Verified

Codebase Memory MCP Server

Repository indexing and structural code analysis for AI agents at high speeds.

Data last scanned yesterday · Reviewed yesterday

Overview

Codebase Memory MCP Server functions as an intelligence engine for AI agents, leveraging tree-sitter AST parsing to map complex codebase structures. It creates persistent knowledge graphs covering functions, classes, and call chains across 158 supported languages, including specialized Hybrid LSP resolution for major stacks like Python and TypeScript. Designed for rapid deployment, the server operates as a single static binary compatible with macOS, Linux, and Windows. By generating structured metadata, it allows AI coding agents to perform structural queries in under one millisecond, drastically reducing token consumption compared to traditional file-by-file exploration.

Our verdict

This project currently holds a security score of 58/100, resulting in a high risk classification. This is primarily due to the lack of external verification for its read-only mode, OAuth implementation, and authentication methods. While it offers impressive performance and zero-dependency architecture, users should exercise caution as these critical security surfaces have not yet been formally reviewed. It is suitable for research and local testing environments but requires careful consideration before deployment in sensitive production workflows.

Zero-dependency implementation in C
Supports 158 languages using tree-sitter
Indexes large repositories like the Linux kernel in minutes
Backing research documented in arXiv:2603.27277

Read-only mode support remains unreviewed
Authentication and OAuth methods are not verified
Community-maintained rather than vendor-official
High risk rating due to unverified security surfaces

Tools

Tool	Description	Risk
get_architecture	Returns languages, packages, entry points, routes, hotspots, boundaries, layers, and clusters.	low
manage_adr	Persists architectural decisions across sessions.	medium
detect_changes	Maps uncommitted changes to affected symbols with risk classification.	low
semantic_query	Performs vector search across the entire codebase graph.	low
search_graph	Performs structural search using regex name patterns, label filters, min/max degree, and file scoping.	low
search_code	Performs graph-augmented grep over indexed files only.	low
index_repository	Starts a temporary supervised worker to index a repository.	medium
list_projects	Lists available projects.	low
trace_path	Traces paths between symbols or locations in the codebase.	low
delete_project	Remove a project and all its graph data.	high

Compatibility

Client	Local	Docker	Remote	Read-only
ChatGPT
Claude Desktop
Cursor
VS Code
Windsurf

Frequently asked questions

›What operating systems are supported?

The server runs on macOS, Linux, and Windows as a single static binary.

›Does this tool require external dependencies or API keys?

No, the tool has zero dependencies and requires no runtime dependencies or API keys to function.

›How is code processed in terms of privacy?

All processing occurs 100% locally on your machine, and your code never leaves your local environment.

›Does the server modify any files?

The tool reads your codebase and writes to your agent configuration files as part of its intended operation.

›How can I access the built-in graph visualization?

You can view the 3D interactive knowledge graph at localhost:9749 if you use the UI-enabled binary variant.

›What languages are supported for code analysis?

The server supports 158 languages using built-in tree-sitter grammars, with additional Hybrid LSP semantic type resolution for 10 specific languages including Python, TypeScript, and Java.