Skip to main content
Glama
cvandesande

project-code-intelligence

by cvandesande

Projekt-Code-Intelligenz

Repository-Intelligenz und Änderungssicherheits-Nachweise für Codierungsagenten.

Projekt-Code-Intelligenz (PCI) indexiert Git-Repositories und gibt Codierungsagenten strukturierte Nachweise für Recherche, Refactoring, Wartung und Sicherheitsarbeit. Agenten können nach Konzept oder Bezeichner suchen, Kandidatenbeziehungen untersuchen, den Auswirkungsbereich einer Änderung einschätzen, wiederholte Implementierungsmuster finden und Static-Analysis-Befunde abfragen, bevor sie Code bearbeiten.

PCI ist kein autonomer Reviewer und sein Graph ist kein Compiler-genauer Call-Graph. Er grenzt die Suche ein und liefert Nachweise; der Agent verifiziert wichtige Schlussfolgerungen weiterhin im Quellcode.

Wobei es hilft

Recherche und Orientierung

  • Suche nach exakten Bezeichnern, Dateinamen, Konfigurationsschlüsseln und bekannten Zeichenfolgen.

  • Suche nach Verhalten, wenn die relevanten Namen unbekannt sind.

  • Untersuche Repository-Sprachen, Dateirollen, Snapshots, Parser-Abdeckung und Index-Frische.

  • Rufe begrenzte Datensätze mit Pfaden, Zeilenbereichen, Metadaten und Quellcode-Ausschnitten ab.

  • Arbeite über mehrere Repositories hinweg über benannte Sammlungen und Repository-Filter.

Sicherere Änderungen

  • Finde Kandidaten für Aufrufer, Aufgerufene, Referenzen, Tests und Modul-Verdrahtung.

  • Prüfe Nachweise zum Auswirkungsbereich, bevor du ein Symbol entfernst, umbenennst oder änderst.

  • Hebe Einstiegspunkt-, Waisen- und Testabdeckungssignale hervor.

  • Spritze nahegelegene Nachweise in unterstützte Codierungsagenten ein, wenn Definitionen hinzugefügt oder entfernt werden.

Wartung und Redundanz

  • Finde Gruppen von Funktionen, die ein Aufrufstruktur-Motiv wiederholen.

  • Bewerte Redundanzkandidaten nach Ähnlichkeit, geschätzten Abstraktionskosten und wahrscheinlichem Nettonutzen.

  • Führe ein Repository-Audit für veraltete Indizes, doppelte Namen, Redundanz kandidaten und statische Befunde durch.

Related MCP server: Graft

Sicherheit und statische Analyse

  • Nimm SARIF-Berichte zusammen mit Quellcode-Datensätzen auf.

  • Suche normalisierte Befunde nach Tool, Regel, Ebene, Baseline-Status oder Pfad.

  • Rufe Diagnosen, Code-Flows und Ausführungsmetadaten ab, ohne dass ein Agent rohe SARIF-Artefakte parsen muss.

So funktioniert es

pci index parst Repository-Dateien in begrenzte Datensätze, extrahiert Metadaten und Kandidatenbeziehungen und speichert Snapshots in Postgres/pgvector. Semantische Einbettungen sind optional: Lexikalische Suche und die meisten strukturellen Nachweise bleiben mit --no-embed verfügbar.

pci mcp stellt den Index über einen lokalen stdio-MCP-Server bereit. Codierungsagenten nutzen dessen filterorientierte Tools, um wahrscheinlich relevante Code-Stellen zu finden, und lesen und verifizieren dann den Live-Quellcode, bevor sie handeln.

Die Standardarchitektur für den lokalen Betrieb ist:

  • Postgres/pgvector: Docker- oder Podman-Compose.

  • Linux-Einbettungsdienste: Podman-Quadlet-Einheiten, die vom systemd des Benutzers verwaltet werden.

  • Apple-Silicon-Einbettungen: ein nativer MLX-Dienst.

