code-graph-mcp
Detects HTTP calls made using Axios, enabling analysis of frontend-to-backend communication.
Detects Express backend routes, handlers, and middleware, allowing mapping of API endpoints.
Detects FastAPI route definitions and handlers for backend analysis.
Detects Flask route definitions and handlers for backend analysis.
Detects React components and their relationships, including imports and render hierarchy.
Detects React Router route definitions, enabling frontend route analysis.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@code-graph-mcp where does LoginPage land in the backend?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
code-graph-mcp
Local code-intelligence MCP server for mono-repos. It indexes your repo once into a knowledge graph — packages, components, frontend routes, HTTP calls, backend routes, handlers — and lets any MCP client (Claude Code, Cursor, Codex CLI, OpenCode…) query structure directly instead of grepping and re-reading files on every question.
Ask "where does LoginPage land in the backend?" and get
LoginPage → POST /api/auth/login → auth.login in one tool call, from a graph
that's already in memory. No file reads, no grep round-trips.
Why
Agents burn most of their tokens re-discovering structure: listing directories, grepping for usages, opening five files to trace one request path. This server front-loads that discovery into a single index pass and then answers structural questions from memory, with output engineered to be cheap:
Compact line-oriented output — no pretty-printed JSON, no prose padding.
Hard token budgets per response (default ~2k tokens, tunable per call) with
…+N more (refine query)truncation instead of overflow.Path compression — repo-relative paths, common prefixes stripped in lists.
Incremental re-index — content-hash manifest; unchanged files are never reparsed.
Savings tracking —
repo_summaryreports how many tokens of raw file reads the session avoided.Zero query-time I/O — every tool answers from in-memory indexes; only
reindextouches disk.
Related MCP server: code-graph-mcp
What it detects
Layer | Detected |
Packages | npm workspaces, any |
Frontend | React Router routes ( |
HTTP calls |
|
Backend | FastAPI ( |
Cross-layer | frontend call ↔ backend route matching by method + normalized path, |
Parsing is regex/heuristic (deliberately: fast, zero native deps). It won't catch every dynamic pattern — that's the tradeoff for indexing thousands of files in milliseconds with two pure-JS dependencies.
Install
github:dorkian/code-graph-mcpvs@dorkian/code-graph-mcp? Thegithub:form tells npx to install straight from https://github.com/dorkian/code-graph-mcp — it works the moment the repo is public, no npm account involved.@dorkian/code-graph-mcpis the package's name on the npm registry and only works afternpm publish; once published, you can use either interchangeably (npm installs are faster since they're cached and versioned).
Fastest: let the CLI configure your client
# Claude Code — writes .mcp.json AND installs the companion skill
npx -y github:dorkian/code-graph-mcp install claude-code --repo .
# Cursor — writes .cursor/mcp.json
npx -y github:dorkian/code-graph-mcp install cursor --repo .
# anything else — prints ready-to-paste config for Claude Desktop, Codex CLI, …
npx -y github:dorkian/code-graph-mcp installThat's it — restart your client and ask "where does LoginPage land in the backend?"
Or: let your AI install it
Paste this into Claude Code, Cursor, Codex, or any coding agent with shell access, from inside the repo you want indexed:
Install the code-graph-mcp server in this repo:
1. Run: npx -y github:dorkian/code-graph-mcp install claude-code --repo .
(if this isn't Claude Code, run `npx -y github:dorkian/code-graph-mcp install`
and apply the printed config for the client you are instead)
2. Add `.codegraph/` to .gitignore if it isn't there.
3. Run: npx -y github:dorkian/code-graph-mcp --repo . --index
and show me the node/edge counts it reports.
4. From now on, prefer the code-graph MCP tools (repo_summary,
find_component_relations, map_frontend_to_backend, search_symbols,
impact_of_change, visualize_graph) over grep/read_file for questions
about repo structure, and call reindex after you edit files.Step 4 is a summary of the bundled skill — Claude Code users get the full version automatically at .claude/skills/code-graph/SKILL.md.
Manual
git clone https://github.com/dorkian/code-graph-mcp.git
cd code-graph-mcp && npm install
node bin/code-graph-mcp.js --repo /path/to/your/repoThe graph lives at <repo>/.codegraph/ — add it to your repo's .gitignore.
Pre-warm the cache (e.g. in CI or a git hook):
code-graph-mcp --repo . --index # incremental
code-graph-mcp --repo . --index --full # rebuild from scratchClient setup (manual configs)
{
"mcpServers": {
"code-graph": {
"command": "npx",
"args": ["-y", "github:dorkian/code-graph-mcp", "--repo", "."]
