
Product
Socket Threat Intel Now Shows Which Malware Campaigns Were Blocked or Detected
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.
pi-code-graph
Advanced tools
Code Graph RAG extension for pi-coding-agent - query codebase knowledge graphs for intelligent code understanding
A native TypeScript extension for pi-coding-agent that builds and queries code knowledge graphs — enabling AI agents to understand codebase structure, relationships, and dependencies.
Ported from code-graph-rag (Python) to pure TypeScript. No Python dependency required.
You: "What functions call UserService.create_user?"
Pi: Uses query_code_graph → generates Cypher → queries Memgraph
→ Returns: AuthController.register(), AdminAPI.bulk_create(), tests/test_users.py::test_create()
You: "What would break if I change validate_input?"
Pi: Uses analyze_code_dependencies → finds all callers
→ Returns: 12 functions across 5 modules depend on validate_input()
You: "Find code that handles email validation"
Pi: Uses semantic_code_search → vector similarity search
→ Returns: utils/validators.py::validate_email(), models/user.py::User.set_email()
# Install the extension
npm install pi-code-graph
# Start pi — Memgraph auto-starts if Docker is available
pi
# Configure (picks up your existing pi auth automatically)
/cgs config
# Index your repository
/cgs index
# Query!
/cgs query "What classes inherit from BaseService?"
Or clone directly:
git clone https://github.com/picassio/pi-code-graph ~/.pi/agent/extensions/pi-code-graph
cd ~/.pi/agent/extensions/pi-code-graph && npm install
┌────────────────────────────────────────────────────────────────┐
│ pi-code-graph │
│ │
│ ┌──────────────────┐ ┌──────────────────┐ ┌─────────────┐ │
│ │ Tree-sitter │ │ LLM Service │ │ Embedding │ │
│ │ (WASM) │ │ (Cypher gen) │ │ Service │ │
│ │ │ │ │ │ │ │
│ │ Parse code → │ │ NL → Cypher │ │ Code → │ │
│ │ AST → Graph │ │ via Claude/ │ │ Vectors │ │
│ │ nodes & edges │ │ Gemini/GPT │ │ (OpenAI) │ │
│ └────────┬─────────┘ └────────┬─────────┘ └──────┬──────┘ │
│ │ │ │ │
│ ▼ ▼ ▼ │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ Memgraph (Bolt) │ │
│ │ Nodes: Project, Module, Class, Function, Method, ... │ │
│ │ Edges: CALLS, IMPORTS, INHERITS, DEFINES, CONTAINS │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │ │ │
│ ┌────────┴──────────┐ ┌────────────┴──────────┐ │
│ │ Graph Queries │ │ Vector Store (zvec) │ │
│ │ (Cypher) │ │ (~/.cgs/vectors) │ │
│ └───────────────────┘ └───────────────────────┘ │
└────────────────────────────────────────────────────────────────┘
~/.cgs/vectors)Pi automatically discovers and uses these tools:
| Tool | Description | When Pi Uses It |
|---|---|---|
query_code_graph | Natural language → Cypher → graph results | Understanding code structure, relationships, call graphs |
get_code_from_graph | Get source code by qualified name | After finding items via query, to see actual code |
semantic_code_search | Vector similarity search by meaning | Finding code by what it does, not its name |
analyze_code_dependencies | Callers/callees analysis | Before refactoring, to understand blast radius |
list_graph_projects | List indexed projects | Checking what's been indexed |
index_repository | Index/update the code graph | Setting up or refreshing the graph (must be enabled) |
The extension injects context into pi's system prompt, so pi knows:
/cgs docker start → /cgs config → index)Single /cgs command with subcommands:
| Command | Shortcut | Description |
|---|---|---|
/cgs config | /cgs c | Interactive configuration (provider, model, embedding) |
/cgs status | /cgs s | Check Memgraph, LLM, embedding availability |
/cgs query <q> | /cgs q | Quick query from the command line |
/cgs index | /cgs i | Index/update current repository |
/cgs docker | /cgs d | Manage Memgraph container |
/cgs clear | Clear results widget | |
/cgs help | /cgs h | Show help |
/cgs docker status # Show Docker/Memgraph status
/cgs docker start # Start Memgraph (auto-generates password)
/cgs docker stop # Stop Memgraph (data preserved)
/cgs docker restart # Restart Memgraph
/cgs docker logs # View Memgraph logs
pi-code-graph uses pi's existing auth — no separate API keys needed.
