The graph answers questions that text search cannot
Code-Graph-RAG parses source into nodes for files, functions, classes, methods, and modules, then connects them through structural and semantic relationships. Natural-language questions become Cypher queries against Memgraph. The result can include the source behind a symbol, its callers, imports, inheritance, and optional flow information rather than a bag of nearby text chunks.
The README lists 13 fully supported languages: Python, TypeScript, TSX, JavaScript, Rust, Go, Java, C, C++, C#, PHP, Lua, and Dart. Scala remains in development. Another group, including Ruby, Kotlin, Swift, Bash, and Nix, receives structural support through ast-grep. Buyers should read the per-language matrix because one unified schema does not mean identical analysis quality.
This is most useful in a monorepo where a question crosses packages or languages. A plain search can find a function name; the graph can help trace which code calls it or which file imports it. The system also supports dead-code walks, structural search, runtime trace overlays, and graph exports. Each result still needs source verification, especially where language analysis falls back to heuristics.
Editing is available, so read access is not the only risk
The interactive tool can retrieve code, propose AST-based patches, and show a diff before applying them. Its MCP server gives Claude Code and other clients the same repository-query and editing surface. That is convenient for an agent working across a large codebase, but it changes the trust model: an indexing service with write tools needs narrower permissions than a search-only service.
Keep the graph process on loopback or another controlled network, scope filesystem access, and require diff review. The project documentation includes a security guide, yet deployment policy remains the operator's job. An LLM-generated Cypher query can also be wrong even when it is syntactically valid. Graph candidates should lead back to named files and lines before an edit is accepted.
The shared graph has one particularly sharp command. The README says --clean deletes every indexed project, not merely the repository currently being updated, and prompts when other projects exist. Back up the data and avoid granting unattended automation permission to use that flag. A confirmation prompt is helpful until a script learns how to bypass it.
What happened when we ran it
We cloned commit 46dae44 into an unprivileged Debian container with 3 CPUs and 8 GB of RAM. Installing 150 packages took 63 seconds and consumed 325 MB. The build succeeded in 10 seconds. Pip-audit reported 0 known vulnerabilities in the installed environment.
Pytest ran for 79 seconds and exited 1. It recorded 24 passing tests, 3 skips, and 200 collection or setup errors out of 224 before stopping. The shown failures all came from integration cases attempting to fetch the Docker server API version. The log says the connection failed; it does not say that the language parsers themselves produced wrong graphs.
That distinction helps, but it does not turn the run green. Docker is a documented prerequisite because cgr daemon up starts Memgraph and Qdrant. Our sandbox did not provide a reachable daemon, and the test suite did not skip those integration cases. Teams running CI in restricted containers must supply Docker access or select an upstream-supported test slice that does not require it.
The checkout contained 1,312 files, about 386,716 source lines, and 31.6 MB of data. We found 13 CI workflows and a Dockerfile, but no top-level tests directory; the actual tests live under codebase_rag/tests. The large ratio of setup errors to passes makes a Docker-capable rerun essential before adopting this commit.
Memgraph and Qdrant turn installation into a service deployment
The published package is the easy part. Python 3.12 or newer, uv tool install, cmake, and ripgrep establish the CLI. cgr daemon up then starts the packaged Memgraph and Qdrant stack. Parsing a repository populates the shared graph, while a second command opens the interactive query path. Semantic search uses the vector side of that stack.
Memgraph is currently a hard dependency in the documented route. Open issue #386 proposes embedded graph and vector alternatives specifically to remove Docker and a running database server, but its acceptance boxes remain unchecked. Until that changes, laptop users and CI operators must budget ports, volumes, image updates, resource limits, backups, and recovery for two data services.
Language depth can add more prerequisites. The release notes mention Jedi for Python, javac facts for Java, Roslyn work for C#, libclang for C++, and structural ast-grep additions. Those frontends improve resolution where available, but they also create toolchain and platform variation. Start with the languages actually present in your repository rather than installing every extra because the matrix is long.
Release v0.0.720 is active, while precision work remains open
The repository was pushed on August 26, 2026, four days after release v0.0.720. GitHub showed 47 combined issues and pull requests. The release added or refined Java and C# taint propagation, Python semantic facts, protobuf indexing, and structural language coverage. This is active maintenance, not a project living on an old tag.
The project's version policy is unusual but documented. Git tags advance on every merge, while GitHub releases and PyPI publish every 50th version or immediately for a security fix. A newer tag than the package is therefore expected and should not be called abandonment. Teams still need to decide whether to pin the packaged release or a specific main-branch commit.
Open issue #1454 gives a concrete reason for platform testing: it reports many subprocess calls relying on locale decoding, which can corrupt non-ASCII tool output on Windows. Issue #386 shows that removing the Docker requirement remains work rather than a shipped option. Code-Graph-RAG is worth a controlled trial for polyglot investigation, but its graph results, edit path, and deployment all need verification on the exact repository and operating system you use.