Symvanta
REMOTE · MCP.SYMVANTA.COM · SCANNED SEP 20
Hosted code graph over MCP: exact callers, dependencies, and cross-repo blast radius for AI agents.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security97
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC is configured correctly; the domain's records validate against the full chain to the root. View diagnostics → Pass
- The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents. View diagnostics → Partial
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability75
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 9208 tokens (~328/item across 28 items; 27 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management53
- Stability observed for 16 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 27 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 29 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Symvanta MCP server?
Symvanta is a hosted endpoint at https://mcp.symvanta.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · mcp.symvanta.com
claude mcp add --transport http com-symvanta-code-graph 'https://mcp.symvanta.com/mcp'
{
"mcpServers": {
"com-symvanta-code-graph": {
"url": "https://mcp.symvanta.com/mcp"
}
}
} {
"servers": {
"com-symvanta-code-graph": {
"type": "http",
"url": "https://mcp.symvanta.com/mcp"
}
}
} [mcp_servers.com-symvanta-code-graph] url = "https://mcp.symvanta.com/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"com-symvanta-code-graph": {
"type": "remote",
"url": "https://mcp.symvanta.com/mcp",
"enabled": true
}
}
} openclaw mcp add com-symvanta-code-graph --url 'https://mcp.symvanta.com/mcp' --transport streamable-http
mcp_servers:
com-symvanta-code-graph:
url: "https://mcp.symvanta.com/mcp" {
"McpServers": {
"com-symvanta-code-graph": {
"Transport": "http",
"Url": "https://mcp.symvanta.com/mcp"
}
}
} assistant mcp add com-symvanta-code-graph -t streamable-http -u 'https://mcp.symvanta.com/mcp'
{
"mcpServers": {
"com-symvanta-code-graph": {
"type": "http",
"url": "https://mcp.symvanta.com/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Tool “add_repository” rewrote its description, which is the text the model reads security
- Tool “init” rewrote its description, which is the text the model reads security
- Tool “ref” rewrote its description, which is the text the model reads security
- New tool “create_project” functional
- New tool “list_installations” functional
- “add_repository” added an optional parameter “installation_id” cosmetic
- “init” added an optional parameter “repository” cosmetic
- “ref” reworded the description of “op” cosmetic
- 11 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.
- 9 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
- 7 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Probed https://mcp.symvanta.com/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=symvanta.com | CN=YE2,O=Let's Encrypt,C=US | 7 Aug 2026 | 5 Nov 2026 | ECDSA 256 | ECDSA-SHA384 | 67c3b30db2e69b03796baf5a264ddd21961 |
| SANs: *.symvanta.com, symvanta.com | ||||||
| CN=YE2,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 4df3b15dd6c0784c507cd37b58e6f115 |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC secure
Validation of mcp.symvanta.com. — Secure
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| symvanta.com. | present | 2371 | 13 | Verified |
| mcp.symvanta.com. | Verified address RRset verified with the apex keys |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
WWW-Authenticate challenge Bearer error="invalid_token", error_description="Missing Authorization header", scope="mcp:read", resource_metadata="https://mcp.symvanta.com/.well-known/oauth-protected-resource/mcp"
Bearer error="invalid_token", error_description="Missing Authorization header", scope="mcp:read", resource_metadata="https://mcp.symvanta.com/.well-known/oauth-protected-resource/mcp" | Header | Value |
|---|---|
| strict-transport-security | max-age=15552000 |
| x-content-type-options | nosniff |
Protected resource metadata
| Document | https://mcp.symvanta.com/.well-known/oauth-protected-resource/mcp |
|---|---|
| Retrieved | Yes |
| Resource | https://mcp.symvanta.com/mcp |
| Authorisation server | https://mcp.symvanta.com/ |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mcp.symvanta.com/mcp | Verified | 200 | |
| http (plaintext) | http://mcp.symvanta.com/mcp | HTTPS enforced | 301 | https://mcp.symvanta.com/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_repository ~266
Attach a GitHub repository to a project (owner + repo_name; clone URL derived; projectId defaults to the bound / default project). Public repos need nothing else. Private repos need installation_id from list_installations (a GitHub App installation that covers the repo) or a workspace PAT saved on the dashboard; without either the attach is refused (private_repository_needs_credential) instead of failing on the queued clone. Idempotent. First attach dispatches an indexing job; response carries visibility, credential ("installation" | "pat" | null), indexing_status ("queued" | "already_indexed") and indexing_job_id to poll. Needs mcp:admin.
