codegraph-mcp

Part of the Accountable AI Engineering suite — provable governance for AI agents on infrastructure you own.

A no-train, on-prem code knowledge graph that you serve to AI agents over MCP — with a hash-chained audit row for every read.

Ask yourself:

• Do your AI coding agents need to understand a codebase that can't be uploaded to a vendor's cloud?
• Have you watched an agent miss that a one-line change breaks a caller in another language — because it only ever saw one file?
• When an agent reads your source, could you produce a record of exactly what it read — and prove it wasn't edited after the fact?

If that's your world, you're in the right place. codegraph-mcp gives agents real, structural understanding of your code, on hardware you control:

• No training, ever. The graph exists only to answer queries. Your code is never used to rank, sell, or train a model, and nothing leaves the machine.
• Overlay, not migration. Point it at any checkout or git URL. Keep hosting your code exactly where it already lives — GitHub, GitLab, an internal mirror, an air-gapped drive.
• Provable reads. Every query an agent makes lands in a tamper-evident, hash-chained audit log you can verify offline. "Which agent read what, and when" is a fact you can show a regulator, not a guess.
• Sees what one-file context can't. Six languages, with cross-language edges — the dependency a giant context window misses. (Independent research keeps finding graph-structured understanding beats stuffing raw files into a prompt.)

Watch the walkthrough

A full tour — browsing the repo, the setup, the live code graph, and all five demo scenarios running for real (narrated, ~12 min):

▶ Watch the walkthrough (MP4) — click the thumbnail or the link to play.

What it does

On every push or re-index, codegraph-mcp parses your source and builds a queryable graph of:

• Symbols — functions, methods, classes, and types, with signatures and exact locations.
• Call edges — who calls whom, within and across files.
• Cross-language edges — the edge nobody else resolves: a TypeScript fetch('/api/users/:id') linked to the Go and Python handlers that serve that route. These files share no symbol name, so only a structural join finds the dependency.
• References — every call site / use of a name.

Then it answers the questions an agent (or a human) actually asks: find this symbol, who calls it, what's the blast radius if I change it, what crosses a language boundary here.

Quick start

git clone https://github.com/cognis-digital/codegraph-mcp
cd codegraph-mcp
pip install -e .          # or just run via `python -m codegraph`

# 1. Index any repo (a local path, or a git URL it clones read-only)
codegraph index ./examples/sample_repo --db graph.db
codegraph index https://github.com/your-org/your-service.git --db graph.db
codegraph index . --since HEAD~1 --db graph.db   # incremental: only what changed

# 2. Query the graph
codegraph query search loadUser --db graph.db
codegraph query impact 7 --db graph.db          # transitive callers ("blast radius")
codegraph query xlang --db graph.db             # cross-language HTTP edges

# 2b. Visualize the graph — Mermaid (renders inline on GitHub) or Graphviz DOT
codegraph viz --db graph.db --view project --format mermaid
codegraph viz --db graph.db --view impact --symbol 7 --format me