MCP Codebase Graph

Turn your project into a smart, searchable map — and give your AI assistant a super-memory!
Crafted by DecentCoders — Building simple tools for smart developers.
🌐 Website: https://mcp-code-graph.pages.dev

🌟 What is this extension?

Usually, when you ask an AI assistant (like Claude, Cursor, or Continue) for help, you have to manually copy and paste your code files into the chat. MCP Codebase Graph stops that hassle. It automatically runs in the background and builds a "map" of how every file, function, and class in your project connects to each other.

It then safely shares this map with your AI using a standard called MCP (Model Context Protocol).

The result? You can just ask your AI questions like:

• "Where is the login function used?"
• "Are there any unused functions I can delete?"
• "Find the code that handles payments."

And the AI will answer instantly, without you needing to paste a single line of code!

🚀 Why will you love it?

1. Works across popular languages

The extension indexes declarations and builds a local code graph for JavaScript, TypeScript, React/JSX/TSX, Python, Go, Rust, Java, C++, C#, Ruby, and PHP.

Language compatibility guide

These ratings describe cross-file reference and dead-code analysis—not whether a file can simply be indexed. The dead-code tool is intentionally conservative: when a language/framework cannot be resolved with enough confidence, it avoids calling code unused.

What the stars mean: ★★★★★ is ready for the listed graph features; ★★★☆☆ is useful for navigation and local relationships; ★★☆☆☆ means the extension deliberately avoids strong unused-code claims until its language-specific resolver is available.

2. "Smart" Meaning Search

You don't need to remember the exact name of a function anymore. You can search for the idea. If you search for "user password check", the extension can find VerifyAuthToken() because it understands the meaning of your code using built-in, local AI embeddings.

3. Find "Dead Code" to Delete Safely

Afraid to delete code because you don't know if it's being used somewhere else? Just ask your AI! The extension can mathematically prove if a function is completely ignored by the rest of your app.

4. Git Intelligence (New!)

Need to know who wrote the code or when it was last changed? Ask your AI "Who is the expert on the payment gateway?" or "When was this function last modified?" The extension directly hooks into your local Git history.

5. Zero Setup, Zero Errors

There is almost nothing to configure — just install it. It uses pure, crash-proof technology (WebAssembly) that works instantly on Windows, Mac, and Linux without any complex build tools. Reopening a project is fast too: the index is verified against your files (mtime + size), so unchanged files are never re-analyzed — only new or modified files are parsed, and deleted files are cleaned up automatically. If you ever want the legacy always-from-scratch behavior, set mcpCodeGraph.startupIndexing to "full" or run Decent Coders: Reindex Workspace.

6. 100% Private and Free

Your code never leaves your computer. The map of your code is saved right inside your project folder (.vscode/mcp_graph.db). It respects your .gitignore file and completely skips heavy folders like node_modules automatically.

🛡️ Data Safety, Privacy & Enterprise Security Compliance (100% Local & Air-Gapped)

This extension is built for compliance-heavy, high-security enterprise environments. All features run with zero external cloud dependencies:

• 100% Local Inference (No Data Exfiltration): Semantic embedding vectors are computed entirely in-process using @xenova/transformers running via local WebAssembly (WASM). Absolutely no third-party APIs (such as OpenAI, Cohere, or Google) are contacted to generate embeddings or perform searches.
• Pure Stdio JSON-RPC Communication (No Open Ports): The Model Context Protocol (MCP) server runs as a local subprocess and communicates with your IDE strictly via standard input/output streams (stdin/stdout). No TCP sockets or network ports are opened, bound, or exposed, eliminating risk from local port scanning or external access.
• Corporate Proxy & Air-Gapped Mirror Support: The child MCP process seamlessly inherits proxy and SSL configurations (HTTP_PROXY, HTTPS_PROXY, NO_PROXY, NODE_EXTRA_CA_CERTS) from the parent environment. Additionally, setting the HF_ENDPOINT environment variable allows downloading the model from trusted enterprise mirrors (e.g., https://hf-mirror.com).
• Zero-Network Fallback (Air-Gapped Ready): If a corporate firewall blocks Hugging Face and no mirror is configured, the system automatically falls back to an offline-first token-overlap vocabulary-hashing generator. This builds full-fidelity 384-dimensional L2-normalized vector embeddings entirely locally in-memory with absolute zero network traffic.
• Isolated SQLite Database Store: Code graphs, symbol signatures (up to 280-char slices), and vector indexes are stored locally inside .vscode/mcp_graph.db within your workspace folder. No cloud synchronization or central telemetry database is used.
• Defensive Threat Containment & Sanitization:
  • Path-Traversal Guard: Workspace path validation and real-path normalization prevent directory traversal attacks or escaping the workspace root.
  • DoS Defense: A strict 2 MB file size limit and a 10,000 edge limit per file protect local memory and CPU from oversized or malicious minified source files.
  • System Path Protection: All system paths (e.g., /home/user) returned to the AI agent are dynamically sanitized to prevent leaking host directory structures.
  • SQL Injection Prevention: Safe parameter-binding is used on all queries to protect the integrity of the local SQLite database.