| Name | Type | Req | Description |
|---|---|---|---|
| default_branch | string | – | Default branch (default main) |
| feedback | object | – | Optional: report how a previous answer worked out; piggybacks on any call. |
| installation_id | string | – | Private repository: id of a GitHub App installation from list_installations that covers it. Refused (installation_lacks_repository) when the installation does not grant access. |
| owner | string | yes | GitHub owner (user or org) |
| projectId | string | – | Project id from init/list_projects. Omit for the active project. |
| repo_name | string | yes | Repository name |
No output schema declared.
No examples provided.
adr ~357
Architecture decision records: the WHY behind code, anchored to a symbol/file/project. Survive reindexes; find_node attaches a node's decisions. Ops: - record: needs title+decision. Anchor with repository+symbolPath or +filePath; omit both for project-wide. Optional context, consequences, status. - list: records for a project, filter by repository/symbolPath/filePath/status. - update: needs id; status:"superseded"+supersededById, or "deprecated".
| Name | Type | Req | Description |
|---|---|---|---|
| consequences | string | – | Trade-offs accepted. |
| context | string | – | Why (constraints, alternatives rejected). |
| decision | string | – | record: what was decided. |
| feedback | object | – | Optional: report how a previous answer worked out; piggybacks on any call. |
| filePath | string | – | Anchor: repo-relative file path. |
| id | integer | – | update: record id (from adr list or find_node decisions). |
| limit | integer | – | list: max records (default 20). |
| op | string | yes | record: create a decision record. list: read records. update: amend or supersede one. |
| projectId | string | – | Project id from init/list_projects. Omit for the active project. |
| repository | string | – | Repository full name, e.g. "owner/repo". Omit when the project has one repository. |
| status | string | – | record/update: lifecycle status. |
| supersededById | integer | – | update: id of the replacement record. |
| symbolPath | string | – | Anchor: symbolPath as find_node / locate returns. |
| title | string | – | record: short imperative title, e.g. "No pgvector". |
No output schema declared.
No examples provided.
ask_codebase ~380
Synthesis Q&A for behavior/architecture questions: answer + citations in one call. HEAVY (~2-4 s, ~3-5 k tokens): prefer context, find_node, or locate when they suffice. scope:"repo" (default) = ONE repo; scope:"all" = cross-repo (repositoryIds narrows, omit spans all; rejects repository). If sufficient_to_answer=true, answer without further tool calls. commitSha pins a revision.
| Name | Type | Req | Description |
|---|---|---|---|
| commitSha | string | – | Pin reads to one indexed revision (7-40 hex). Graph tools error with revision_not_indexed when it is not an indexed revision of the scoped repository, or revision_not_servable when that revision's gr… |
| feedback | object | – | Optional: report how a previous answer worked out; piggybacks on any call. |
| limit | integer | – | Max candidate symbols fed to synthesis (default 10, max 30). |
| projectId | string | – | Project id from init/list_projects. Omit for the active project. |
| query | string | – | Alias of question. |
| question | string | – | The behavior question, e.g. "how does X work". |
| repository | string | – | Repository full name, e.g. "owner/repo". Omit when the project has one repository. |
| repositoryIds | array | – | scope:all only. Restrict to these encoded repository ids. |
| scope | string | – | repo (default) = single-repo. all = cross-repo; repositoryIds narrows, omit spans all. |
No output schema declared.
No examples provided.
bundle ~303
Run up to 10 independent tool calls in parallel in one round-trip. Calls share the bundle-level project/repository scope unless a call sets its own args.repository, which scopes that call alone. Supported: locate (args.mode text|symbol|semantic|file|config, not codebase), relate (kind:callers only), find_node, list_file_symbols, find_http_route. Returns results in input order; unsupported tool names return {error}.
| Name | Type | Req | Description |
|---|---|---|---|
| calls | array | yes | Calls to run in parallel; each uses the bundle's project/repository scope unless its args.repository names another one. |
| commitSha | string | – | Pin reads to one indexed revision (7-40 hex). Graph tools error with revision_not_indexed when it is not an indexed revision of the scoped repository, or revision_not_servable when that revision's gr… |
| feedback | object | – | Optional: report how a previous answer worked out; piggybacks on any call. |
| projectId | string | – | Project id from init/list_projects. Omit for the active project. |
| repository | string | – | Repository full name, e.g. "owner/repo". Omit when the project has one repository. |
No output schema declared.
