
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
codebase-memory-mcp
Advanced tools
Fast code intelligence for AI coding agents — installs a verified native runtime set
The fastest and most efficient code intelligence engine for AI coding agents. Full-indexes an average repository in milliseconds, the Linux kernel (28M LOC, 75K files) in 3 minutes. Answers structural queries in under 1ms. This npm wrapper downloads, verifies, and caches the selected native runtime set: the executable, its authenticated integration asset, and—when requested—the content-addressed UI pack.
High-quality parsing through tree-sitter AST analysis across 162 languages — producing a persistent knowledge graph of functions, classes, call chains, HTTP routes, and cross-service links. 15 MCP tools. No hosted service or API key; this package requires Node.js to manage and launch the cached native runtime set. Plug and play across 45 automatic/conditional client surfaces.
npm install -g codebase-memory-mcp
The runtime set for your platform is downloaded automatically at install time. There is one composition per platform and the graph UI is always included — the former CBM_VARIANT=ui opt-in is obsolete.
Then configure your coding agents:
codebase-memory-mcp install
Restart your agent. Say "Index this project" — done.
install configures the appropriate MCP, durable-context, and documented hook surfaces without widening client permissions.~/.bob/mcp.json already exists.~/.codebuddy/.mcp.json while preserving active older files; Bob Shell uses ~/.bob/mcp_settings.json; Pochi uses the mcp section in ~/.pochi/config.jsonc; Amazon Q Developer IDE defaults to ~/.aws/amazonq/default.json while preserving either documented alternative.UserPromptSubmit; on macOS/Linux, GitLab Duo gets a fail-open user SessionStart, while Devin gets UserPromptSubmit, PostCompaction, and a deduplicated SessionStart when Claude does not already provide it. Qoder, GitLab Duo, Devin, and Factory hooks are withheld on Windows without a documented shell/executor contract. Cline's auto-activating file hooks are withheld because their context output is not reliably consumed, CodeBuddy beta hooks are not auto-installed, and Cursor context hooks remain withheld.| OS | Architecture |
|---|---|
| macOS | arm64, amd64 |
| Linux | arm64, amd64 |
| Windows | arm64, amd64 |
codebase-memory-mcp install # configure all detected coding agents
codebase-memory-mcp --version
codebase-memory-mcp --help
codebase-memory-mcp update # update to latest release
codebase-memory-mcp uninstall # remove agent configs
Every MCP tool is also available directly from the command line:
codebase-memory-mcp cli index_repository '{"repo_path": "/path/to/repo"}'
codebase-memory-mcp cli search_graph '{"name_pattern": ".*Handler.*", "label": "Function"}'
codebase-memory-mcp cli trace_call_path '{"function_name": "main", "direction": "both"}'
codebase-memory-mcp cli get_architecture '{}'
| Category | Tools |
|---|---|
| Indexing | index_repository, list_projects, delete_project, index_status |
| Querying | search_graph, trace_call_path, detect_changes, query_graph |
| Analysis | get_architecture, get_graph_schema, get_code_snippet, search_code |
| Advanced | manage_adr, ingest_traces |
Benchmarked on Apple M3 Pro:
| Operation | Time |
|---|---|
| Linux kernel full index (28M LOC, 75K files) | 3 min |
| Django full index | ~6s |
| Cypher query | <1ms |
| Trace call path (depth=5) | <10ms |
See github.com/DeusData/codebase-memory-mcp for the full README including all MCP tools, configuration options, graph data model, and language support details.
MIT
FAQs
Fast code intelligence for AI coding agents — installs a verified native runtime set
The npm package codebase-memory-mcp receives a total of 9,894 weekly downloads. As such, codebase-memory-mcp popularity was classified as popular.
We found that codebase-memory-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.