The better-code-review-graph server builds and queries a knowledge graph of your codebase to enable token-efficient code reviews, semantic search, call-graph resolution, and security scanning.
Graph Management
Build a full or incremental code knowledge graph from your repository (14+ languages via Tree-sitter)
Update incrementally using git-diff (only re-parses changed files)
Embed code entities using local ONNX (zero config) or cloud providers (Jina, Gemini, OpenAI, Cohere)
Export as GraphML, JSON-LD, DOT, or Cypher; import previously exported graphs
Summarize functions with LLM-generated docstrings; view graph stats
Graph Querying
Find callers, callees, imports, importers, children, tests, and inheritors of any symbol
Semantic + keyword search across code entities using vector embeddings
Impact analysis (blast radius) of changed files, auto-detected from git diff
Find large functions/classes, spot-check callsite snippets, detect renamed/moved symbols between git refs
Diff nodes added/removed/modified between two commit SHAs; supports temporal snapshots and multi-repo federation
Code Review
Generate token-optimized review context: structural summaries, impacted nodes, source snippets, and review guidance
Auto-detect changed files from git diff or specify manually
Delta review between two commit SHAs to surface refactor moves and line shifts
Security Scanning
Heuristic scan (5 built-in regex rules, zero dependencies) or Semgrep scan
Export findings as JSON or SARIF v2.1.0; suppress specific findings; list available rules
Configuration
View server status, update runtime settings, clear embedding cache, manage cloud credentials
Key Highlights
Zero-config local ONNX semantic search out of the box
Paginated output to prevent token overflow
Temporal graph history via point-in-time snapshots
Multi-repo federation; self-hostable over stdio or HTTP; MIT licensed
mcp-name: io.github.n24q02m/better-code-review-graph
Knowledge graph for token-efficient code reviews -- semantic search and call-graph resolution across your codebase.
Project | Tagline | Tag |
Peer AI agents chat in a shared folder — no human relay, no orchestrator, wor... | Tooling | |
Knowledge graph for token-efficient code reviews -- semantic search and call-... | MCP | |
2-way Google Drive sync with .driveignore filter — rclone engine, Windows tray | Tooling | |
IMAP/SMTP email for AI agents -- read, send, organize folders, and manage att... | MCP | |
Composite MCP server for Godot Engine -- 17 composite tools for AI-assisted g... | MCP | |
Markdown-first Notion for AI agents -- pages, databases, blocks, and comments... | MCP | |
Drop-in python-semantic-release fork with built-in release-safety guards (orp... | Tooling | |
Telegram for AI agents -- messages, chats, media, and contacts across both bo... | MCP | |
Google Workspace MCP server (Docs/Drive/Calendar/Gmail/Sheets/Slides/Tasks/Ch... | MCP | |
Claude Code plugin marketplace for the n24q02m MCP servers -- install web sea... | Marketplace | |
Image and video understanding + generation for AI agents -- across Gemini, Op... | MCP | |
Chrome Extension for bulk operations on Jules tasks via batchexecute API -- a... | Tooling | |
Shared foundation for building MCP servers -- Streamable HTTP transport, OAut... | MCP | |
Persistent AI memory with hybrid search and embedded sync. Open, free, unlimi... | MCP | |
Fast multi-model retrieval runtime for ONNX and GGUF embeddings, reranking, and model contracts | Library | |
Secrets without the server. | CLI | |
A self-distilling neuro-symbolic cascade that amortises LLM cost across knowl... | Tooling | |
Shared web infrastructure package for search, scraping, HTTP security, and st... | Library | |
Open-source MCP server for AI agents: web search, content extraction, and lib... | MCP |
An MCP server that parses your codebase with Tree-sitter, builds a structural graph of functions/classes/imports, and gives Claude (or any MCP client) precise context so it reads only what matters instead of the whole tree. Semantic search runs through the local ONNX model registry from fastretrieval by default (zero config, no API key), with an optional cloud embedding chain. Fork of code-review-graph with fixed multi-word search, qualified call resolution, dual-mode embeddings, output pagination, and production CI/CD.
v2.0 adds temporal columns (valid_from_sha / valid_to_sha on every node + edge) and an opt-in security scanner. The schema migration is auto-applied on first GraphStore open, and a backup of the pre-2.0 DB is saved to <graph_db>.pre-2.0.bak so you can roll back. See BREAKING_CHANGES.md for the full schema-change list, behavior changes, environment requirements, and the downgrade procedure (CRG_DOWNGRADE_TO_1_X=1 uv run better-code-review-graph).