No examples provided.
context ~287
First-touch task orientation. Pass a natural-language task; returns the top 5 relevant files with their symbols and best-matching snippets in one call (~1-1.5k tokens, ~500 ms, no LLM). Replaces chaining locate (text) + locate (semantic) + list_file_symbols. Known symbol: find_node/locate. Synthesized explanation: ask_codebase.
| Name | Type | Req | Description |
|---|---|---|---|
| commitSha | string | – | Pin reads to one indexed revision (7-40 hex). Graph tools error with revision_not_indexed when it is not an indexed revision of the scoped repository, or revision_not_servable when that revision's gr… |
| feedback | object | – | Optional: report how a previous answer worked out; piggybacks on any call. |
| projectId | string | – | Project id from init/list_projects. Omit for the active project. |
| repository | string | – | Repository full name, e.g. "owner/repo". Omit when the project has one repository. |
| task | string | yes | Natural-language task. Returns ranked files with symbols and matching snippets, no LLM call. |
No output schema declared.
No examples provided.
create_project ~121
Create a project in the workspace (name; slug derived and made unique). Needs mcp:admin; plan project caps apply (plan_limit_exceeded). Then attach repositories with add_repository { projectId, owner, repo_name } and bind the session with ref op:"use_project" (or init with the checkout's repository once attached).
| Name | Type | Req | Description |
|---|---|---|---|
| feedback | object | – | Optional: report how a previous answer worked out; piggybacks on any call. |
| name | string | yes | Project name. The slug is derived from it and made unique within the workspace. |
No output schema declared.
No examples provided.
diff_impact ~256
Impact of a diff between two indexed revisions of one repo (base..head): changed files + symbols, union blast radius (layers + cross-repo fallout), affected endpoints, test suites, and co-change reminders. Replaces per-symbol relate (kind:blast_radius) loops before merging. Defaults: head = session's effective revision, base = previous indexed. For UNCOMMITTED edits, run ref (op:"index_working_tree"), then call with no shas.
| Name | Type | Req | Description |
|---|---|---|---|
| base | string | – | Base revision (7-40 hex). Omit for the previous indexed. |
| expansionLimit | integer | – | Cap on impacted nodes (default 25); totals always reported. |
| feedback | object | – | Optional: report how a previous answer worked out; piggybacks on any call. |
| head | string | – | Head revision (7-40 hex). Omit for the session's effective revision. |
| includeCrossRepo | boolean | – | Include cross-repo fallout (default true). |
| projectId | string | – | Project id from init/list_projects. Omit for the active project. |
| repository | string | – | Repository full name, e.g. "owner/repo". Omit when the project has one repository. |
No output schema declared.
No examples provided.
estimate_scope ~118
Pre-flight estimate before graph traversal: coarse count of files a task likely touches and whether it spans layers (common/browser/node/electron-main/...) or repositories. Decides single-file edit vs consulting the graph. Heuristic, from symbol-name + text matches.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | yes | Natural-language description of the intended change. |
| feedback | object | – | Optional: report how a previous answer worked out; piggybacks on any call. |
| projectId | string | – | Project id from init/list_projects. Omit for the active project. |
No output schema declared.
No examples provided.
find_http_route ~291
Resolve an HTTP route by path + optional method to endpoint + handler (filePath + line bounds). Use instead of grep/locate for URL paths: follows framework router metadata (Express, Fastify, Hono, Laravel, FastAPI, etc.) and resolves dynamic segments, prefix groups, and middleware-mounted routers text search misses.
| Name | Type | Req | Description |
|---|---|---|---|
| commitSha | string | – | Pin reads to one indexed revision (7-40 hex). Graph tools error with revision_not_indexed when it is not an indexed revision of the scoped repository, or revision_not_servable when that revision's gr… |
| feedback | object | – | Optional: report how a previous answer worked out; piggybacks on any call. |
| method | string | – | HTTP method filter, e.g. GET or POST. |
| path | string | yes | Route path, e.g. "/api/users/:id". Partial paths match. |
| projectId | string | – | Project id from init/list_projects. Omit for the active project. |
| repository | string | – | Repository full name, e.g. "owner/repo". Omit when the project has one repository. |
No output schema declared.
