Primary question: Do you need a local, tree-sitter-grounded GraphRAG layer that an LLM agent can query through MCP without you writing custom retrieval glue?
Evaluation snapshot
Verdict:
Try it if
Skip it if
15-minute evaluation checks
Verification scope
Test environment: Source-summary review only; no RepoDaily runtime environment recorded.
Verified
- Reviewed the repository claims and sources already captured in the RepoDaily Brief, including the documented local-first architecture and supported parsing surface.
- Normalized graphify into the local graph-retrieval scenario of the Code Intelligence pilot.
Not assessed
- RepoDaily has not installed graphify or completed an extract-and-query cycle on the pilot repository
- Parser coverage, graph accuracy, incremental freshness, artifact cleanup, and agent outcome improvements remain unverified
RepoDaily adoption score
RepoDaily rates this as 92/100 (strong) for adoption: evidence, installation path, production risk, differentiation, license clarity, and AI/agent fit are scored from the article sources and adoption notes.
6 source(s) across 4 source category/categories, plus a RepoDaily-specific evidence module when available.
6 workflow step(s), 5 next-action step(s), and 4 command/install signal(s) were detected.
Trending momentum is +937 stars, with maintenance/release/issue signals counted when present.
Risk is marked medium, with 7 security note(s) and 4 explicit skip condition(s).
3 opportunity lens item(s), 4 alternative(s), and 4 type-specific section(s) support differentiation.
License source or license wording is present.
9 AI/agent-related signal(s) were detected in the article text and metadata.
Project overview
graphify is a Python tool that ingests a folder of source code, SQL schemas, R scripts, shell scripts, documents, papers, images, and videos, then emits a queryable knowledge graph. The PyPI package is published under the name graphifyy at version 0.1.14, with the user-facing command remaining graphify. The project is positioned as a skill for AI coding assistants including Claude Code, Codex, OpenCode, Cursor, and Gemini CLI, and it can also run as a Model Context Protocol server over stdio or, when built from source with the mcp extra, over Streamable HTTP.
What separates graphify from a generic RAG wrapper is its parsing pipeline. It uses tree-sitter grammars for Python, JavaScript, TypeScript, Go, Rust, Java, C, C++, Ruby, C#, Kotlin, Scala, and PHP to extract real call and import edges from ASTs rather than chunking files by text. On top of the syntax graph it runs graspologic with Leiden community detection to cluster related nodes, and an optional LLM pass adds semantic concepts that are not visible in the AST (for example, a project-level idea the model attributes to the whole repository). The result is a graph.json file that downstream agents can query with natural-language terms.
The project is explicit about being a local development tool. Its SECURITY.md states that graphify makes no network calls during graph analysis, only during the explicit ingest subcommand when a user provides a URL. It does not execute code from source files (tree-sitter parses ASTs with no eval or exec), it never uses shell=True in subprocess calls, and it stores no credentials or API keys. For teams that cannot send proprietary source through a hosted retrieval API, that posture is the central value proposition.
Maturity is the main caveat. The package is still at 0.1.x, which the SECURITY.md lists as the only supported version line, and the CHANGELOG shows active churn in core pieces of the pipeline including the seed-selection logic for natural-language queries, the TS/JS and C# member-call resolvers, the Obsidian canvas exporter, and the extractor that reconciles deleted files during update and watch runs. The direction is coherent, but the surface is still moving.
Why it is trending now
- 937 period stars and a rank-7 trend slot on 2026-07-04, driven by demand for MCP-native skills rather than prompt-only assistants.
- Ships a real syntax graph: 13 tree-sitter grammars plus graspologic Leiden clustering, which most skill-style repos do not.
- Runs as a Claude Code skill and as a local MCP stdio server, with a Dockerfile path for an HTTP transport when built from source with the mcp extra.
- Optional backends keep it flexible: neo4j for graph storage, pypdf plus html2text for PDF ingestion, and watchdog for live filesystem updates.
- Exports to Obsidian canvas and knowledge-graph formats, which gives human reviewers a way to inspect what the agent is actually querying.
Problem it solves
- LLM coding agents lose structural context in large repositories and tend to flatten call graphs into bag-of-text chunks.
- Naive RAG pipelines split files by character count and discard import, call, and receiver-type relationships that matter for impact analysis.
- Hosted code-graph services require sending proprietary source across the network, which is blocked for many enterprise repos.
- Local grep-and-ripgrep MCP servers do not understand language semantics, so they cannot answer questions like which method a typed receiver calls.
- Multi-modal inputs (PDFs, papers, images, videos) rarely share a single query surface with source code, forcing teams to maintain separate indexes.