Related MCP server: TempoGraph
For OMP and other local coding harnesses, the primary surface is the package CLI
plus the bundled skills/ workflows. The skills invoke the CLI directly and do
not require an MCP server mapping.
# Run without a persistent install
uvx --python 3.13 better-code-review-graph graph build --full-rebuild \
--repo-root /path/to/repo
uvx --python 3.13 better-code-review-graph graph stats \
--repo-root /path/to/repo
# Or install the console script
pip install better-code-review-graph
better-code-review-graph query search --search-query "authentication" \
--repo-root /path/to/repoThe optional Semgrep engine for deeper security scans is a separate extra:
pip install 'better-code-review-graph[security]'MCP stdio remains a secondary protocol adapter for clients that require it:
{
"mcpServers": {
"better-code-review-graph": {
"command": "uvx",
"args": ["--python", "3.13", "better-code-review-graph"],
"env": { "MCP_TRANSPORT": "stdio" }
}
}
}Install with an AI agent -- paste this to your AI coding agent:
Install
better-code-review-graphfollowing the steps at https://raw.githubusercontent.com/n24q02m/claude-plugins/main/plugins/better-code-review-graph/setup-with-agent.md
Full CLI usage is in CLI. Optional per-client MCP setup is at mcp.n24q02m.com/servers/better-code-review-graph/setup/.
CRG is local-first for coding workflows:
CLI and bundled Skills are the primary surfaces for graph build/query, impact analysis, review context, security scans, and repository onboarding.
MCP stdio is the secondary protocol adapter over the same local domain services; it does not maintain a separate graph implementation.
Graph state stays in <repo>/.code-review-graph/graph.db unless an explicit
multi-user/self-host configuration selects another data directory.
PyPI, CI, security scanning, GitHub releases, and eligible stable MCP Registry publication remain active. Historical public OCI tags are retained, but new public Docker Hub/GHCR images are no longer published.
CRG has no hosted Cloudflare runtime in the target topology.
The repo ships a smithery.yaml so the server can be built and
run through Smithery. It deploys over stdio and needs
no startup configuration -- the config schema is empty, and any optional cloud
embedding/summary keys are supplied at runtime through the server's own config
flow (see Configuration below). The launch command is the same
uvx invocation as a local install:
startCommand:
type: stdio
commandFunction: |-
(config) => ({ command: 'uvx', args: ['--python', '3.13', 'better-code-review-graph'] })Everything works out of the box with zero configuration -- semantic search
uses the local ONNX registry from fastretrieval
(Qwen3-Embedding-0.6B is the current built-in reference entry, ~570 MB
downloaded on first graph embed). This reference entry is not a Qwen-only
boundary: any built-in registry ID or valid non-Qwen artifact manifest follows
the same resolver. All environment variables below are optional and only needed
for cloud embeddings, LLM summaries, or an explicit BYO local artifact.
Embeddings select the first provider/model entry in EMBEDDING_MODELS; later
entries are retained as configuration but are not runtime fallbacks. Summaries
use their ordered SUMMARY_MODELS chain. Providers are inferred from model
prefixes and use the matching <PROVIDER>_API_KEY.
Variable | Purpose | Empty (default) |
| Cloud embedding selection; the first entry is active | Local fastretrieval registry |
| Summarizer fallback chain for | Summaries disabled |
All vectors are stored at a fixed 768 dimensions (MRL truncation), so the embeddings table schema stays valid across providers. Switching embedding model changes the vector space; embeddings are tracked per provider and a provider switch triggers re-embedding rather than mixing incomparable vectors.
Cloud models need the provider key for whatever prefixes appear in your chains. Without any cloud key the server stays on local ONNX. Summarizers must expose a chat-completion API (so Jina and Cohere are embedding-only).
Model prefix | API key env var | Get a key |
|
| |
|
| |
|
| |
|
| |
|
| https://cloud.google.com/vertex-ai/generative-ai/docs/start/express-mode/overview |
Any other litellm provider works via
its standard <PROVIDER>_API_KEY.
