arbor

v3.0.0 — The Right Node · v2.6.0 stopped dropping colliding symbols. It did not stop resolving them to the wrong one. When a bare name matched several modules, resolution fell through to "same directory" and confidently attached the edge to whichever definition happened to sit next to the caller. On a graded fixture the three largest hubs reported zero downstream impact while unrelated siblings inherited their centrality. A file's own imports now settle it. Reproduce it yourself: getArbor-dev/arbor-torture

Why Arbor

Most AI coding tools treat code as text. Arbor builds a semantic dependency graph — functions, classes, and modules as nodes; calls, imports, and inheritance as edges — then answers execution-aware questions with deterministic precision:

No keyword guessing. No embedding hallucinations. One graph, every interface.

Where the graph is unsure, it says so — edges carry a confidence, and ambiguous resolutions are labelled rather than hidden. An honest unknown beats a confident wrong answer.

Related MCP server: CodeGraph CLI MCP Server

What's new in v3.0.0

One fix, measured.

Symbol resolution consults the importing file. When a bare name matched definitions in several modules, resolve_ref fell through to SameDir and attached the edge to whichever definition sat in the caller's own directory — not a dropped edge, a confidently misrouted one, stamped at 0.55 confidence.

GraphBuilder already kept a per-file import map, but only apply_import_validation read it, and that scores an edge after one has been chosen. It never saw the references going to the wrong node. Consulting it between the same-file and same-directory checks keeps a local definition shadowing an import, while letting a written import beat mere adjacency. Resolution::ViaImport scores 0.93, above SameDir's 0.55.

Measured

A fixture of 260 modules across 10 layers, each layer defining the same 26 function names. Ground truth is derived from the generator's own edge list, so the expected answer is exact rather than estimated.

Previously flat at about 22 regardless of the real answer. Now it tracks. Risk on the largest hub moves from LOW to CRITICAL.

Total edge count barely moves (1335 → 1334). That is the signature of misrouting rather than loss: the edges were always there, pointing at the wrong nodes.

Breaking

• Resolution gains a ViaImport variant — an exhaustive match will not compile

• Edges land on different nodes, so cached graphs, stored node ids, and centrality baselines from 2.6.0 will differ

Known and still open

Written down rather than left to be discovered:

• Small targets now over-report (36 → 61, 16 → 46). Safer direction than silence, but not yet correct.

• PageRank has no escape from a closed cycle. Every member of a 500-function ring scores above 90% centrality on one caller each, so mutually recursive clusters — parsers, tree walkers, state machines — crowd the top of any ranking.

• Inheritance produces no edges. class Middle(Base) is invisible, so changing a base class shows zero blast radius.

• Dynamic and reflective imports (importlib, __import__, import(), eval(require(...))) are unresolvable by construction and are documented as expected misses in the fixture rather than counted as defects.

Correctness, not speed. Each of these was silently wrong before.

New capability — concept search. Substring matching cannot find get_authenticated from login; they share no substring. Identifiers are now tokenized and expanded through curated concept clusters, and docstrings, signatures, and paths are indexed alongside names. Deterministic, offline, no model. Available on the library as ArborGraph::search_ranked (arbor query remains literal-substring for now).

New capability — hunk-level impact. changed_node_ids_for_ranges keeps only symbols whose lines actually changed, instead of every symbol in a touched file.

Measured on identical node sets, after the duplicate-extraction fix:

Graph caches from earlier versions are invalidated — centrality now means something different, so a stale cache would be read wrong.

Think a number is wrong? cargo bench -p arbor-graph and prove it: BENCHMARKS.md.

Quickstart

# Install
cargo install arbor-graph-cli

# Index your project (one command)
cd your-project && arbor setup

# Explore before you edit
arbor map . --exclude-test          # ranked project skeleton (~1k tokens)
arbor refactor parse_file           # blast radius of changing a symbol
arbor diff                          # impact of uncommitted git changes

# Wire up your AI agent
claude mcp add --transport stdio --scope project arbor -- arbor bridge

Agent workflow: call get_map first → search_symbols / get_file_graph to locate code → Read only the target file. Full MCP guide →

For AI agents (MCP)

Arbor ships a production MCP server via arbor bridge. Stdio is the default; HTTP is opt-in for remote/enterprise.

# Stdio (Claude, Cursor, VS Code)
arbor bridge

# HTTP (MCP 2026-07-28)
arbor bridge --http --port 3333

Cursor / VS Code

{
  "mcpServers": {
    "arbor": {
      "type": "stdio",
      "command": "arbor",
      "args": ["bridge"]
    }
  }
}

Templates: templates/mcp/ · Setup scripts: scripts/setup-mcp.sh · scripts/setup-mcp.ps1

16 MCP tools

Every tool returns { ok, tool, data, meta: { suggested_next_tool, suggested_next_args } } so agents chain calls without re-prompting.

Registry: io.github.Anandb71/arbor · Official API lookup · Glama listing

CLI reference

All query commands support --json. map additionally supports --tokens N, --focus "pattern", --focus-changed.

Visual tour

Full recording: media/recording-2026-01-13.mp4

Installation

# Rust / Cargo
cargo install arbor-graph-cli

# Homebrew (macOS/Linux)
brew install Anandb71/tap/arbor

# Scoop (Windows)
scoop bucket add arbor https://github.com/Anandb71/arbor && scoop install arbor

# npm wrapper (cross-platform)
npx @anandb71/arbor-cli

# Docker
docker pull ghcr.io/anandb71/arbor:latest

No-Rust installers:

• macOS/Linux: curl -fsSL https://raw.githubusercontent.com/Anandb71/arbor/main/scripts/install.sh | bash

• Windows: irm https://raw.githubusercontent.com/Anandb71/arbor/main/scripts/install.ps1 | iex

Pinned installs: docs/INSTALL.md

Language support

Production parsers: Rust · TypeScript / JavaScript · Python · Go · Java · C / C++ · C# · Dart

Fallback parsers: Kotlin · Swift · Ruby · PHP · Shell

Adding languages →

CI & pull requests

arbor diff --markdown
arbor check --max-blast-radius 30 --markdown
arbor summary

GitHub Action (pre-built binary, ~5s vs ~3–5min compile):

name: Arbor Check
on: [pull_request]

jobs:
  arbor:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: getArbor-dev/arbor@v3.0.0
        with:
          command: check . --max-blast-radius 30 --markdown
          comment-on-pr: true
          github-token: ${{ secrets.GITHUB_TOKEN }}

Architecture

arbor-core (Tree-sitter parsing)
    └── arbor-graph (petgraph + PageRank + impact analysis)
            ├── arbor-cli      — CLI + MCP bridge
            ├── arbor-mcp      — MCP protocol server
            ├── arbor-server   — WebSocket JSON-RPC
            ├── arbor-watcher  — incremental file watcher
            └── arbor-gui      — desktop UI

Docs: Quickstart · Architecture · Graph schema · MCP integration · Benchmarks · Roadmap · Philosophy

Release channels: GitHub Releases · crates.io · GHCR · npm · VS Code / Open VSX · Homebrew · Scoop — Releasing guide

Philosophy

1. Consumer first — beautiful, intuitive, instantly useful

2. Accessibility second — works across ecosystems, runs anywhere

3. Affordability next — minimal overhead, from laptops to monoliths

Arbor is local-first: no mandatory data exfiltration, offline-capable, open source. Security policy →

Contributing

cargo build --workspace
cargo test --workspace
cargo clippy --workspace --all-targets --all-features

CONTRIBUTING.md · Good first issues · Code of conduct

Contributors

License

MIT — see LICENSE.