Primary question: Does the blast-radius context your editor receives match the actual risk surface of your change, or does it still pull in unrelated files?
Evaluation snapshot
Verdict:
Try it if
Skip it if
15-minute evaluation checks
Verification scope
Test environment: Documentation and source-artifact review only; no normalized RepoDaily runtime test completed.
Verified
- Reviewed the repository documentation, architecture diagrams, benchmark presentation, local SQLite storage model, and MCP/CLI integration claims captured by the Brief.
- Confirmed that project-provided benchmark claims remain project evidence and have not yet been reproduced by RepoDaily.
Not assessed
- RepoDaily has not yet installed the tool or rebuilt its graph on the shared pilot repository
- Cross-language parser coverage, benchmark transferability, stale-index recovery, and measured reviewer outcomes remain unverified
RepoDaily adoption score
RepoDaily rates this as 94/100 (strong) for adoption: evidence, installation path, production risk, differentiation, license clarity, and AI/agent fit are scored from the article sources and adoption notes.
6 source(s) across 3 source category/categories, plus a RepoDaily-specific evidence module when available.
6 workflow step(s), 5 next-action step(s), and 5 command/install signal(s) were detected.
Trending momentum is +356 stars, with maintenance/release/issue signals counted when present.
Risk is marked low, with 8 security note(s) and 4 explicit skip condition(s).
3 opportunity lens item(s), 4 alternative(s), and 4 type-specific section(s) support differentiation.
License source or license wording is present.
7 AI/agent-related signal(s) were detected in the article text and metadata.
Project overview
code-review-graph is a local-first code intelligence layer that parses a repository with Tree-sitter, stores the resulting call and import graph in a local SQLite database at .code-review-graph/graph.db, and exposes that graph to AI coding tools through Model Context Protocol (MCP) tools. The goal is to let assistants like Claude Code, Cursor, Codex, Gemini CLI, Continue, Windsurf, and Zed read only the files that are actually affected by a change, rather than re-reading large parts of the codebase on every review task.
The project ships as a Python 3.10+ package on PyPI under the MIT License (Copyright 2026 Tirth Kanani). A single `code-review-graph install` command auto-detects which AI coding tools are present, writes the correct MCP configuration for each one, installs platform-native hooks or skills where supported, and injects graph-aware instructions into platform rules. `code-review-graph build` then parses the codebase into the persistent SQLite graph.
Version 2.3.7, released on 2026-07-18 as a maintainer-reconciliation release, packages verified work merged since v2.3.6. It adds broader language coverage (Terraform/OpenTofu, Ansible, VB.NET, expanded SystemVerilog, corrected Rust trait identity, Java and Spring modeling, PHP/Laravel, Julia, and C# inheritance edges), ten focused graph commands, bounded enrichment, dead-code analysis, weighted impact-radius ranking, graph provenance on MCP responses, and the final CodeQL security fixes. The release notes state there are no breaking changes.
The security model is explicit and unusually well-documented for a tool in this category. The README and SECURITY.md state that code-review-graph makes no network calls during normal graph and review workflows, only reads source files within the validated repository root, and stores all data locally in SQLite. Optional cloud embeddings require explicit configuration with OpenAI-compatible, Google Gemini, or MiniMax providers and emit an egress warning unless CRG_ACCEPT_CLOUD_EMBEDDINGS=1 is set.
Why it is trending now
- Released v2.3.7 on 2026-07-18 with substantial language and framework expansion (Terraform/OpenTofu, Ansible, VB.NET, SystemVerilog, Rust trait fixes, Java/Spring, PHP/Laravel, Julia, C#) — directly relevant to developers working across polyglot repositories.
- Auto-detects and configures 14+ MCP-compatible platforms in a single install command, including Codex, Claude Code, CodeBuddy Code, Cursor, Windsurf, Zed, Continue, OpenCode, Antigravity, Gemini CLI, Qwen, Qoder, Kiro, and GitHub Copilot.
- Persistent SQLite graph at .code-review-graph/graph.db enables incremental updates: the README diagram shows a hook or watch update re-parsing only 5 files while 2,910 are skipped.
- Security posture is concrete: parameterized SQL placeholders, _validate_repo_root() path traversal guard, _sanitize_name() prompt-injection mitigation, no shell=True in subprocess calls, dependencies pinned with upper bounds, SHA256 hashes in uv.lock, and D3.js loaded with Subresource Integrity.
- Benchmark board in the README reports a median ~82x per-question token reduction across six real repositories, with a 528x maximum and 0.71 average impact F1 against graph-derived ground truth.