Variable | Purpose |
| Custom OpenAI-compatible base URL for cloud embedding (SSRF-guarded) |
| Custom OpenAI-compatible base URL for the summarizer (SSRF-guarded) |
| Skip the local ONNX download; embedding is unavailable unless a cloud chain is configured |
| Built-in fastretrieval model ID, or a local directory containing |
| Required dimension for an external model ID without a manifest |
| ONNX file path inside a manifest-backed artifact directory |
| Explicit pooling for an external ID without a manifest: |
| Explicit L2 normalization for an external ID without a manifest |
| Override the per-user data directory (default |
| Deprecated singular vars, honored one release with a warning -- migrate to the |
CRG intentionally exposes no local reranker settings because this server has
no local reranker path. A custom external embedding ID without a manifest must
provide LOCAL_EMBEDDING_DIM; a local artifact directory must provide a valid
fastretrieval-manifest.json, otherwise startup fails closed.
{
"mcpServers": {
"better-code-review-graph": {
"command": "uvx",
"args": ["--python", "3.13", "better-code-review-graph"],
"env": {
"MCP_TRANSPORT": "stdio",
"EMBEDDING_MODELS": "jina_ai/jina-embeddings-v5-text-small,gemini/gemini-embedding-001",
"SUMMARY_MODELS": "gemini/gemini-2.5-flash",
"JINA_AI_API_KEY": "jina_...",
"GEMINI_API_KEY": "AIza..."
}
}
}
}You can also configure cloud keys interactively in HTTP mode via the relay
setup form (config(action="setup_start") returns the browser URL). See the
modes overview and
multi-user setup.
The relay setup form has an optional workspace username field. Entering the
same username always lands you in the same per-sub bucket, so your keys and
graph stay reachable across a re-authorization and across devices, instead of
being tied to the one-off subject minted for each /authorize round-trip.
Leaving it blank keeps the previous per-authorize behaviour.
Trust boundary: when the form is gated by a shared MCP_RELAY_PASSWORD, the
username is a partition key, not a secret -- anyone who knows that password can
type any username and reach that bucket. That is fine for a trusted group; an
untrusted multi-tenant deployment needs a per-user secret or delegated OAuth
instead.
One-time migration: existing users must re-enter their credentials once after this change. Nothing is deleted; credentials stored under the old random subject are simply no longer addressed.
Seven tools, each grouping related actions to keep the tool surface small.
graph -- Graph lifecycleActions: build | update | stats | embed | export | summarize
Action | Description |
| Full or incremental graph build. Set |
| Alias for |
| Graph size, languages, node/edge breakdown, embedding count. |
| Compute vector embeddings for semantic search. Dual-mode: local ONNX or cloud chain. |
| Export the graph as |
| LLM-generated one-paragraph docstrings for |
query -- Graph queriesActions: query | search | impact | large_functions | spot_check | renamed_in_diff | diff
Action | Description |
| Predefined patterns: |
| Search code entities by name/keyword or semantic similarity. |
| Blast radius of changed files. Auto-detects from git diff. Paginated with |
| Find functions/classes exceeding a line-count threshold. |
| Random callsite snippets from the last |
| Symbols whose callsite line shifted versus a base ref. |
| Nodes added/removed/modified between two commit SHAs ( |
Most read actions accept as_of=<sha> for temporal (point-in-time) snapshots
and repo=<repo_id> to scope a federated multi-repo graph.
review -- Code review contextActions: context (default) | delta
Token-optimized review context with structural summary, impacted nodes, source
snippets, and review guidance. context auto-detects changed files from the
git diff; delta (with from_sha/to_sha, optional show_line_shifts)
surfaces refactor moves between two commits.
config -- Server configuration and credential setupActions: status | set | cache_clear | setup_status | setup_start | setup_skip | setup_reset | setup_complete
Action | Description |
| Server info: version, graph path, node/edge counts, embedding backend, embeddings count. |
| Update a runtime setting ( |
| Remove all computed embeddings. |
| Show current credential state, providers configured, and setup URL. |
| Start relay setup to configure API keys via browser (HTTP mode). |
| Set local mode (skip relay permanently, use ONNX only). |
| Clear credentials and reset state. |
| Re-resolve credentials from environment variables. |
security -- Security scanningActions: scan | report | suppress | rule_list
Action | Description |
| Run a security scan ( |
| Re-emit cached findings as JSON ( |
| Suppress a finding by |
| List available rules for an engine. |
The semgrep engine requires the [security] extra and runs Semgrep's
p/auto registry pack plus a 3-rule curated overlay.
help -- Full documentationTopics: graph | query | review | config | security | recipes
Returns complete documentation for each tool. Use when the compressed descriptions above are insufficient.
config__open_relay -- Re-trigger the relay setup formRegistered automatically from mcp-core.
