mrkeyoor.com_
Sun 01 Nov 01:52 UTC
AI Toolsevaluationupdated 29 Sept 2026

codebase-memory-mcp review

codebase-memory-mcp is a local code index that gives AI coding agents a map of functions, calls, imports, routes, and files instead of making them reopen the repository for every question. It stores that map in SQLite, exposes it through MCP and a CLI, and does not send the code to a hosted service.

+340stars / 7d
Verdict

Our sandbox installed 352 packages in 31 seconds, built in 17 seconds, and passed all 47 UI tests, so codebase-memory-mcp is a credible choice for developers who want a local structural map inside their coding agent. Use it for navigation, call tracing, and change-impact clues, then confirm consequential answers against the source. Skip it when stale-index risk or static-analysis false positives would turn an agent's confident answer into a release decision.

We ran it

Lab card: what happened when we ran codebase-memory-mcpScreenshot of codebase-memory-mcp (deusdata.github.io/codebase-memory-mcp)
Install✓ · 31s352 packages · 357 MB
Build✓ · 17s
Tests✓ · 11s47 passed · 0 failed of 47 (vitest)
Known vulns00 critical · 0 high · 0 moderate · 0 low (npm audit)
Repo2246 files~2,523,779 lines of source · 1375.2 MB · 23 CI workflows · tests dir

Answers from our run

Does codebase-memory-mcp build from source?

Dependencies installed in 31 seconds (352 packages), and the build succeeded in 17 seconds. We cloned commit 1f9b4db into a clean Debian container with 3 CPUs and no project-specific setup.

Do codebase-memory-mcp's tests pass?

Yes. The project's own test command finished in 11 seconds and reported 47 passed, 0 failed (vitest).

Does codebase-memory-mcp have known vulnerabilities in its dependencies?

npm audit found none in the dependency tree at the time of our run.

Who should not use codebase-memory-mcp?

Teams that need dead-code findings to be authoritative: open issue #1642 documents live constructors, framework methods, and callbacks reported as dead.

What are the alternatives to codebase-memory-mcp?

code-review-graph, CodeGraphContext, Claude Context. Our sandbox installed 352 packages in 31 seconds, built in 17 seconds, and passed all 47 UI tests, so codebase-memory-mcp is a credible choice for developers who want a local structural map inside their coding agent.

Setup4/5Prebuilt binary is simple; installer edits configs and starts a daemon
Docs5/5Detailed install, operations, query, security, and limit guidance
Community5/545,402 stars and active issue and pull-request work
Maturity4/5v0.11.0 is active, with serious correctness issues still open

Discussed on

  1. hnI replaced grep-based code exploration with a knowledge graph – 10x less token4 points
  2. hnHigh-performance code intelligence MCP server3 points
  3. hnCode Intelligence MCP Server3 points

Who it’s for

Developers who want Claude Code, Codex, Cursor, or another MCP client to answer structural questions from a persistent local index.
Teams working across large repositories where repeated file searches waste context and time.
Engineers who need call paths, change impact, architecture summaries, or read-only graph queries alongside ordinary source inspection.
Organizations that want code analysis on their own machines without a model API key for the indexing layer.

Who it’s NOT for

Teams that need dead-code findings to be authoritative: open issue #1642 documents live constructors, framework methods, and callbacks reported as dead.
Nested multi-repo workspaces that depend on automatic freshness after every branch switch: open issue #1429 shows a nested graph can stay stale while status displays the live branch.
Locked-down desktops where an installer may not edit agent configuration or start a shared background daemon. The README says the installer does both.
Very large Windows repositories that can produce an index above 4 GiB: open issue #2399 reports v0.11.0 failing when its staging database reached that boundary.

Setup reality

Our sandbox run at commit 1f9b4db found the Node project under ./graph-ui/. It installed 352 packages in 31 seconds, using 357 MB, then built in 17 seconds and passed all 47 Vitest tests in 11 seconds. npm audit found 0 known vulnerabilities.

The normal product path is a prebuilt native executable with no model key or hosted service. Its installer detects supported agents and edits their MCP configuration. Building the C server from source needs C and C++ compilers, zlib, and Git.

The lab timings cover graph-ui, not the native indexer or its full C suite. The repository had 2,246 files and about 2,523,779 source lines in a 1,375.2 MB checkout, plus 23 CI workflow files and no Dockerfile. A shared daemon, cache directory, watcher settings, and a one-time full reindex after the v0.11.0 format change are the main operational details.

17 MCP tools answer structural questions from one persistent graph

The v0.11.0 server keeps a local map of symbols and their relationships, exposed through 17 MCP tools. An agent can ask what calls a function, which tests touch it, where a route is handled, or what a changed file may affect. The answer comes from a stored SQLite graph instead of another tour through dozens of source files. That is the useful idea here: give the model a smaller, structured view, while keeping the source code available for confirmation.

Those tools cover indexing, search, call tracing, architecture summaries, change detection, code snippets, and read-only Cypher-style queries. Tree-sitter handles syntax across the project's broad language set, while a narrower Hybrid LSP layer adds type-aware resolution for named languages. There is no model inside the server. Your existing MCP client interprets the request and decides which graph tool to call.