If you're logged in to any provider via pi's /login, it's automatically available:
| Provider | Auth Method | Default Model (LLM) |
|---|---|---|
| Anthropic | OAuth or API key | claude-sonnet-4-20250514 |
| API key | gemini-2.0-flash | |
| OpenRouter | API key | google/gemini-2.0-flash-001 |
| OpenAI | API key | gpt-4o-mini |
| Ollama | None (local) | codellama |
You can choose which provider and model to use via /cgs config:
/cgs config → 🤖 LLM Provider → 🔄 Auto
→ Choose Provider: anthropic 🔰 OAuth
→ Choose Model: claude-sonnet-4-20250514
Settings persist to ~/.cgs/config.toml:
[llm]
source = "auto"
auto_provider = "anthropic"
auto_model = "claude-sonnet-4-20250514"
[embedding]
source = "auto"
auto_provider = "openai"
auto_model = "text-embedding-3-small"
[memgraph]
host = "localhost"
port = "7687"
user = "memgraph"
password = "xK9mL2pQrS5tU8vW" # Auto-generated on first start
[project]
allow_index = false
Embeddings power semantic code search. Configure via /cgs config → Embedding:
| Mode | Provider | How |
|---|---|---|
| Auto | Uses pi's auth | OpenAI or OpenRouter from pi's login |
| Manual | OpenAI, OpenRouter, Ollama | Enter your own API key |
Default model: text-embedding-3-small (1536 dimensions, fast, good quality)
| Variable | Default | Description |
|---|---|---|
CGR_ALLOW_INDEX | false | Enable indexing tools for agents |
CGR_PROJECT_NAME | <dirname> | Project name in the graph |
MEMGRAPH_HOST | localhost | Memgraph host |
MEMGRAPH_PORT | 7687 | Memgraph port |
Indexing tools are disabled by default. This means agents can query the graph but cannot modify it.
Enable indexing via:
/cgs config → Project Settings → Enable IndexingCGR_ALLOW_INDEX=trueThis is intentional for multi-agent environments where you want a stable graph indexed by CI/CD.
┌─────────────────────────────────────────────────┐
│ CI/CD Pipeline │
│ index_repository on merge → Memgraph │
└──────────────────────┬──────────────────────────┘
│
┌───────────────┼───────────────┐
▼ ▼ ▼
┌─────────┐ ┌─────────┐ ┌─────────┐
│ Agent 1 │ │ Agent 2 │ │ Agent 3 │
│ READ │ │ READ │ │ READ │
│ ONLY │ │ ONLY │ │ ONLY │
└─────────┘ └─────────┘ └─────────┘
| Language | File Extensions | Parser |
|---|---|---|
| Python | .py | tree-sitter-python |
| TypeScript | .ts, .tsx | tree-sitter-typescript |
| JavaScript | .js, .jsx, .mjs | tree-sitter-javascript |
| Java | .java | tree-sitter-java |
| Rust | .rs | tree-sitter-rust |
| Go | .go | tree-sitter-go |
| C | .c, .h | tree-sitter-c |
| C++ | .cpp, .hpp, .cc, .cxx | tree-sitter-cpp |
# Install dependencies
npm install
# Type check
npm run check
# Run tests (289 tests)
npm test
# Watch mode
npm run test:watch
# Auto-start via extension
/cgs docker start
# Or manually
docker run -d --name cgr-memgraph -p 7687:7687 -p 3000:3000 memgraph/memgraph-platform
The repository needs to be indexed first:
/cgs config # Enable indexing under Project Settings
/cgs index # Index the repository
This is by design. Enable via /cgs config → Project Settings → Enable Indexing.
The LLM generates Cypher queries from natural language. Try:
validate_* in the auth module"/cgs status to check which LLM model is being usedMIT
FAQs
Code Graph RAG extension for pi-coding-agent - query codebase knowledge graphs for intelligent code understanding
The npm package pi-code-graph receives a total of 19 weekly downloads. As such, pi-code-graph popularity was classified as not popular.
We found that pi-code-graph demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Product
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.

Security News
Fixes for eMudhra and Brotli are out. Getting them everywhere they’re needed means tracking down bundled libraries, runtimes, and certificate stores.

Threat Research
/Security News
Socket uncovered secret-stealing workflows that ran in LiteLLM’s GitHub repository 11 days before the supply chain attack on PyPI and Docker.