project-code-intelligence
Projekt-Code-Intelligenz
Repository-Intelligenz und Änderungssicherheits-Nachweise für Codierungsagenten.
Projekt-Code-Intelligenz (PCI) indexiert Git-Repositories und gibt Codierungsagenten strukturierte Nachweise für Recherche, Refactoring, Wartung und Sicherheitsarbeit. Agenten können nach Konzept oder Bezeichner suchen, Kandidatenbeziehungen untersuchen, den Auswirkungsbereich einer Änderung einschätzen, wiederholte Implementierungsmuster finden und Static-Analysis-Befunde abfragen, bevor sie Code bearbeiten.
PCI ist kein autonomer Reviewer und sein Graph ist kein Compiler-genauer Call-Graph. Er grenzt die Suche ein und liefert Nachweise; der Agent verifiziert wichtige Schlussfolgerungen weiterhin im Quellcode.
Wobei es hilft
Recherche und Orientierung
Suche nach exakten Bezeichnern, Dateinamen, Konfigurationsschlüsseln und bekannten Zeichenfolgen.
Suche nach Verhalten, wenn die relevanten Namen unbekannt sind.
Untersuche Repository-Sprachen, Dateirollen, Snapshots, Parser-Abdeckung und Index-Frische.
Rufe begrenzte Datensätze mit Pfaden, Zeilenbereichen, Metadaten und Quellcode-Ausschnitten ab.
Arbeite über mehrere Repositories hinweg über benannte Sammlungen und Repository-Filter.
Sicherere Änderungen
Finde Kandidaten für Aufrufer, Aufgerufene, Referenzen, Tests und Modul-Verdrahtung.
Prüfe Nachweise zum Auswirkungsbereich, bevor du ein Symbol entfernst, umbenennst oder änderst.
Hebe Einstiegspunkt-, Waisen- und Testabdeckungssignale hervor.
Spritze nahegelegene Nachweise in unterstützte Codierungsagenten ein, wenn Definitionen hinzugefügt oder entfernt werden.
Wartung und Redundanz
Finde Gruppen von Funktionen, die ein Aufrufstruktur-Motiv wiederholen.
Bewerte Redundanzkandidaten nach Ähnlichkeit, geschätzten Abstraktionskosten und wahrscheinlichem Nettonutzen.
Führe ein Repository-Audit für veraltete Indizes, doppelte Namen, Redundanz kandidaten und statische Befunde durch.
Related MCP server: Graft
Sicherheit und statische Analyse
Nimm SARIF-Berichte zusammen mit Quellcode-Datensätzen auf.
Suche normalisierte Befunde nach Tool, Regel, Ebene, Baseline-Status oder Pfad.
Rufe Diagnosen, Code-Flows und Ausführungsmetadaten ab, ohne dass ein Agent rohe SARIF-Artefakte parsen muss.
So funktioniert es
pci index parst Repository-Dateien in begrenzte Datensätze, extrahiert Metadaten und
Kandidatenbeziehungen und speichert Snapshots in Postgres/pgvector. Semantische
Einbettungen sind optional: Lexikalische Suche und die meisten strukturellen Nachweise
bleiben mit --no-embed verfügbar.
pci mcp stellt den Index über einen lokalen stdio-MCP-Server bereit. Codierungsagenten
nutzen dessen filterorientierte Tools, um wahrscheinlich relevante Code-Stellen zu finden,
und lesen und verifizieren dann den Live-Quellcode, bevor sie handeln.
Die Standardarchitektur für den lokalen Betrieb ist:
Postgres/pgvector: Docker- oder Podman-Compose.
Linux-Einbettungsdienste: Podman-Quadlet-Einheiten, die vom systemd des Benutzers verwaltet werden.
Apple-Silicon-Einbettungen: ein nativer MLX-Dienst.
Agentenintegration: ein stdio-MCP-Server mit optionalen Bearbeitungs-Nachweis-Hooks.
Remote-Postgres- und OpenAI-kompatible Einbettungsendpunkte werden unterstützt, wenn dieser Kompromiss beabsichtigt ist.
