
Product
Microsoft Teams Notifications Are Now Available in Socket
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.
@astudioplus/codegraph-mcp
Advanced tools
CodeGraph MCP server — cross-language code intelligence with 42 tools, 38 languages
Cross-language code intelligence for AI agents — 42 tools, 38 languages, persistent memory, documentation intelligence, one-call PR review.
npm install -g @astudioplus/codegraph-mcp
Add to ~/.claude.json:
{
"mcpServers": {
"codegraph": {
"command": "codegraph-mcp",
"args": []
}
}
}
Same config — the codegraph-mcp command starts the server in MCP (stdio) mode.
Pass flags after --:
{
"mcpServers": {
"codegraph": {
"command": "codegraph-mcp",
"args": ["--workspace", "/path/to/project", "--exclude", "vendor"]
}
}
}
| Flag | Default | Description |
|---|---|---|
--workspace <path> | current dir | Directories to index (repeatable) |
--exclude <dir> | — | Directories to skip (repeatable) |
--embedding-model <model> | bge-small | bge-small, jina-code-v2, or granite-97m (32K context, multilingual) |
--max-files <n> | 5000 | Maximum files to index |
--profile <name> | all | Scope tool surface: core (8), graph (16), memory (14), security (pro), all (42) |
--graph-only | off | Skip embeddings — graph + structural tools only. No ONNX model load, 10-50× faster indexing. For CI / one-shot graph queries. |
--run-tool <name> | — | One-shot: index, run a single tool, print result, exit. No MCP handshake. Pair with --tool-args '<json>'. |
Pre-configured rule files that teach your AI agent to use CodeGraph tools before falling back to grep / multi-file reads:
Get a code-graph analysis comment on every PR — blast radius, test gaps,
stale docs, suggested reviewers. Runs graph-only (no embeddings, no
API keys, just GITHUB_TOKEN). The core invocation:
codegraph-server --graph-only \
--run-tool codegraph_pr_context \
--tool-args '{"baseBranch":"main","format":"markdown"}'
This prints a ready-to-post markdown PR comment. A copy-paste workflow
template lives at .github/workflows/codegraph-pr.yml in the main repo.
Install a PreToolUse hook that nudges Claude to fetch graph context (get_edit_context, analyze_impact) before editing source files in indexed workspaces. Skips non-source files and ad-hoc edits silently. Never blocks tool calls.
npx codegraph-mcp-install-hooks # interactive prompt
npx codegraph-mcp-install-hooks --dry # preview the change
npx codegraph-mcp-install-hooks --force # skip prompt
npx codegraph-mcp-install-hooks --uninstall
Analysis (11): get_ai_context, get_edit_context, get_curated_context, analyze_impact, analyze_complexity, find_circular_deps, find_hot_paths, find_dead_imports, get_module_summary, search_by_pattern, search_by_error
PR review (1): pr_context — one-call PR analysis: blast radius, test gaps, stale docs, commit hint, suggested reviewers. Supports format:"markdown" for ready-to-post CI comments.
Navigation (13): symbol_search, get_callers, get_callees, get_detailed_symbol, get_symbol_info, get_dependency_graph, get_call_graph, find_by_imports, find_by_signature, find_entry_points, find_implementors, find_related_tests, traverse_graph
Memory (7): memory_store, memory_get, memory_search, memory_context, memory_list, memory_stats, memory_invalidate
Documentation (7): index_markdown, search_docs, list_doc_sources, remove_doc_source, verify_design, design_gaps, generate_architecture_doc
Indexing (3): reindex_workspace, index_files, index_directory
All tool names are prefixed with codegraph_ (e.g. codegraph_symbol_search).
Systems: C, C++, Rust, Zig, Objective-C
JVM: Java, Kotlin, Scala, Groovy, Clojure
Web/Scripting: TypeScript/JS, Python, Ruby, PHP, Perl, Lua, Elixir, Elm
Web/Style: CSS
Mobile: Swift, Dart
Functional: Haskell, OCaml, Julia, Erlang
Enterprise: C#, COBOL, Fortran, Go
Blockchain: Solidity
Shell/Config: Bash, HCL/Terraform, TOML, YAML, Dockerfile
Hardware: Verilog/SystemVerilog, Tcl
Data Science: R
Anonymous usage telemetry helps improve CodeGraph. Events tracked: tool invocations (name + duration), startup, errors. No file paths, code content, or PII is ever sent.
Opt out: set CODEGRAPH_TELEMETRY=off in your environment.
Apache-2.0 — GitHub
FAQs
CodeGraph MCP server — cross-language code intelligence with 42 tools, 38 languages
We found that @astudioplus/codegraph-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.

Security News
Socket CTO Ahmad Nassri joins AppSec leaders at Black Hat to discuss active malware, package manager risks, and software supply chain defense.