arbor
Arbor
Graph-native intelligence for codebases.
Know what breaks before you break it.
Table of Contents
Related MCP server: CodeGraph CLI MCP Server
The Arbor Philosophy
Arbor is rooted in three unwavering principles, listed in strict order of priority. Every architectural decision is measured against this hierarchy:
Consumer First: Tooling must be beautiful, intuitive, and instantly useful out of the box. The developer experience triumphs over all other metrics.
Accessibility Second: Deep AI intelligence and graph analysis should never be gatekept. Our tooling is built to work seamlessly across language ecosystems and run deterministically on any machine.
Affordability Next: We ruthlessly optimize for minimal computational overhead. From edge laptops to giant monoliths, graph exploration should have zero-friction adoption.
For comprehensive details on our approach, read our PHILOSOPHY.md.
Why Arbor
Most AI code tooling treats code as text retrieval.
Arbor builds a semantic dependency graph and answers execution-aware questions:
If I change this symbol, what breaks?
Who calls this function, directly and transitively?
What is the shortest architectural path between these two nodes?
You get deterministic, explainable impact analysis instead of approximate keyword matches.
What you get
Blast radius analysis: See exactly which files and modules will be affected by a change (complete with depth confidence levels) before you ever press save.
Graph-backed symbol resolution: Accurately tracks dependencies across files and entire language boundaries automatically.
Agent-native MCP (v2.1.0): 10 MCP tools — surgical traversal (
get_callers,get_callees,list_entry_points,search_symbols,get_file_graph,get_node_detail) plus broad analysis tools, all returning asuggested_next_toolhint for zero-reprompt agent chaining.Unified Tooling (CLI + GUI + MCP): Native desktop GUI, a blazing fast CLI, and Claude/AI Model Context Protocol integration all utilizing the exact same core analytical reasoning engine.
Git-aware risk gating: Block pull-requests automatically in your CI/CD if a PR introduces a dangerously high architectural blast radius.
Lightning fast incremental indexing: Sub-second background cache updates instantly tracking your code edits in real-time.
Visual tour
For a full-screen recording of the workflow, see media/recording-2026-01-13.mp4.
Quickstart
# 1) Install the Arbor CLI globally via Cargo
cargo install arbor-graph-cli
# 2) Initialize Arbor and build the dependency graph for your codebase
cd your-project
arbor setup
# 3) See EVERYTHING a function touches before you break it
arbor refactor <symbol-name>
# 4) Run safety checks (Great for CI/CD or before committing)
arbor diff # See what your uncommitted git changes impact
arbor check --max-blast-radius 30 # Fail the checks if your changes break more than 30 nodes
# 5) Launch the visual interface to intuitively explore your code's architecture
arbor guiInstallation options
Use whichever channel fits your environment:
# Rust / Cargo
cargo install arbor-graph-cli
# Homebrew (macOS/Linux)
brew install Anandb71/tap/arbor
# Scoop (Windows)
scoop bucket add arbor https://github.com/Anandb71/arbor
scoop install arbor
# npm wrapper (cross-platform)
npx @anandb71/arbor-cli
# Docker
docker pull ghcr.io/anandb71/arbor:latestNo-Rust installers:
macOS/Linux:
curl -fsSL https://raw.githubusercontent.com/Anandb71/arbor/main/scripts/install.sh | bashWindows PowerShell:
irm https://raw.githubusercontent.com/Anandb71/arbor/main/scripts/install.ps1 | iex
For pinned/versioned installs, see docs/INSTALL.md.
MCP integration
Arbor includes a real MCP server via arbor bridge (stdio transport). v2.1.0 adds 10 tools — 6 surgical tools for precise graph traversal and 4 broad tools for architectural analysis.
Claude Code quick install
claude mcp add --transport stdio --scope project arbor -- arbor bridge
claude mcp listAvailable tools
Surgical (v2.1.0): list_entry_points · get_callers · get_callees · search_symbols · get_file_graph · get_node_detail
Broad: get_logic_path · analyze_impact · find_path · get_knowledge_path
All tools return a standard envelope with suggested_next_tool + suggested_next_args so agents can chain calls without re-prompting.
Multi-client setup
Full guide: docs/MCP_INTEGRATION.md
Ready templates:
templates/mcp/Bootstrap scripts:
scripts/setup-mcp.shscripts/setup-mcp.ps1
Registry verification (authoritative)
Registry name:
io.github.Anandb71/arborOfficial API lookup: https://registry.modelcontextprotocol.io/v0.1/servers?search=io.github.Anandb71/arbor
github.com/mcp search UI may lag indexing. Use the official registry API lookup above as source of truth.
Language support
Arbor supports production parsing and graph analysis across major ecosystems:
Rust
TypeScript / JavaScript
Python
Go
Java
C / C++
C# (Native Tree-sitter)
Dart
Kotlin (fallback parser)
Swift (fallback parser)
Ruby (fallback parser)
PHP (fallback parser)
Shell (fallback parser)
Detailed parser notes and expansion guidance:
Architecture and docs
Start here when you need deeper internals:
Git-aware CI workflows
Arbor supports pre-merge risk checks and change gating:
arbor diff
arbor check --max-blast-radius 30
arbor open <symbol>Use the repository GitHub Action for CI integration:
name: Arbor Check
on: [pull_request]
jobs:
arbor:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: Anandb71/arbor@v2.0.1
with:
command: check . --max-blast-radius 30Release channels
Automated release distribution includes:
GitHub Releases (platform binaries)
crates.io
GHCR container images
npm wrapper package
VS Code Marketplace / Open VSX extension channels
Homebrew + Scoop
Runbook: docs/RELEASING.md
Contributing
Contributions are welcome.
