codegraph

A local code knowledge graph that indexes code structure, symbols, and relationships across a project. It uses tree-sitter, a parser that reads source code into a structured form, and stores the index in SQLite.

In plain words
What is it for?
Use it to trace callers and dependencies, follow request paths, inspect framework routes, analyse change impact, search symbols, and identify affected tests.
Why use it?
It helps an agent understand how code connects and estimate what may be affected before a change.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/full-stack-skills/agent-skills/codegraph
Any agent
npx skills add full-stack-skills/agent-skills --skill codegraph
Clone the repo
git clone --depth 1 https://github.com/full-stack-skills/agent-skills

Made for: Claude Code, Codex.

Per session 60 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,746 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 2 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00060 $0.02746
Opus 5 $0.00030 $0.01373
Sonnet 5 $0.00012 $0.00549
Haiku 4.5 $0.00006 $0.00275

Measured yesterday against content hash 2b3e329c581b, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade C, and why

codegraph scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Downloads and executes remote codehighSupply chain

curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.

curl -fsSL https://raw.githubusercontent.com/colbymchenry/codegraph/main/install.sh | sh

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -fsSL https://raw.githubusercontent.com/colbymchenry/codegraph/main/install.sh | sh
skills/codegraph/SKILL.md · 206 lines

How it starts

The opening of the file, as written. The whole thing — 206 lines — stays where its author put it; the contents beside it link to each section on GitHub.

CodeGraph — 语义代码智能

CodeGraph 是基于 tree-sitter 的本地代码知识图谱工具,为 AI 编码代理(Claude Code、Cursor、Codex、Gemini 等)提供符号关系、调用图和代码结构的即时查询能力。

核心收益:平均节省 ~16% 成本、~58% 减少工具调用、~47% 减少 token 消耗、~22% 加速响应。

100% 本地 — 无数据离开机器,无 API 密钥,无外部服务,仅 SQLite 数据库。

Capability Boundaries

✅ Strong Suits

  1. 代码结构查询 — "X 如何工作"、"X 如何到达 Y"
  2. 符号搜索与调用链追踪 — 查找函数/类的调用者与被调用者
  3. 变更影响分析 — 修改某符号前分析影响范围(blast radius)
  4. 框架路由识别 — Django/Express/NestJS/Spring/Gin 等 14 个框架的路由绑定
  5. 跨语言桥接 — iOS(Swift↔ObjC)、React Native(JS↔原生)、Expo Modules
  6. 自动同步 — 文件监听器 + 防抖自动同步,索引随代码实时更新
  7. 全文搜索 — 基于 FTS5 的符号名即时搜索
  8. 受影响测试文件追踪 — codegraph affected 溯源变更影响的测试文件

⚠️ Requirements

  1. 项目需运行 codegraph init -i 初始化知识图谱索引
  2. MCP 服务器需通过 codegraph install 配置到目标 Agent
  3. 配置后需重启 Agent 才能加载 MCP 服务器
  4. 首次索引可能需要几分钟(取决于代码库大小)

❌ Out of Scope(附替代方案)

  1. 实时调试 / 运行时动态分析 → 使用调试器(如 GDB、Chrome DevTools)
  2. 非文件系统项目(如远程仓库未检出)→ 先 clone 到本地
  3. 代码编辑/生成 → 使用 Agent 自身的编辑能力
  4. CI/CD 流水线管理 → 使用专用 CI 工具

When to Use This Skill

Use this skill when the agent needs to:

  • 理解代码库架构:"X 如何工作"、"请求如何到达数据库"
  • 追踪符号依赖:"谁调用了 X"、"X 调用了谁"
  • 分析变更影响:"修改 X 会影响什么"
  • 查找调用链:"从 A 到 B 的完整路径"
  • 审查代码结构:获取项目文件结构、符号索引
  • 确定受影响的测试文件:codegraph affected

Data Privacy

CodeGraph 不收集、存储或传输任何用户数据。所有索引存储在项目本地的 .codegraph/ 目录中,SQLite 数据库不会离开你的机器。无 API 密钥,无外部服务。

How It Works

Agent → CodeGraph MCP Server (explore/search/callers/callees/impact/node)
         → SQLite 知识图谱 (符号 · 边 · 文件 · FTS5)
  1. Extraction — tree-sitter 解析源代码为 AST,提取节点和边
  2. Storage — 存入本地 SQLite 数据库(.codegraph/codegraph.db),支持 FTS5
  3. Resolution — 解析引用关系:调用→定义、导入→源文件、框架路由
  4. Auto-Sync — 原生 OS 文件事件监听 + 防抖同步(默认 2s),索引实时更新

Quick Start

# Step 1: 安装 CLI(无需 Node.js)
curl -fsSL https://raw.githubusercontent.com/colbymchenry/codegraph/main/install.sh | sh
# Step 2: 配置 Agent
codegraph install
# Step 3: 初始化项目
cd your-project
codegraph init -i

Workflow

Step 1. 初始化项目 — 确认 .codegraph/ 存在,若不存在则运行 codegraph init -i

Read the full file on GitHub · 206 lines

Files

What ships with it

8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 206 lines · 60 tokens per session scan C 2b3e329c581b

Subscribe to this mod's changes

codegraph is a skill published in the GitHub repository full-stack-skills/agent-skills (2 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 60 tokens to every session and 2,746 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

systematic-debugging

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.

obra/superpowers · 21 tokens

next-cache-components-adoption

Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…

vercel/next.js · 95 tokens

babysit-pr

Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…

openai/codex · 114 tokens

imagegen

Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…

openai/codex · 113 tokens

cpu-profile-analysis

Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…

microsoft/vscode · 71 tokens

next-cache-components-optimizer

Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…

vercel/next.js · 170 tokens