
Security News
Deno Goes the Way of the Dinosaur
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.
pi-code-graph
Advanced tools
Code Graph RAG extension for pi-coding-agent - query codebase knowledge graphs for intelligent code understanding
A native TypeScript extension for pi-coding-agent that builds and queries code knowledge graphs — enabling AI agents to understand codebase structure, relationships, and dependencies before making changes.
Ported from code-graph-rag (Python) to pure TypeScript. No Python dependency required.
You: "What functions call UserService.create_user?"
Pi: → query_code_graph → Cypher → Memgraph
→ AuthController.register(), AdminAPI.bulk_create(), tests/test_users.py::test_create()
You: "What would break if I change validate_input?"
Pi: → analyze_code_dependencies → finds all callers
→ 12 functions across 5 modules depend on validate_input()
You: "Find code that handles email validation"
Pi: → semantic_code_search → embedding → zvec HNSW search
→ utils/validators.py::validate_email(), models/user.py::User.set_email()
# As a pi package
npm install pi-code-graph
# Or clone for development
git clone https://github.com/picassio/pi-code-graph
pi
/cgs setup # Guided wizard: starts Memgraph, configures LLM, indexes repo
Or manually:
/cgs docker start # Start Memgraph via Docker Compose
/cgs config # Configure LLM provider + embedding model
/cgs index # Index the current repository
The agent automatically uses the graph tools. You can also query directly:
/cgs query "What classes inherit from BaseService?"
┌─────────────────────────────────────────────────────────────┐
│ pi-code-graph │
│ │
│ ┌────────────────┐ ┌────────────────┐ ┌──────────────┐ │
│ │ Tree-sitter │ │ LLM Service │ │ Embedding │ │
│ │ (WASM) │ │ (Cypher gen) │ │ Service │ │
│ │ │ │ │ │ │ │
│ │ Parse → AST → │ │ NL → Cypher │ │ Code → │ │
│ │ graph nodes │ │ via OpenRouter │ │ vectors │ │
│ └───────┬────────┘ └───────┬────────┘ └──────┬───────┘ │
│ │ │ │ │
│ ▼ ▼ ▼ │
│ ┌──────────────────────────────────────────────────────┐ │
│ │ Memgraph (Bolt protocol) │ │
│ │ Nodes: Project, Module, Class, Function, Method │ │
│ │ Edges: CALLS, IMPORTS, INHERITS, DEFINES, │ │
│ │ DEFINES_METHOD, CONTAINS │ │
│ └──────────────────────────────────────────────────────┘ │
│ │
│ ┌──────────────────────────────────────────────────────┐ │
│ │ zvec (in-process vector DB) │ │
│ │ HNSW index, cosine similarity, per-project storage │ │
│ │ ~/.cgs/vectors/{project}/ │ │
│ └──────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────┘
Nodes:
Project — top-level project containerPackage — language package (e.g., npm package, Python package)Module — source file as a moduleFile, Folder — file system structureClass, Interface, Enum, Type — type definitionsFunction, Method — callable code elementsExternalPackage — third-party dependenciesRelationships:
CALLS — function/method call edges (resolved via AST + type inference)DEFINES — module defines a function/classDEFINES_METHOD — class defines a methodIMPORTS — module imports from another moduleINHERITS — class extends another classIMPLEMENTS — class implements an interfaceCONTAINS_* — structural containment (project→package→folder→file→module)DEPENDS_ON_EXTERNAL — dependency on third-party package~/.cgs/cache/{project}.jsonthis.method(), imports, builtins)~/.cgs/vectors/{project}/v0.16.0 adds an opt-in Ax (@ax-llm/ax) runtime path for typed LLM programs. It does not use Ax built-in provider wrappers. Instead, Ax calls go through PiAxAIService, which wraps pi-code-graph's existing LLMClient stack so Pi/modelRegistry auth, OAuth/custom headers, and provider behavior remain the single source of truth.
[query]
engine = "legacy" # legacy | ax
ax_router = true
ax_repair = true
ax_max_repair_attempts = 1
Safety rails are unchanged in Ax mode: generated Cypher is still validated as read-only, checked for scalar/list operator mistakes, scoped to the active project, and result-capped before execution.
