code-review-graph

Local code graph that gives a coding assistant review context, blast radius and change risk.

By Tirth Kanani (individual) Python Local · stdio Developer toolsKnowledge and memory

103 popularity score ★ 33k ↓ 302k/mo

Connect your client

Local (PyPI)

Add in one click

Opens the app, which asks before it adds the server.

Or add it by command or config

Claude CodeTerminal
claude mcp add code-review-graph -- uvx code-review-graph serve
Claude Desktopclaude_desktop_config.json
{
  "mcpServers": {
    "code-review-graph": {
      "command": "uvx",
      "args": [
        "code-review-graph",
        "serve"
      ]
    }
  }
}
Cursor~/.cursor/mcp.json
{
  "mcpServers": {
    "code-review-graph": {
      "command": "uvx",
      "args": [
        "code-review-graph",
        "serve"
      ]
    }
  }
}
VS Code.vscode/mcp.json
{
  "servers": {
    "code-review-graph": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "code-review-graph",
        "serve"
      ]
    }
  }
}
Codex~/.codex/config.toml
[mcp_servers.code-review-graph]
command = "uvx"
args = ["code-review-graph", "serve"]
Gemini CLITerminal
gemini mcp add --scope user code-review-graph uvx -- code-review-graph serve

Settings 12

CRG_TOOLS Optional: Comma-separated list of tools to expose. The --tools flag wins over it, and all 30 are exposed when neither is set.
CRG_DATA_DIR Optional: Folder for the graph database and generated files, used as given instead of .code-review-graph/ in the repository.
CRG_REPO_ROOT Optional: Repository to serve, overriding detection from the working folder.
CRG_TOOL_TIMEOUT Optional: Seconds before a read tool call is cut off. 0 means no limit. Default 0.
CRG_RECURSE_SUBMODULES Optional: Set to 1 to index git submodules too. For build_or_update_graph_tool.
CRG_EMBEDDING_MODEL Optional: Model for local embeddings (needs the embeddings extra). For embed_graph_tool.
VOYAGE_API_KEY secret Optional: Key for Voyage embeddings. For embed_graph_tool.
GOOGLE_API_KEY secret Optional: Key for Gemini embeddings (needs the google-embeddings extra). For embed_graph_tool.
CRG_ACCEPT_CLOUD_EMBEDDINGS Optional: Set to 1 to silence the warning shown before code identifiers are sent to a cloud embeddings provider. For embed_graph_tool.
Set together: openai embeddings
CRG_OPENAI_API_KEY secret Optional: Key for an OpenAI-compatible embeddings endpoint. For embed_graph_tool.
CRG_OPENAI_BASE_URL Optional: Base URL of the OpenAI-compatible embeddings endpoint. For embed_graph_tool.
CRG_OPENAI_MODEL Optional: Embedding model name at that endpoint. For embed_graph_tool.

What it does

code-review-graph parses a repository with Tree-sitter into a graph of functions, classes, imports, calls, inheritance and tests, and stores it in a SQLite file. A coding assistant then asks the graph what a change touches and reads just those files, so it does not have to scan the repository again for every review.

There are 30 MCP tools and 5 prompts. The day-to-day ones answer the review questions: who calls this and what tests cover it, or how far a change spreads and how risky it is. Others look at the codebase as a whole. They find clusters of related code, the symbols everything depends on, links between clusters nobody expected, and long functions. A refactoring pair previews a rename and then applies it to your files. You can also generate a Markdown wiki or search several registered repositories at once.

You install it from PyPI and run code-review-graph install, which detects the coding tools on your machine and writes its MCP entry and hooks into each one. The server itself is code-review-graph serve over stdio, or over HTTP on localhost:5555 with --http. Semantic search works without embeddings, but it matches by meaning only after you add a local model through the embeddings extra or point it at a cloud embeddings provider.

