colbymchenry/codegraph
Pre-indexed code knowledge graph, auto syncs on code changes, for Claude Code, Codex, Gemini, Cursor, OpenCode, AntiGravity, Kiro, and Hermes Agent — fewer tokens, fewer tool calls, 100% local
How codegraph is put together
CodeGraph (@colbymchenry/codegraph) is a local-first semantic code-intelligence CLI and MCP server that indexes a codebase into a SQLite-backed knowledge graph (nodes, edges, FTS search) so AI coding agents get surgical code context. The main body is TypeScript running on Node >=20, with an optional native 'kernel' written in Rust (napi-rs cdylib) that does tree-sitter parse+extract in one boundary crossing per file, falling back to WASM grammars (web-tree-sitter/tree-sitter-wasms) when absent. Data flows: file scan -> parse pool (worker threads) -> reference resolution -> SQLite store (WAL + FTS5) -> graph traversal/context building exposed through MCP tools served over stdio to a persistent local daemon. Separate small packages under telemetry-dashboard/ and telemetry-worker/ deploy Cloudflare Workers (Wrangler) for optional product telemetry, while the core tool itself is 100% local.
Languages
Frameworks
Datastores
Infrastructure
Major components
CLI entrypoint (src/bin)
Implements the `codegraph` command (init, serve --mcp, upgrade, uninstall) with Node version gating, fatal-error handling, and command supervision.
Extraction pipeline (src/extraction)
Scans files (gitignore-aware, default-ignore dirs), detects languages/frameworks, parses via a worker-thread tree-sitter pool (WASM or native Rust kernel) and writes nodes/edges through a store writer.
Native kernel (codegraph-kernel)
Rust cdylib exposing tree-sitter parse+extract for ~15 languages over napi, with revision-matched grammars asserted against the WASM fallback by parity tests.
Database layer (src/db)
Manages the SQLite connection (PRAGMA tuning, WAL heal, inode-replacement detection), schema.sql, migrations, prepared-query builder, and bulk-load index/FTS trigger windows.
Resolution layer (src/resolution)
Resolves unresolved references to definitions project-wide using import resolvers, path aliases, workspace packages, name matching, and language-specific synthesizers (Swift/ObjC bridge, C fnptr, GoFrame).
MCP server & daemon (src/mcp)
Serves CodeGraph tools over the Model Context Protocol on stdio, managed by a long-lived local daemon with startup handshake, ppid/liveness watchdogs, query worker pool, and session state.
Context & search (src/context, src/search)
Combines FTS search with graph traversal to build ranked, size-bounded markdown/JSON context payloads for agent tasks, including symbol extraction from natural-language queries.
Installer, sync & telemetry (src/installer, src/sync, src/telemetry, src/upgrade)
Wires the MCP server into detected agents' configs, watches files/git hooks for auto-sync, sends opt-out usage telemetry, and self-upgrades the CLI.
A batch of contributor fixes merged, focused on making queries find the right files and symbols more reliably.
4 weeksWeek of 2026-08-17
Week of 2026-08-17latest
A batch of contributor fixes merged, focused on making queries find the right files and symbols more reliably.
Week of 2026-08-03
The busiest week of the month, adding first-class union-type support to the index and tuning the explore feature through careful measurements.
Week of 2026-07-27
A smaller week spent fixing correctness and stability bugs across the MCP server, Python references, and the database.
Week of 2026-07-20
The v1.5.0 release week: major speed improvements plus built-in support for ten additional languages.
Over the last four weeks, CodeGraph shipped a major v1.5.0 release that dramatically sped up indexing and added support for ten more programming languages, followed by a wave of quality work making search results and code lookups more accurate. The team also fixed a series of reliability issues around how the tool resolves imports, handles large indexes, and recovers from crashes. A recurring theme was hardening the 'explore' feature so agents get correct symbols and file paths back when querying the code graph.
Week by week
2026-08-17A batch of contributor fixes merged, focused on making queries find the right files and symbols more reliably.latest6 changes
Feature
New ranking setting for configs
codegraph.json now supports a "deprioritize" option that pushes certain file paths down in search rankings without removing them entirely.
Feature
Local installs of Codex
The installer can now set up Codex per-project instead of only globally.
Fix
Better path alias handling
Import resolution now follows tsconfig "extends" chains, so projects with shared base configs resolve paths correctly.
Refactor
Faster exact-name searches
Exact-name lookups now jump straight to the right spot in the name index instead of scanning it.
Fix
Regex crash fix for Swift routes
Fixed a Vapor route pattern that could freeze the parser on certain inputs by removing catastrophic backtracking.
Fix
Self-healing index recovery
Retry passes during full indexing now correctly decode results and automatically restore any rows that got wiped.
2026-08-03The busiest week of the month, adding first-class union-type support to the index and tuning the explore feature through careful measurements.6 changes
Feature
Union types are now indexed
Union declarations are modeled as their own nodes in the graph, and trait dispatch can now reach implementors behind unions.
Fix
Explore output budgeting reworked
A series of changes makes result rendering respect exact budgets with bounded overshoot and guards, so four repos stopped truncating their output.
Fix
Agents always see named symbols
Queries are now guaranteed to render an agent-named symbol no matter where it sits in the results.
Fix
Quieter ambient declaration files
TypeScript ambient declaration files that nothing depends on are damped down in flow-style queries.
