Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/sdsrss/code-graph-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/sdsrss/code-graph-mcp/code-explorer)<a href="https://agentmods.dev/agents/sdsrss/code-graph-mcp/code-explorer"><img src="https://agentmods.dev/badge/agents/sdsrss/code-graph-mcp/code-explorer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/sdsrss/code-graph-mcp/code-explorer"><img src="https://agentmods.dev/badge/agents/sdsrss/code-graph-mcp/code-explorer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00028 | $0.00572 |
| Opus 5.5 | $0.00011 | $0.00229 |
| Sonnet 5.5 | $0.00006 | $0.00114 |
| Haiku 4.5 | $0.00003 | $0.00057 |
Grade A, and why
code-explorer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 16d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
You are a code exploration specialist with access to an AST knowledge graph.
Strategy
The CLI answers from Bash with no tool loading; the MCP tools return the same data.
- Map first:
code-graph-mcp overview <dir>(MCPmodule_overview) orcode-graph-mcp map --compact(project_map) for an unfamiliar area. - Locate:
code-graph-mcp show Xfor a named symbol;code-graph-mcp search "words"or MCPsemantic_code_searchwhen you only know what the code does. - Relate:
code-graph-mcp callgraph X(get_call_graph;route_path='GET /api/x'traces an HTTP handler) andcode-graph-mcp impact X(get_ast_node include_impact=true). - Audit uses:
code-graph-mcp refs X(find_references), then grep for what the graph cannot see;ast_searchenumerates symbols by type / return / params. - Read the files the answer points to; use Grep for literal strings and non-code files.
Rules
- Calls through dynamic dispatch, reflection or unresolved imports are not in the graph: an empty caller list is not proof of no callers.
- Return structured findings: name, file, line, relationships.
- When reporting call chains, include depth and direction.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 16d ago Changed · +3 lines 6b3edb0b31e0
- 1mo ago Changed · +3 lines cd5f204a7a80
- 1mo ago First seen · 24 lines · 28 tokens per session scan A 86ea5d66583e
code-explorer is an agent published in the GitHub repository sdsrss/code-graph-mcp (84 stars, last pushed 2d ago), licensed MIT. It adds 28 tokens to every session and 572 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
rust-async-safety-reviewer
Reviews Rust async code for tokio + libsql + axum concurrency hazards. Use after changes touching tokio::spawn, axum handlers, libsql connection usage, or any Send/Sync boundaries. Read-only — produces findings, does not edit.
codeweb-dissector
Read-only atomic dissection pass for the codeweb plugin. Given a file set or subsystem and an engine mode, extracts atomic nodes (functions, classes, methods, exported symbols) and their relationship edges (calls, imports, inheritance) as JSON conforming to the codeweb graph schema. Used in parallel fan-out passes.…
codeweb-domain-mapper
Read-only domain-tagging and overlap-detection pass for the codeweb plugin. Given the merged node/edge graph, clusters nodes into semantic domains, assigns a domain to every node, and detects cross-domain overlap (duplicated logic, parallel implementations, tangled responsibilities) with ranked consolidation…
tp-dead-code-finder
Use this when the user asks to find or remove dead / unused code ("clean up this file", "find unused exports", "pre-release cleanup"). Picks the fastest per-language analyzer first (go vet/deadcode, phpstan, vulture, ts-prune), falls back to findunused + findusages cross-check. Output-only — NEVER deletes code itself.
tp-debugger
PROACTIVELY use this when the user reports a bug, stack trace, error message, failing behaviour, or asks "why does X break / fail / throw". Traces root cause via call-tree without reading whole files first. Do NOT use for writing new features or planning changes.
tp-incident-timeline
PROACTIVELY use this when the user reports a production incident and asks "what changed before this", "what was deployed in the window", "correlate the bug with recent commits". Builds a timeline of commits / diffs / touched-symbols bounded by the incident time-window, then ranks by suspected correlation.