graph

A command for answering codebase questions through a code graph, which maps relationships between files, functions, and other code elements.

In plain words
What is it for?
Use it to find callers, trace paths between components, assess a file's impact, or inspect highly connected parts of the codebase.
Why use it?
It can show connections and impact across a project without requiring separate file searches.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/ozmasterai/torus-framework/graph
Clone the repo
git clone --depth 1 https://github.com/OZmasterAI/Torus-Framework
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,238 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.01238
Opus 5 $0.00000 $0.00619
Sonnet 5 $0.00000 $0.00248
Haiku 4.5 $0.00000 $0.00124

Measured yesterday against content hash 7c4bb7a4f47f, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

graph scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

commands/graph.md · 121 lines

How it starts

The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/graph — Query the Code Graph

Answer any codebase question using the toroidal-indexer code graph. One tool call, compact result — no grep/find/glob.

Usage

/graph <question>                              # natural language query
/graph what calls calculateWeeklyAIRewards     # callers query
/graph blast radius of jwt-auth.ts             # impact analysis
/graph path from Scheduler to AIUsageLog       # shortest call chain
/graph hubs                                    # most-connected nodes
/graph clusters                                # community overview

How It Works

All indexer tools route through toolshed MCP: run_tool("indexer", "<tool>", {args}).

The primary tool is code_query — it does BFS/DFS graph traversal server-side and returns a compact text summary of nodes + edges within a token budget. One call answers most questions.

Step 1 — Resolve project name

PROJECT = basename of current working directory

Step 2 — Read project context via MCP resource (optional, ~150 tokens)

Before querying, read the compact project summary to understand graph size and top hubs:

ReadMcpResourceTool("indexer://project/PROJECT/context")

For cluster overview (~300 tokens): ReadMcpResourceTool("indexer://project/PROJECT/clusters") For hub details (~200 tokens): ReadMcpResourceTool("indexer://project/PROJECT/hubs")

These replace reading the full GRAPH_REPORT.md (~2000 tokens). Only read resources when you need orientation — skip for targeted queries where you already know what to look for.

Step 3 — Call code_query (default for most questions)

run_tool("indexer", "code_query", {
  "project": "PROJECT",
  "question": "the user's question or key terms",
  "depth": 2,
  "budget": 2000
})

Returns pre-formatted text: scored seed nodes → BFS traversal → NODES list with file:line → EDGES list with relationship types. All in ~1500-2000 tokens.

Seed selection uses hybrid BM25 + vector similarity search. Semantic queries like "authentication flow" will find JWT/login symbols even without exact substring matches.

Read the full file on GitHub · 121 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 121 lines · 0 tokens per session scan A 7c4bb7a4f47f

Subscribe to this mod's changes

graph is a command published in the GitHub repository OZmasterAI/Torus-Framework (5 stars, last pushed 3mo ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 1,238 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.