The useful part is a local code graph your agent can query
Graft parses a repository into linked files that describe symbols, imports, calls, directories, and likely areas of impact. The structural layer uses tree-sitter and stays on the machine. Commands such as graft ask, graft callers, graft skeleton, graft grep, and graft map let an agent request a narrow slice instead of opening files until it stumbles onto the right subsystem. The generated graph is a cache under graft/, and the tool adds that directory to .gitignore by default.
The pitch is credible because the output is ordinary data rather than a service you must keep running. There is no vector database or daemon for the default path. A query checks the working tree and refreshes changed structural data before answering. Graft also exposes 6 MCP tools for finding code, reading a file's API, tracing calls, searching all matches, mapping a repository, and checking freshness. That makes it useful beside an existing coding agent without forcing a replacement editor.
Twenty-two languages get unequal levels of code understanding
The README lists 22 languages, but support has tiers. TypeScript, JavaScript, Python, Go, Java, and R receive hand-written extraction with cross-file call and import resolution. Rust, C, C++, C#, Ruby, PHP, Kotlin, Scala, Swift, Elixir, Solidity, OCaml, Zig, Dart, Clojure, and Lua use a broader generic extractor. Optional language servers can add more precise edges for Rust, C and C++, Go, Python, and TypeScript or JavaScript.
That distinction matters more than the total. A symbol appearing in the graph does not prove every call edge is resolved with compiler accuracy. Unsupported files are skipped, according to the README. Open issue 236 also shows a narrower integration defect: with Graft 0.13.0, a clean Vue build was followed by graft check reporting every .vue node as removed. Retrieval still worked in the report, but the freshness command could not serve as a reliable CI gate for that repository.
What happened when we ran it
Our sandbox installed Graft at commit d92f856 in 20 seconds. Npm added 86 packages, and the installed tree occupied 349 MB. The source checkout itself contained 283 files, about 44,181 lines of source, and used 43.9 MB. Installation completed without an error, which is a better first impression than many tools that expect a globally prepared developer machine.
The build passed in 8 seconds. Node's test runner then completed in 73 seconds with 938 passed and 0 failed out of 938. Npm audit reported 0 known vulnerabilities across critical, high, moderate, and low severities. The repository also contained 6 CI workflow files, a Dockerfile, and a tests directory. These results cover the supplied commit in our fresh Debian container with 3 CPUs, 8 GB of RAM, no secrets, and no privileged access.
Deep explanations require a provider key and expose more code
A plain structural build costs no model tokens and needs no network call. graft build --deep changes that boundary. It sends file content through the provider and model you select, then caches model-written summaries, concept nodes, and per-symbol explanations. Supported routes include Anthropic and OpenAI-compatible services such as OpenRouter, Fireworks, Groq, a LiteLLM proxy, or a local endpoint. Teams with confidential code need to judge the chosen provider's terms and deployment before enabling this layer.
Provider compatibility is still a practical fault line. Open issue 235 reports that version 0.13.0 repeatedly stopped a deep build against DeepSeek V4 Flash through Together after reaching 2,047 of 2,133 symbol summaries. The structural graph remained clean in that report. This is a good reason to treat deep enrichment as optional: the local map can still be useful when a model returns an empty or unusable response.
Init can write outside the repository, so preview it first
graft init detects supported agents and offers to write their native instruction files. Claude Code receives a project skill, MCP registration, status line, and hooks. Codex integration may edit AGENTS.md, ~/.codex/config.toml, ~/.codex/hooks.json, and a hook shim under the user's Codex directory. Those user-level settings apply beyond the current repository. The README documents --dry-run to list changes and --no-global to keep writes inside the project.
Noninteractive use is safer by default: without a terminal prompt, init writes nothing unless you pass an explicit agent list or --yes. Even so, a team should review the generated instructions before committing them. Graft's local cache stays ignored, while selected wiring files are meant to be shared. That separation is sensible, but it adds agent policy to the repository and can affect every developer after checkout.
Current issues put Node 20 and huge monorepos on the trial list
GitHub showed 4,948 stars, 81 combined issues and pull requests, and a last push on August 25, 2026. The repository has no GitHub release returned by the latest-release endpoint, though its tags include v0.13.0. Activity is plainly current. The size of the open queue and the project's July 2026 creation date also suggest fast change, so pin the npm version and read upgrade notes before putting generated context into a required workflow.
Open issue 234 says the package declares Node 20 or newer while direct dependency Commander 15 requires Node 22.12 or newer. Issue 122 documents a Graft 0.10.1 run that exhausted memory near 2,900 of 3,294 parseable files, although smaller scoped builds succeeded. Neither report cancels our clean 938-test result. They define where that result stops answering the adoption question: older runtimes, Vue checks, provider-specific deep builds, and very large repositories need their own proof.
Graft earns a trial because the structural path is local, inspectable, and useful before any model call. Start with one representative repository, compare agent file reads on real work, and keep the graph advisory until freshness checks pass in CI. If the map saves repeated exploration without confusing the agent, the 20-second install was cheap evidence. If it does not, removing a generated cache and a small set of reviewed wiring files is a manageable exit.