No examples provided.
find_node ~525
Resolve 1-10 symbols to filePath + line bounds + signature. selectors: array keyed by symbol (bare name) / symbolPath / filePath / nodeId; a flat query/name/single field also works. includeSource=true adds the excerpt, includeSummaries=true AI summaries. A node from a SCIP-indexed package also carries scip_package_name (and scip_package_version / scip_manager when known). For a class/interface/struct/protocol it carries a compact heritage field (<=5 ancestors, <=20 descendants, omitted when empty); includeHeritage:false skips it, includeCrossRepo:true walks cross-repo heritage. {resolved:false, candidates} = no confident match.
| Name | Type | Req | Description |
|---|---|---|---|
| commitSha | string | – | Pin reads to one indexed revision (7-40 hex). Graph tools error with revision_not_indexed when it is not an indexed revision of the scoped repository, or revision_not_servable when that revision's gr… |
| expansionLimit | integer | – | Cap on expanded related nodes (default 15, max 100). |
| feedback | object | – | Optional: report how a previous answer worked out; piggybacks on any call. |
| includeCommunity | boolean | – | Attach the symbol's Louvain module (community name). Off by default (extra edge lookup). |
| includeCrossRepo | boolean | – | With includeHeritage on, walk cross-repo heritage edges. No-op when includeHeritage is off. |
| includeHeritage | boolean | – | Default true. Include a compact heritage field for a class/interface/struct/protocol. false skips it on bulk scans. |
| includeSource | boolean | – | Attach source for resolved nodes. |
| includeSummaries | boolean | – | Attach generated summaries when available. |
| limit | integer | – | Max results (default 5, max 20). |
| projectId | string | – | Project id from init/list_projects. Omit for the active project. |
| repository | string | – | Repository full name, e.g. "owner/repo". Omit when the project has one repository. |
| selectors | array | yes | Symbols to resolve (1-10), each by nodeId, symbol, symbolPath, or filePath. |
| sourceMode | string | – | With includeSource: "signature" returns the declaration only. |
No output schema declared.
No examples provided.
freshness ~141
Returns lastIndexedSha, lastIndexedAt, and the current remote HEAD sha for a repository: detect index drift from remote. Reports what Symvanta knows, not local git. currentRemoteSha is null when no GitHub credential is configured. Echoes the active ref pin (pinnedBranch, pinnedSha).
| Name | Type | Req | Description |
|---|---|---|---|
| feedback | object | – | Optional: report how a previous answer worked out; piggybacks on any call. |
| projectId | string | – | Project id from init/list_projects. Omit for the active project. |
| repository | string | – | Repository full name, e.g. "owner/repo". Omit when the project has one repository. |
No output schema declared.
No examples provided.
history ~280
Indexed commit history. Ops: - commits: recent commits (metadata + file list); <=200/call, default 50. With a clone prefer git log. - commit: one commit by sha with its diff summary (added/modified/deleted/renamed); null if outside the indexed window. - recently_changed: files ranked by change frequency in the indexed window ("what's hot").
| Name | Type | Req | Description |
|---|---|---|---|
| author | string | – | Filter by author name or email substring. |
| feedback | object | – | Optional: report how a previous answer worked out; piggybacks on any call. |
| limit | integer | – | Max rows (default 50, max 200). |
| op | string | yes | commits: recent commits (metadata + file list). commit: one commit in detail. recently_changed: most-changed files over the window. |
| path | string | – | Restrict to commits touching this repo-relative path. |
| projectId | string | – | Project id from init/list_projects. Omit for the active project. |
| repository | string | – | Repository full name, e.g. "owner/repo". Omit when the project has one repository. |
| sha | string | – | op:commit. The commit to read (7-64 hex). |
| since | string | – | ISO datetime lower bound. |
| until | string | – | ISO datetime upper bound. |
No output schema declared.
