When a coding agent needs to understand a project, it usually works it out the slow way: grep, open a file, grep again. CodeGraph does that reading once, in advance. It parses your code into a graph of every function, class, call and import, stores it in a SQLite database in a .codegraph folder inside your project, and gives your agent one tool, codegraph_explore, that returns the relevant source, the call paths between symbols and what a change would affect.
It works with Claude Code, Cursor, Codex, OpenCode, Gemini CLI, GitHub Copilot, Windsurf and about ten other agents, on Windows, macOS and Linux, and the README shows more than 30 languages. The graph updates itself as files change, and a local viewer, codegraph ui, lets you browse it yourself. It is MIT-licensed, with about 77,000 stars and 51 contributors since January 2026, and version 1.6.2 is the latest release.
The numbers in its README are the project's own, and we did not reproduce them. Its benchmark, re-measured in August 2026 on seven open-source repos with four runs per setup, reports 88% fewer tool calls, 53% faster answers, 62% fewer tokens and 44% lower cost on average. The spread is wide: 78% cheaper on Excalidraw, 13% on Django, about even on Gin. The same README says CodeGraph leaves about 80% more retrieved context sitting in a long session than file reading does, which is a fair thing for it to admit.
- Repository: github.com/colbymchenry/codegraph
- Licence: MIT (MIT License)
- Language: TypeScript. Stars: 77K. Forks: 5,115. Last push: Nov 1, 2026.
- Scan: safe, Nov 7, 2026, commit f72c9d2
Who it is for
Developers who use a coding agent on medium or large codebases and watch it burn tokens finding its way around. On a small project the agent finds things quickly anyway, so the gain is smaller. You need to be comfortable in a terminal.
Getting started
1. macOS or Linux: install the command-line tool (no Node needed). Read the script first if you prefer
curl -fsSL https://raw.githubusercontent.com/colbymchenry/codegraph/main/install.sh | sh2. Or, if you already have Node
npm i -g @colbymchenry/codegraph3. In a new terminal, connect it to your agents. This is where it asks about usage stats
codegraph install4. Build the graph for each project, then restart your agent
cd your-project && codegraph init5. Optional: switch off usage stats at any time
codegraph telemetry offThe installer suggests yes for three things: auto-allowing CodeGraph's tools in Claude Code and Qwen Code, a Claude Code prompt hook, and sharing usage stats. Read each question, because codegraph install --yes turns all three on without asking. codegraph uninstall removes the agent settings and the tool.
Safety scan
We cloned colbymchenry/codegraph at commit f72c9d2 on Nov 7, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secret hits across 1,847 files and about 584,000 lines, mostly TypeScript. Five pattern hits, all explained: four are the words curl ... | sh in comments and help text, and one is the Windows upgrade, which runs PowerShell with -ExecutionPolicy Bypass and an encoded script. The code's comment gives quoting as the reason for the encoding, and the script downloads the new release.
- Telemetry is on unless you decline. codegraph install asks once, with yes selected. With --yes, or with npx straight into init, there is no question and you get a one-line notice before the first send. It sends a random machine ID, version, operating system, command and tool counts, language names and coarse size buckets to telemetry.getcodegraph.com. TELEMETRY.md rules out code, paths, file and symbol names and IP addresses, and the client code we read and the public ingest worker match that list. Turn it off with codegraph telemetry off, CODEGRAPH_TELEMETRY=0 or DO_NOT_TRACK=1. The README's 100% local describes your code and index, not these stats.
- One limit on the no-IP claim: the worker's code never reads the IP and the database has no column for it, but its Cloudflare config switches on Cloudflare's request logs at full sampling, and we cannot see what those logs keep. Any web request also shows your address to the server receiving it. If that matters to you, turn telemetry off before the first send.
- Installing and upgrading run code from the internet. install.sh has no sudo and stays in ~/.codegraph and ~/.local/bin, but it does not check the SHA256SUMS file the releases include. On a Mac or Linux bundle install, codegraph upgrade pipes the current install.sh from the main branch into sh. Releases come from a public workflow with signed provenance, which you can check yourself with gh attestation verify; the scripts do not do it for you. The npm package has no install script, only a preuninstall cleanup.