Pi automatically discovers and uses these tools:
| Tool | Description | When the Agent Uses It |
|---|---|---|
query_code_graph | Natural language → Cypher → graph results | Understanding structure, relationships, call graphs |
semantic_code_search | Vector similarity search by meaning | Finding code by what it does, not by name |
analyze_code_dependencies | Callers/callees/blast radius analysis | Before refactoring — know what would break |
get_code_from_graph | Retrieve source code by qualified name | After finding items via query, read the actual code |
list_graph_projects | List all indexed projects | Checking what's available to query |
index_repository | Index/update the code graph | Keeping the graph up to date after code changes |
The extension injects context into pi's system prompt so the agent:
index_repository before querying if code has changed (incremental, fast)The indexer tracks file changes via SHA-256 hashes stored at ~/.cgs/cache/{project}.json.
| What | Full Index | Incremental Update |
|---|---|---|
| File scan | Hash all files | Hash all files |
| Parsing | All source files | Only changed/new files |
| Graph | Delete project + recreate | Delete changed modules + recreate |
| Embeddings | All functions | Only functions from changed files |
| Deleted files | N/A | Removed from graph automatically |
/cgs index # Incremental (fast — only changed files)
/cgs index --clean # Full re-index (delete + rebuild everything)
All projects share one Memgraph instance, separated by qualified name prefixes:
pi-code-graph.src.services.ServiceManager → project: pi-code-graph
pi-squad.src.scheduler.Scheduler → project: pi-squad
Each project gets isolated storage:
~/.cgs/
├── config.toml # Global settings
├── cgs.log # Log file (no console output)
├── cache/
│ ├── pi-code-graph.json # Hash cache
│ └── pi-squad.json
├── docker/
│ └── docker-compose.yml # Memgraph compose
└── vectors/
├── pi-code-graph/ # zvec HNSW index
└── pi-squad/
Index any project from anywhere:
# Index current directory
/cgs index
# Index a different project
index_repository(project_root="/path/to/other-project")
Query across projects:
query_code_graph("classes where qualified_name starts with pi-squad")
analyze_code_dependencies(target="Scheduler") # finds it in pi-squad
| Command | Shortcut | Description |
|---|---|---|
/cgs | Interactive menu | |
/cgs setup | Guided first-time setup (Docker, LLM, indexing) | |
/cgs config | /cgs c | Configure LLM provider, embedding, Memgraph |
/cgs status | /cgs s | Check service availability |
/cgs query <q> | /cgs q | Quick graph query |
/cgs index | /cgs i | Index/update current repository |
/cgs docker | /cgs d | Manage Memgraph container (start/stop/restart/logs) |
/cgs logs | /cgs l | View extension log file |
/cgs help | /cgs h | Show help |
pi-code-graph uses pi's existing auth — no separate API keys needed. If you're logged in via /login, it works automatically.
Provider priority: OpenRouter → Google → OpenAI → Anthropic → Ollama
Configure via /cgs config or edit ~/.cgs/config.toml:
[llm]
source = "auto"
auto_provider = "openrouter"
auto_model = "google/gemini-2.0-flash-001"
[embedding]
source = "auto"
auto_provider = "openrouter"
auto_model = "openai/text-embedding-3-small"
[memgraph]
host = "localhost"
port = "7687"
[project]
allow_index = true
[query]
engine = "legacy" # or "ax" for the custom PiAxAIService runtime
ax_router = true
ax_repair = true
ax_max_repair_attempts = 1
The extension manages Memgraph via Docker Compose (~/.cgs/docker/docker-compose.yml):
/cgs docker start # Start both containers
/cgs docker stop # Stop (data preserved in Docker volumes)
/cgs docker logs # View Memgraph logs
| Language | Extensions | WASM Grammar |
|---|---|---|
| Python | .py | tree-sitter-python |
| TypeScript | .ts, .tsx | tree-sitter-typescript |
| JavaScript | .js, .jsx, .mjs | tree-sitter-javascript |
| Java | .java | tree-sitter-java |
| Rust | .rs | tree-sitter-rust |
| Go | .go | tree-sitter-go |
| C++ | .cpp, .hpp, .cc, .cxx | tree-sitter-cpp |
| C# | .cs | tree-sitter-c-sharp |
| PHP | .php | tree-sitter-php |
All grammars loaded via @vscode/tree-sitter-wasm — no native compilation needed.
Indexing is disabled by default. Agents can query the graph but cannot modify it.
Enable via:
/cgs config → Project Settings → Enable Indexing/cgs setup (offers to enable during guided setup)CGR_ALLOW_INDEX=true environment variableThis is intentional for multi-agent environments where you want a stable graph.
npm install # Install dependencies
npm run check # Type check (tsc --noEmit)
npm test # Run tests (289 tests)
npm run test:watch # Watch mode
# Link for local development with pi
# Add to ~/.pi/agent/settings.json packages:
# "../../path/to/pi-code-graph"
MIT
FAQs
Code Graph RAG extension for pi-coding-agent - query codebase knowledge graphs for intelligent code understanding
The npm package pi-code-graph receives a total of 6 weekly downloads. As such, pi-code-graph popularity was classified as not popular.
We found that pi-code-graph demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.

Security News
Anthropic’s free OSS Scanner uses Mythos and other Claude models to find open source vulnerabilities and send maintainers reports with proposed fixes.

Security News
On Front Lines’ Early Adopters: CISO podcast, Andrew Becherer shares lessons from Datadog, weighs the long-term costs of AI-built tools, and explains how founders can actually gain a CISO’s trust.