No examples provided.
index_health ~420
Per-project index health. pendingLibraryVersions: cross-repo specifiers still indexing (an empty result may mean "not indexed yet", not "not in code"); call when a query is surprisingly empty. A row with status "skipped" is never going to arrive (a dev or optional dependency, which the catalog does not index) and status "failed" means discovery found no source, so only "indexing" is worth waiting on. architecture: per-repo Louvain module count + modularity Q (low Q = tangled), plus circular-dependency and mutually-recursive-symbol counts (inspect via map view:"architecture"). versionDrift: joined cross-repo SCIP edges whose consumer-pinned package version differs from the sibling's current version (package, pinned vs current, edge count). externalsCoverage: per-repo count of external references joined onto a sibling definition vs left as materialized stubs. unindexableRepositories: repos whose last index produced no graph and left a status (no_default_branch = the remote has no resolvable default branch, e.g. an empty repo; awaiting_upload = an upload-provider repo with no zip yet; remote_head_unresolvable = the remote could not be reached to resolve its head, so this is a network or credential problem, not a repository one), with the worker's log line as indexStatusDetail; explains a silently-empty repo. degradedRepositories: repos that DID index but lost a derived artifact (community_detection_skipped = Louvain clustering did not run, so map view:"architecture" has no modules; raise COMMUNITY_EDGE_CEILING or set COMMUNITY_DETECTION=true, then reindex). Both carry a human-readable reason.
| Name | Type | Req | Description |
|---|---|---|---|
| feedback | object | – | Optional: report how a previous answer worked out; piggybacks on any call. |
| projectId | string | – | Project id from init/list_projects. Omit for the active project. |
| repository | string | – | Repository full name, e.g. "owner/repo". Omit when the project has one repository. |
No output schema declared.
No examples provided.
init ~186
Call first, with repository:"owner/name" (your checkout's GitHub remote). Binds the session to the project holding that repository and returns it as the active project with its repositories, index health, and a `usage` field (decision matrix + routing). workspace.attached=false means the checkout is NOT indexed: nothing in the answer describes it; attach it (add_repository, create_project) or work without the graph, do not route through the projects listed. Without repository: the pinned project (ref op:"use_project") or the workspace default.
| Name | Type | Req | Description |
|---|---|---|---|
| feedback | object | – | Optional: report how a previous answer worked out; piggybacks on any call. |
| repository | string | – | The checkout's GitHub remote as "owner/name" (a clone URL is accepted). Binds the session to the project holding it; workspace.attached=false means it is not indexed. |
No output schema declared.
No examples provided.
library ~218
Library catalog lookups. Ops: - packages: list indexed npm packages (specifier, ecosystem, owner/name, indexed-at, sha). Tenant-scoped, no projectId. - version: one package's resolved version for a project (sha, version, dep type, indexed-at, status indexed|indexing|failed|not_found). "indexing" means a job for that revision is in flight, so retrying later converges; "failed" carries a reason and does not change on its own.
| Name | Type | Req | Description |
|---|---|---|---|
| feedback | object | – | Optional: report how a previous answer worked out; piggybacks on any call. |
| limit | integer | – | op:packages. Max rows (default 50, max 200). |
| op | string | yes | packages: list indexed packages. version: resolve one specifier's indexed version. |
| projectId | string | – | Project id from init/list_projects. Omit for the active project. |
| specifier | string | – | op:version. Package specifier, e.g. "react". |
No output schema declared.
No examples provided.
list_file_symbols ~267
List symbols in one file (name + kind + line bounds). Step 1 of the two-step read: get line bounds, then pass startLine/endLine to source (op:read) for that slice only (~4-15x fewer tokens). For one symbol + signature, use find_node {symbol, filePath}.
| Name | Type | Req | Description |
|---|---|---|---|
| commitSha | string | – | Pin reads to one indexed revision (7-40 hex). Graph tools error with revision_not_indexed when it is not an indexed revision of the scoped repository, or revision_not_servable when that revision's gr… |
| feedback | object | – | Optional: report how a previous answer worked out; piggybacks on any call. |
| filePath | string | yes | Repo-relative file path to list symbols for. |
| projectId | string | – | Project id from init/list_projects. Omit for the active project. |
| repository | string | – | Repository full name, e.g. "owner/repo". Omit when the project has one repository. |
No output schema declared.
No examples provided.
list_installations ~112
GitHub App installations connected to this workspace and the repositories each can reach (private included). Use before add_repository for a private repository: pass the installation's id as installation_id. pat_configured says whether a workspace PAT exists as the fallback credential. Empty = connect the GitHub App on the dashboard (Project > Repositories). An installation whose GitHub call failed carries error and an empty list.
| Name | Type | Req | Description |
|---|---|---|---|
| feedback | object | – | Optional: report how a previous answer worked out; piggybacks on any call. |
No output schema declared.