Schnellstart
Installiere die CLI aus einem Checkout:
uv tool install /path/to/project-code-intelligence
export PATH="$HOME/.local/bin:$PATH"Starte die gebündelte Datenbank und das beste verfügbare lokale Einbettungs-Backend:
pci doctor --start
pci doctorIndexiere ein Git-Repository:
cd /path/to/repo
pci index .Installiere die MCP-Konfiguration für deinen Codierungsagenten:
pci mcp install --target codexUnterstützte Ziele sind claude, codex, opencode, pi, vscode,
copilot, cline und zed. Siehe docs/MCP_SETUP.md für
client-spezifische Einrichtung, Projektabgrenzung und Umgang mit Anmeldedaten.
Für lexikalische Suche ohne Einbettungen:
pci doctor --start-db
pci index --no-embed .Kern-Agenten-Tools
Tool | Zweck |
| Index-Frische, Umfang, Datensatzzahlen und Abfragefähigkeiten. |
| Datei-Inventar, gefiltert nach Sprache, Rolle, Pfad oder generiertem/Test-Status. |
| Exakte indexierte Suche nach Symbolen, Dateinamen, Schlüsseln und bekannten Zeichenfolgen. |
| Konzeptsuche, wenn Bezeichner unbekannt sind. |
| Rufe vollständige indexierte Datensätze und Metadaten ab. |
| Kandidaten für Aufrufer, Aufgerufene, Referenzen und verwandte Symbole. |
| Aufrufer, Tests, Verdrahtung, Einstiegspunkt-Signale und semantische Nachbarn für eine vorgeschlagene Änderung. |
| Wiederholte Aufrufstruktur-Gruppen, sortiert nach wahrscheinlichem Refactoring-Wert. |
| Filtere normalisierte SARIF-Befunde. |
| Rufe Diagnosen, Code-Flows und Details zur statischen Analyse ab. |
Führe pci audit für einen Gesamtbaum-Nachweisbericht aus.
Nachweise, keine Urteile
PCI unterscheidet bewusst zwischen stärkeren indexierten Fakten und approximativen und heuristischen Nachweisen.
Kandidatenbeziehungs-Kanten sind keine typgeprüften Call-Graph-Fakten.
Der Ausblasbereich kann nicht beweisen, dass eine Änderung sicher ist.
Redundanzbewertungen können nicht entscheiden, ob zwei Funktionen eine Abstraktion teilen sollten.
Statische Befunde behalten die Einschränkungen ihres Ursprungsanalysators bei.
Ein Index kann nach nicht committeten oder neu committeten Änderungen veraltet sein.
Semantische Abfragen können relevante Code übersehen oder plausible Nachbarn zurückgeben.
Verifiziere wichtige Aufrufer und Befunde im Live-Quellcode. Verwende direkte Dateilesevorgänge für bekannte Pfade und kleine begrenzte Fragen; PCI ist am nützlichsten, wenn der Ort, der Name oder die Auswirkung noch nicht bekannt ist.
Installation
Python-CLI
Installiere für den aktuellen Benutzer mit uv:
uv tool install /path/to/project-code-intelligenceFür eine bearbeitbare Entwicklungsinstallation:
cd /path/to/project-code-intelligence
python -m venv .venv
. .venv/bin/activate
python -m pip install -e .Nix
Auf NixOS oder einem anderen Linux-Host mit aktivierten Flakes:
nix build
nix run . -- doctor --skip-db --embedding skip
nix developInstalliere dauerhaft in das Benutzerprofil:
nix profile install .#project-code-intelligenceDie Nix-Closure enthält die CLI, den MCP-Server, Python-Abhängigkeiten und die gebündelten Compose- und Quadlet-Assets. Schwere Linux-Einbettungslaufzeiten bleiben in Podman Containern, anstatt host-native Nix-Abhängigkeiten zu werden.
Lokale Datenbank
Starte nur die gebündelte Postgres/pgvector-Datenbank:
pci doctor --start-dbDie installierte Compose-Datei wird in einen Benutzer-Cache materialisiert. Um eine benutzerdefinierte Kopie zu verwenden:
export PCI_COMPOSE_FILE=/path/to/docker-compose.yml
pci doctor --start-dbLokaler Einbettungsdienst
Die CLI enthält die Dienstvorlagen; es gibt kein separates PCI-Einbettungspaket.