In HTTP mode it returns <PUBLIC_URL>/authorize so the agent can re-open the
browser setup form (e.g. after credential expiry); in stdio mode it returns
status: 'stdio_unsupported'.
Running better-code-review-graph with no arguments starts the MCP server
over stdio. A leading positional argument routes to a local CLI subcommand
that calls the same domain services used by the MCP adapter. Run these with
uvx (or uv run from a source checkout):
# Start the MCP server over stdio (default -- no subcommand)
uvx better-code-review-graph
# Build, inspect, and embed the local graph
uvx better-code-review-graph graph build
uvx better-code-review-graph graph stats
uvx better-code-review-graph graph embed
# Query relationships and impact
uvx better-code-review-graph query query \
--pattern callers_of --target "path/to/module.py::function"
uvx better-code-review-graph query search --search-query "authentication"
uvx better-code-review-graph query impact --changed-files src/app.py
# Produce review context and run a local security scan
uvx better-code-review-graph review context --base HEAD~1
uvx better-code-review-graph security scan --engine heuristicCommand | Description |
| Full or incremental graph build. |
| Compute vector embeddings using local ONNX or the configured cloud chain. |
| Inspect, export/import a portable |
| Run relationship patterns or keyword/semantic search. |
| Analyze changed-file blast radius or find oversized nodes. |
| Inspect callsites, line shifts, or commit-to-commit graph changes. |
| Generate review context or diff buckets for a code change. |
| Run and manage heuristic/Semgrep security findings. |
| Show or remove stored credential config ( |
| Environment self-check from shared |
| Inspect, open, or clear the relay setup session. |
CLI subcommands print structured JSON and exit non-zero on an error. The
config, doctor, and relay subcommands come from shared mcp-core.
What this fork fixes versus the upstream code-review-graph:
Feature | code-review-graph | better-code-review-graph |
Multi-word search | Broken (literal substring) | AND-logic word splitting |
callers_of/callees_of | Empty results (bare name targets) | Qualified name resolution + bare fallback |
Embedding | sentence-transformers + torch (1.1 GB) | fastretrieval ONNX + cloud (200 MB), dual-mode |
Output size | Unbounded (500K+ chars) | Paginated (max_results, truncated flag) |
Tool design | 9 individual tools | 7 grouped tools: graph + query + review + config + security + help + config__open_relay |
Plugin hooks | Invalid PostEdit/PostGit | Valid PostToolUse |
How better-code-review-graph stacks up against direct competitors in each pillar:
Capability | better-code-review-graph | Greptile | Sourcegraph (Cody / MCP) | CodeGraph (colbymchenry) |
Codebase knowledge graph | Yes (Tree-sitter, 14 langs, SQLite) | Yes (functions/classes/deps) | Yes (precise code indexing) | Yes (Tree-sitter, 20+ langs, SQLite) |
Persistent incremental updates | Yes (git-diff + file-hash re-parse) | ? | Yes (continuous indexing) | Yes (OS file-watcher debounced) |
Qualified call resolution (callers/callees) | Yes (same-file bare-call resolution + fallback) | ? | Yes (go-to-def / find-references) | Yes (callers / callees / impact) |
Semantic search / embeddings | Yes (fastretrieval local registry + cloud Jina/Gemini/OpenAI/Cohere) | ? | Yes (semantic + keyword + regex) | No (FTS5 full-text only) |
Token-optimized review context | Yes ( | Yes (PR review comments) | No (code-context assistant) | No (context layer, not review) |
Security scanning | Yes (Semgrep | ? | ? | No |
Self-hostable | Yes (stdio default, machine-bound) | Yes (Docker / K8s / air-gapped) | Yes (self-hosted instance) | Yes (100% local, no API keys) |
Free / open source | Yes (Apache-2.0) | No (proprietary SaaS; free OSS tier) | No (Enterprise license, source private) | Yes (MIT) |
Sources: Greptile · Greptile pricing · Sourcegraph MCP · CodeGraph. Cells marked ? are capabilities the competitor does not publicly document, not confirmed absences.
