CodeGraph puts a local SQLite index behind one MCP tool
CodeGraph parses a repository into symbols and relationships, stores them in .codegraph/codegraph.db, and lets an agent ask for relevant source plus the paths connecting it. The default MCP surface exposes one tool, codegraph_explore; narrower node, search, caller, callee, impact, file, and status commands remain available through the CLI or an environment setting. This focused interface suits agents that otherwise spend several turns searching for definitions and rebuilding call chains.
The README lists more than 30 language and framework formats, with a native Rust kernel for 20 languages and portable fallbacks elsewhere. It also recognizes routes, inheritance, imports, callbacks, and some cross-language mobile bridges. Static analysis still has boundaries, so the graph labels uncertain edges and names places where a flow stops. That honesty is useful. It does not turn every runtime relationship, reflective call, dependency-injection rule, or message bus into a knowable edge.
Agent installation and project indexing are separate steps
Installing the CLI puts codegraph on the path. Running codegraph install then detects selected agents and writes their MCP configuration, with optional changes to instruction and permission files. No project has been indexed at that point. Each repository needs codegraph init, which creates the local database and builds the first graph. Teams that manage developer configuration centrally can print a config snippet instead of allowing the installer to edit files.
Once initialized, a watcher updates changed files and the server checks for stale content before returning source. The viewer described on main binds to 127.0.0.1, and the index stays local. Anonymous telemetry is a separate channel: it can send coarse daily totals for commands, languages, agents, platform, and version. The documentation says code, paths, symbol names, queries, repository names, and IP addresses are excluded, with codegraph telemetry off, CODEGRAPH_TELEMETRY=0, and DO_NOT_TRACK=1 available.
What happened when we ran it
Our npm install finished in 10 seconds, adding 193 packages and consuming 162 MB on disk. The build succeeded in 21 seconds. Npm audit reported 0 known vulnerabilities across the installed dependency tree. Those are good first checks for commit 3ed73bc, a 150 MB monorepo with 1,089 files and roughly 296,458 source lines. They did not carry through to the full test result.
Vitest exited with code 1 after 110 seconds. It reported 2,902 passed, 852 failed, and 864 skipped out of 4,618 tests. At file level, 159 failed, 90 passed, and 18 were skipped. This was a broad failure rather than one red case at the end of an otherwise clean suite, so a buyer should reproduce the command before trusting the checkout as a development base.
The supplied log tail names failures in CLI query and parse-warning tests, SQLite backend tests, and database edge-validation tests. It does not show the assertions or one shared cause. We therefore cannot attribute the 852 failures to the Debian container, a missing service, a platform assumption, or a product regression. The defensible finding is narrower: install and build passed in our unprivileged Node 22 sandbox, while the test target did not.
The main README documents a viewer absent from v1.6.0
The browser UI on the main branch is described in detail: callers appear beside source, flows show each hop, and maps summarize module dependencies. The current release record points to v1.6.0 from August 26, 2026. Open issue 1816 reports that a fresh v1.6.0 install returns error: unknown command 'ui', despite the README telling users to run that command. Several commenters reproduced the mismatch on Linux.
That gap does not make the viewer imaginary; it means main-branch documentation describes code newer than the latest release. Evaluate v1.6.0 from its own release notes and installed help, then treat README-only commands as unshipped until a release includes them. This matters for automation because codegraph install, init, serve, and ui change different parts of the system. A copied main README is not a versioned CLI contract.
Version 1.6.0 still misses some real runtime callers
Issue 1820 gives a compact Python example where obj.method() resolves, while passing obj.method to an executor does not create the caller edge. The affected production method appears test-only in caller and impact output. Other open items describe Scala inheritance edges and C preprocessor parsing. These are exactly the classes of mistake that matter when someone asks which tests to run or what a change might break.
Use impact output as a navigation aid, then verify high-risk paths in source and tests. CodeGraph's own README says static coverage stops around reflection, dynamic dispatch, dependency injection, and framework conventions. The library route also has a separate constraint: embedding requires Node 22.5 or newer because it uses built-in node:sqlite, even though the standalone CLI carries its own runtime. Teams should test their language mix, generated code, ignored paths, and monorepo layout before standardizing.
A 472-item queue reflects active work and unsettled edges
GitHub reported 70,298 stars and 472 open issues and pull requests. The last push was September 9, 2026, one day after several new extraction and resolution reports were opened or updated. The queue includes fixes for Python imports, Dart members, C preprocessing, Kotlin visibility, and large-repository memory behavior. This is plainly active development, with users supplying detailed reproductions and proposed patches. The same pace means graph behavior can change between releases.
Release v1.6.0 fixed serious failures, including stale source slices, missing symbols after parser interruption, and write-ahead logs that could grow without a bound after killed sessions. Those fixes show the maintainers are working on correctness and recovery. Our 852 failed tests prevent a clean recommendation for the tested commit. Trial the released binary on a disposable index, compare several caller and impact results with source, and keep it advisory until your own suite and graph checks agree.