
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
cgraphy
Advanced tools
cgraphy is a Python code knowledge graph and Model Context Protocol (MCP) server for AI coding agents such as Claude Code, Codex CLI, Cursor, and Gemini CLI.
cgraphy indexes any codebase into a knowledge graph — functions, classes and files as nodes; calls, imports, inheritance and git co-change history as edges — and serves compact, token-budgeted slices of it to AI assistants through the Model Context Protocol. Instead of re-reading dozens of files to orient itself on every prompt, an agent asks the graph and gets the relevant subgraph in a couple of thousand tokens.
cgraphy_context expands the graph greedily around a
symbol and stops exactly at your token budget — cost scales with the
question, not the repo.--git-history mines commit history for files that change
together (logical coupling), an edge type static analysis can't see..cgraphy/. No services, no
daemons, no vector database.pip install cgraphy # or: uv tool install cgraphy
cd your-repo
cgraphy init # one command: MCP config + agent steering + index
cgraphy init does three things:
.mcp.json — picked up automatically by Claude
Code in all its forms: CLI, VSCode extension, and the desktop app.CLAUDE.md and AGENTS.md telling agents to
consult the graph (cgraphy_overview → cgraphy_search →
cgraphy_context) before reading files — this is what makes the graph
actually replace bulk file reading. (Agents can't be forced, only steered:
instruction files + persuasive tool descriptions + the tools being
genuinely faster is the mechanism, and it works.)Or register the MCP server manually with your assistant:
Claude Code
claude mcp add cgraphy -- uvx cgraphy serve /path/to/repo
Codex CLI (~/.codex/config.toml)
[mcp_servers.cgraphy]
command = "uvx"
args = ["cgraphy", "serve", "/path/to/repo"]
Gemini CLI (~/.gemini/settings.json) / Cursor (.cursor/mcp.json)
{"mcpServers": {"cgraphy": {"command": "uvx",
"args": ["cgraphy", "serve", "/path/to/repo"]}}}
Reading / orientation:
| Tool | Returns | The agent uses it… |
|---|---|---|
cgraphy_overview | Repo map: subsystems, key symbols by importance, all files | first, instead of reading files to orient |
cgraphy_search | Ranked matches with file:line and summaries (hybrid lexical+semantic when the [semantic] extra is installed) | before grep / directory listing |
cgraphy_context | Subgraph around a symbol (callers, callees, imports, co-changes) within a token budget | instead of reading whole files |
cgraphy_read | Just one symbol's source, line-numbered, budgeted | instead of reading the whole file |
Editing / reviewing — the tools that make the graph part of the change loop:
| Tool | Returns | The agent uses it… |
|---|---|---|
cgraphy_impact | Blast radius: direct + transitive dependents, affected tests, historically co-changed files | before modifying shared code |
cgraphy_diff_context | The working git diff mapped to touched symbols, their users, and covering tests | before committing / when resuming work |
Enrichment:
| Tool | Returns | The agent uses it… |
|---|---|---|
cgraphy_enrich | Batch of symbols that still need one-line summaries | when asked to "enrich the graph" |
cgraphy_store_summaries | Confirmation + remaining count | to save the summaries it wrote |
Retrieval is usage-aware: symbols an agent repeatedly asks about get a small, capped boost in future context expansion (telemetry stays in the local SQLite file; nothing leaves your machine).
pip install "cgraphy[semantic]"
Adds tiny static embeddings (model2vec, CPU-only, no torch) fused with FTS5
by reciprocal-rank fusion — closes the vocabulary gap between issue-style
prose ("login broken") and code identifiers (validate_jwt).
The graph self-heals: tools detect stale files and re-index incrementally (changed files only) before answering.
Structure is extracted automatically; meaning comes from summaries. Tell your agent once:
enrich the cgraphy graph
It will loop cgraphy_enrich → cgraphy_store_summaries until every symbol
has a one-line semantic summary. Summaries are keyed to a hash of each
symbol's source, so editing one function invalidates only that summary.
For CI, cgraphy index --summarize pre-bakes summaries with your own
Anthropic API key (pip install cgraphy[summarize], ANTHROPIC_API_KEY set).
cgraphy view . # http://localhost:8787
A dependency-free local page (bundled Cytoscape.js): search, color by kind, click for details, double-click to expand neighbors; co-change edges shown dashed.
python scripts/benchmark.py /path/to/repo "your question"
Prints the tokens an agent spends orienting via cgraphy (overview + search + context) versus reading every code file, and the reduction factor.
python scripts/eval_localization.py /path/to/repo 50
Mines fix-like commits from the repo's history (subject = query, touched files = ground truth, co-change mining excludes evaluated commits), then scores an ablation ladder — FTS-only, +PageRank, +graph expansion, ±co-change edges — on hit@5/hit@10/MRR and token cost. No LLM calls, no human grading, fully reproducible. Results and a paper draft live in paper/.
cgraphy index walks the repo (respecting .gitignore +
.cgraphyignore), parses each file with tree-sitter, and stores nodes and
edges in .cgraphy/graph.db (SQLite + FTS5). Re-indexing is incremental by
content hash.cgraphy serve exposes the five MCP tools over stdio.--git-history adds weighted co-change edges mined from
git log.Design details: docs/superpowers/specs/2026-07-08-cgraphy-design.md
MIT
mcp-name: io.github.pmgarg/cgraphy
FAQs
Code knowledge graph over MCP: compact, token-budgeted context for AI coding agents
We found that cgraphy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.