Start with: CONTRIBUTING.md
Code of conduct: CODE_OF_CONDUCT.md
Security policy: SECURITY.md
Good first tasks: docs/GOOD_FIRST_ISSUES.md
For local development:
cargo build --workspace
cargo test --workspaceContributors
Security
Arbor is local-first by design:
No mandatory data exfiltration
Offline-capable workflows
Open-source code paths
Report vulnerabilities via SECURITY.md.
License
MIT — see LICENSE.
Available Tools
2 toolsanalyze_impactC
Analyzes the impact (blast radius) of changing a specific node.
| Name | Required | Description | Default |
|---|---|---|---|
| node_id | Yes | ID or name of the node to analyze |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions analyzing impact but doesn't specify what the analysis entails (e.g., computational cost, side effects, permissions required, or output format). This leaves significant gaps in understanding the tool's behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that directly states the tool's purpose without any fluff or redundancy. It is appropriately sized and front-loaded, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of impact analysis, no annotations, and no output schema, the description is incomplete. It doesn't explain what 'blast radius' entails, the nature of the analysis, or what results to expect, leaving the agent with insufficient context for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, with 'node_id' documented as 'ID or name of the node to analyze'. The description adds no additional parameter semantics beyond this, so it meets the baseline of 3 for high schema coverage without extra value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Analyzes the impact (blast radius) of changing a specific node.' It specifies the verb ('analyzes') and resource ('impact of changing a specific node'), though it doesn't explicitly differentiate from the sibling tool 'get_logic_path' (which might retrieve paths rather than analyze impact).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives, such as the sibling tool 'get_logic_path'. It lacks context on prerequisites, scenarios where this analysis is needed, or any exclusions, leaving the agent without usage direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_logic_pathC
Traces the call graph to find dependencies and usage of a function or class.
| Name | Required | Description | Default |
|---|---|---|---|
| start_node | Yes | Name of the function or class to trace |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions tracing and finding dependencies/usage, which suggests a read-only analysis operation, but doesn't clarify if it's safe, has side effects, requires permissions, or details output format (e.g., graph structure, depth limits). This leaves significant gaps for a tool with potential complexity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that directly states the tool's purpose without unnecessary words. It's appropriately sized and front-loaded, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations and no output schema, the description is incomplete for a tool that traces call graphs. It lacks details on behavioral traits (e.g., safety, performance), output format, or how it differs from siblings, making it inadequate for an agent to fully understand usage without additional context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, clearly documenting the single parameter 'start_node'. The description adds context by specifying it traces 'dependencies and usage of a function or class', which aligns with the schema but doesn't provide additional syntax or format details beyond what's already covered.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with specific verbs ('traces', 'find') and resources ('call graph', 'dependencies and usage', 'function or class'), making it easy to understand what it does. However, it doesn't explicitly differentiate from its sibling tool 'analyze_impact', which might have overlapping or related functionality.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus its sibling 'analyze_impact' or any alternatives. It implies usage for tracing dependencies and usage, but lacks explicit context, prerequisites, or exclusions, leaving the agent to infer appropriate scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
2 tool updates
v1.0.0- First observed
analyze_impact - First observed
get_logic_path
TDQS
The two tools have clearly distinct purposes: analyze_impact focuses on assessing the blast radius of a node change, while get_logic_path traces dependencies and usage in a call graph. There is no overlap or ambiguity between these functions.
Both tools follow a consistent verb_noun pattern (analyze_impact, get_logic_path) with clear, descriptive names. The naming style is uniform and predictable across the set.
With only two tools, the server feels thin for a domain like code or system analysis, where more operations (e.g., for managing nodes, viewing graphs, or updating logic) might be expected. This limited set could hinder agent workflows.
Inferring a domain of code or system dependency analysis, the toolset is severely incomplete. It lacks basic CRUD operations (e.g., create, update, delete nodes) and essential functions like listing or searching dependencies, leaving significant gaps for agent tasks.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Code intelligence platform for AI agents. 20 tools for architecture, security & impact analysis.
AI-powered codebase analysis — call graphs, security, dead code, complexity. 150+ tools.
AI Agent with Architectural Memory. Impact analysis (free), tests and code from the graph (pro).
Deterministic context layer for your codebase: change impact, blast radius, answers with receipts.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceAn intelligent server that provides semantic code search, domain-driven analysis, and advanced code understanding for large codebases using LLMs and vector embeddings.11MIT
- FlicenseNot gradedqualityFmaintenanceA high-performance CLI tool that provides semantic code search, advanced architectural analysis, and codebase indexing with vector embeddings across multiple programming languages. Enables AI assistants to understand and navigate large codebases through graph-based relationships and intelligent code pattern detection.872-
- AlicenseAqualityAmaintenanceA local-first codebase intelligence tool that enables AI assistants to research codebases using semantic search, multi-hop relationship discovery, and structural parsing. It allows users to extract architectural patterns and institutional knowledge across 30+ programming languages through an MCP-compatible interface.21,428MIT
- AlicenseNot gradedqualityCmaintenanceA graph-powered code intelligence engine that indexes codebases into a structural knowledge graph to provide AI agents with deep context on function calls, types, and execution flows. It offers local, zero-dependency tools for hybrid search, impact analysis, and dead code detection across Python, JavaScript, and TypeScript projects.808MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/getArbor-dev/arbor'
If you have feedback or need assistance with the MCP directory API, please join our Discord server