}
}
}Then copy skills/code-graph/ into .claude/skills/ (the install claude-code command does both).
{
"mcpServers": {
"code-graph": {
"command": "npx",
"args": ["-y", "github:dorkian/code-graph-mcp", "--repo", "${workspaceFolder}"]
}
}
}{
"mcpServers": {
"code-graph": {
"command": "npx",
"args": ["-y", "github:dorkian/code-graph-mcp", "--repo", "/abs/path/to/repo"]
}
}
}[mcp_servers.code-graph]
command = "npx"
args = ["-y", "github:dorkian/code-graph-mcp", "--repo", "/abs/path/to/repo"]Any other MCP client: it's a plain stdio server — run
node bin/code-graph-mcp.js --repo <path> and speak MCP over stdin/stdout.
Use it as a Claude custom connector (claude.ai / Desktop / mobile)
Claude's custom connectors only accept remote MCP servers: Claude connects
to your server URL from Anthropic's cloud, not from your machine, so a local
stdio process can't be added directly — the server must be reachable on the
public internet over Streamable HTTP. That's what --http mode is for:
# on your VPS, next to a checkout of the repo you want indexed
npx -y github:dorkian/code-graph-mcp --repo /srv/my-monorepo \
--http --port 3333 --auth-token "$(openssl rand -hex 24)"Put it behind your reverse proxy with TLS (Caddy example):
graph.yourdomain.com {
reverse_proxy 127.0.0.1:3333
}Then in Claude: Settings → Connectors → Add custom connector and paste
https://graph.yourdomain.com/mcp/<your-token>The token-in-URL form exists exactly for this: the connector UI takes a plain
URL (or OAuth), so the secret rides in the path; API/CLI clients can send
Authorization: Bearer <token> instead. Keep in mind what you're exposing —
the graph reveals your repo's structure (routes, endpoints, file names), so
treat the URL like a password, rotate the token if it leaks, and never run
--http without a token on anything internet-facing. Run it as a systemd
service and add a cron/git-hook --index call to keep the graph fresh after
pushes.
Who can use your hosted URL — and what they get. Anyone you share
https://graph.yourdomain.com/mcp/<token> with can add it as a custom
connector in their own Claude (Settings → Connectors → Add custom connector;
available on all plans — Free accounts can add one custom connector). But be
clear about the model: one running instance indexes one repo on your
server, and every connected user queries that same shared graph. It is
not multi-tenant — users can't point your instance at their own codebases.
Host it to demo the tool or to give a team a shared brain for one codebase;
for their own repos, users run their own instance (stdio locally via the
install command, or --http on their own box).
Tools
Tool | Purpose | Key params |
| Packages, deps, FE/BE routes, counts, session token savings |
|
| Everything related to a component/route: children, parents, hooks, endpoints, imports |
|
| Full chain |
|
| Mermaid/DOT slice: |
|
| Fuzzy find any node by name/path — replaces grep for "where is X" |
|
| Blast radius: transitive dependents of a node or file |
|
| Refresh graph; incremental by default |
|
Every tool accepts max_tokens (response budget) and, where lists appear,
detail: "compact" | "full".
Example output (map_frontend_to_backend, name: "LoginPage"):
LoginPage -> POST /api/auth/login -> POST /api/auth/login (services/api/app/auth.py) -> auth.loginExample diagram (visualize_graph, kind: "fe-to-be"):
graph LR
n1(("route /login")) --> n2["LoginPage"]
n2 -- calls --> n3["POST /api/auth/login"]
n3 -- hits --> n4[/"POST /api/auth/login"/]
n4 -- handled by --> n5[["fn login"]]Storage format
.codegraph/graph.json — versioned node/edge lists, loaded into in-memory
Maps (by id, name, file, endpoint path) at startup; a ~1k-file repo loads in
well under a second. .codegraph/manifest.json — sha1 per indexed file,
drives incremental re-index and deleted-file pruning. Corrupted or missing
graph files trigger a clean full re-index, never a crash.
Development
npm install
npm test # 57 unit assertions against a bundled fixture mono-repo,
# an MCP smoke test speaking real JSON-RPC over stdio,
# and an HTTP smoke test covering --http mode + token authThe fixture under test/fixture/ is a miniature mono-repo (React app, FastAPI
service, Express service) exercising every detection path including
include_router alias resolution and template-literal endpoints.