Auf Linux installiere Podman und stelle sicher, dass systemctl --user funktioniert, dann führe aus:
pci doctor
pci doctor --start-embeddingPCI erkennt verfügbare Hardware, materialisiert nur das ausgewählte Backend unter
~/.config/containers/systemd/, lädt das Benutzer-systemd neu und startet es. Veraltete PCI
Einheiten für andere Einbettungs-Backends werden gestoppt und entfernt. Bilder und Standardmodelle
werden bei der ersten Verwendung heruntergeladen.
Wähle ein Backend explizit aus, wenn gewünscht:
# AMD GPU
pci doctor --start-embedding --embedding-backend rocm
# NVIDIA GPU
pci doctor --start-embedding --embedding-backend cuda
# Portable CPU fallback
pci doctor --start-embedding --embedding-backend fastembed
# AMD Ryzen AI NPU (experimental)
pci doctor --start-embedding --embedding-backend lemonadeVerfügbare Auswahlmöglichkeiten sind auto, fastembed, lemonade, rocm, cuda und
apple. PCI lehnt ein angefragtes Backend ab, wenn die erforderliche Hardware oder Laufzeit
nicht verfügbar ist. apple läuft nativ und nicht über Quadlet.
Um die Datenbank und ein explizites Backend zusammen zu starten:
pci doctor --start --embedding-backend rocmContainerisierte Backends veröffentlichen standardmäßig einen OpenAI-kompatiblen Endpunkt unter
http://127.0.0.1:18081/v1/embeddings. Führe jeweils nur ein lokales Backend aus, da sie
diesen Endpunkt teilen.
Hardware | Backend | Laufzeit-Hinweise |
CPU | FastEmbed | Portabler Fallback; Podman Quadlet. |
Apple Silicon | MLX | Nativer Prozess mit der Apple-GPU. |
AMD Ryzen AI NPU | Lemonade FLM | Experimentell; erfordert unterstützte XDNA-Hardware, Treiber und Firmware. |
AMD GPU | llama.cpp ROCm | Podman Quadlet mit |
NVIDIA GPU | llama.cpp CUDA | Erfordert den NVIDIA-Treiber, Container Toolkit und Podman-CDI-Unterstützung. |
Stoppe Einbettungsdienste, ohne die Datenbank zu berühren:
pci doctor --stop-embeddingEntferne generierte lokale Dienste, Caches und den gebündelten Datenbank-Volume:
pci doctor --clean--clean ist destruktiv und fragt vor dem Entfernen von Daten nach.
Remote-Einbettungen
Starte nur die Datenbank und konfiguriere dann einen vertrauenswürdigen OpenAI-kompatiblen Anbieter:
pci doctor --start-db
export PCI_ALLOW_REMOTE_EMBEDDING=1
export PCI_EMBEDDING_ENDPOINT=https://api.openai.com/v1/embeddings
export PCI_EMBEDDING_ENDPOINT_MODEL=text-embedding-3-small
export OPENAI_API_KEY=...
pci doctorRemote-Endpunkte erhalten quellabgeleiteten Text. Aktiviere sie nur, wenn das für die indexierten Repositories akzeptabel ist.
Repositories indexieren
Indexiere ein Repository:
pci index /path/to/repoIndexiere mehrere Repositories als Arbeitsbereich:
cd /path/to/workspace
pci index service-api web-ui shared-libPCI leitet Sammlungs- und Repository-Namen aus den Pfaden ab. MCP-Clients filtern nach diesen logischen Namen und nicht nach absoluten Dateisystempfaden. Die Indexierung ist inkrementell: unveränderte Dateien werden wiederverwendet, wenn kompatible Snapshots existieren.