Fix
Generated-file banners recognized
Wrangler-style "generated by..." banners are now detected so generated files are treated appropriately.
Feature
Supported languages shown to MCP clients
The MCP server now tells connected tools which languages CodeGraph supports.
2026-07-27A smaller week spent fixing correctness and stability bugs across the MCP server, Python references, and the database.6 changes
Chore
Self-hosted telemetry dashboard
Telemetry now runs on Cloudflare D1 with a password-gated admin dashboard, including a login fix for Chromium's no-referrer policy.
Fix
Smarter blast-radius reporting
Change impact now follows caller chains before claiming there is no test coverage.
Fix
Python class references tracked
Bare references to classes in Python now produce proper reference edges.
Fix
Stale symbol bodies rejected
The MCP server will never serve a symbol body from a file that has changed since it was indexed.
Fix
Database memory leak plugged
Sessions killed by the watchdog no longer leak the SQLite write-ahead log without limit.
Fix
Windows installer hook fixed
The Claude prompt hook is now written as codegraph.cmd so it works on Windows.
2026-07-20The v1.5.0 release week: major speed improvements plus built-in support for ten additional languages.6 changes
Feature
Ten new languages supported
C#, Ruby, PHP, Swift, Kotlin, R, Lua/Luau, Scala, and Dart walkers all shipped as default-routed languages in the kernel.
Refactor
Big indexing speedups
A chain of optimizations cut indexing time substantially — for example tokio −23%, kong −23% cumulative, and the Swift compiler from 185s to 98s — with byte-identical results.
Refactor
Near-instant save-to-graph sync
Adaptive debouncing and scoped watcher sync keep incremental updates well under a second at any repo size.
Feature
GitHub Copilot installer targets
CodeGraph can install itself into VS Code Copilot, Copilot CLI, and JetBrains, with fixes for folderless windows and false-positive detection.
Chore
v1.5.0 released
The [Unreleased] changelog was promoted into version 1.5.0 with README polish and benchmark re-validation.
Chore
Stronger release gates
Release CI now requires kernel builds and passes a full walker-parity check before shipping.
Dependencies and code review
Dependency advisories
Security Watch
6 vulnerable packages (8 advisories) across 107 scanned dependencies.
vitest 2.1.9
1 advisory. Fixed in 4.1.0.
How it can be abusedIf a developer starts Vitest with its UI enabled, anyone who can reach that local server, including a malicious website open in the same machine's browser, can read or run arbitrary files on the developer's computer. Only developers actively running the test UI are affected, not end users of CodeGraph.
- criticalGHSA-5xrq-8626-4rwpWhen Vitest UI server is listening, arbitrary file can be read and executed
nanoid 3.3.11
2 advisories. Fixed in 3.3.16.
How it can be abusedThis bug only matters if the program lets an attacker control the length value passed to nanoid, or uses a custom ID generator, which would let them trigger an infinite loop that hangs the process. Here, nanoid just makes short random IDs for graph nodes and edges with fixed, hardcoded sizes, so there is no realistic way for anyone to feed it bad input, and users of this local CLI tool are not meaningfully exposed.
- highGHSA-28wg-ghj8-5hjvnanoid: non-secure generators can loop indefinitely with negative size
- highGHSA-2v37-7h3g-55p8nanoid: custom generators can loop indefinitely when size is zero
picomatch 4.0.3
1 advisory. Fixed in 4.0.4.
How it can be abusedPicomatch turns glob patterns into matchers here, and certain patterns with repeated extglob groups can make matching take huge amounts of time on crafted inputs. Since this tool runs locally and its patterns come from your own config and ignore files, not from untrusted network sources, an attack would require someone to plant a hostile pattern in files you already chose to run against your own codebase.
- highGHSA-c2c7-rcm5-vvqjPicomatch has a ReDoS vulnerability via extglob quantifiers
postcss 8.5.6
2 advisories. Fixed in 8.5.12.
How it can be abusedIf this tool ever processed a CSS file crafted by an attacker, a sneaky comment inside that CSS could trick PostCSS into reading and leaking any file on the machine that happens to end in .map. In practice CodeGraph parses TypeScript and Rust source for its code graph and does not process CSS at all, so the only people exposed would be developers running unrelated build or styling steps that pull in PostCSS on untrusted input.
- highGHSA-6g55-p6wh-862qPostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
- highGHSA-r28c-9q8g-f849PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
rollup 4.57.1
1 advisory. Fixed in 2.80.0.
How it can be abusedAn attacker who can get malicious code or a crafted plugin into your build could trick Rollup into writing files outside the project folder during bundling. Here Rollup is only used at development time to bundle CodeGraph's own trusted source, so end users running the tool are not exposed.
- highGHSA-mw96-cpmx-2vgcRollup 4 has Arbitrary File Write via Path Traversal
vite 5.4.21
1 advisory. Fixed in 8.0.16.
How it can be abusedThis flaw only matters when someone runs Vite's development server on Windows, where an attacker who can reach that server could trick it into serving files it was supposed to block, such as source code or secrets. In this repo Vite is only a build tool for the optional Cloudflare telemetry dashboard, which is not exposed as a local dev server to untrusted users, so real-world abuse is unlikely.
- highGHSA-fx2h-pf6j-xcffvite: `server.fs.deny` bypass on Windows alternate paths
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required