The graph answers relationships that text search cannot
Graphify parses a repository into concepts and typed edges, then lets a user ask what a symbol connects to, how two concepts are linked, or which nodes anchor a subsystem. Code extraction uses tree-sitter rather than an LLM. Results include graph.html for browsing, GRAPH_REPORT.md for a written summary, and graph.json for direct queries. Every edge is labeled as extracted from source, inferred by resolution, or ambiguous.
That structure is useful for architectural questions. Grep can find the string DatabasePool, but it does not directly show the shortest path from an HTTP handler through a service to that pool. Graphify can expose that path and point back to files and lines. The graph should guide where an engineer reads next. It should not replace the source, because name resolution and relationship classification can be wrong even when parsing itself succeeds.
Our 4,541 passing tests came with 24 Terraform failures
We cloned commit b2cd362 into an unprivileged Debian container with 3 CPUs and 8 GB of RAM. The checkout contained 823 files, roughly 143,329 source lines, and occupied 16.1 MB. Installation took 48 seconds, added 63 packages, and used 189 MB. The build succeeded in 14 seconds, while pip-audit found 0 known vulnerabilities in the installed dependency set.
The repository had 3 CI workflow files, a Dockerfile, and a tests directory. Its Python package requires version 3.10 or newer and includes tree-sitter grammars for many common languages. Optional dependency groups add MCP, graph databases, documents, media, model providers, and niche language grammars. The public package is named graphifyy, with two ys, although the installed command is graphify. That naming detail matters when using uvx.
What happened when we ran it
Our pytest run lasted 190 seconds and exited with failure. It reported 4,541 passed, 24 failed, and 212 skipped out of 4,565. The tail showed Terraform assertions receiving an error that said tree_sitter_hcl not installed. Run: pip install tree-sitter-hcl. Affected cases covered blocks, references across files, empty files, comments, and tfvars input.
The log gives a concrete missing component for those failing cases. It does not say why that package was absent from the environment selected by the harness. The project metadata lists tree-sitter-hcl in the Terraform extra and development dependency group, while it is absent from base dependencies. Buyers who need HCL should install the Terraform extra and rerun those 24 cases. The 4,541 passes are substantial evidence, though they do not turn the failed suite green.
Local code parsing has a narrower privacy boundary than documents
The README says code AST extraction happens locally without API calls. Markdown, PDFs, images, video, and audio can go through the assistant's model or a configured backend for a semantic pass. That distinction should be written into a data policy. A team may permit source parsing on a laptop while forbidding design documents, customer screenshots, meeting recordings, or credentials from reaching an outside model.
Optional extras make those paths explicit. PDF, office, Google Workspace, video, MCP, Neo4j, FalkorDB, Terraform, SQL, and provider integrations each pull separate packages or authentication. Install only the formats used by the repository. .gitignore and .graphifyignore control input selection, but a reviewer should also inspect graphify-out/ before committing it because generated nodes and reports may repeat sensitive names or document content.
Assistant installation changes how tools read the repository
graphify install can register a skill for Claude Code, Codex, Cursor, Gemini CLI, and many other assistants. Project mode writes platform files into the repository. For Codex, AGENTS.md carries the always-on query guidance. Claude Code can use a hook that nudges the assistant before search or source reads, while strict mode blocks the first raw source read and redirects it to the graph. These are workflow changes, not a passive CLI installation.
Open issue 3129 reports Graphify 0.9.50 writing a Windows machine-specific executable path into a repository-tracked .codex/hooks.json. On another machine, that path does not exist and can break Bash tool calls. Inspect generated diffs before commit, prefer a project policy that works across operating systems, and test the repository from a second checkout. A hook should fail safely when a developer has not installed Graphify.
Extracted edges and inferred edges both need regression checks
Open issue 3123 shows Graphify 0.9.50 treating TypeScript import type and export type statements as runtime import edges. In the reporter's roughly 7,900-node repository, all 3 reported import cycles were false positives. The type relationships were real, but TypeScript removes them at runtime. An architecture report that mixes those meanings can send a team toward work that does not affect the deployed module graph.
Incremental semantic extraction has a more serious open report. Issue 2843 says the first graphify update removed 133 nodes and 236 edges across 8 of 21 documents in one Windows run because some semantic nodes lacked an origin marker. The issue includes a proposed fix and verification, but it remained open when checked. Track node and edge totals per source file across updates, and keep a full rebuild available as a comparison.
August 2026 releases are frequent and the defect queue is busy
GitHub showed 111,124 stars, 1,137 open issues and pull requests, and a last push on August 25, 2026. Release v0.9.50 landed the same day with fixes for Ruby identifiers, qualified constants, CommonJS exports, merged community IDs, Windows markers, watch events, PostgreSQL grammar packaging, and several extractor details. The combined open count includes pull requests rather than representing 1,137 confirmed bugs.
Graphify is most convincing as an orientation aid that reduces aimless reading. The 4,541 passing tests support that trial, and the 24 HCL failures show why optional formats must be tested separately. Build a graph from one representative repository, compare paths and cycles with source, run an incremental update, inspect generated assistant files, and decide whether the saved reading time outweighs another derived artifact that the team must validate.