No examples provided.
list_projects ~48
List all projects with indexing summaries. Find a project by name or check which exist.
| Name | Type | Req | Description |
|---|---|---|---|
| feedback | object | – | Optional: report how a previous answer worked out; piggybacks on any call. |
No output schema declared.
No examples provided.
list_repositories ~70
List repositories in a project. Find repository names to scope a query to one repo.
| Name | Type | Req | Description |
|---|---|---|---|
| feedback | object | – | Optional: report how a previous answer worked out; piggybacks on any call. |
| projectId | string | – | Project id from init/list_projects. Omit for the active project. |
No output schema declared.
No examples provided.
list_tests_for ~230
Test suites and cases whose suite name matches a symbol name (case-insensitive substring). Call before adding tests to see existing coverage and mirror its shape.
| Name | Type | Req | Description |
|---|---|---|---|
| commitSha | string | – | Pin reads to one indexed revision (7-40 hex). Graph tools error with revision_not_indexed when it is not an indexed revision of the scoped repository, or revision_not_servable when that revision's gr… |
| feedback | object | – | Optional: report how a previous answer worked out; piggybacks on any call. |
| projectId | string | – | Project id from init/list_projects. Omit for the active project. |
| repository | string | – | Repository full name, e.g. "owner/repo". Omit when the project has one repository. |
| selector | string | yes | Symbol name to match against test suite names. |
No output schema declared.
No examples provided.
locate ~665
Search/lookup. Pick a mode, or omit with a bare query to AUTO-ROUTE (text, then semantic on empty; response carries answered_by). Modes: - text (replaces grep): literal identifier/string, one row/occurrence. queries:[...] (<=10 terms) searches several in one call (and implies this mode when mode is omitted). pathsOnly:true = "filePath:lineNumber" only (~5x cheaper). maxPerFile caps rows/file (default 5). Empty carries did_you_mean; do NOT retry reworded, use semantic. - symbol: symbols by name/symbolPath in one repo. kind filters node kind, layer one layer. Tests last unless includeTests:true. - semantic: vector search for symbols similar to a natural-language query (names unknown). - file: fuzzy filename search (basename); filenames only. - config (replaces grep for env/config keys): key/env-var usages with nearest-symbol context; queries:[...] batches several keys. - codebase: cross-repo candidate scan; narrow with repositoryIds.
| Name | Type | Req | Description |
|---|---|---|---|
| commitSha | string | – | Pin an indexed revision (text/symbol/semantic/config; ignored by file/codebase). |
| feedback | object | – | Optional: report how a previous answer worked out; piggybacks on any call. |
| includeTests | boolean | – | text/symbol/semantic. Include test files. Default false ranks them last; auto-on for test queries. |
| kind | string | – | mode:symbol. Filter by node kind. |
| layer | string | – | mode:symbol. Scope to one layer (e.g. browser, node, common, test). |
| limit | integer | – | Max results. Per-mode caps apply (text 200/20, symbol 20, semantic 5, file 10, config 20/20, codebase 20/10). |
| maxPerFile | integer | – | mode:text. Cap occurrences/file (default 5; capped file carries moreInFileTruncated). 0 = uncapped. |
| mode | string | – | Force a mode. Omit + bare query = AUTO-ROUTE (text, then semantic on empty). queries without a mode implies text. |
| name | string | – | mode:file. Filename fragment; defaults to query. |
| pathPrefix | string | – | text/symbol/config. Restrict to paths under this prefix. |
| pathsOnly | boolean | – | mode:text. "filePath:lineNumber" only, no snippets (~5x fewer tokens). |
| projectId | string | – | Project id from init/list_projects. Omit for the active project. |
| queries | array | – | text/config. Up to 10 terms; interleaved, deduped, each tagged matchedQuery. Without an explicit mode, implies mode:text. Accepts a JSON-array string. |
| query | string | – | Search term or NL query. Required for symbol/semantic/codebase; text/config: query or queries; file: query or name. |
| repository | string | – | Single-repo scope (not codebase; that is project-wide, use repositoryIds). |
| repositoryIds | array | – | mode:codebase. