
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
codebase-memory-mcp
Advanced tools
Fast code intelligence engine for AI coding agents — single static binary MCP server
The fastest and most efficient code intelligence engine for AI coding agents. Full-indexes an average repository in milliseconds, the Linux kernel (28M LOC, 75K files) in 3 minutes. Answers structural queries in under 1ms. Ships as a single static binary — this package downloads and runs it automatically.
High-quality parsing through tree-sitter AST analysis across 159 languages — producing a persistent knowledge graph of functions, classes, call chains, HTTP routes, and cross-service links. 14 MCP tools. Zero dependencies. Plug and play across 43 automatic/conditional client surfaces.
npm install -g codebase-memory-mcp
The binary for your platform is downloaded automatically at install time. Then configure your coding agents:
codebase-memory-mcp install
Restart your agent. Say "Index this project" — done.
install configures the appropriate MCP, durable-context, and documented hook surfaces without widening client permissions.~/.bob/mcp.json already exists.~/.codebuddy/.mcp.json while preserving active older files; Bob Shell uses ~/.bob/mcp_settings.json; Pochi uses the mcp section in ~/.pochi/config.jsonc; Amazon Q Developer IDE defaults to ~/.aws/amazonq/default.json while preserving either documented alternative.UserPromptSubmit; on macOS/Linux, GitLab Duo gets a fail-open user SessionStart, while Devin gets UserPromptSubmit, PostCompaction, and a deduplicated SessionStart when Claude does not already provide it. Qoder, GitLab Duo, Devin, and Factory hooks are withheld on Windows without a documented shell/executor contract. Cline's auto-activating file hooks are withheld because their context output is not reliably consumed, CodeBuddy beta hooks are not auto-installed, and Cursor context hooks remain withheld.| OS | Architecture |
|---|---|
| macOS | arm64, amd64 |
| Linux | arm64, amd64 |
| Windows | amd64 |
codebase-memory-mcp install # configure all detected coding agents
codebase-memory-mcp --version
codebase-memory-mcp --help
codebase-memory-mcp update # update to latest release
codebase-memory-mcp uninstall # remove agent configs
Every MCP tool is also available directly from the command line:
codebase-memory-mcp cli index_repository '{"repo_path": "/path/to/repo"}'
codebase-memory-mcp cli search_graph '{"name_pattern": ".*Handler.*", "label": "Function"}'
codebase-memory-mcp cli trace_call_path '{"function_name": "main", "direction": "both"}'
codebase-memory-mcp cli get_architecture '{}'
| Category | Tools |
|---|---|
| Indexing | index_repository, list_projects, delete_project, index_status |
| Querying | search_graph, trace_call_path, detect_changes, query_graph |
| Analysis | get_architecture, get_graph_schema, get_code_snippet, search_code |
| Advanced | manage_adr, ingest_traces |
Benchmarked on Apple M3 Pro:
| Operation | Time |
|---|---|
| Linux kernel full index (28M LOC, 75K files) | 3 min |
| Django full index | ~6s |
| Cypher query | <1ms |
| Trace call path (depth=5) | <10ms |
See github.com/DeusData/codebase-memory-mcp for the full README including all MCP tools, configuration options, graph data model, and language support details.
MIT
FAQs
Fast code intelligence for AI coding agents — installs a verified native runtime set
The npm package codebase-memory-mcp receives a total of 25,702 weekly downloads. As such, codebase-memory-mcp popularity was classified as popular.
We found that codebase-memory-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.