How it works
- Install and run: the package is graphifyy on PyPI, the binary is graphify, and requires-python is set to >=3.10 in pyproject.toml.
- Extract: graphify extract walks the target folder, parses each supported language with its tree-sitter grammar, and builds a networkx graph of call and import edges.
- Cluster: graspropic runs Leiden community detection to group related nodes, and an optional LLM pass adds semantic concepts that the AST cannot see.
- Query: graphify query performs per-term BFS seed selection against the graph, with a recent fix in _pick_seeds that stops one exact-match term from starving out other query terms.
- Serve: graphify serve exposes the graph as an MCP server. Over stdio it makes no network listener; over HTTP (via the Dockerfile path) it requires an API key and binds to a configurable host.
- Export: graphify export obsidian writes graph.json into Obsidian canvas and knowledge-graph files, with a recent fix that filters dangling community members in both to_obsidian and to_canvas.
Integration surface: where graphify plugs in
- Claude Code skill: the package ships a skill.md file (declared in pyproject.toml under tool.setuptools.package-data) that Claude Code loads directly.
- MCP stdio server: graphify serve with the default transport communicates over stdio only and opens no network listener, per SECURITY.md.
- MCP HTTP server: the Dockerfile builds from python:3.12-slim, installs the mcp extra (which pulls mcp, starlette, and uvicorn), and runs python -m graphify.serve with --transport http and a configurable --api-key.
- Optional Neo4j backend: the neo4j extra lets you persist the graph in Neo4j instead of (or alongside) the local graph.json.
- Optional PDF and watch extras: pypdf plus html2text handle local PDF ingestion, and watchdog powers live update and watch modes without network calls.
Try-it path: concrete commands from the source pack
- Local skill install: pip install graphifyy (PyPI name has a double y) on Python 3.10 or newer, then run the graphify command.
- All-in install for power features: pip install graphifyy[all] to pull mcp, neo4j, pypdf, html2text, and watchdog in one step.
- Single-shot analysis: graphify extract <folder> then graphify query "<natural language question>".
- Live editing loop: graphify watch to keep graph.json in sync as files change; a recent fix reconciles extractor-backed sources against files still present after deletions.
- Containerized HTTP server: docker build -t graphify . then docker run -p 8080:8080 -v "$(pwd)/graphify-out:/data" graphify /data/graph.json --transport http --host 0.0.0.0 --api-key "$SECRET".
Maintenance risk: what the CHANGELOG reveals
The CHANGELOG shows a tool under active hardening rather than a stable 1.0. Recent unreleased entries fix a crash in graphify export obsidian where a community member id with no backing node raised KeyError inside to_canvas (#1236 follow-up), extend the TS/JS member-call resolver to handle const s = new Svc(); s.doThing() and typed-parameter calls inside returned closures (#1630), and add a C# receiver-typed member-call resolver so recv.Method() resolves to the receiver type's method instead of matching any same-named method in the corpus (#1609).
Two of the fixes address correctness rather than polish. The BFS seed diversity fix (#1596 / #1445) prevents a single exact-label match from hijacking multi-term queries, which previously collapsed exploration to one unrelated neighborhood. The extract crash fix (#1618) handles a node whose source_file equals the scan root and previously raised ValueError: '.' has an empty name after all LLM extraction cost had already been spent. Neither is marked as a 0.9.5 regression, but both indicate that edge cases in real corpora are still being discovered.
Architecture read: parsing, clustering, and serving
The pipeline has three distinct layers. The parse layer is tree-sitter, with byte slices decoded using errors="replace" so non-UTF-8 source files degrade gracefully instead of crashing extraction. The graph layer is networkx plus graspologic, where Leiden community detection groups nodes and an optional LLM pass adds semantic concepts; the semantic remap logic (_semantic_id_remap) skips nodes whose source_file equals the scan root because they have no per-file identity to remap.
The serve layer is where the security model lives. _load_graph in serve.py wraps json.JSONDecodeError and prints a recovery message instead of crashing on a corrupted graph.json. security.validate_url limits fetches to http and https schemes and a custom _NoFileRedirectHandler blocks file:// redirects. safe_fetch streams responses and aborts at 50 MB, while safe_fetch_text aborts at 10 MB. For the MCP surface, security.validate_graph_path resolves paths and requires them inside graphify-out/, and security.sanitize_label strips control characters, caps labels at 256 characters, HTML-escapes node labels and edge titles before pyvis embeds them, and is also applied to MCP text output so that node labels from user-controlled source files cannot break the format returned to agents.
Who should pay attention?
Good fit if
- Teams using Claude Code or another MCP-capable assistant on a private monorepo who cannot use a hosted code-graph SaaS.