SARIF-Berichte, die unter indexierten Repository-Pfaden gefunden werden, werden automatisch übernommen. Setze ein Repository zurück und baue es neu auf mit:
pci index --reset /path/to/repoVerwende pci status, um Indexierungsläufe zu überprüfen, und pci index --help für Parser-,
Einbettungs-, Sammlungs- und Datenbankoptionen.
MCP- und Agenten-Hooks
Erstelle projektspezifische schreibgeschützte Datenbank-Anmeldedaten und drucke eine MCP-Konfiguration:
pci index --init-db --mcp-config codex .Installiere oder entferne die MCP-Konfiguration ohne Neuindexierung:
pci mcp install --target codex
pci mcp install --target codex --uninstallDie generierte Client-Konfiguration enthält kein Datenbank-Passwort. Anmeldedaten werden
unter dem PCI-Konfigurationsverzeichnis des Benutzers mit Modus 0600 gespeichert. Pi verwendet eine
projektlokale .pi/extensions/-MCP-Brücke. Cline erfordert --config-path,
da seine Einstellungsdatei benutzerbezogen ist.
Optionale Hooks können einen Agenten an die Verwendung des Index erinnern und Nachweise in die Nähe von Bearbeitungen einfügen, die Definitionen hinzufügen oder entfernen:
pci hook install --target codexDie Hook-Unterstützung und Installationsdetails variieren je nach Client. Hooks sind eine Hilfe, kein Durchsetzungs- oder Korrektheitsmechanismus. Siehe docs/MCP_SETUP.md und docs/SYSTEM_PROMPT.md.
Datenschutz und Sicherheit
Der lokale Standard hält quellabgeleitete Datensätze und Einbettungen auf der Maschine. Das macht nicht jedes Artefakt sicher zu veröffentlichen.
Commite oder verteile keine Datenbank-Dumps, Wiederherstellungs-Artefakte, SARIF-Ausgaben, Einbettungs-Caches, Modelldateien, Vektorindizes, generierte Daten aus privaten Repositories oder lokale MCP-Anmeldedateien. Sie können Quellcode-Ausschnitte, Pfade, Symbole, Befunde, Metadaten und aus Quellcode abgeleitete Einbettungen enthalten.
Sammlungen organisieren Repositories, sind aber keine Sicherheitsgrenze. Verwende separate Datenbanken oder Datenbankbenutzer, wenn Repositories eine stärkere Isolierung erfordern. Projektspezifische MCP-Anmeldedaten schränken den normalen Zugriff ein, ersetzen aber nicht die Host- und Datenbanksicherheit.
Wann PCI gut passt
PCI hilft tendenziell, wenn:
das Repository oder der Arbeitsbereich groß oder unbekannt ist;
Bezeichner zu Beginn einer Aufgabe unbekannt sind;
generierte Dateien breite Lesevorgänge teuer oder verrauscht machen;
ein Refactoring Aufrufer-, Test- und Verdrahtungsnachweise benötigt;
Wartungsarbeiten die Entdeckung wiederholter Muster erfordern;
statische Befunde mit dem Quellcode korreliert werden müssen;
mehrere Repositories über eine Schnittstelle durchsucht werden müssen.
Es kann für ein kleines vertrautes Repository, eine bekannte Datei und einen Zeilenbereich
oder eine Frage, die durch einen begrenzten rg- oder Dateilesevorgang beantwortet wird,
wenig Mehrwert bieten. Das Ziel ist nicht, Standard-Entwicklerwerkzeuge zu ersetzen;
es ist, die unsicheren Entdeckungs- und Änderungsplanungsschritte um sie herum zu verbessern.
Token- und Kostenreduzierung kann ein nützlicher Nebeneffekt sein, aber PCI verspricht sie nicht. Miss, ob der Index echte Sitzungen verbessert, mit docs/EVALUATING_VALUE.md und dem Sitzungs-Retrospektiv-Prompt.
Entwicklung
Der MCP-Server verwendet stdio; Docker Compose ist für die lokale Datenbank, nicht für das Hosten des MCP-Prozesses. Führe das vollständige Entwicklungs-Gate aus mit:
nix develop
make checkFür Änderungen am Ingest, an der Datenbank oder am MCP-Verhalten führe auch aus:
docker compose up -d pgvector
make integration-smokeSiehe CONTRIBUTING.md und AGENTS.md für Projektkonventionen und Veröffentlichungsschutzmaßnahmen.
