mrkeyoor.com_
Sun 25 Oct 09:35 UTC
AI Toolsevaluationupdated 25 Oct 2026

Trail-Code review

Graft builds a local source-code map that coding agents can query for functions and their relationships. The project is now called Trail-Code, which also documents files for carrying team decisions into later sessions. Our measurement covers Graft commit 80692e5, not the renamed product's newer behavior.

+267stars / 7d
Verdict

Graft commit 80692e5 passed all 1,266 repository tests, while npm audit reported 1 high-severity vulnerability. That supports a limited trial with dependency review, not a claim that the map improves coding-agent results. Start with structural queries on code whose relationships you can check. Before initializing today's Trail-Code, review both its configuration writes and its documented processing of session messages and PR review comments through Claude Code. The September run did not assess that processing or team-memory behavior.

We ran it

Lab card: what happened when we ran Trail-CodeScreenshot of Trail-Code (trailhq.com/graft)
Install✓ · 42s88 packages · 443 MB
Build✓ · 8s
Tests✓ · 135s1266 passed · 0 failed of 1266 (node:test)
Known vulns10 critical · 1 high · 0 moderate · 0 low (npm audit)
Repo343 files~60,638 lines of source · 44.7 MB · 6 CI workflows · Dockerfile · tests dir

Answers from our run

Does Trail-Code build from source?

Dependencies installed in 42 seconds (88 packages), and the build succeeded in 8 seconds. We cloned commit 80692e5 into a clean Debian container with 3 CPUs and no project-specific setup.

Do Trail-Code's tests pass?

Yes. The project's own test command finished in 135 seconds and reported 1266 passed, 0 failed (node:test).

Does Trail-Code have known vulnerabilities in its dependencies?

npm audit flagged 1 known advisory in the dependency tree at the time of our run.

Who should not use Trail-Code?

Teams that cannot accept the documented configuration writes: the measured initializer can change user-level Codex settings, although --no-global skips those writes.

What are the alternatives to Trail-Code?

ast-grep, Aider. Graft commit 80692e5 passed all 1,266 repository tests, while npm audit reported 1 high-severity vulnerability.

SetupN/AInstallation and build passed, but agent initialization, supported runtime compatibility and current Trail-Code setup were not independently evaluated.
DocsN/AThe supplied README extracts document commands and data boundaries, but documentation accuracy and task completion were not checked against a running installation.
CommunityN/ASupplied repository activity does not establish support responsiveness, contributor continuity or the experience of obtaining help.
MaturityN/AThe older commit passed its repository suite, but graph accuracy, coding-agent outcomes and the renamed product's newer features were not evaluated.

Discussed on

  1. hnShow HN: Graft – Claude Code hooks that cut grep tokens by 42%39 points
  2. hnGraft6 points
  3. hnShow HN: Graft – Give coding agents a semantic map instead of grep3 points
  4. hnShow HN: Claude Code kept ignoring our MCP tools, so we used hooks instead3 points

Who it’s for

Developers who want to add code navigation to a coding agent they already use.
Teams that prefer a local source map to operating a separate search database.
Engineers prepared to inspect initialization changes and compare graph answers with source code.

Who it’s NOT for

Teams that cannot accept the documented configuration writes: the measured initializer can change user-level Codex settings, although --no-global skips those writes.
Teams that cannot send prior session messages or repository review comments to Anthropic through Claude Code: today's documented initialization includes this processing, separately from optional deep summaries.
Buyers who need demonstrated improvements in agent task success or cost: the supplied sandbox measured installation, build and repository tests.

Setup reality

Our Graft run at commit 80692e5 installed in 42 seconds, recorded 88 dependencies and used 443 MB on disk. The build passed in 8 seconds; all 1,266 node:test cases passed in 135 seconds. Npm audit reported 1 high-severity vulnerability.

At that revision, structural graph construction needs no model key. The optional --deep pass uses a selected model provider and credentials. The initializer can write agent instructions, MCP registration and hooks; its documented --dry-run lists proposed writes, and --no-global skips writes outside the repository.

Today's Trail-Code initializer has an additional boundary. The current README says the user's Claude Code processes prior session messages with Claude Sonnet under the user's login, sending those messages to Anthropic and counting toward Claude usage. When gh is installed and signed in, initialization also retrieves review comments from the repository's last 50 merged PRs for similar processing. The README says this material does not go to Trail. The September run did not assess these initialization features. A dry run showing proposed file writes does not establish that these data flows have been evaluated.

The sandbox had 3 CPUs and 8 GB of RAM, with image label lab-node:22. That label does not establish the actual runtime or operating-system version. Keep current package instructions separate from the September 27, 2026 measurement.

