistent knowledge graph for structural search, call tracing, architecture summaries, dead-code detection, and cross-repo analysis. Open dossier | MCP server for semantic codebase intelligence, combining AST structure, embeddings, clustering, feature hubs, restore points, and memory graph tools. Open dossier | Remote MCP server for analyzing, searching, retrieving, and auditing code from public Git repositories without cloning them into the local workspace. Open dossier |
|---|---|---|---|---|
| Next steps | ||||
| Trust | ||||
| Review status | Not reviewed | Not reviewed | Not reviewed | Not reviewed |
| Package trust | Package not verified | Package not verified | Package not verified | Package not verified |
| Source provenance | Source-backed | Source-backed | Source-backed | Source-backed |
| Submitter | oktofeesh1 | oktofeesh1 | oktofeesh1 | oktofeesh1 |
| Install risk | Review first | Review first | Review first | Review first |
| Notes | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ |
| Brand | — | — | — | |
| Category | mcp | mcp | mcp | mcp |
| Source | Source-backed | Source-backed | Source-backed | Source-backed |
| Author | CodeGraphContext | DeusData | forloopcodes | searchcode.com |
| Added | 2026-06-05 | 2026-06-05 | 2026-06-05 | 2026-06-06 |
| Platforms | ||||
| Harness | ||||
| Source repo | — | — | — | — |
| Safety notes | ✓CodeGraphContext indexes repository contents and can expose code structure, symbols, dependencies, comments, filenames, and relationships to Claude. Live file watching can keep graph data updated as files change, so verify the watched tree before enabling it on private workspaces. External graph databases can retain indexed source metadata after the MCP session ends. Generated graph context may include prompt-injection text from comments, documentation, fixtures, tests, or vendored files. Review database credentials, ignored paths, and repository scope before connecting the server to an MCP client. | ✓Codebase Memory MCP reads source files across indexed repositories and writes MCP entries, instruction files, skills, hooks, and agent configuration files during install. The background watcher and auto-index features can keep graph data updated as source files change. The optional graph UI exposes a local visualization server on a localhost port. Shared graph artifacts and SQLite databases can persist source metadata after an MCP session ends. Verify downloaded release binaries, checksums, signatures, and provenance before running them in sensitive environments. | ✓Context+ can inspect source files, build AST and embedding indexes, run static analysis, create memory graph nodes, and propose code changes. The `propose_commit` tool is designed to write code after validation and creates shadow restore points before saving. Static analysis tools may invoke local compilers, linters, or language tools depending on the repository. Runtime caches and memory graph data can persist source-derived embeddings and relationships after the MCP session ends. External embedding providers can receive source-derived text, identifiers, prompts, and cluster-labeling context. | ✓Searchcode analyzes public repositories through a hosted remote service; do not point it at private repository URLs unless you have a private/enterprise arrangement and have reviewed the current access controls. The service can return code snippets, file contents, symbols, file trees, static-analysis findings, and credential-scan findings from public repositories. Treat tool results as machine-assisted code intelligence. Confirm security findings, complexity claims, and dependency conclusions against the repository before making merge, hiring, acquisition, or incident decisions. Large or repeated repository analysis can create automated traffic to Searchcode; keep agent loops bounded and avoid broad unattended scans. |
| Privacy notes | ✓Source code, file paths, symbol names, comments, dependency names, call graphs, class hierarchies, search terms, prompts, graph queries, and tool outputs may be visible to the MCP client and model provider. Indexing proprietary repositories can reveal architecture, product plans, credentials accidentally committed to code, internal package names, or security-sensitive paths. If using a remote graph backend, review its authentication, retention, backups, logging, and access controls before indexing private code. Remove or ignore secrets, customer data, generated dumps, logs, and vendor directories before building code graphs for model access. | ✓Source code, filenames, paths, symbols, comments, imports, routes, call graphs, architecture summaries, ADRs, graph queries, prompts, and tool outputs may be visible to the MCP client and model provider. Persistent graph databases and shared artifacts can retain proprietary architecture, internal package names, route names, service boundaries, and accidentally committed secrets. Auto-indexing broad workspace roots can include unrelated private repositories or generated files. Avoid committing shared graph artifacts unless the repository owners explicitly approve storing derived code intelligence in version control. | ✓Source code, file paths, symbol names, comments, identifiers, embeddings, memory nodes, relations, prompts, API keys, static-analysis output, proposed diffs, and tool results may be visible to the MCP client and model provider. Proprietary codebases can expose internal architecture, feature maps, naming conventions, secrets accidentally present in code, and product plans. Keep API keys and provider base URLs out of committed MCP configs, logs, screenshots, and shared prompts. Review `.mcp_data` and generated restore-point data before sharing workspaces or artifacts. | ✓Prompts and tool inputs can reveal which public repositories, symbols, files, dependencies, security concerns, or candidate portfolios a team is investigating. Returned code snippets, findings, file paths, and repository metadata become part of the MCP client transcript and may be processed by the connected model provider. Public code can still contain secrets, personal data, proprietary code accidentally committed upstream, or prompt-injection text. Review returned snippets before forwarding them into other tools or reports. Searchcode's public page says the hosted MCP server is free during beta and does not require signup or an API key; review the live site before production use because pricing and private-code options may change. |
| Prerequisites |
|
|
|
|
| Install | | | | |
| Config | | | | |
| Citations | ||||
| Claim | Unclaimed | Unclaimed | Unclaimed | Unclaimed |
Give Claude a persistent code knowledge graph for search, call paths, architecture, impact analysis, ADRs, dead code, and cross-service links.
Give Claude semantic and structural code context with AST trees, skeletons, semantic search, blast radius, static analysis, memory graph, and restore points.
Source-backed guides for putting this to work.
Write a claude-code-hint tag to stderr under CLAUDECODE, and Claude Code prompts users once to install your official-marketplace plugin.
Loading live community signals…
A short, calm digest of reviewed Claude resources. Unsubscribe any time.