Explicit selection -- Cloud embedding errors are reported; the runtime does not silently switch models or fall back to local ONNX.
Error handling -- Tools return error strings with fix suggestions, never crash.
Read-only mount -- Docker mode mounts the repo as :ro (read-only).
SSRF-guarded endpoints -- Custom EMBEDDING_API_BASE / LLM_API_BASE URLs are validated before any outbound call.
To report a vulnerability, see SECURITY.md.
git clone https://github.com/n24q02m/better-code-review-graph
cd better-code-review-graph
uv sync --group dev
uv run pytest
uv run better-code-review-graphRequirements: Python 3.13, uv.
This plugin implements TC-Local (machine-bound, single trust principal). See the mcp-core trust model for full classification.
Mode | Graph DB | Cloud credentials | Who can read your data? |
stdio (default) |
|
| Only your OS user |
HTTP self-host (multi-user) | Per-user | Per-user | Only the authenticated user |
The v2.0 release added temporal columns (valid_from_sha / valid_to_sha
on every node and edge) plus an opt-in security scanner. The schema migration
is auto-applied on first GraphStore open, and a backup of the pre-2.0 DB is
written to <graph_db>.pre-2.0.bak. To downgrade and restore it:
CRG_DOWNGRADE_TO_1_X=1 uvx better-code-review-graphFull schema-change list, behavior changes, and rollback procedure: BREAKING_CHANGES.md. Release-by-release history: CHANGELOG.md.
Full docs at mcp.n24q02m.com/servers/better-code-review-graph/setup/:
Setup -- install methods for Claude Code, Codex, Gemini CLI, Cursor, Windsurf, mcp.json
Modes overview -- stdio / local-relay / remote-relay / remote-oauth
Multi-user setup -- per-JWT-sub credential model
Use the help tool from any MCP client for inline per-tool reference.
Apache-2.0 -- See LICENSE.
Server configuration, status, and credential setup. Actions: status (show state), set (key, value -- keys: log_level), cache_clear (wipe embeddings), setup_status (credential state), setup_start (relay browser setup), setup_skip (local mode), setup_reset (clear credentials), setup_complete (re-resolve from env). Use help tool for full docs.
| Name | Required | Description | Default |
|---|---|---|---|
| key | No | ||
| force | No | ||
| value | No | ||
| action | Yes | ||
| repo_root | No |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description describes actions like 'cache_clear (wipe embeddings)' and 'setup_reset (clear credentials)' which imply destructive behavior, but annotations set destructiveHint: false. This is a clear contradiction. Additionally, while it lists some behavioral traits, the inconsistency undermines transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single paragraph that packs many actions into a few lines. While not overly long, it lacks structure (e.g., bullet points) and front-loads the action list without clear organization. It could be more concise by grouping related actions.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 5 parameters, multiple actions, and an output schema, the description is insufficient. It does not describe return values, error conditions, or the output schema, and leaves important details uncovered (e.g., force, repo_root). The agent lacks enough context to use the tool effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With schema description coverage at 0%, the description must compensate but only partially explains parameters. It mentions that for 'set' action, key and value are used and key can be 'log_level', but does not explain force, repo_root, or the required action parameter beyond listing action names. Significant gaps remain.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose as managing server configuration, status, and credential setup, and lists specific actions (status, set, cache_clear, etc.). It distinguishes from sibling config__open_relay by being the main config tool, but could more explicitly differentiate when to use each.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by listing actions and their effects (e.g., 'status (show state)', 'cache_clear (wipe embeddings)'), but does not explicitly state when to use this tool versus alternatives like 'help' or 'config__open_relay'. It only mentions 'Use `help` tool for full docs', which is weak guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get the relay configuration URL for better-code-review-graph, opening it in the user's browser when possible. Returns the relay URL, whether the browser launched, and the current status.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, but it does disclose the browser-launching side effect and explicitly says 'when possible', acknowledging the action may not always succeed. It also previews the return payload (URL, whether browser launched, and current status), which is useful behavioral context. However, it does not clarify what 'current status' refers to or explain why browser launch might fail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that front-loads the action and resource, then states the side effect and the return values. Every clause provides distinct information without filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter tool with an output schema available, the description is functionally complete: it says what the tool retrieves, what side effect it may have, and what it returns. The slight vagueness around the 'current status' and browser-launch conditions keeps it from being fully rich, but it is sufficient for correct selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, so there are no parameter semantics for the description to clarify. The baseline for a no-parameter tool applies, and the description does not need to compensate for any schema gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The wording names a specific verb ('Get') and a specific resource ('relay configuration URL for better-code-review-graph'), and it clearly distinguishes this from a generic sibling like config by tying the operation to the relay URL and browser-launch behavior. The purpose is immediately understandable with no ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intended context is implied: an agent should call this when it needs the relay configuration URL and may want it opened in the browser. However, there is no explicit when-to-use or when-not-to-use guidance, and no alternative sibling tools are named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Build and manage the code knowledge graph. Actions: build (full_rebuild, base, repo_root), update (base, repo_root), stats (repo_root), embed (repo_root), export (format, output_path, repo_root), import (import_path, repo_root), summarize (max_nodes, repo_root). Use help tool for full docs.
