codegraph

A tool that builds a knowledge graph of a codebase: a map of files, functions, classes, imports, calls, uses, and inheritance relationships.

In plain words
What is it for?
Use it to generate or refresh the graphify-out/ graph so other tools can inspect cross-file relationships before editing code.
Why use it?
It reveals connections across files that a text search may miss, helping agents understand how a change can affect the wider codebase.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/linkpranay-ai/context-engineering-protocol/ult-codegraph
Any agent
npx skills add linkpranay-ai/context-engineering-protocol --skill ult-codegraph
Clone the repo
git clone --depth 1 https://github.com/linkpranay-ai/context-engineering-protocol

Made for: Claude Code, Codex.

Per session 40 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 4,020 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00040 $0.04020
Opus 5 $0.00020 $0.02010
Sonnet 5 $0.00008 $0.00804
Haiku 4.5 $0.00004 $0.00402

Measured 2d ago against content hash b7534f2bb814, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

codegraph scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.github/skills/ult-codegraph/SKILL.md · 315 lines

How it starts

The opening of the file, as written. The whole thing — 315 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Codebase Graph (graphify wrapper)

Wraps the external graphify CLI (https://github.com/safishamsi/graphify, MIT license, distributed as the PyPI package graphifyy) to build a knowledge graph of a codebase — files, functions, classes, and their calls/imports/uses/inherits relationships — at graphify's own fixed output location, graphify-out/, where other skills query it directly.

Status: piloting. Validated on a real ~40 KSLOC FastAPI codebase (a structural lead — webhook_dispatcher.py → RetryPolicy, the bridge between two otherwise-separate subsystems — that a textual grep could not find, since the bridging file never mentions the target term) before this migration. Now rolling out to a small set of engineering volunteers piloting it on substantially larger codebases (500 KSLOC+), where graph.json itself can run to tens of MB and the scoped-query pattern below stops being optional and starts being the only thing that scales. Report findings (works well / doesn't / surprises) as an issue in this repo so this can graduate out of pilot status or be reworked.

How to generate / refresh the graph

Step 0 — scope the index (first run only)

Before running graphify update on the whole repo, take a quick look at what's actually there:

# Top-level dirs by file count — surfaces generated/vendored/other-language subtrees
for d in */; do n=$(find "$d" -type f | wc -l); echo "$n $d"; done | sort -rn | head -10

Then ask: is there one directory that holds essentially all the source you care about, separate from generated code, vendored third-party libraries, or bindings for other languages?

  • Yes — point graphify update at that directory instead of . (e.g. graphify update src/ --no-cluster). Smaller, cleaner graph; less cross-language noise in affected/explain results.
  • No (everything's genuinely mixed) — run graphify update . --no-cluster on the repo root. Validated on a real ~300 KSLOC, 8-language, 2425-file monorepo (google/protobuf): completed in 5m28s, 73K nodes / 254K edges, with affected/explain queries returning in ~3s — an unscoped run on a messy repo is workable, just expect occasional cross-language results.
  • No, but multiple genuinely independent roots (e.g. sibling repos or workspace directories with no shared parent worth scoping to) — index each root separately, then combine:

Read the full file on GitHub · 315 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 315 lines · 40 tokens per session scan A b7534f2bb814

Subscribe to this mod's changes

codegraph is a skill published in the GitHub repository linkpranay-ai/context-engineering-protocol (8 stars, last pushed 2d ago), licensed Apache-2.0. It adds 40 tokens to every session and 4,020 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

sdd

Execute the Liatrio Spec-Driven Development (SDD) workflow when explicitly invoked by the user. NOTE: this skill is NOT intended to be dynamically loaded or automatically triggered; it should only ever be explicitly called by the user.

liatrio-labs/spec-driven-workflow · 50 tokens

bcc-plan-spar

BCC align+lock+review PLAN.md for one slice (no product code). Slash: /bcc-plan-spar · chat: bcc:plan-spar · "lock PLAN" · spar the plan. Args: rounds=N (auto-review cap), review=self|subagent|cli|auto|off. Grill until clear enough (no default Q&A quota). Hand off to bcc-clean-cut after human APPROVE.

bo-cao/breaking-coding-chaos · 91 tokens

bcc-throughline

BCC global progress cockpit (plans.md/progress.md/findings.md). Slash: /bcc-throughline · chat: bcc:throughline · "where are we" · reprioritize · resume after /clear. Not for coding or full PLAN grill.

bo-cao/breaking-coding-chaos · 56 tokens

handoff

Guides the Claude Code agent through completing a task, selecting a handoff tier, building a valid completion-card, and performing a clean task handoff.

BrianNguyen29/x-harness · 31 tokens

x-harness-admission

Teach the x-harness admission workflow and completion-card discipline.

BrianNguyen29/x-harness · 11 tokens

bcc-breaking-coding-chaos

BCC main skill: dual-loop coding workflow (throughline → plan-spar → clean-cut) or quick status+next. Slash: /bcc-breaking-coding-chaos · chat: bcc:breaking-coding-chaos · "run BCC" · "BCC status" · "what next BCC". Needs a real idea (1:1 implement). Args: goal text, or status. May pass plan-spar review budget as…

bo-cao/breaking-coding-chaos · 101 tokens