Dokumentation
docs/MCP_SETUP.md — MCP-Clients, Scopes, Anmeldedaten und Sicherheitsmodell
docs/PUBLIC_API.md — CLI-, Umgebungs-, MCP- und Python-Kompatibilitätsoberflächen
docs/EVALUATING_VALUE.md — Bewertung von PCI anhand realer Coding-Sitzungen
docs/SYSTEM_PROMPT.md — Agentenanweisungen zur Verwendung von PCI
docs/SYSTEM_PROMPT_RATIONALE.md — Begründung des Prompt-Designs
docs/SESSION_RETROSPECTIVE_PROMPT.md — Evaluations-Prompt am Ende der Sitzung
.env.example — Referenz zur Umgebungskonfiguration
CONTRIBUTING.md — Entwicklungsworkflow
Lizenz
MIT. Siehe LICENSE.
Available Tools
8 toolscode_intel_statusC
Check code intelligence snapshot, file, record, edge, and embedding state.
| Name | Required | Description | Default |
|---|---|---|---|
| collection | No | ||
| repo | No | ||
| snapshot_id | No | ||
| include_historical | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so description carries full burden. It implies a read-only operation ('Check'), but does not explicitly declare side-effect-free behavior, authentication needs, or any other behavioral traits. This is insufficient for a 4-param tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with a clear verb and list of resources. It is concise but lacks structure; could benefit from additional sentences or bullet points for clarity. Not overly verbose, but not optimally organized.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 4 parameters, no output schema, and siblings that cover similar ground, the description is incomplete. It does not explain what the tool returns, how parameters interact, or how it relates to other tools. The agent would need to infer too much.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, meaning none of the 4 parameters are described in the schema. The description does not add any parameter-level details, such as how 'collection', 'repo', 'snapshot_id', or 'include_historical' affect the result. This is a critical gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the action 'Check' and lists the resources being checked (snapshot, file, record, edge, and embedding state). It distinguishes from sibling tools which focus on individual items or specific aspects, but lacks explicit differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like get_code_intel_record or search_code_intel_semantic. Usage context is implied but not stated, leaving the agent without decision criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_code_intel_recordA
Fetch one code intelligence record by numeric ID, including display content.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It indicates a read operation ('Fetch') and adds that the result includes display content, but does not disclose other behavioral traits such as authentication requirements, rate limits, or potential side effects. For a simple fetch, this is minimally adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no wasted words. It front-loads the verb and resource, and efficiently conveys the key details. Every part earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one parameter, no output schema, and no annotations, the description is reasonably complete. It covers what the tool does and hints at the response content ('including display content'). Some may argue it is adequate enough to use correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, so the description must compensate. It adds 'by numeric ID', which is already inferred from the integer type in the schema. It does not explain the meaning of the ID, valid range, or any other details beyond what the schema provides. This adds minimal value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Fetch', the resource 'code intelligence record', and the method 'by numeric ID', along with the additional feature 'including display content'. This distinguishes it from sibling search tools and other get tools like get_static_code_flow.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when the numeric ID is known, but does not provide explicit when-to-use or when-not-to-use guidance, nor does it mention alternatives among the sibling tools. It gives clear context but lacks exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_static_code_flowC
Fetch ordered SARIF/CodeQL code-flow steps for one static-analysis finding.