  • Agentenintegration: ein stdio-MCP-Server mit optionalen Bearbeitungs-Nachweis-Hooks.

Remote-Postgres- und OpenAI-kompatible Einbettungsendpunkte werden unterstützt, wenn dieser Kompromiss beabsichtigt ist.

Schnellstart

Installiere die CLI aus einem Checkout:

uv tool install /path/to/project-code-intelligence
export PATH="$HOME/.local/bin:$PATH"

Starte die gebündelte Datenbank und das beste verfügbare lokale Einbettungs-Backend:

pci doctor --start
pci doctor

Indexiere ein Git-Repository:

cd /path/to/repo
pci index .

Installiere die MCP-Konfiguration für deinen Codierungsagenten:

pci mcp install --target codex

Unterstützte Ziele sind claude, codex, opencode, pi, vscode, copilot, cline und zed. Siehe docs/MCP_SETUP.md für client-spezifische Einrichtung, Projektabgrenzung und Umgang mit Anmeldedaten.

Für lexikalische Suche ohne Einbettungen:

pci doctor --start-db
pci index --no-embed .

Kern-Agenten-Tools

Tool

Zweck

code_intel_status

Index-Frische, Umfang, Datensatzzahlen und Abfragefähigkeiten.

list_code_intel_files

Datei-Inventar, gefiltert nach Sprache, Rolle, Pfad oder generiertem/Test-Status.

search_code_intel_text

Exakte indexierte Suche nach Symbolen, Dateinamen, Schlüsseln und bekannten Zeichenfolgen.

search_code_intel_semantic

Konzeptsuche, wenn Bezeichner unbekannt sind.

get_code_intel_record

Rufe vollständige indexierte Datensätze und Metadaten ab.

related_code_intel

Kandidaten für Aufrufer, Aufgerufene, Referenzen und verwandte Symbole.

blast_radius

Aufrufer, Tests, Verdrahtung, Einstiegspunkt-Signale und semantische Nachbarn für eine vorgeschlagene Änderung.

find_redundancy

Wiederholte Aufrufstruktur-Gruppen, sortiert nach wahrscheinlichem Refactoring-Wert.

search_static_findings

Filtere normalisierte SARIF-Befunde.

get_static_finding

Rufe Diagnosen, Code-Flows und Details zur statischen Analyse ab.

Führe pci audit für einen Gesamtbaum-Nachweisbericht aus.

Nachweise, keine Urteile

PCI unterscheidet bewusst zwischen stärkeren indexierten Fakten und approximativen und heuristischen Nachweisen.

  • Kandidatenbeziehungs-Kanten sind keine typgeprüften Call-Graph-Fakten.

  • Der Ausblasbereich kann nicht beweisen, dass eine Änderung sicher ist.

  • Redundanzbewertungen können nicht entscheiden, ob zwei Funktionen eine Abstraktion teilen sollten.

  • Statische Befunde behalten die Einschränkungen ihres Ursprungsanalysators bei.

  • Ein Index kann nach nicht committeten oder neu committeten Änderungen veraltet sein.

  • Semantische Abfragen können relevante Code übersehen oder plausible Nachbarn zurückgeben.

Verifiziere wichtige Aufrufer und Befunde im Live-Quellcode. Verwende direkte Dateilesevorgänge für bekannte Pfade und kleine begrenzte Fragen; PCI ist am nützlichsten, wenn der Ort, der Name oder die Auswirkung noch nicht bekannt ist.

Installation

Python-CLI

Installiere für den aktuellen Benutzer mit uv:

uv tool install /path/to/project-code-intelligence

Für eine bearbeitbare Entwicklungsinstallation:

cd /path/to/project-code-intelligence
python -m venv .venv
. .venv/bin/activate
python -m pip install -e .