- It changes your agent's setup: an MCP entry, a marked section in CLAUDE.md or AGENTS.md, and auto-allow for mcp__codegraph__*. The Claude Code hook reads your prompt on your machine and adds graph context to how, where and trace questions. If you decline it, codegraph upgrade can add it back to a global Claude Code setup without asking, because the code keeps no record of the refusal; set CODEGRAPH_NO_PROMPT_HOOK=1 to stop that. The MCP server also checks GitHub for a new version once a day (CODEGRAPH_NO_UPDATE_CHECK=1), and the installer offers an optional waitlist that only sends an email you type.
- Advisories: the one critical is Astro 6.3.7 (code execution through AVIF image optimization), and it appears only in site/package-lock.json, the documentation site built for GitHub Pages. That folder also has 12 highs. telemetry-worker has 14 highs and telemetry-dashboard has 9; they are the project's own server tools. None of these three folders ships in the npm package. The root lockfile has two highs, Rollup path traversal and a Windows-only launch-editor bug in Vite, both development tools only, plus five moderate and two low. A separate check of its 51 runtime packages found no advisories.
- codegraph-kernel is the Rust parser: tree-sitter grammars and the code that extracts symbols, with 73 locked crates and no advisories. It has no networking crates or calls, and its build.rs compiles vendored C grammars. The repo also carries 29 compiled WebAssembly grammar files as fallback parsers, which cannot be read line by line. An extra pass over the repo found no exfiltration hosts, and the only injection phrase is a test string. The four hidden-character hits are harmless: a Farsi test string, an emoji, and zero-width spaces in a test and a design note. The sensitive paths such as ~/.ssh are in code that refuses to index those folders.
- Two workflows with nine action uses and no pull_request_target. The one third-party action, withastro/action@v6, is not pinned to a commit, and it only builds the docs site. A licence and contributing guide are present; no security policy or Dependabot.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | 5 pattern hits found and read; every one is listed under the raw findings. |
| Install-time code | 1 Cargo build script. 5 installer scripts |
| Committed binaries | None. |
| CI workflows | 2 workflows. None use pull_request_target. 1 of 1 third-party action pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often github.com, opencode.ai, raw.githubusercontent.com, evil.example. No URLs to bare IP addresses. |
| Known vulnerabilities | 96 advisories across 822 pinned packages: 1 critical, 34 high, 46 moderate, 15 low. codegraph-kernel/Cargo.lock: 73 packages, 0 advisories; package-lock.json: 221 packages, 9 advisories; site/package-lock.json: 428 packages, 31 advisories; telemetry-dashboard/package-lock.json: 94 packages, 25 advisories; telemetry-worker/package-lock.json: 90 packages, 34 advisories. |
| Project hygiene | Has licence file, contributing guide. Missing security policy, automated dependency updates, CodeQL. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Pattern hits (5)
| Where | Rule | Match |
|---|---|---|
| install.sh:9 | download-piped-to-shell | # curl -fsSL https://raw.githubusercontent.com/colbymchenry/codegraph/main/install.sh | sh |
| install.sh:12 | download-piped-to-shell | # Uninstall: curl -fsSL .../install.sh | sh -s -- --uninstall |
| scripts/npm-shim.js:277 | download-piped-to-shell | ' curl -fsSL https://raw.githubusercontent.com/' + REPO + '/main/install.sh | sh\n' |
| src/upgrade/index.ts:658 | download-piped-to-shell | deps.log(c.dim(`Install curl, or run manually: ${INSTALL_SH_URL} | sh`)); |
| src/upgrade/index.ts:828 | powershell-encoded | const code = deps.run('powershell.exe', ['-NoProfile', '-ExecutionPolicy', 'Bypass', '-EncodedCommand', encoded]); |
Installer scripts (5)
- install.ps1, 198 lines; talks to api.github.com, github.com, raw.githubusercontent.com
- install.sh, 152 lines; talks to api.github.com, github.com, raw.githubusercontent.com
- scripts/agent-eval/run-agent.sh, 35 lines
- scripts/agent-eval/run-all.sh, 150 lines
- scripts/agent-eval/run-arms.sh, 57 lines
Worst known vulnerabilities (24 of 96)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-26w7-cxv4-gfx2 | critical | astro@6.3.7 | Astro: Remote code execution through AVIF image optimization |