Publishing this repo to GitHub
Credentials never leave your machine, so push it yourself:
cd code-graph-mcp
git init && git add -A && git commit -m "code-graph-mcp v0.2.0"
git branch -M main
git remote add origin https://github.com/dorkian/code-graph-mcp.git
git push -u origin main
# optional: publish to npm so npx works
npm login
npm publish --access publicLicense
MIT © dorkian
Available Tools
7 toolsfind_component_relationsFind component relationsA
Given a component or route name, return everything related: child components it renders, parents that render it, hooks/stores used, endpoints it calls, and file import relationships. Use instead of grepping for usages.
Inputs: name (required), detail, max_tokens.
impact_of_changeImpact of change (blast radius)A
Given a component, handler, endpoint, or file path, list everything that depends on it (directly and transitively, up to depth N). Use before refactors and when debugging 'what breaks if I change this?'.
Inputs: name (required), depth, max_tokens.
map_frontend_to_backendMap frontend to backendA
Trace the full chain Component/Route -> HTTP call -> backend route -> handler function. Accepts a frontend name (LoginPage), a route (/login), or an endpoint path (/api/login) and works from either end. Use for 'where does X land in the backend?' questions.
Inputs: name (required), max_tokens.
reindexReindex repoA
Refresh the graph. Incremental by default (only changed files reparsed); pass full:true to rebuild from scratch. Call after significant code edits.
Inputs: full.
repo_summaryRepo summaryA
High-level overview of the indexed repo: packages, dependency highlights, frontend routes, backend routes, node/edge counts, and session token-savings stats. Call this FIRST for any structural question instead of listing directories.
Inputs: detail, max_tokens.
search_symbolsSearch symbolsA
Fuzzy search any indexed node (components, routes, endpoints, handlers, files, packages) by name or path. Use instead of grep/find for 'where is X defined?'.
Inputs: query (required), limit, types, max_tokens.
visualize_graphVisualize graph sliceA
Return a Mermaid (default) or Graphviz DOT diagram for a slice of the graph: kind 'component-tree' (render hierarchy under a component) or 'fe-to-be' (frontend-to-backend flow). Paste the Mermaid block directly into chat to render it.
Inputs: name (required), kind, format, max_nodes, +1 more.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
TDQS
Scored across 7 tools
Each tool has a clearly distinct purpose: finding relations, impact analysis, frontend-to-backend mapping, reindexing, repo summary, symbol search, and visualization. No two tools overlap in functionality.
All tool names follow a consistent verb_noun pattern in snake_case (e.g., find_component_relations, impact_of_change, map_frontend_to_backend). The naming is predictable and intuitive.
With 7 tools, the set is well-scoped for a code graph analysis tool. Each tool serves a necessary role without redundancy or bloat.
The tools cover key operations: search, retrieval, impact analysis, mapping, visualization, and reindexing. A minor gap is direct access to file content or diff capabilities, but the set is comprehensive for its stated purpose.
Maintenance
Related MCP Connectors
Shared context for your codebase: a hosted code knowledge graph over MCP. Free plan, OAuth sign-up.
Hosted code graph over MCP: exact callers, dependencies, and cross-repo blast radius for AI agents.
Repository knowledge graph MCP server for codebase understanding and debugging.
Ask who calls a route, what a change breaks or who reads a field, across a system's repos.
Related MCP Servers
- AlicenseAqualityDmaintenanceCross-repository code knowledge graph MCP server for Java, Kotlin, JavaScript, and TypeScript. Indexes source code into embedded KuzuDB via tree-sitter and exposes 30+ tools for call-flow tracing, multi-hop taint analysis (OWASP/CWE/PCI/STIG), entry-point reachability filtering, performance hotspot detection, and license compliance — without reading source files. 95% fewer tokens vs source-read332MIT
- AlicenseNot gradedqualityAmaintenanceA high-performance code knowledge graph server implementing MCP, indexing codebases into a structured AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing.3,891 npm95MIT
- AlicenseNot gradedqualityBmaintenancePrivate, local-first code intelligence MCP server that builds a static graph of repositories and exposes search, architecture, impact analysis, and review tools via MCP.MIT
- AlicenseNot gradedqualityCmaintenanceEnables people and AI agents to query local code repositories as graphs through stdio MCP tools for project listing, search, dependency tracing, impact analysis, bridge detection, node inspection, bounded code reading, and optional LSP definition/reference lookups.MIT