| Name | Required | Description | Default |
|---|---|---|---|
| finding_id | Yes | ||
| flow_index | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description does not disclose behavioral traits such as whether the operation is read-only, error handling (e.g., if finding_id does not exist), or any side effects. The description only says 'Fetch' implying a read operation, but lacks further detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence, front-loading the key action and resource. However, it could include more context without becoming verbose, such as noting the optional parameter.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema or annotations, the description leaves gaps: it does not explain the ordering of steps, the SARIF/CodeQL format, or the role of the optional flow_index. An agent might not know how to properly use flow_index or interpret the response.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description adds minimal meaning beyond the schema. It implies finding_id identifies the finding, but does not explain flow_index or the structure of code-flow steps. The schema already defines types and requirements, so the description adds little value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool fetches ordered SARIF/CodeQL code-flow steps for a single static-analysis finding, using a specific verb and resource. It distinguishes from siblings like get_static_finding which fetches a finding itself, and search_static_findings which searches for findings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives, nor when not to use it or what prerequisites are needed. For example, it does not mention that finding_id likely comes from get_static_finding or search_static_findings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_static_findingC
Fetch one SARIF/static-analysis finding with rule, locations, and code-flow steps.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It only states the action and returned fields but does not disclose behavioral traits such as read-only nature, idempotency, authentication requirements, or any side effects. For a fetch tool, read-only hint would be expected but is missing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is concise and front-loaded with the verb 'Fetch'. However, it lacks important details about parameters and usage, which reduces its efficiency for an agent. Slightly better than average due to its brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, no output schema), the description is incomplete. It does not describe the parameter 'id', does not define what constitutes a 'finding', and does not provide any context for the return value. An agent would need additional information to correctly invoke this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has one integer parameter 'id' with no description. The schema description coverage is 0%, meaning the description adds no meaning beyond the schema's type definition. It does not explain what the 'id' represents (e.g., finding ID, expected format) or how to obtain it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action 'Fetch' and the resource 'one SARIF/static-analysis finding', and lists included fields (rule, locations, code-flow steps). This distinguishes it from siblings like 'get_static_code_flow' (which likely returns only code flow) and 'search_static_findings' (which lists findings).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide any guidance on when to use this tool vs. alternatives like 'search_static_findings' or 'get_static_code_flow'. The use case (fetch a specific finding by ID) is implied but not explicitly stated, and no exclusions or prerequisites are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_code_intel_semanticC
Embed a query with the configured embedding backend and search embedded code intelligence records.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | ||
| limit | No | ||
| collection | No | ||
| repo | No | ||
| record_type | No | ||
| language | No | ||
| file_role | No | ||
| content_class | No | ||
| confidence_kind | No | ||
| source_path | No | ||
| symbol | No | ||
| metadata_key | No | ||
| metadata_value | No | ||
| metadata_contains | No | ||
| snapshot_id | No | ||
| include_historical | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, and the description does not disclose behavioral traits beyond the basic operation. There's no mention of safety, permissions, side effects, or output characteristics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, which is concise but under-specified. It lacks important details that would help the agent, so it does not earn its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (16 parameters, nested objects, no output schema, no annotations), the description is severely incomplete. It fails to convey search behavior, filtering logic, or return value structure.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage and 16 parameters, the description adds no meaning to any parameter. No enum values or additional context are provided.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action 'embed a query' and 'search embedded code intelligence records', indicating it performs semantic search. However, it could be more precise about what 'embedded' means and how it differs from text search.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs siblings like search_code_intel_text or search_static_findings. The description lacks context for appropriate usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_code_intel_textC
Search or list code intelligence records with optional PostgreSQL full-text search and exact filters.