| Name | Required | Description | Default |
|---|---|---|---|
| base | No | HEAD~1 | |
| roots | No | ||
| action | Yes | ||
| format | No | graphml | |
| max_nodes | No | ||
| repo_root | No | ||
| import_path | No | ||
| output_path | No | ||
| full_rebuild | No |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate not read-only or destructive, but the description adds little behavioral detail. It implies the tool modifies state (build, update) but doesn't disclose side effects or prerequisites.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is dense but somewhat verbose. It lists actions and parameters inline, which is functional but not optimally structured. Could be more front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 9 parameters and only 1 required, and no schema descriptions, the description is insufficient. It covers action-to-parameter mapping but fails to explain parameter semantics and behavior. Output schema existence may help but is not referenced.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0% coverage, so description must compensate. It connects actions to parameters (e.g., build requires full_rebuild, base, repo_root), adding meaning beyond bare names. However, still omits explanation for several parameters like roots and format.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool builds and manages a code knowledge graph, and lists specific actions. This distinguishes it from sibling tools like query or review.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives. The description lists actions but does not provide context for selecting between them or other tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get full documentation for any tool. Topics: graph | query | review | config | security | recipes. Use when compressed descriptions are insufficient.
| Name | Required | Description | Default |
|---|---|---|---|
| topic | No | graph |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false. Description adds that it returns 'full documentation', which is consistent and implies a safe, read-only operation. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences: first states purpose, second gives usage guideline. No wasted words, front-loaded information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple doc lookup tool with one optional parameter and an output schema, the description adequately covers purpose, usage, and available topics. Output schema handles return value documentation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has one parameter 'topic' with no enum, but description lists specific topics (graph, query, review, etc.), adding meaning beyond schema. Schema coverage is 0%, so description compensates well.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states verb 'Get full documentation' and resource 'any tool'. Lists specific topics (graph, query, etc.), which distinguishes it from sibling tools that are the tools themselves.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Use when compressed descriptions are insufficient', providing clear guidance on when to invoke this tool. Also lists available topics for reference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Query the code knowledge graph for relationships, search, and impact analysis. Actions: query (pattern, target), search (search_query), impact (changed_files|base), large_functions (min_lines), spot_check (n -- random callsite snippets from last callers_of/callees_of/inheritors_of/importers_of result), renamed_in_diff (base -- symbols whose callsite line shifted vs base ref), diff (from_sha, to_sha -- nodes added/removed/modified between two commit SHAs). Use help tool for full docs.
