
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
open-codebase-index
Advanced tools
Host-neutral semantic codebase search with embeddings, symbol discovery, and call-graph tooling
Search a codebase by meaning, then follow the result into definitions, callers, and dependency paths.
open-codebase-index is a local semantic code index for OpenCode, Jcode, Pi, Codex, Claude Code, and other MCP clients. It combines embeddings, BM25 keyword search, branch-aware filtering, symbol lookup, and a call graph behind agent-friendly tools.
New installs should use open-codebase-index and open-codebase-index-mcp. The legacy package opencode-codebase-index and opencode-codebase-index-mcp remain supported aliases.
codebase_context and codebase_peek.implementation_lookup, call_graph, and call_graph_path.Requires Node.js 20 or newer.
Install the package:
npm install open-codebase-index
Legacy installs continue to work with:
npm install opencode-codebase-index
Add it to opencode.json:
{
"plugin": ["open-codebase-index"]
}
Legacy alias:
{
"plugin": ["opencode-codebase-index"]
}
Run /status, then /index.
Ask a repository question, for example:
Where is authentication state validated before an API request?
The first index creates embeddings. Later runs reuse unchanged content and process only relevant changes.
| Host | Recommended integration | Storage |
|---|---|---|
| OpenCode | Native plugin | .opencode/ |
| Jcode | Per-session MCP server | .codebase-index/ |
| Pi | Pi package | .codebase-index/ |
| Codex | Marketplace plugin with MCP and skill guidance | .codebase-index/ |
| Claude Code | Marketplace plugin with MCP and skill guidance | .claude/ |
| Cursor, Windsurf, other MCP clients | open-codebase-index-mcp (legacy alias: opencode-codebase-index-mcp) | Selected by --host; default is OpenCode-compatible |
See Installation and host setup for complete instructions.
index_status or /status.index_codebase or /index.codebase_context.codebase_peek when you only need likely locations.implementation_lookup for a known symbol or definition question.codebase_search when you need full matching source content.grep for exact identifiers or exhaustive text matches.| Need | Tool |
|---|---|
| Route a repository question to a bounded evidence pack | codebase_context |
| Find likely files and symbols without source bodies | codebase_peek |
| Retrieve full matching code | codebase_search |
| Find an authoritative definition | implementation_lookup |
| Find analogous implementations or duplicates | find_similar |
| Find direct callers or callees | call_graph |
| Find a path between two symbols | call_graph_path |
| Analyze a branch or pull request blast radius | pr_impact |
See Tools and commands for host availability, tool details, MCP prompts, and slash commands.
source files
│
├─ file discovery and git-aware change detection
├─ tree-sitter parsing and semantic chunking
├─ embedding generation and content-hash reuse
▼
SQLite metadata + usearch vectors + BM25 index
│
├─ semantic candidates
├─ keyword candidates
├─ branch and request filters
├─ deterministic fusion and ranking
▼
locations, source results, definitions, and call-graph evidence
The TypeScript layer handles host integration, configuration, indexing orchestration, providers, ranking, and tools. The Rust NAPI module handles parsing, vector storage, SQLite operations, BM25 indexing, hashing, and call extraction.
Read Architecture for the detailed data flow and design decisions.
With embeddingProvider: "auto", providers are tried in this order:
Ollama is the simplest local option:
ollama pull nomic-embed-text
{
"embeddingProvider": "ollama"
}
A custom OpenAI-compatible embeddings endpoint is also supported. Provider, indexing, search, reranking, include/exclude, knowledge-base, storage, and debug settings are documented in Configuration.
OpenCode project config lives at .opencode/codebase-index.json. Codex, Pi, and Jcode use .codebase-index/config.json; Claude uses .claude/codebase-index.json.
{
"embeddingProvider": "auto",
"scope": "project",
"indexing": {
"autoIndex": false,
"watchFiles": true,
"requireProjectMarker": true,
"semanticOnly": false
},
"search": {
"maxResults": 20,
"minScore": 0.1,
"fusionStrategy": "rrf",
"rerankTopN": 20
}
}
Only specify values you want to override. See Configuration for defaults and host-specific paths.
The index stores reusable content by hash and maintains branch catalogs for chunks and symbols. On a branch switch, unchanged content can be reused while results remain scoped to the active branch. Linked worktrees without a local project config share the main checkout's portable project index; adding a worktree-local config creates an isolated index boundary.
OpenCode and Pi can index additional directories as knowledge bases. Configure them with knowledgeBases or use the host-native knowledge-base tools where available.
Optional external reranking supports Cohere, Jina, and custom compatible endpoints. Local filtering and evidence classes are applied before external candidates are submitted.
See Configuration for examples and privacy considerations.
Start with:
/status or index_statusindex_health_check/index retryCommon provider, native module, stale index, branch, and performance issues are covered in Troubleshooting.
The repository includes reproducible retrieval datasets, latency and quality budgets, baseline comparison, and cross-repository benchmarking tools.
Performance depends on repository size, parser coverage, provider latency, embedding cache reuse, and the selected indexing limits. Prefer measured evaluation over fixed marketing claims.
npm ci
npm run build
npm run typecheck
npm run lint
npm run test:run
Native changes require Rust and npm run build:native. See Contributing, Architecture, and Adding language support.
open-codebase-index rename planMIT. See LICENSE.
FAQs
Host-neutral semantic codebase search with embeddings, symbol discovery, and call-graph tooling
The npm package open-codebase-index receives a total of 436 weekly downloads. As such, open-codebase-index popularity was classified as not popular.
We found that open-codebase-index demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.