Code-Graph-RAG turns a multi-language codebase into a searchable knowledge graph, which maps source files and relationships among functions, classes, methods, modules, and services. Developers and coding agents use it to ask questions about a repository, retrieve code, identify dead code, and make AST-based edits with a diff preview; it can handle a monorepo, meaning multiple projects or services kept in one repository. The catalogue entries provide a skill and an instruction for working with this system.
Borrowing it
Nothing to install: this file belongs to vitali87/code-graph-rag. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/vitali87/code-graph-rag/main/.github/skills/code-review/SKILL.mdgit clone --depth 1 https://github.com/vitali87/code-graph-ragWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vitali87/code-graph-rag/code-review)<a href="https://agentmods.dev/skills/vitali87/code-graph-rag/code-review"><img src="https://agentmods.dev/badge/skills/vitali87/code-graph-rag/code-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vitali87/code-graph-rag/code-review"><img src="https://agentmods.dev/badge/skills/vitali87/code-graph-rag/code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00044 | $0.00619 |
| Opus 5.5 | $0.00018 | $0.00248 |
| Sonnet 5.5 | $0.00009 | $0.00124 |
| Haiku 4.5 | $0.00004 | $0.00062 |
Grade A, and why
code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 52 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Reviewing code-graph-rag
This repository parses source in many languages with tree-sitter and ingests the
result into a code graph: nodes for modules, classes and functions, edges such as
CALLS, INSTANTIATES, DEFINES and IMPORTS. Most defects that reach main
are wrong or missing edges for a specific language construct, not crashes.
Weight the review accordingly.
Highest-value checks
Graph-edge correctness
- Does a new or changed construct produce every edge it should, and no edge it
should not? A constructor call is the recurring example: it should record
INSTANTIATESon the class andCALLSon the constructor. - Check the qualified name the edge is attached to. Name-mangling bugs recur
here: duplicate-suffixed classes, verbatim identifiers (
@classin C#), named constructors, generics (Box<int>()) and marker-stripping passes have each produced an edge pointing at a name that no node has. - Resolution must respect scope. A local variable shadowing a type means the receiver is not a construction; flag resolution that matches on bare name without checking what is actually in scope.
Language coverage and consistency
- A fix in one language's parser usually applies to its siblings. If the change
touches
dart/, ask whethercsharp/,cpp/, and the rest share the shape and need the same fix — or say explicitly why they do not. - Grammars are optional at install time. Code and tests must not assume a grammar is present; tests for one language should skip cleanly without it.
Tests
- Every behavioral fix needs a fixture reproducing the exact construct, and the fixture must be valid source in that language — an invalid fixture can pass for the wrong reason. Verify the assertion would fail without the fix.
- Prefer asserting on specific edges between specific qualified names over asserting on counts, which pass accidentally.
Repository conventions
- Python 3.12,
ruff(line length 88), anduvfor dependencies. Any dependency change must updateuv.lock; CI fails on drift viauv lock --check. - Comments explain why, not what. Match the density of surrounding code.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 52 lines · 44 tokens per session scan A 84218d1ab912
code-review is a skill published in the GitHub repository vitali87/code-graph-rag (5,286 stars, last pushed today), licensed MIT. It adds 44 tokens to every session and 619 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-22.
Other skills, from other repositories
ch015-verifier
Run CH015 adversarial verification workflows to independently validate security reports, recheck file-line evidence, find false positives, severity errors, missed findings, and dependencies.
ch015-pentest
Run CH015 penetration testing workflows for attacker-minded source-code review, exploit scenarios, POC generation, dry-run or live verification, and security findings.
review-pr
Visualize a pull request on the Cartographer map — see which entities are affected, the blast radius, and the review path. Use when user says "review pr", "review pull request", or "/cartographer review-pr".
vibedrift-drift-check
Use when writing or changing code in an existing repository to keep new code consistent with the repo's own conventions and avoid duplicating code that already exists. Checks a proposed function against the repo's dominant patterns and existing functions BEFORE it lands, turning drift detection into drift prevention.…
mastermind-test-audit
Read-only review of whether the tests in a finished change actually prove its behaviour — changed code no test reaches, a test exercising a different path than the one that changed, an assertion edited to match the new output, and a suite that ran nothing. Use after implementation, and whenever a change claims to be…
mastermind-comment-audit
Read-only review of a non-empty comment delta. Flags narration with evidence, names what it deliberately kept, and reports removed rationale. Use when the user asks to check comments or a finished diff's pre-gate found added, modified, or deleted comments; skip automatic routing when no comment changed.