| Name | Required | Description | Default |
|---|---|---|---|
| n | No | ||
| base | No | HEAD~1 | |
| kind | No | ||
| repo | No | ||
| as_of | No | ||
| limit | No | ||
| action | Yes | ||
| target | No | ||
| to_sha | No | ||
| pattern | No | ||
| from_sha | No | ||
| languages | No | ||
| max_depth | No | ||
| min_lines | No | ||
| repo_root | No | ||
| max_results | No | ||
| search_query | No | ||
| changed_files | No | ||
| context_lines | No | ||
| file_path_pattern | No | ||
| max_payload_bytes | No |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, and the description aligns by presenting read-like actions (query, search, impact, diff). The description adds behavioral detail per action (e.g., 'spot_check returns random callsite snippets'), enhancing transparency beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is information-dense, packing multiple actions and their arguments into a single paragraph without excessive verbosity. It is not structured with sections but remains focused. The mention of 'help' for full docs prevents over-expansion.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 21 parameters and high complexity, the description provides a high-level overview of actions but lacks depth on many parameters. An output schema exists, which helps, but the description still leaves gaps regarding parameter usage and edge cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must explain parameters. It maps some parameters to actions (e.g., pattern, target for query), but many parameters (kind, repo, as_of, limit, languages, etc.) remain unexplained, limiting practical guidance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool queries a 'code knowledge graph' and lists specific actions like query, search, impact, etc. It distinguishes itself from siblings like config or help by detailing unique functionalities, though it does not explicitly differentiate from the sibling 'graph' tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description lacks guidance on when to use this tool versus alternatives. It lists actions but does not specify when to use a particular action or when not to use the tool. The only direction is 'Use help tool for full docs,' which defers responsibility.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Generate token-efficient review context for code changes. Actions: context (default — auto-detects changed files from git diff, returns structural summary, impacted nodes, source snippets, and review guidance), delta (from_sha, to_sha — wraps the query.diff buckets and, when show_line_shifts=true, surfaces qualified_names whose line_start moved between the two commits for refactor auditing). Context params: changed_files (auto), max_depth=2, include_source=true, max_lines_per_file=200, base='HEAD~1', repo_root (auto). Delta params: from_sha, to_sha, show_line_shifts=false, repo, repo_root. Use help tool for full docs.
| Name | Required | Description | Default |
|---|---|---|---|
| base | No | ``context`` action — git ref for change detection (default: ``HEAD~1``). | HEAD~1 |
| repo | No | Phase 2 Task 10 — when non-empty, scope to nodes whose ``repo_id`` matches (e.g. ``repo='repo_a-aaaaaaaa'``). Default ``""`` includes every federated repo. Both actions. | |
| action | No | ``context`` (default) or ``delta``. | context |
| to_sha | No | ``delta`` action — later commit SHA. Required. | |
| from_sha | No | ``delta`` action — earlier commit SHA. Required. | |
| languages | No | ``context`` action — optional list of language names (e.g. ``["python"]``) to scope the ``untested_functions`` list. Excludes functions whose language doesn't match. Fixes false positives on cross-language repos (D16, fixes #340). | |
| max_depth | No | ``context`` action — impact radius depth (default: 2). | |
| repo_root | No | Repository root path (auto-detected). Both actions. | |
| changed_files | No | ``context`` action — files to review (auto-detected from git if omitted). | |
| include_source | No | ``context`` action — include source code snippets (default: true). | |
| show_line_shifts | No | ``delta`` action — when True, include nodes whose ``line_start`` moved between ``from_sha`` and ``to_sha`` in the response (default False). | |
| max_lines_per_file | No | ``context`` action — max source lines per file (default: 200). |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, establishing safety. The description adds significant behavioral context: auto-detection of changed files, output structure (structural summary, impacted nodes, source snippets), and conditional behavior for 'show_line_shifts'. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is efficiently structured: starts with the primary purpose, then lists actions and their parameters. It avoids redundancy and front-loads the most important information. A minor density of technical details is acceptable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 12 parameters, 100% schema coverage, and an output schema, the description covers the tool's behavior well. It explains both actions, parameter defaults, and key behaviors. The slight reliance on the 'help' tool for 'full docs' indicates a minor gap, but overall it is sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds value by grouping parameters under each action and providing examples (e.g., 'repo='repo_a-aaaaaaaa''), but it mostly reiterates schema descriptions. The grouping and context slightly elevate it from the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool generates 'token-efficient review context for code changes' with two distinct actions: 'context' and 'delta'. It specifies verbs ('generate', 'auto-detects', 'returns') and the resource ('code review context'). While not explicitly distinguishing from siblings, the purpose is specific enough to make the tool's role clear against other tools like 'graph' or 'query'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use each action: 'context' for automatic git diff analysis and 'delta' for comparing two commits. It even details delta's 'show_line_shifts' option for refactor auditing. It lacks explicit 'when not to use' but offers clear context and refers to the 'help' tool for full documentation, which is reasonable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Security scanning over the code knowledge graph. Actions: scan (engine='heuristic'|'semgrep', repo_root), report (format='json'|'sarif', repo_root), suppress (rule_id, remove=false, repo_root), rule_list (engine='heuristic'|'semgrep'). Use help tool for full docs.