Nix

Auf NixOS oder einem anderen Linux-Host mit aktivierten Flakes:

nix build
nix run . -- doctor --skip-db --embedding skip
nix develop

Installiere dauerhaft in das Benutzerprofil:

nix profile install .#project-code-intelligence

Die Nix-Closure enthält die CLI, den MCP-Server, Python-Abhängigkeiten und die gebündelten Compose- und Quadlet-Assets. Schwere Linux-Einbettungslaufzeiten bleiben in Podman Containern, anstatt host-native Nix-Abhängigkeiten zu werden.

Lokale Datenbank

Starte nur die gebündelte Postgres/pgvector-Datenbank:

pci doctor --start-db

Die installierte Compose-Datei wird in einen Benutzer-Cache materialisiert. Um eine benutzerdefinierte Kopie zu verwenden:

export PCI_COMPOSE_FILE=/path/to/docker-compose.yml
pci doctor --start-db

Lokaler Einbettungsdienst

Die CLI enthält die Dienstvorlagen; es gibt kein separates PCI-Einbettungspaket. Auf Linux installiere Podman und stelle sicher, dass systemctl --user funktioniert, dann führe aus:

pci doctor
pci doctor --start-embedding

PCI erkennt verfügbare Hardware, materialisiert nur das ausgewählte Backend unter ~/.config/containers/systemd/, lädt das Benutzer-systemd neu und startet es. Veraltete PCI Einheiten für andere Einbettungs-Backends werden gestoppt und entfernt. Bilder und Standardmodelle werden bei der ersten Verwendung heruntergeladen.

Wähle ein Backend explizit aus, wenn gewünscht:

# AMD GPU
pci doctor --start-embedding --embedding-backend rocm

# NVIDIA GPU
pci doctor --start-embedding --embedding-backend cuda

# Portable CPU fallback
pci doctor --start-embedding --embedding-backend fastembed

# AMD Ryzen AI NPU (experimental)
pci doctor --start-embedding --embedding-backend lemonade

Verfügbare Auswahlmöglichkeiten sind auto, fastembed, lemonade, rocm, cuda und apple. PCI lehnt ein angefragtes Backend ab, wenn die erforderliche Hardware oder Laufzeit nicht verfügbar ist. apple läuft nativ und nicht über Quadlet.

Um die Datenbank und ein explizites Backend zusammen zu starten:

pci doctor --start --embedding-backend rocm

Containerisierte Backends veröffentlichen standardmäßig einen OpenAI-kompatiblen Endpunkt unter http://127.0.0.1:18081/v1/embeddings. Führe jeweils nur ein lokales Backend aus, da sie diesen Endpunkt teilen.

Hardware

Backend

Laufzeit-Hinweise

CPU

FastEmbed

Portabler Fallback; Podman Quadlet.

Apple Silicon

MLX

Nativer Prozess mit der Apple-GPU.

AMD Ryzen AI NPU

Lemonade FLM

Experimentell; erfordert unterstützte XDNA-Hardware, Treiber und Firmware.

AMD GPU

llama.cpp ROCm

Podman Quadlet mit /dev/kfd und /dev/dri.

NVIDIA GPU

llama.cpp CUDA

Erfordert den NVIDIA-Treiber, Container Toolkit und Podman-CDI-Unterstützung.

Stoppe Einbettungsdienste, ohne die Datenbank zu berühren:

pci doctor --stop-embedding

Entferne generierte lokale Dienste, Caches und den gebündelten Datenbank-Volume:

pci doctor --clean

--clean ist destruktiv und fragt vor dem Entfernen von Daten nach.

Remote-Einbettungen

Starte nur die Datenbank und konfiguriere dann einen vertrauenswürdigen OpenAI-kompatiblen Anbieter:

pci doctor --start-db
export PCI_ALLOW_REMOTE_EMBEDDING=1
export PCI_EMBEDDING_ENDPOINT=https://api.openai.com/v1/embeddings
export PCI_EMBEDDING_ENDPOINT_MODEL=text-embedding-3-small
export OPENAI_API_KEY=...
pci doctor

Remote-Endpunkte erhalten quellabgeleiteten Text. Aktiviere sie nur, wenn das für die indexierten Repositories akzeptabel ist.

Repositories indexieren

Indexiere ein Repository:

pci index /path/to/repo

Indexiere mehrere Repositories als Arbeitsbereich:

cd /path/to/workspace
pci index service-api web-ui shared-lib

PCI leitet Sammlungs- und Repository-Namen aus den Pfaden ab. MCP-Clients filtern nach diesen logischen Namen und nicht nach absoluten Dateisystempfaden. Die Indexierung ist inkrementell: unveränderte Dateien werden wiederverwendet, wenn kompatible Snapshots existieren.

SARIF-Berichte, die unter indexierten Repository-Pfaden gefunden werden, werden automatisch übernommen. Setze ein Repository zurück und baue es neu auf mit:

pci index --reset /path/to/repo

Verwende pci status, um Indexierungsläufe zu überprüfen, und pci index --help für Parser-, Einbettungs-, Sammlungs- und Datenbankoptionen.

MCP- und Agenten-Hooks

Erstelle projektspezifische schreibgeschützte Datenbank-Anmeldedaten und drucke eine MCP-Konfiguration:

pci index --init-db --mcp-config codex .

Installiere oder entferne die MCP-Konfiguration ohne Neuindexierung:

pci mcp install --target codex
pci mcp install --target codex --uninstall

Die generierte Client-Konfiguration enthält kein Datenbank-Passwort. Anmeldedaten werden unter dem PCI-Konfigurationsverzeichnis des Benutzers mit Modus 0600 gespeichert. Pi verwendet eine projektlokale .pi/extensions/-MCP-Brücke. Cline erfordert --config-path, da seine Einstellungsdatei benutzerbezogen ist.

Optionale Hooks können einen Agenten an die Verwendung des Index erinnern und Nachweise in die Nähe von Bearbeitungen einfügen, die Definitionen hinzufügen oder entfernen:

pci hook install --target codex

Die Hook-Unterstützung und Installationsdetails variieren je nach Client. Hooks sind eine Hilfe, kein Durchsetzungs- oder Korrektheitsmechanismus. Siehe docs/MCP_SETUP.md und docs/SYSTEM_PROMPT.md.

Datenschutz und Sicherheit

Der lokale Standard hält quellabgeleitete Datensätze und Einbettungen auf der Maschine. Das macht nicht jedes Artefakt sicher zu veröffentlichen.

Commite oder verteile keine Datenbank-Dumps, Wiederherstellungs-Artefakte, SARIF-Ausgaben, Einbettungs-Caches, Modelldateien, Vektorindizes, generierte Daten aus privaten Repositories oder lokale MCP-Anmeldedateien. Sie können Quellcode-Ausschnitte, Pfade, Symbole, Befunde, Metadaten und aus Quellcode abgeleitete Einbettungen enthalten.

Sammlungen organisieren Repositories, sind aber keine Sicherheitsgrenze. Verwende separate Datenbanken oder Datenbankbenutzer, wenn Repositories eine stärkere Isolierung erfordern. Projektspezifische MCP-Anmeldedaten schränken den normalen Zugriff ein, ersetzen aber nicht die Host- und Datenbanksicherheit.

Wann PCI gut passt

PCI hilft tendenziell, wenn:

  • das Repository oder der Arbeitsbereich groß oder unbekannt ist;

  • Bezeichner zu Beginn einer Aufgabe unbekannt sind;

  • generierte Dateien breite Lesevorgänge teuer oder verrauscht machen;

  • ein Refactoring Aufrufer-, Test- und Verdrahtungsnachweise benötigt;

  • Wartungsarbeiten die Entdeckung wiederholter Muster erfordern;

  • statische Befunde mit dem Quellcode korreliert werden müssen;

  • mehrere Repositories über eine Schnittstelle durchsucht werden müssen.

Es kann für ein kleines vertrautes Repository, eine bekannte Datei und einen Zeilenbereich oder eine Frage, die durch einen begrenzten rg- oder Dateilesevorgang beantwortet wird, wenig Mehrwert bieten. Das Ziel ist nicht, Standard-Entwicklerwerkzeuge zu ersetzen; es ist, die unsicheren Entdeckungs- und Änderungsplanungsschritte um sie herum zu verbessern.