Read tools have no time limit unless you set CRG_TOOL_TIMEOUT, which is 0 by default in main.py. The project's default branch is staging, and its README runs ahead of the 2.3.9 release. The Codex Skill under $CODEX_HOME/skills, the post-checkout, post-merge and post-rewrite hooks, and the removal of CRG_HOOK_WORKTREES are not in that release yet.

What it needs

RuntimePython 3.10+
Runs onmacOS, Windows, Linux

Install with pip install code-review-graph (or pipx), then run code-review-graph install in the project, or configure one client with --platform. The uvx launch command needs uv on PATH. Local semantic search needs pip install code-review-graph[embeddings], Gemini embeddings need the google-embeddings extra, and community detection uses the communities extra (igraph).

Limits

  • Limit Version 2.3.9 installs a pre-commit git hook only. The post-checkout, post-merge and post-rewrite hooks and the Codex Skill exist only on the staging branch.
  • Limit In 2.3.9, git hooks skip linked worktrees unless CRG_HOOK_WORKTREES=1 is set. The README on staging no longer mentions that setting.
  • Not covered Execution-flow detection works best for Python and PHP/Laravel. Its own README says JavaScript and Go flow detection still needs work.
  • Limit Impact analysis is conservative and flags files that may not really be affected, so large dependency graphs give false positives.
  • Limit For trivial single-file edits the graph context can cost more tokens than reading the file.
  • Limit Keyword search ranking is admitted to need work, and some queries return no hits because of module naming.
  • Size cap get_impact_radius_tool returns up to 500 results and detect_changes_tool 25 by default, each raised with max_results.

Who it suits

A fit for developers on medium or large repositories who review multi-file changes with an assistant and want it to see who calls the changed code before it reads code. Nothing leaves your machine unless you choose cloud embeddings. On small repositories or one-off questions the project itself says plain file reads are often enough. Note that the installer edits the config of every coding tool it detects, so pass --platform if you want to touch only one, and leave out apply_refactor_tool with CRG_TOOLS if the assistant should never edit files.

Tools 30

25 only read, 5 change things. A ? marks an optional parameter.