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | ||
| limit | No | ||
| collection | No | ||
| repo | No | ||
| record_type | No | ||
| language | No | ||
| file_role | No | ||
| content_class | No | ||
| confidence_kind | No | ||
| source_path | No | ||
| symbol | No | ||
| metadata_key | No | ||
| metadata_value | No | ||
| metadata_contains | No | ||
| snapshot_id | No | ||
| include_historical | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries full burden. It does not disclose whether the operation is read-only, any side effects, rate limits, or pagination behavior. The description is minimal and does not provide behavioral context beyond the basic action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with front-loaded purpose, but lacks structure such as breaking down search vs list modes. It is concise but could be more organized without adding length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 16 parameters, no output schema, and no annotations, the description is severely incomplete. It does not explain pagination limits, return format, or how parameters interact, leaving the agent with insufficient information to use the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% with 16 parameters. The description adds no meaning beyond the schema parameter names, failing to explain how 'query', 'collection', 'metadata_contains', etc., function together. The baseline for 0% coverage is low, and the description does not compensate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool searches or lists code intelligence records, mentioning PostgreSQL full-text search and exact filters. It distinguishes from sibling 'search_code_intel_semantic' by implying a text-based approach, but lacks explicit differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like semantic search or static findings search. There is no mention of prerequisites, excluded cases, or context for full-text vs exact filters.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_static_findingsC
Search SARIF/static-analysis findings with exact filters.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| collection | No | ||
| repo | No | ||
| tool | No | ||
| rule_id | No | ||
| level | No | ||
| baseline_state | No | ||
| source_path | No | ||
| snapshot_id | No | ||
| include_historical | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations and a terse description, important behavioral details are missing, such as how filters combine (AND/OR), pagination behavior, performance considerations, or what happens when no filters are applied. The agent is left to infer behavior from the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, which is concise but lacks structure. It could be improved by adding a second sentence to mention key behavioral aspects without adding much length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 10 parameters, no output schema, and no annotations, the description is severely incomplete. An agent cannot effectively use this tool without guessing parameter semantics and expected behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, meaning the description must explain parameter meanings, but it does not mention any parameters beyond 'exact filters'. The agent has no information on how parameters like 'limit', 'collection', or 'include_historical' affect the search.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool searches for SARIF/static-analysis findings with exact filters, which distinguishes it from sibling tools like search_code_intel_semantic and search_code_intel_text that likely perform semantic or text-based searches.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus its siblings, nor are there any exclusions or prerequisites mentioned. The description lacks context for appropriate use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
8 tool updates
v0.1.0- First observed
code_intel_status - First observed
get_code_intel_record - First observed
get_static_code_flow - First observed
get_static_finding - First observed
related_code_intel - First observed
search_code_intel_semantic - First observed
search_code_intel_text - First observed
search_static_findings
TDQS
Scored across 8 tools
Tools are mostly distinct in purpose: status overview, individual retrieval of records/findings/flow, semantic/text search, and graph relationships. However, 'get_code_intel_record' and 'related_code_intel' both involve records, but descriptions clarify the difference.
Naming mixes patterns: 'get_code_intel_record' vs 'get_static_finding' (different ordering), 'search_code_intel_semantic' vs 'search_static_findings' (inconsistent prefix). 'code_intel_status' and 'related_code_intel' lack verb prefixes, breaking the verb_noun pattern.
With 8 tools, the count is well-scoped for a code intelligence server covering status, retrieval, search, and relationships. Neither sparse nor bloated.
Covers core needs: status, record/finding retrieval, two search modes, and graph edges. Missing explicit listing endpoints, but search can substitute. No clear dead ends for a read-only intelligence server.
Maintenance
Related MCP Connectors
Code intelligence for coding agents: semantic, AST, graph, and full-text search. 279+ languages.
Code intelligence for LLMs. Analyze, search, and retrieve code from any public git repository.
Enterprise code intelligence for M&A, security audits, and tech debt. Hosted server with 200k free.
Ask a codebase what calls what: search, blast radius, paths between symbols, and diffs.
Related MCP Servers
- AlicenseAqualityAmaintenanceLocal-first code intelligence MCP server with hybrid BM25 + ONNX vector search, symbol-level impact analysis, diff-aware PR review with risk scoring, and persistent memory tied to git state.36398 npm82MIT
- AlicenseBqualityDmaintenanceLocal-first codebase context engine that parses code into a ranked dependency graph and serves it to AI tools via MCP for deep structural understanding.59 npm1MIT
- AlicenseBqualityAmaintenanceHigh-performance code intelligence MCP server. Indexes codebases into a persistent knowledge graph — average repo in milliseconds. 159 languages, sub-ms queries, 99% fewer tokens. Single static binary, zero dependencies.81746,667MIT
- AlicenseNot gradedqualityAmaintenanceA local code-intelligence engine for AI agents that indexes repositories into a PostgreSQL-backed code graph and serves structured, token-budgeted context over MCP and HTTP, enabling targeted queries on symbols, dependencies, contracts, and impact analysis.7Apache 2.0