Token- und Kostenreduzierung kann ein nützlicher Nebeneffekt sein, aber PCI verspricht sie nicht. Miss, ob der Index echte Sitzungen verbessert, mit docs/EVALUATING_VALUE.md und dem Sitzungs-Retrospektiv-Prompt.

Entwicklung

Der MCP-Server verwendet stdio; Docker Compose ist für die lokale Datenbank, nicht für das Hosten des MCP-Prozesses. Führe das vollständige Entwicklungs-Gate aus mit:

nix develop
make check

Für Änderungen am Ingest, an der Datenbank oder am MCP-Verhalten führe auch aus:

docker compose up -d pgvector
make integration-smoke

Siehe CONTRIBUTING.md und AGENTS.md für Projektkonventionen und Veröffentlichungsschutzmaßnahmen.

Dokumentation

Lizenz

MIT. Siehe LICENSE.

Available Tools

8 tools
code_intel_statusC

Check code intelligence snapshot, file, record, edge, and embedding state.

ParametersJSON Schema
NameRequiredDescriptionDefault
collectionNo
repoNo
snapshot_idNo
include_historicalNo

TDQS

C2.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so description carries full burden. It implies a read-only operation ('Check'), but does not explicitly declare side-effect-free behavior, authentication needs, or any other behavioral traits. This is insufficient for a 4-param tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence with a clear verb and list of resources. It is concise but lacks structure; could benefit from additional sentences or bullet points for clarity. Not overly verbose, but not optimally organized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 4 parameters, no output schema, and siblings that cover similar ground, the description is incomplete. It does not explain what the tool returns, how parameters interact, or how it relates to other tools. The agent would need to infer too much.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, meaning none of the 4 parameters are described in the schema. The description does not add any parameter-level details, such as how 'collection', 'repo', 'snapshot_id', or 'include_historical' affect the result. This is a critical gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the action 'Check' and lists the resources being checked (snapshot, file, record, edge, and embedding state). It distinguishes from sibling tools which focus on individual items or specific aspects, but lacks explicit differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like get_code_intel_record or search_code_intel_semantic. Usage context is implied but not stated, leaving the agent without decision criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_code_intel_recordA

Fetch one code intelligence record by numeric ID, including display content.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It indicates a read operation ('Fetch') and adds that the result includes display content, but does not disclose other behavioral traits such as authentication requirements, rate limits, or potential side effects. For a simple fetch, this is minimally adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no wasted words. It front-loads the verb and resource, and efficiently conveys the key details. Every part earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with one parameter, no output schema, and no annotations, the description is reasonably complete. It covers what the tool does and hints at the response content ('including display content'). Some may argue it is adequate enough to use correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, so the description must compensate. It adds 'by numeric ID', which is already inferred from the integer type in the schema. It does not explain the meaning of the ID, valid range, or any other details beyond what the schema provides. This adds minimal value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Fetch', the resource 'code intelligence record', and the method 'by numeric ID', along with the additional feature 'including display content'. This distinguishes it from sibling search tools and other get tools like get_static_code_flow.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when the numeric ID is known, but does not provide explicit when-to-use or when-not-to-use guidance, nor does it mention alternatives among the sibling tools. It gives clear context but lacks exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_static_code_flowC

Fetch ordered SARIF/CodeQL code-flow steps for one static-analysis finding.