- Polyglot repositories spanning Python, TypeScript, Go, Rust, Java, C#, Kotlin, Scala, PHP, Ruby, C, or C++.
- Knowledge-management setups that want to query code, SQL schemas, R scripts, PDFs, papers, and images from one graph.
- Anyone who wants a human-inspectable export via Obsidian canvas alongside the machine-queryable MCP surface.
Skip for now if
- Single-language, single-file scripts where grep already answers every question.
- Environments locked to Python older than 3.10, since requires-python is set to >=3.10.
- Teams that need a stable 1.0 API contract before building internal tooling on top of the graph.json format.
- Use cases that require a managed cloud control plane; graphify is deliberately local-first and ships no hosted tier.
Risks and cautions
The security model is unusually explicit for a 0.1.x tool, but the core pipeline is still being hardened against real-world corpus edge cases.
- Version is 0.1.14 and SECURITY.md only lists 0.1.x as supported, so the graph.json format and CLI surface can still change.
- Recent fixes touch correctness-critical paths including BFS seed selection, TS/JS and C# member-call resolution, and extract-time crash handling.
- The HTTP MCP transport requires you to supply and manage an API key and to bind a host correctly; misconfiguration exposes the graph.
- Optional extras (neo4j, mcp, pypdf, html2text, watchdog) are installed separately, so behavior depends on which extras a user actually pulls.
- No network calls during graph analysis; the only optional network path is the explicit ingest subcommand fetching a user-provided URL.
- URL fetching is locked to http and https schemes, and a custom redirect handler blocks file:// targets.
- Download caps: safe_fetch aborts at 50 MB and safe_fetch_text aborts at 10 MB; non-2xx responses raise HTTPError instead of being treated as content.
- MCP path validation requires graph paths to resolve inside graphify-out/ and requires that directory to exist, blocking traversal.
- sanitize_label strips control characters, caps labels at 256 characters, HTML-escapes labels and edge titles before pyvis embeds them, and is also applied to MCP text output to resist prompt injection from node labels.
- tree-sitter byte slices decode with errors="replace" so non-UTF-8 source degrades gracefully; os.walk is called with followlinks=False throughout detect.py.
- No eval or exec of source files, no shell=True in subprocess calls, and no storage of credentials or API keys.
Alternatives to compare
| Approach | When to use | Trade-off |
|---|---|---|
Microsoft GraphRAG | When you want a research-grade GraphRAG pipeline tuned for documents and are comfortable with a heavier LLM-driven extraction step. | Open source (MIT) but LLM extraction costs are significant at scale. |
LlamaIndex | When you need a broad indexing and retrieval framework with many data loaders and want to bolt on a graph store. | Open source (MIT); you pay for the embedding and LLM calls you configure. |
LangChain | When retrieval is one piece of a larger agent orchestration and you want a general-purpose chain and tool abstraction. | Open source (MIT); LLM and embedding costs depend on your provider. |
Sourcegraph Cody / Code Search | When you want a managed, web-scale code search and AI assistant and can send source to a hosted or self-hosted enterprise instance. | Commercial product with a self-hosted enterprise tier. |
What this trend reveals
Replace ad-hoc retrieval in internal coding agents
Teams building internal agents on top of Claude Code, Codex, or a custom MCP client can swap hand-rolled grep-and-embed retrieval for graphify's tree-sitter plus Leiden graph and get impact-aware answers out of the box.
Run graphify extract on one representative service, then ask the agent an affected-style question such as which callers break if a given method signature changes. Compare against your current retrieval path on the same query.
Mixed-media knowledge bases for research teams
Because the ingest path accepts code, SQL schemas, R scripts, PDFs, papers, images, and videos, research teams can point graphify at a project folder that mixes analysis scripts with PDF references and query the combined graph from one MCP client.
Point graphify at a folder that contains both an R analysis script and a PDF paper it references, extract, and confirm the query surface returns nodes from both modalities.
Obsidian-powered code review
The Obsidian canvas and knowledge-graph export gives reviewers a visual map of communities and call edges, which is useful for architecture reviews on unfamiliar repos.
Export a mid-size service to Obsidian using graphify export obsidian and check that community boxes correspond to meaningful subsystems rather than random clusters.
RepoDaily verdict
graphify is the rare skill-style repo that ships a real syntax-aware graph instead of a prompt wrapper. Its tree-sitter-plus-Leiden pipeline, explicit local-first security model, and MCP surface make it a credible retrieval layer for Claude Code and other MCP-capable assistants, provided you accept that the 0.1.x pipeline is still being hardened and that the HTTP transport needs careful key and host management.