build_or_update_graph_tool changes
Builds the graph, or updates it for files changed since a git basefull_rebuild?: booleanrepo_root?: stringbase?: stringpostprocess?: stringrecurse_submodules?: booleanembedding_provider?: stringembedding_model?: string
run_postprocess_tool changes
Reruns flow detection, community detection and full-text indexing on the stored graphflows?: booleancommunities?: booleanfts?: booleanrepo_root?: stringembedding_provider?: stringembedding_model?: string
get_minimal_context_tool
Returns a very short summary of the graph and the current change, meant as the first calltask?: stringchanged_files?: arrayrepo_root?: stringbase?: string
get_impact_radius_tool
Lists the code reached from changed files, up to a hop depth (2 by default)changed_files?: arraymax_depth?: integermax_results?: integerrepo_root?: stringbase?: stringdetail_level?: stringresolution?: string
get_review_context_tool
Gathers changed code, its neighbours and source excerpts for a reviewchanged_files?: arraymax_depth?: integerinclude_source?: booleanmax_lines_per_file?: integerrepo_root?: stringbase?: stringdetail_level?: stringmax_results?: integermax_files?: integer
query_graph_tool
Answers one structural question about a symbol: callers, callees, tests, imports or inheritancepattern: stringtarget: stringrepo_root?: stringdetail_level?: stringmax_results?: integerresolution?: string
traverse_graph_tool
Walks the graph breadth-first or depth-first from a matching node within a token budgetquery: stringmode?: stringdepth?: integertoken_budget?: integerrepo_root?: string
semantic_search_nodes_tool
Finds functions, classes and files by name or, with embeddings, by meaningquery: stringkind?: stringlimit?: integerrepo_root?: stringmodel?: stringprovider?: stringdetail_level?: string
embed_graph_tool changes
Computes vector embeddings for the graph's nodes, locally or with a cloud providerrepo_root?: stringmodel?: stringprovider?: string
list_graph_stats_tool
Reports node and edge counts, languages and when the graph was last updatedrepo_root?: string
get_docs_section_tool
Returns one section of the project's own usage documentationsection_name: stringrepo_root?: string
find_large_functions_tool
Lists functions, classes or files longer than a line threshold (50 by default)min_lines?: integerkind?: stringfile_path_pattern?: stringlimit?: integerrepo_root?: string
list_flows_tool
Lists detected execution flows, ranked by criticality by defaultsort_by?: stringlimit?: integerkind?: stringdetail_level?: stringrepo_root?: string
get_flow_tool
Shows the steps of one execution flow, optionally with sourceflow_id?: integerflow_name?: stringinclude_source?: booleanrepo_root?: stringmax_steps?: integermax_source_lines?: integer
get_affected_flows_tool
Names the execution flows that pass through changed fileschanged_files?: arraybase?: stringrepo_root?: stringdetail_level?: stringmax_flows?: integer
list_communities_tool
Lists clusters of closely linked codesort_by?: stringmin_size?: integerdetail_level?: stringrepo_root?: stringmax_results?: integermax_members?: integer
get_community_tool
Shows one code cluster and, if asked, its memberscommunity_name?: stringcommunity_id?: integerinclude_members?: booleanrepo_root?: stringmax_members?: integer
get_architecture_overview_tool
Summarises the codebase layout from its clusters and the links between themrepo_root?: stringdetail_level?: stringmax_results?: integermax_members?: integer
detect_changes_tool
Scores the risk of the current change and names affected flows and untested codebase?: stringchanged_files?: arrayinclude_source?: booleanmax_depth?: integerrepo_root?: stringdetail_level?: stringmax_results?: integermax_flows?: integer
get_hub_nodes_tool
Lists the most connected symbolstop_n?: integerrepo_root?: stringdetail_level?: string
get_bridge_nodes_tool
Lists symbols that sit between clusters, ranked by betweenness centralitytop_n?: integerrepo_root?: stringdetail_level?: string
get_knowledge_gaps_tool
Points out isolated code, thin clusters and busy code without testsrepo_root?: stringmax_per_category?: integerdetail_level?: string
get_surprising_connections_tool
Finds links between clusters that look unexpectedtop_n?: integerrepo_root?: stringdetail_level?: string
get_suggested_questions_tool
Suggests review questions drawn from the graph analysisrepo_root?: string
refactor_tool
Previews a rename, finds dead code or suggests refactorings, without changing filesmode?: stringold_name?: stringnew_name?: stringkind?: stringfile_pattern?: stringrepo_root?: stringmax_results?: integerdetail_level?: string
apply_refactor_tool changes
Applies a rename previewed by refactor_tool to the source files, or shows the diff with dry_runrefactor_id: stringrepo_root?: stringdry_run?: booleanmax_diff_files?: integer
generate_wiki_tool changes
Writes a Markdown wiki, one page per cluster, to .code-review-graph/wiki/repo_root?: stringforce?: boolean
get_wiki_page_tool
Returns one generated wiki pagecommunity_name: stringrepo_root?: stringmax_chars?: integer
list_repos_tool
Lists repositories in the shared registry at ~/.code-review-graph/registry.json
cross_repo_search_tool
Searches symbols across registered repositories, optionally only those named in reposquery: stringkind?: stringlimit?: integermax_results?: integerrepos?: array

Prompts 5

review_changes
Pre-commit review using change detection, affected flows and test gaps
architecture_map
Architecture write-up from clusters and flows, with Mermaid diagrams
debug_issue
Guided debugging through search, flow tracing and recent changes
onboard_developer
Orientation for a newcomer from stats, architecture and critical flows
pre_merge_check
Readiness check with risk score, test gaps and dead code

Similar servers