ParametersJSON Schema
NameRequiredDescriptionDefault
finding_idYes
flow_indexNo

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description does not disclose behavioral traits such as whether the operation is read-only, error handling (e.g., if finding_id does not exist), or any side effects. The description only says 'Fetch' implying a read operation, but lacks further detail.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence, front-loading the key action and resource. However, it could include more context without becoming verbose, such as noting the optional parameter.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema or annotations, the description leaves gaps: it does not explain the ordering of steps, the SARIF/CodeQL format, or the role of the optional flow_index. An agent might not know how to properly use flow_index or interpret the response.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description adds minimal meaning beyond the schema. It implies finding_id identifies the finding, but does not explain flow_index or the structure of code-flow steps. The schema already defines types and requirements, so the description adds little value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool fetches ordered SARIF/CodeQL code-flow steps for a single static-analysis finding, using a specific verb and resource. It distinguishes from siblings like get_static_finding which fetches a finding itself, and search_static_findings which searches for findings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives, nor when not to use it or what prerequisites are needed. For example, it does not mention that finding_id likely comes from get_static_finding or search_static_findings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_static_findingC

Fetch one SARIF/static-analysis finding with rule, locations, and code-flow steps.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes

TDQS

C2.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It only states the action and returned fields but does not disclose behavioral traits such as read-only nature, idempotency, authentication requirements, or any side effects. For a fetch tool, read-only hint would be expected but is missing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that is concise and front-loaded with the verb 'Fetch'. However, it lacks important details about parameters and usage, which reduces its efficiency for an agent. Slightly better than average due to its brevity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, no output schema), the description is incomplete. It does not describe the parameter 'id', does not define what constitutes a 'finding', and does not provide any context for the return value. An agent would need additional information to correctly invoke this tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has one integer parameter 'id' with no description. The schema description coverage is 0%, meaning the description adds no meaning beyond the schema's type definition. It does not explain what the 'id' represents (e.g., finding ID, expected format) or how to obtain it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action 'Fetch' and the resource 'one SARIF/static-analysis finding', and lists included fields (rule, locations, code-flow steps). This distinguishes it from siblings like 'get_static_code_flow' (which likely returns only code flow) and 'search_static_findings' (which lists findings).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide any guidance on when to use this tool vs. alternatives like 'search_static_findings' or 'get_static_code_flow'. The use case (fetch a specific finding by ID) is implied but not explicitly stated, and no exclusions or prerequisites are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_code_intel_semanticC

Embed a query with the configured embedding backend and search embedded code intelligence records.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryYes
limitNo
collectionNo
repoNo
record_typeNo
languageNo
file_roleNo
content_classNo
confidence_kindNo
source_pathNo
symbolNo
metadata_keyNo
metadata_valueNo
metadata_containsNo
snapshot_idNo
include_historicalNo

TDQS

C2.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, and the description does not disclose behavioral traits beyond the basic operation. There's no mention of safety, permissions, side effects, or output characteristics.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, which is concise but under-specified. It lacks important details that would help the agent, so it does not earn its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (16 parameters, nested objects, no output schema, no annotations), the description is severely incomplete. It fails to convey search behavior, filtering logic, or return value structure.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage and 16 parameters, the description adds no meaning to any parameter. No enum values or additional context are provided.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action 'embed a query' and 'search embedded code intelligence records', indicating it performs semantic search. However, it could be more precise about what 'embedded' means and how it differs from text search.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs siblings like search_code_intel_text or search_static_findings. The description lacks context for appropriate usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_code_intel_textC

Search or list code intelligence records with optional PostgreSQL full-text search and exact filters.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryNo
limitNo
collectionNo
repoNo
record_typeNo
languageNo
file_roleNo
content_classNo
confidence_kindNo
source_pathNo
symbolNo
metadata_keyNo
metadata_valueNo
metadata_containsNo
snapshot_idNo
include_historicalNo

TDQS

C2.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries full burden. It does not disclose whether the operation is read-only, any side effects, rate limits, or pagination behavior. The description is minimal and does not provide behavioral context beyond the basic action.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence with front-loaded purpose, but lacks structure such as breaking down search vs list modes. It is concise but could be more organized without adding length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 16 parameters, no output schema, and no annotations, the description is severely incomplete. It does not explain pagination limits, return format, or how parameters interact, leaving the agent with insufficient information to use the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% with 16 parameters. The description adds no meaning beyond the schema parameter names, failing to explain how 'query', 'collection', 'metadata_contains', etc., function together. The baseline for 0% coverage is low, and the description does not compensate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool searches or lists code intelligence records, mentioning PostgreSQL full-text search and exact filters. It distinguishes from sibling 'search_code_intel_semantic' by implying a text-based approach, but lacks explicit differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like semantic search or static findings search. There is no mention of prerequisites, excluded cases, or context for full-text vs exact filters.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_static_findingsC

