Graft turns a codebase into files an agent can browse
Graft maps source files, symbols, imports, and calls into a local graft/ directory. Coding agents can query that map through six MCP tools or the CLI instead of opening files until they stumble onto the right subsystem. The generated material is ordinary files, so there is no search server to keep alive. Graft supports 23 languages across its full and broad parsing tiers, with optional language-server edges for Rust, C, C++, Go, Python, TypeScript, and JavaScript.
That design is most useful when the same repository appears in many agent sessions. A structural build records per-symbol relationships with tree-sitter. Commands such as ask, grep, callers, skeleton, and map refresh against the working tree before answering. The map includes uncommitted edits because freshness is based on file contents, not the current commit. Each teammate creates a separate cache rather than checking generated graph files into Git.
The fast graph is local, while deeper summaries need a model key
The basic graph and freshness check run without a key or network request. A deep build is different: it sends code through a model to summarize individual files, group them into concept nodes, and add per-symbol summaries. Graft accepts OpenAI-compatible services, Anthropic's API, LiteLLM, OrcaRouter, and local endpoints through provider, model, key, and base URL settings. That keeps vendor choice open, but the privacy boundary depends on the endpoint you select.
The README presents the concept layer as linked Markdown with summaries, source references, and typed relationships. Handwritten notes below the generated block survive regeneration. One detail deserves care: the README says the code crux currently ships in the per-symbol deep graph, while inserting it into the Markdown concept nodes is described as next. Buyers should treat the current output as the product and avoid budgeting around that aspiration.
What happened when we ran it
Our sandbox installed commit 80692e5 in 42 seconds. The checkout contained 343 files, roughly 60,638 lines of source, and occupied 44.7 MB before installation. npm added 88 packages and brought disk use to 443 MB. The TypeScript build then completed successfully in 8 seconds. We used 3 CPUs, 8 GB of RAM, Node 22, no secrets, and an unprivileged container.
The test suite passed all 1,266 node:test cases in 135 seconds with 0 failures. That is strong evidence for the repository mechanics we exercised. It does not measure whether Graft finds the right context in a customer's codebase, saves tokens, or improves patch quality. Those product claims require a representative repository and agent workload. npm audit also reported 1 known high-severity vulnerability, so the otherwise clean run does not clear a strict dependency gate.
graft init edits project files and user agent settings
The two-command quick start hides a meaningful permission decision. graft init can write agent instructions, an MCP file, Claude Code hooks, and a status line in the project. Selecting the generic agents host can also register an MCP server in ~/.codex/config.toml, place a hook shim under ~/.codex/hooks/, and update ~/.codex/hooks.json. The documented --dry-run, --no-global, --no-mcp, and --no-hooks switches let you narrow that scope before writing anything.
Removal also deserves a check. Open issue 546 reports that version 0.19.0 can leave an orphaned Codex MCP environment table after uninstall, causing Codex to reject its config until the file is edited by hand. The current package file says 0.21.1, but the issue remained open on October 3. Take a copy of shared agent settings, inspect the dry run, and verify both install and uninstall on one workstation before a team rollout.
Worktrees and non-Latin concepts expose context risks
Open issue 515 describes a serious review failure: an MCP server started in the main checkout cannot be pointed at a subagent's separate worktree. In the reported experiment, Graft returned code from the main checkout while reviewers were examining another commit. The CLI started inside the worktree was the stated workaround. A context tool that answers from the wrong tree can make a confident review less accurate, so worktree-heavy teams should test this exact path.
Language coverage also has a text boundary. Issue 543 reports that deep synthesis in version 0.21.1 strips non-Latin characters while making filenames, which can merge distinct concepts into one node. The report covers Cyrillic and says the same rule affects CJK, Arabic, and Greek names. This concerns generated concept labels, not whether the listed source languages parse. Repositories using non-English concept names should inspect the resulting node count and names after every deep build.
An October 3 push outweighs the missing release page
GitHub reported 9,539 stars and 209 open issues and pull requests on October 3, 2026, and the repository was pushed that day. New issues and pull requests were also arriving on October 3, including fixes and reports around Python call resolution, Codex uninstall behavior, and non-Latin concept synthesis. There was no latest GitHub release returned by the API, but same-day code and issue activity show that the project is being worked on.
Official npm builds send anonymous, opt-out usage events, and the telemetry document names every allowed field. It also says a stop hook locally reads the tail of an agent transcript after a Graft-using turn to count whether the response mentioned token savings; no transcript text is stored or sent. That disclosure is unusually specific. Teams with strict monitoring rules still need to disable telemetry or build from source before letting Graft touch private repositories.