📦 How to Install and Use

Step 1: Install

1. Open VS Code.
2. Go to the Extensions tab (Ctrl+Shift+X or Cmd+Shift+X).
3. Search for MCP Codebase Graph.
4. Click Install.

Step 2: Let it work its magic

1. Open your project folder in VS Code.
2. Look at the bottom-left corner of your screen. You will see it say Syncing... and then Base Memory: Ready.
3. That’s it! Every time you save a file, it quietly updates the map in the background.

Reindex the entire codebase

Use a full reindex after installing/updating the extension, switching branches, pulling a large change set, or when graph results look stale.

1. Open the project folder in VS Code or Cursor (not an individual file).
2. Open the Command Palette:
   • Windows/Linux: Ctrl+Shift+P
   • macOS: Cmd+Shift+P
3. Run Decent Coders: Reindex Workspace.
4. Wait for the status bar to return to Base Memory: Ready. You can follow progress in View → Output → MCP Codebase Graph by Decent Coders.
5. In an AI agent, call get_codebase_summary to confirm the indexed file and symbol counts before relying on graph or dead-code results.

A reindex rebuilds the local graph database at .vscode/mcp_graph.db. It respects .gitignore and skips generated/heavy folders such as node_modules, dist, and build.

Step 3: Use the graph with an AI agent

VS Code with GitHub Copilot

1. Open the Chat view and select Agent mode (MCP tools are not used in Ask mode).
2. Select Configure Tools in the chat input and enable MCP Codebase Graph.

Cursor

1. Open Cursor Agent and open its MCP/Tools settings.
2. Enable mcp-code-graph if it is disabled.

The extension registers a dedicated local MCP process with the editor and exposes 8 graph tools automatically. Every tool returns the same unified JSON envelope with built-in pagination (current_page, page_size, total_items, total_pages, has_more) and composable filters (file path, symbol type, language, relationship type, confidence tier, and more), so agents can fetch exactly the slice of the graph they need. Try these prompts with Copilot Agent or Cursor Agent:

"Summarize my codebase." "Find the code that handles email sending." "If I change the createUser function, what other files will break?" "Are there any unused functions in this project that I can delete?" "Who is the expert on the handleLogin function?" "Who wrote most of the code in this repository?"

✅ How do I know it's working?

Press Ctrl+Shift+P (or Cmd+Shift+P on Mac) and type: "Decent Coders: Show Summary & Stats"

A pop-up will appear showing you exactly how many files, functions, and classes it successfully mapped out!

🔧 Troubleshooting

• Nothing is happening: Make sure you opened a Folder in VS Code, not just a single file. The extension needs a whole folder to build a map!
• It ignores my code: The extension automatically reads your .gitignore file. If a file is ignored by Git, or inside a node_modules or dist folder, it will be skipped.
• The AI agent isn't calling the graph tools: Tools must be enabled once — in VS Code open Chat → Agent → Configure Tools and enable MCP Codebase Graph (in Cursor, enable mcp-code-graph in MCP/Tools settings). Also confirm you are in Agent mode, not Ask mode (Ask never invokes tools). The extension ships trigger-rich tool descriptions, server-level routing instructions, and a bundled Copilot instructions file (prompts/mcp-code-graph.instructions.md) so the agent picks the tools automatically once enabled. For Cursor, or for even stronger steering, copy the project-rule snippet in docs/LLM-USAGE.md into .cursor/rules/mcp-code-graph.mdc.
• First tool call fails with Cannot read properties of undefined (reading 'invoke'): This is a known VS Code race condition, not a problem with this extension (microsoft/vscode#323990) — VS Code exposes MCP tools in the agent's tool list slightly before it finishes wiring the invocation handler, so the first MCP tool call right after opening a window / reloading / re-activating can crash inside VS Code itself. Fix: wait a few seconds and retry the message — the second attempt succeeds. It never affects built-in tools or any later graph calls.
• Semantic search (mode="semantic") returns an error or empty results: Semantic search uses a small local AI model. On first use it downloads once (~25 MB from Hugging Face, cached in the extension's storage — never in your project), then a background worker embeds your index. If you're offline or behind a restrictive proxy the download fails — exact search keeps working, and semantic retries automatically once the model is available. Empty results with a note mean the embedding worker is still catching up; retry in a minute.

👨‍💻 About DecentCoders

DecentCoders is a developer-first group. We believe in building simple, highly effective tools that respect your privacy and make programming more joyful.

• Website: https://mcp-code-graph.pages.dev

Made with care by DecentCoders. Enjoy writing great code!