
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
graphify-sfcc
Advanced tools
Demandware-aware code-graph MCP server + engine: cartridge-path resolution, parsers, graph queries, function/symbol layer, CLI, visualizer, and a grep-router hook.
💡 Quick Setup Guide: For step-by-step setup instructions across Claude Code, Claude Desktop, Cursor, Gemini, Windsurf, and VS Code, see the dedicated INSTALLATION.md guide.
An ultra-fast, Demandware-aware code-graph engine and Model Context Protocol (MCP) server for Salesforce Commerce Cloud (SFCC / SFRA) codebases.
graphify-sfcc lets AI coding assistants answer "how is this wired?" questions in one deterministic tool call (~200 tokens) instead of a slow, context-bloating chain of grep and file reads.
graphify-sfcc?When an AI assistant investigates SFCC architecture — which copy of Checkout.js wins on the cartridge path? where is this helper used? what does HookMgr.callHook dispatch to? — raw text search fails:
grep → read → grep round-trips. Each read dumps whole source files into context, consuming thousands of tokens.app_custom vs app_storefront_base). It cannot tell which of five Checkout.js files actually executes or resolve ~/cartridge/... requires.graphify-sfcc vs. Raw GrepHead-to-head benchmark on 10 real-world SFCC architecture queries (evaluated against ground truth):
| Metric | Traditional Grep | graphify-sfcc | Improvement |
|---|---|---|---|
| Tool Calls / Query (Avg) | ~6.6 calls | ~2.1 calls | ⚡ 3× Faster |
| Tokens / Query | 5,000+ tokens | ~200 tokens | 💰 95% Token Savings |
| Cartridge Precedence | Guesses / Fails | Exact (Leftmost-Wins) | 🎯 100% Accuracy |
| Symbol Call-Site Recall | Incomplete | 1.00 (Exact File:Line) | 🔍 Complete Precision |
graphify-sfcc indexes your entire repository into a high-performance Graphology network graph, capturing:
require('*/cartridge/...') leftmost-wins precedence, app_storefront_base/..., base/..., relative ./, and dw/* platform externals.module.superModule override chains and shadowed modules across cartridges.server.* Route Wiring: prepend, append, replace, get, post, use, and extend middleware bindings.hooks.json Dispatch: Dynamic HookMgr.callHook() and hooksHelper() execution linked to script handlers.res.render('template') calls, ISML <isinclude template="...">, and URLUtils.url(...) routes.server.forms.getForm('name') mapped to forms/**/*.xml definitions and field IDs.getCustomPreferenceValue('id') reads joined against customPreferences.js and system metadata XML to catch unconfigured preference bugs.session, request, customer, response, pdict, slotcontent, and dw.order.OrderMgr.graph TD
A[SFCC / SFRA Repository] --> B[Cartridge Path Resolver]
A --> C[AST & XML Parsers]
B --> D[Graphology Network Engine]
C --> D
D --> E[MCP Server stdio]
D --> F[Interactive HTML Visualizer]
E --> G[Claude / Cursor / Gemini / Windsurf / VS Code]
Install graphify-sfcc globally via npm:
npm install -g graphify-sfcc
Verify installation:
graphify-sfcc --version
# Output: 0.1.0
| Command | Description |
|---|---|
graphify-sfcc (or serve) | Start the stdio MCP server for AI assistants. |
graphify-sfcc build | Build/refresh graph index and output node/edge stats. |
graphify-sfcc visualize | Generate an interactive HTML graph visualization and open it in browser. |
graphify-sfcc install | Install the Claude skill (.claude/skills/sfcc-graph/SKILL.md) into your workspace. |
Configure graphify-sfcc in your AI coding assistant. Standard stdio config block:
{
"mcpServers": {
"graphify-sfcc": {
"command": "graphify-sfcc",
"args": ["serve"],
"env": {
"SFCC_GRAPH_ROOT": "/absolute/path/to/your/sfcc-storefront-repo"
}
}
}
}
claude mcp add graphify-sfcc -- graphify-sfcc serve%APPDATA%\Claude\claude_desktop_config.json (Win) or ~/Library/Application Support/Claude/claude_desktop_config.json (macOS).cursor/mcp.json~/.codeium/windsurf/mcp_config.json~/.gemini/config/mcp_config.json or workspace .mcp.json(See INSTALLATION.md for detailed client setup guides).
graphify-sfcc exposes 18 deterministic MCP tools to your AI agent:
| Tool | Purpose |
|---|---|
build_index | Build or refresh graph index for target repository. |
stats | Return total counts for cartridges, modules, routes, templates, and symbols. |
resolve_module | Resolve exact target file path given a require specifier and caller context. |
who_overrides | List override chain (module.superModule) and lower-precedence shadows. |
dependencies_of | List all outbound require modules and imported scripts for a file. |
callers_of | Find all inbound caller modules that require a given file. |
defines_symbols | List top-level functions defined in a module with line numbers. |
symbol_usages | Find exact file:line call sites of a function across the codebase. |
route_info | Inspect controller route handlers (prepend, append, replace, get, post). |
hook_handler | Find script handlers bound to a hooks.json hook extension point. |
template_graph | Inspect ISML template includes (<isinclude>) and outbound route links. |
pref_usage | Inspect site preference reads (getCustomPreferenceValue) vs metadata declarations. |
uses_global | Find dw ambient global accesses (session, request, customer, pdict) in a file. |
global_usages | Find all files accessing a specific dw ambient global. |
unresolved | Audit dead require links, missing ISML templates, and orphan site preferences. |
search_nodes | Search graph nodes by substring, cartridge name, or node kind. |
explain | Return full attributes, incoming edges, and outgoing edges for any node. |
shortest_path | Compute shortest dependency path between two files or symbols in the graph. |
Generate an interactive, standalone HTML network visualization of your codebase architecture:
graphify-sfcc visualize
This creates .sfcc-graph-cache/visualize.html and automatically opens it in your default web browser.
You can also use graphify-sfcc as a Node.js library in custom tooling:
import { Index, CartridgeResolver } from 'graphify-sfcc';
// Build or load graph index for repository
const index = Index.build({ root: '/path/to/sfcc-storefront' });
// Query exact function call sites
const usages = index.symbolUsages('Handle');
console.log(usages);
// Resolve cartridge path precedence
const resolver = new CartridgeResolver('/path/to/sfcc-storefront');
const resolved = resolver.resolveRequire('*/cartridge/scripts/checkout/checkoutHelpers', 'app_custom');
console.log(resolved);
graphify-sfcc maintains 85.2% unit test coverage across 60 test suites:
npm run build # Compile TypeScript (tsc)
npm test # Run 60 unit tests with LCOV path mapping
npm run smoke # Execute graph integration smoke test
SFCC_GRAPH_ROOT: Target SFCC repository root path.SFCC_GRAPH_CARTRIDGE_PATH: Override cartridge resolution path (e.g. app_custom:app_storefront_base).SFCC_GRAPH_CACHE: Override disk cache folder (default <repo-root>/.sfcc-graph-cache/).Distributed under the MIT License. Created by nabhat.
FAQs
Demandware-aware code-graph MCP server + engine: cartridge-path resolution, parsers, graph queries, function/symbol layer, CLI, visualizer, and a grep-router hook.
We found that graphify-sfcc demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.