Problem it solves
- AI coding tools re-read large parts of a codebase on review tasks, consuming tokens and context window capacity that scale with repository size rather than with the actual change.
- Without a persistent structural graph, assistants lack reliable blast-radius information and may miss dependent files that a change actually touches.
- Existing static-analysis tools often do not expose their results through MCP, so they cannot feed context directly into the assistants developers already use.
- Cross-language repositories (Python, JavaScript, Java, Go, Rust, C#, PHP, Terraform, Ansible) require parsers that understand each language's import and call semantics to build a useful graph.
How it works
- Install with `pip install code-review-graph` (or `pipx install code-review-graph`) and run `code-review-graph install` to auto-detect and configure every supported AI coding platform, writing MCP configuration and platform-native hooks.
- Run `code-review-graph build`, which invokes the Tree-sitter multi-language parser (code_review_graph/parser.py) to extract class, function, import, and call nodes from the repository root.
- The parser writes the extracted structure into a SQLite database at .code-review-graph/graph.db, managed by code_review_graph/graph.py, forming the persistent call and import graph.
- When a file changes, code_review_graph/incremental.py computes the git diff, finds dependents of the changed nodes, and re-parses only the affected files instead of the full repository.
- MCP tool implementations in code_review_graph/tools/ expose graph queries — blast radius, risk scores, dead-code, impact-radius ranking — to connected AI assistants over stdio or localhost-bound streamable HTTP.
- The assistant queries MCP tools for the minimal affected file set and risk scores, reads only those files, and returns a review bounded to the actual change surface.
Product demo and interface preview
Architecture read: how the pieces fit
- code_review_graph/parser.py — Tree-sitter multi-language parser; EXTENSION_TO_LANGUAGE mapping plus _CLASS_TYPES, _FUNCTION_TYPES, _IMPORT_TYPES, _CALL_TYPES node-type registries.
- code_review_graph/graph.py — SQLite graph store; all queries use parameterized '?' placeholders per SECURITY.md.
- code_review_graph/tools/ — MCP tool implementations exposed to connected assistants.
- code_review_graph/incremental.py — Git diff plus file-watch logic for incremental updates.
- code_review_graph/embeddings.py — Vector embedding support; provider-and-model-scoped refresh is default-off and refuses silent provider/model/endpoint migration per the v2.3.7 changelog.
- code_review_graph/visualization.py — D3.js HTML generator; D3.js v7 loaded from d3js.org with SRI verification.
- code_review_graph/cli.py and code_review_graph/main.py — CLI entry point and MCP server entry point respectively.
Command surface
- `pip install code-review-graph` — install from PyPI.
- `code-review-graph install` — auto-detect and configure all supported AI coding platforms.
- `code-review-graph install --platform codex` — configure only Codex; same pattern works for cursor, claude-code, gemini-cli, and others.
- `code-review-graph build` — parse the codebase into the SQLite graph.
- `code-review-graph uninstall` — safe symmetric cleanup derived from live platform specifications (added in v2.3.7 per PR #482).
- `code-review-graph embed` — manual embedding; also purges orphan vectors for deleted or renamed nodes.
- v2.3.7 adds ten focused graph commands, quiet and JSON output, bounded enrichment, and dead-code analysis (PRs #95, #340, #341).
Integration surface: MCP and platform support
- MCP-compatible over stdio or localhost-bound streamable HTTP, per the SECURITY.md threat surface description.
- Auto-detected platforms per the README diagram: Codex, Claude Code, CodeBuddy Code, Cursor, Windsurf, Zed, Continue, OpenCode, Antigravity, Gemini CLI, Qwen, Qoder, Kiro, and GitHub Copilot.
- CodeBuddy Code MCP configuration and project skills added in v2.3.7 using its official shared project contract (PR #633).
- Graph provenance is now attached to MCP responses (PR #646 in v2.3.7).
- Custom languages are supported by dropping a .code-review-graph/languages.toml mapping extensions and node types to any grammar in tree-sitter-language-pack.
Maintenance risk
- Only version 2.3.x is supported for security fixes per SECURITY.md; anything below 2.3 is unsupported.
- CI runs Bandit on every PR, Ruff for code quality, and mypy for type checking; Bandit exemptions are documented in pyproject.toml with per-skip justifications.
- Test coverage gate is 65 percent: `uv run pytest --cov=code_review_graph --cov-report=term-missing --cov-fail-under=65`.
- Dependencies are pinned with upper bounds and uv.lock carries SHA256 hashes.