One native binary also installs a daemon, watcher, and UI

The v0.11.0 release serves its graph UI on port 9749 from the same native install used for the local server. That install supports macOS, Linux, and Windows, keeps indexes under the user's cache directory, starts a per-account coordination daemon when a compatible session needs it, and can watch Git changes for incremental reindexing. No hosted account or model credential is required for those jobs.

Convenience comes with reach. The installer detects coding agents, writes their MCP entries, and may add instructions, skills, or lifecycle hooks where the client supports them. Codex asks users to review and trust installed hooks, and some clients receive only a limited integration because their hook contracts are weak. If desktop configuration is managed centrally, inspect the scripts and use the documented manual MCP entry instead of handing the installer every detected client.

What happened when we ran it

Our sandbox run used commit 1f9b4db on September 28, 2026, with 3 CPUs, 8 GB of RAM, Node 22, no secrets, and an unprivileged container. The checkout contained 2,246 files, about 2,523,779 lines of source, and occupied 1,375.2 MB. The detected Node project lived under ./graph-ui/.

Installing that package succeeded in 31 seconds. npm added 352 packages and used 357 MB on disk. The build completed in 17 seconds, and Vitest finished in 11 seconds with 47 passed and 0 failed. npm audit reported 0 known vulnerabilities at every severity.

Our method covered the detected Node project only. The repository also contained 23 CI workflow files, a tests directory, and no Dockerfile. These results verify the UI package at the measured commit. They do not test the native C indexer, the prebuilt release binary, indexing speed, graph accuracy, or the full source suite. Treat the clean 47-test result as UI evidence, not a blanket certificate for every path in the repository.

Open issue #1642 makes dead-code results leads, not deletion orders

In the Python example attached to issue #1642, all 50 cases shown as dead were live. Constructors, framework-invoked methods, and callbacks by reference can appear dead because the detector sees no incoming graph edge. That does not make the feature useless. It makes dead a lead for inspection rather than a deletion list.

Freshness has a separate failure mode. Issue #1429 describes nested repositories that do not reindex after a branch switch, even though status reads the live branch and commit from disk. The graph can therefore look current while returning symbols from the old tree. The documented workaround is a manual reindex using the existing project name. Anyone using nested checkouts should make that reindex part of branch-changing automation.

Issue #2399 found a 4 GiB Windows staging boundary

Open issue #2399 reports v0.11.0 completing analysis on a very large Windows repository, then failing to publish when the staging database reached exactly 4 GiB. Splitting the source into several projects worked for the reporter but fragmented some cross-project analysis. This is a narrow case, yet it matters to the teams most likely to buy into a persistent graph: owners of generated Java trees and oversized monorepos.

Team-shared graph files have another cost. The README warns that the compressed artifact is rewritten on every index and Git stores each rewrite as a new blob. Its example reached about 6 GB of history across roughly 350 commits. Commit snapshots on a release cadence, ignore the directory, or set up Git LFS deliberately. Do not let an automatic watcher quietly become a repository-growth machine.

A September 28 push sits beside 646 open issues and pull requests

GitHub showed 45,402 stars and 3,720 forks on September 29, 2026. The last push landed on September 28, and v0.11.0 shipped on September 15. Search results separated the API's combined count into 474 open issues and 172 open pull requests. New reports and fixes were still moving on September 29, so the project is plainly maintained. The 646-item queue also shows how much surface its 45 agent integrations and broad parser coverage create.

Use codebase-memory-mcp when your agent repeatedly asks structural questions that grep answers poorly. Its local graph, 17 tools, and clean 47-test UI run make it worth a trial. Keep ordinary source reads in the loop for dead code, branch-sensitive work, and any change where a stale or merged symbol could cost more than the saved context.

Alternatives

ProjectWhat it isPick it when
code-review-graph gh↗A local Tree-sitter graph aimed at review context, blast radius, and pull-request checks.pick this instead when code review and a CI merge gate are the main jobs, and a Python package fits your environment.
CodeGraphContextA local MCP and CLI code graph with embedded and external database choices.pick this instead when choosing among KuzuDB, FalkorDB, LadybugDB, Nornic DB, or Neo4j matters more than a single native binary.
Claude ContextAn MCP server that retrieves code through embedding-based semantic search.pick this instead when semantic retrieval is the priority and an OpenAI embedding key is acceptable.

What people are saying

  1. [github-trending] DeusData/codebase-memory-mcp

Sources

  1. codebase-memory-mcp repository and README
  2. codebase-memory-mcp v0.11.0 release notes
  3. Open issue #1642: dead-code false positives
  4. Open issue #1429: stale graphs in nested repositories
  5. Open issue #2399: 4 GiB Windows persistence failure
  6. Measured commit 1f9b4db

More ai tools reviews

pr-agent · agent-sprite-forge · KiroCrew · Orkas · hypit · Paradev · the whole board →