Search SARIF/static-analysis findings with exact filters.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
collectionNo
repoNo
toolNo
rule_idNo
levelNo
baseline_stateNo
source_pathNo
snapshot_idNo
include_historicalNo

TDQS

C2.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations and a terse description, important behavioral details are missing, such as how filters combine (AND/OR), pagination behavior, performance considerations, or what happens when no filters are applied. The agent is left to infer behavior from the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, which is concise but lacks structure. It could be improved by adding a second sentence to mention key behavioral aspects without adding much length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 10 parameters, no output schema, and no annotations, the description is severely incomplete. An agent cannot effectively use this tool without guessing parameter semantics and expected behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, meaning the description must explain parameter meanings, but it does not mention any parameters beyond 'exact filters'. The agent has no information on how parameters like 'limit', 'collection', or 'include_historical' affect the search.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool searches for SARIF/static-analysis findings with exact filters, which distinguishes it from sibling tools like search_code_intel_semantic and search_code_intel_text that likely perform semantic or text-based searches.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus its siblings, nor are there any exclusions or prerequisites mentioned. The description lacks context for appropriate use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 8 tool updatesv0.1.0
    • First observedcode_intel_status
    • First observedget_code_intel_record
    • First observedget_static_code_flow
    • First observedget_static_finding
    • First observedrelated_code_intel
    • First observedsearch_code_intel_semantic
    • First observedsearch_code_intel_text
    • First observedsearch_static_findings

TDQS

B3/5.0

Scored across 8 tools

Disambiguation4/5

Tools are mostly distinct in purpose: status overview, individual retrieval of records/findings/flow, semantic/text search, and graph relationships. However, 'get_code_intel_record' and 'related_code_intel' both involve records, but descriptions clarify the difference.

Naming Consistency3/5

Naming mixes patterns: 'get_code_intel_record' vs 'get_static_finding' (different ordering), 'search_code_intel_semantic' vs 'search_static_findings' (inconsistent prefix). 'code_intel_status' and 'related_code_intel' lack verb prefixes, breaking the verb_noun pattern.

Tool Count5/5

With 8 tools, the count is well-scoped for a code intelligence server covering status, retrieval, search, and relationships. Neither sparse nor bloated.

Completeness4/5

Covers core needs: status, record/finding retrieval, two search modes, and graph edges. Missing explicit listing endpoints, but search can substitute. No clear dead ends for a read-only intelligence server.

Maintenance

ActivitySlowing
ResponsivenessUnresponsive

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    A
    maintenance
    Local-first code intelligence MCP server with hybrid BM25 + ONNX vector search, symbol-level impact analysis, diff-aware PR review with risk scoring, and persistent memory tied to git state.
    36
    398 npm
    82
    MIT
  • A
    license
    B
    quality
    D
    maintenance
    Local-first codebase context engine that parses code into a ranked dependency graph and serves it to AI tools via MCP for deep structural understanding.
    5
    9 npm
    1
    MIT
  • A
    license
    B
    quality
    A
    maintenance
    High-performance code intelligence MCP server. Indexes codebases into a persistent knowledge graph — average repo in milliseconds. 159 languages, sub-ms queries, 99% fewer tokens. Single static binary, zero dependencies.
    8
    17
    46,667
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    A local code-intelligence engine for AI agents that indexes repositories into a PostgreSQL-backed code graph and serves structured, token-budgeted context over MCP and HTTP, enabling targeted queries on symbols, dependencies, contracts, and impact analysis.
    7
    Apache 2.0