GitNexus maps callers before an agent changes code
Before changing a function, you can ask GitNexus's impact tool which indexed symbols depend on it. Tree-sitter parses source into relationships stored in LadybugDB, exposed through MCP. That's a useful addition when file search leaves you piecing together callers by hand. Check whether the map catches your project's indirect relationships.
Our checkout contained 5,653 files and roughly 952,193 source lines in 42.3 MB. The README describes both a local CLI and a browser graph explorer, with a local server bridging them. The CLI is the more sensible starting point for ongoing repository work because it persists an index. Browser-only exploration uses an in-memory database and has its own memory limits. Neither route makes the README's promise of complete context a proven property.
What happened when we ran it
Our run installed GitNexus commit 746217a in 5 seconds, adding 200 npm packages and occupying 95 MB on disk. The October 8, 2026 sandbox used the lab-node:22 image in a fresh Debian container, with 3 CPUs, 8 GB of RAM, no secrets, and no elevated privileges. Installation succeeded. Npm audit reported 0 known vulnerabilities, with 0 critical, high, moderate, or low findings in the audited dependency set.
The harness found no build script or target and no test script or target, so it skipped both steps. Its scan found 29 CI workflow files, no Dockerfile, and no tests directory. Those findings describe what our harness discovered in that checkout. They do not mean a build passed, that the project has no upstream checks, or that indexing accuracy was established. The current README documents development checks and separately named Dockerfiles, which also makes the scan's limits worth keeping visible.
The Noncommercial license is a purchasing decision
The repository's license file names PolyForm Noncommercial. The README directs commercial users toward separate licensing and an enterprise offering. Developers choosing dependencies for company use should settle that question before wiring GitNexus into daily code review. This is source you can inspect, with restrictions that deserve attention. A GitHub repository and a local execution path don't themselves establish permission for your intended use.
A successful 200-package installation establishes no permission. For a personal project within the stated noncommercial terms, the local graph may be worth exploring. For a business seeking a tool it can adopt under familiar permissive terms, this is a concrete reason to consider alternatives. The README doesn't state commercial license pricing.
The quick start writes agent files and editor configuration
The README's analyze command creates repository context files, installs agent skills, and registers Claude Code hooks. setup writes editor MCP configuration. That is convenient when you want an agent using the graph immediately, but it also means analyzing a repository has effects beyond reading source. Review those generated files as part of adoption. The documented --index-only path offers a narrower starting point when you want to inspect the graph before adding integrations.
The measured environment used Node 22, but the current README puts a more specific runtime requirement on the optional local embedding stack through module.registerHooks. Native grammar availability also depends on platform support. Core structural indexing doesn't require an LLM credential. Wiki generation does require a configured model provider, with a local authenticated CLI option documented too. Decide which features you need before assuming the local indexing privacy claim covers every optional model call.
An open Python issue shows callers can disappear from impact results
Issue 3497 reports that GitNexus v1.6.12 misses calls through a function that returns a module. The chained form _pc().target() loses the edge to target. In the two-step form, m = _pc(); m.target(), the report shows a missing caller without the corresponding dropped-site warning. That matters for a common Python technique: importing a module lazily to avoid an import cycle.
The reproduction distinguishes lower-bound and exact labels, and records an unknown-risk warning on the zero-caller result. Read it before interpreting an empty caller list as permission to delete code. Our 5-second installation did not exercise this case. The sensible use of the graph is to find leads, then cross-check a consequential change with source search and the language's own analysis tools. An absent relationship needs investigation.
Large indexes need native database memory as well as a Node heap
Issue 3526 concerns large Java repository indexing on a constrained host. It reports that database buffer exhaustion left a severely incomplete relationship graph after a write path skipped rows. A later integrity check detected the collapse. Open PR 3540 proposes aborting exhausted writes and preventing a collapsed replacement index from being published. That fix remains a proposal.
Our container's 8 GB of RAM supplies no answer about how large a repository you can index safely. We measured installation, not a monorepo indexing workload or native database pressure. Inspect graph integrity and budget the database pool separately from JavaScript memory. Raising the Node heap alone does not address the native pool described in the issue. Trial the actual repository before making impact results a release requirement.
October activity supports a trial with independent checks
GitHub recorded a push on October 10, 2026, with 47,817 stars and 300 open issues and PRs combined. The latest stable release returned by the API was v1.6.12, published September 12. Recent work includes graph-write recovery and release evaluation. Alongside the 29 workflow files found in our checkout, that shows active maintenance despite the older stable tag. The unresolved caller and write reports still limit what I'd entrust to the graph.
Serena is the alternative I'd examine for symbol navigation and editing through language servers. Repomix fits a simpler need: package repository text for an AI reader. Choose GitNexus when persistent relationship queries are the missing part of your workflow and its licensing fits. The 95 MB installation footprint we measured is manageable. Before connecting automated edits, give it a known caller chain from your code and check that every expected relationship appears.