| GHSA-mw96-cpmx-2vgc | high | rollup@4.57.1 | Rollup 4 has Arbitrary File Write via Path Traversal |
| GHSA-587h-7wmj-h5pm | high | vite@7.3.6 | launch-editor: `fs.existsSync()` existence check can be bypassed on Windows |
| GHSA-2pvr-wf23-7pc7 | high | astro@6.3.7 | Astro: Host header SSRF in prerendered error page fetch |
| GHSA-2883-xcg3-v3hh | high | js-yaml@4.1.1 | js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources |
| GHSA-52cp-r559-cp3m | high | js-yaml@4.1.1 | js-yaml: YAML merge-key chains can force quadratic CPU consumption |
| GHSA-5p4m-2wfm-xmqj | high | js-yaml@4.1.1 | JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) - CVE-2026-59870 fix not backported |
| GHSA-f88m-g3jw-g9cj | high | sharp@0.34.5 | sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 |
| GHSA-rgj7-g3m4-5g8c | high | sharp@0.34.5 | sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545 |
| GHSA-wq5f-xc86-pv6w | high | sharp@0.34.5 | sharp : Vulnerability in librsvg dependency CVE-2026-96889 |
| GHSA-7w5x-hrqm-74c2 | high | smol-toml@1.6.1 | smol-toml: Denial of Service via malformed TOML documents |
| GHSA-2p49-hgcm-8545 | high | svgo@4.0.1 | SVGO removeScripts plugin leaves some executable scripts intact |
| GHSA-w27v-7q3p-w38r | high | svgo@4.0.1 | SVGO: removeScripts allows executable links through namespace and control-character bypasses |
| GHSA-587h-7wmj-h5pm | high | vite@7.3.3 | launch-editor: `fs.existsSync()` existence check can be bypassed on Windows |
| GHSA-mrhx-c7xc-m3w5 | high | zod@4.4.3 | Zod can exhaust memory while validating oversized constrained collections |
| GHSA-rgj7-g3m4-5g8c | high | sharp@0.35.2 | sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545 |
| GHSA-wq5f-xc86-pv6w | high | sharp@0.35.2 | sharp : Vulnerability in librsvg dependency CVE-2026-96889 |
| GHSA-2m5v-pch6-74hx | high | undici@7.28.0 | undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent |
| GHSA-4cwx-7wf7-3272 | high | undici@7.28.0 | undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives |
| GHSA-4w7w-5xrc-9h26 | high | undici@7.28.0 | undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects |
| GHSA-qrxm-fqhp-jwvm | high | undici@7.28.0 | undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation |
| GHSA-rfgv-xxqx-mfg5 | high | undici@7.28.0 | undici vulnerable to Denial of Service via unrequested WebSocket subprotocol |
| GHSA-w293-vg96-wgc3 | high | undici@7.28.0 | undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool |
| GHSA-xjj6-f33q-929c | high | undici@7.28.0 | undici vulnerable to Denial of Service via unhandled error on excessive content-encodings |
By the numbers
| Stars | 77K |
|---|---|
| Forks | 5,115 |
| Contributors | 51 |
| Commits | 1,853 |
| Open issues | 186 |
| Open pull requests | 76 |
| Releases | 33 |
| Latest release | v1.6.2 |
| Licence | MIT |
| Main language | TypeScript |
| Project age | 9 months |
| Last push | Nov 1, 2026 |
| Tracked files | 1,847 |
| Lines of code | 584.1K |
| Checkout size | 173 MB |
Lines by language: TypeScript 467.3K, Markdown 31.7K, Rust 30.2K, C 16.7K, Svelte 13.4K, JavaScript 8,974.
Questions
Is CodeGraph free?
Yes. The tool is MIT-licensed with no account, and your only cost is your agent's usage. The project also has a waitlist for a separate hosted product at getcodegraph.com; the README gives no price for it.
Does CodeGraph send my code anywhere?
We found nothing that does. The graph stays in your project's .codegraph folder and the viewer talks only to your own machine. What leaves is the anonymous usage stats, unless you turn them off, and a daily version check against GitHub.
How do I turn off CodeGraph's telemetry?
Answer no when codegraph install asks, or run codegraph telemetry off, which also deletes unsent data. For a shell or CI, set CODEGRAPH_TELEMETRY=0 or DO_NOT_TRACK=1. codegraph telemetry status shows the current state.
Will it really cut my token bill by 44%?
That is the project's own average, and it varies a lot by repo and question: about even on Gin, 78% cheaper on Excalidraw in its table. It helps most when the agent would otherwise read many files. We did not run the benchmark ourselves.
CodeGraph or Understand Anything?
They solve different problems. CodeGraph gives your agent fast answers through a tool call and updates itself as you work. Understand Anything, also on this list, builds a dashboard and guided tours for people learning a codebase.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.