- v2.3.7 explicitly excludes four client-validation drafts, signaling active curation of what enters the release.
Who should pay attention?
Good fit if
- You review changes in a polyglot repository (Python, JavaScript, Java, Go, Rust, C#, PHP, Terraform, Ansible) using an MCP-compatible editor and want bounded token usage.
- You maintain a repository large enough that assistants regularly re-read hundreds of files on a single review request.
- You need blast-radius and dead-code information fed directly into Claude Code, Cursor, Codex, or Gemini CLI without a separate dashboard.
- You want a local-only tool with no network calls during normal graph and review workflows.
Skip for now if
- Your repository is small enough that you can paste the relevant files into an assistant manually.
- Your editor or assistant does not support MCP and you have no plans to adopt one.
- You require a hosted or SaaS code intelligence platform with team-wide dashboards and RBAC.
- You need static analysis certifications (MISRA, DO-178C, CERT) rather than a graph for context reduction.
Risks and cautions
Local-only by default, MIT-licensed, single-command install, and SQLite-backed with documented security mitigations. Risk rises to medium only if you enable cloud embeddings.
- Normal graph and review workflows make no network calls; all data stays in a local SQLite database at .code-review-graph/graph.db.
- Optional cloud embeddings require explicit configuration and emit an egress warning unless CRG_ACCEPT_CLOUD_EMBEDDINGS=1 is set.
- Only version 2.3.x receives security fixes; users on older versions must upgrade.
- Adding a new built-in language requires touching parser.py node-type registries and adding fixture tests, which may deter contributors without Tree-sitter experience.
- SQL Injection: all queries use parameterized '?' placeholders.
- Path Traversal: _validate_repo_root() requires a .git, .svn, or .code-review-graph directory.
- Prompt Injection: _sanitize_name() strips control characters and caps names at 256 characters.
- XSS in visualization: escH() escapes HTML entities and </script> is escaped in JSON output.
- Subprocess Injection: no shell=True; all git commands use list arguments.
- Supply Chain: dependencies pinned with upper bounds; uv.lock carries SHA256 hashes.
- CDN Tampering: D3.js loaded with a Subresource Integrity (SRI) hash.
- API Key Leakage: cloud embedding credentials loaded only from environment or configuration, never hardcoded.
Alternatives to compare
| Approach | When to use | Trade-off |
|---|---|---|
aider | You want a terminal-first AI pair programmer that edits files directly rather than a context graph feeding an existing editor. | Free, open-source (Apache-2.0); bring your own API keys. |
Continue | You want an open-source IDE extension with its own codebase indexing and retrieval rather than a standalone MCP graph layer. | Free, open-source (Apache-2.0); cloud features billed separately. |
Sourcegraph Cody | You need enterprise-scale code search and code intelligence across many repositories with hosted infrastructure. | Free tier available; enterprise plans are commercial. |
Tree-sitter alone | You only need structural parsing and are willing to build your own context layer. | Free, open-source (MIT). |
What this trend reveals
MCP tool integrations for specialized workflows
code-review-graph exposes blast-radius, risk scores, and dead-code analysis through MCP tools. Teams with custom review checklists (security gates, compliance gates, architecture-governance gates) can build additional MCP tools on top of the SQLite graph without changing the parser.
Read code_review_graph/tools/ to see the existing MCP tool implementations and confirm the query surface the new tools would reuse.
Custom language support via languages.toml
Dropping a .code-review-graph/languages.toml file mapping extensions and node types to any grammar in tree-sitter-language-pack adds language support without contributing upstream. Teams with internal DSLs or niche languages can self-serve.
Follow docs/CUSTOM_LANGUAGES.md referenced in CONTRIBUTING.md and test with a small fixture file under tests/fixtures/.
Embeddings-based semantic retrieval on top of the graph
v2.3.7 adds provider-and-model-scoped embedding refresh on build, update, postprocess, and watch paths, default-off and fail-soft. Teams that want semantic search alongside structural blast radius can enable local sentence-transformers embeddings without forcing cloud egress.
Run `code-review-graph embed` on a representative repository and confirm the local model download path and fail-soft behavior described in the changelog.
RepoDaily verdict
code-review-graph is a focused, well-documented local-first layer that turns a repository into a SQLite structural graph and exposes precise blast-radius context to MCP-compatible AI coding tools. Its v2.3.7 release, concrete security mitigations, and broad platform auto-detection make it a practical pick for developers who want bounded token usage during reviews without adopting a hosted code intelligence platform.