| Name | Required | Description | Default |
|---|---|---|---|
| action | No | scan | |
| engine | No | heuristic | |
| format | No | json | |
| remove | No | ||
| rule_id | No | ||
| repo_root | No |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are sparse (no readOnlyHint, destructiveHint false) and provide little safety context. The description lists actions but does not disclose side effects, authorization needs, or limitations beyond scanning. No contradiction, but insufficient behavioral details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences front-load the tool's purpose, followed by a compact enumeration of actions and parameters. No wasted words; every element adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 6 parameters and 0% schema coverage, the description covers actions and key constraints but defers to the help tool for full docs. The output schema exists but is not referenced, leaving return values unexplained. Adequate but incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, yet the description adds significant meaning by listing parameter values per action (e.g., engine='heuristic'|'semgrep', format='json'|'sarif'). This compensates for the schema's lack of description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Security scanning over the code knowledge graph.' It enumerates four specific actions (scan, report, suppress, rule_list) with their parameters, differentiating it from sibling tools like config, graph, query, and review.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. The mention 'Use `help` tool for full docs' implies incomplete documentation but does not provide context for selection or exclusion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v3.20.0config4 fields changedOutput schema / additionalPropertiesAdded value: +trueOutput schema / propertiesRemoved value: -{
- "result": {
- "type": "string"
- }
-}Output schema / requiredRemoved value: -[
- "result"
-]Output schema / x-fastmcp-wrap-resultRemoved value: -truegraph5 fields changedInput schema / properties / import_pathAdded value: +{
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "default": null
+}Output schema / additionalPropertiesAdded value: +trueOutput schema / propertiesRemoved value: -{
- "result": {
- "type": "string"
- }
-}Output schema / requiredRemoved value: -[
- "result"
-]Output schema / x-fastmcp-wrap-resultRemoved value: -truequery4 fields changedOutput schema / additionalPropertiesAdded value: +trueOutput schema / propertiesRemoved value: -{
- "result": {
- "type": "string"
- }
-}Output schema / requiredRemoved value: -[
- "result"
-]Output schema / x-fastmcp-wrap-resultRemoved value: -truereview4 fields changedOutput schema / additionalPropertiesAdded value: +trueOutput schema / propertiesRemoved value: -{
- "result": {
- "type": "string"
- }
-}Output schema / requiredRemoved value: -[
- "result"
-]Output schema / x-fastmcp-wrap-resultRemoved value: -truesecurity4 fields changedOutput schema / additionalPropertiesAdded value: +trueOutput schema / propertiesRemoved value: -{
- "result": {
- "type": "string"
- }
-}Output schema / requiredRemoved value: -[
- "result"
-]Output schema / x-fastmcp-wrap-resultRemoved value: -truev3.19.0configconfig__open_relaygraphhelpqueryreviewsecurityThe core tools map to distinct concerns: graph management, querying, review context, security, and configuration. The main ambiguity is between `config` and `config__open_relay`, and `graph.summarize` could potentially be confused with `review.context`, but descriptions clarify the intended primary use.
Tool names are consistently short lowercase domain labels: graph, query, review, config, help, security. The `config__open_relay` tool breaks this pattern by promoting a sub-action with a double underscore to a top-level tool.
Seven tools is a well-scoped size for a code-review-graph server, with each tool grouping a coherent set of related actions. The count supports a broad feature set while remaining navigable and non-redundant.
The surface covers the full lifecycle: graph build/update/stats/embed/import/summarize, flexible querying and diff analysis, review-context generation, security scanning and suppression, plus configuration and credential setup. There are no obvious dead ends or missing core operations for the stated purpose.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Code intelligence for coding agents: semantic, AST, graph, and full-text search. 279+ languages.
Ground-truth code graph for your codebase: exact callers, callees, symbols & dependencies.
Code intelligence platform for AI agents. 20 tools for architecture, security & impact analysis.
Give your AI agent a persistent map of your project's structure, dependencies, and bugs.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/n24q02m/better-code-review-graph'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