A local map for the agent you already use

Before changing a shared function, a coding agent needs to find its callers. Graft builds a local source map and exposes queries through its CLI and MCP interface. Consider it when you want code navigation added to an existing assistant and can check the returned relationships against the source.

The map lives in a local graft/ directory. At the measured revision, structural parsing uses tree-sitter; an optional deeper pass uses a model to write summaries. Finding a function and explaining its behavior are different jobs. Check both the relationships and any generated explanation before relying on them for a patch.

What happened when we ran it

Our sandbox installed Graft commit 80692e5 in 42 seconds, built it in 8 seconds and passed all 1,266 node:test cases in 135 seconds. The run took place on September 27, 2026, with 3 CPUs and 8 GB of RAM. The recorded image label was lab-node:22; it does not establish the actual Node.js or operating-system version.

Installation recorded 88 dependencies and occupied 443 MB on disk. The checkout occupied 44.7 MB and contained 343 files and about 60,638 source lines. Npm audit reported 1 high-severity vulnerability. The supplied summary does not identify the affected package or establish whether Graft exposes a reachable attack path. Review the advisory before adoption.

The scan also recorded 6 CI workflow files, a Dockerfile and a tests directory. These observations and the passing suite describe the repository checks we ran. They do not measure graph accuracy, agent task completion, patch quality, model spending or time saved. The README's performance figures are project claims, not results from this sandbox.

Graft is now Trail-Code

The current README says, "Graft is now Trail-code." It documents the trail command and @trailhq/trail-code package while retaining the older names. Our measured result belongs to commit 80692e5; it does not establish the behavior of today's package.

The current documentation also describes learnings: files that preserve decisions and preferences for later agent sessions. That serves a different purpose from locating callers. The September run did not assess whether an agent retrieves or follows those learnings. Evaluate that behavior separately if preserving team decisions is your main reason to adopt Trail-Code.

Structural parsing and model summaries have different boundaries

The measured revision documents a structural graph that does not call a model. Its optional --deep pass uses the provider you select for file summaries, concept nodes and per-symbol summaries. Where source material goes therefore depends on the selected endpoint.

For an initial evaluation, use structural queries on a repository whose relationships you already understand. Ask about a shared function and inspect its actual callers. Add summaries only if they answer a question the structural map leaves open. This is a suggested evaluation workflow; the supplied lab run did not reproduce it.

Review today's initialization before trying it

Initialization deserves a separate review from graph construction. At the measured revision, graft init can write agent instructions, register MCP and install hooks. Selecting the generic agents host can also change user-level Codex configuration, affecting other repositories. The documented --dry-run lists proposed writes, and --no-global skips writes outside the repository. These are documented controls, not initialization behavior independently tested by our sandbox.

Today's Trail-Code initializer also processes material beyond source files. The current README says trail init reads the user's own messages from prior Claude Code sessions for the repository. The user's Claude Code performs that reading with Claude Sonnet under the user's login, so those messages go to Anthropic and count toward Claude usage. The README says they do not go to Trail.

When gh is installed and signed in, the current initializer also retrieves review comments from the repository's last 50 merged PRs under the user's GitHub login. The README says material that looks like a secret is removed, then the user's Claude Code reads those comments in the same way. These are documented data flows, not behavior assessed in the September run. They are additional to the optional deep-summary pass.

Inspect proposed configuration writes and decide whether this model processing fits your repository policy before running today's initializer. A structural parser that needs no model does not make every initialization step local to your machine.

Choose the tool for the job

ast-grep provides structural code search, linting and rewriting. Pick it when you need to find a syntax pattern or repeat a code transformation. Graft is the relevant trial when your goal is to make a repository map available to an assistant you already use. This is a comparison of documented purposes, not a performance comparison.

Aider is a terminal coding assistant with its own codebase map. Consider it when you are choosing the assistant as well as its context mechanism. If you intend to keep your existing agent, evaluate Graft's structural answers on a familiar change before adopting wider integration.

Alternatives

ProjectWhat it isPick it when
ast-grep gh↗A command-line tool for structural code search, linting and rewriting.Pick ast-grep when you need to find a syntax pattern or apply a repeatable rewrite.
Aider gh↗A terminal coding assistant that also maps your codebase.Consider Aider when you are choosing the coding assistant as well as its codebase context mechanism.

Sources

  1. Graft documentation at measured commit
  2. Current Trail-Code documentation
  3. ast-grep documentation
  4. Aider documentation

More ai tools reviews

ColossalAI · genoffice · hex · open-duet · drawio-skill · docker-android · the whole board →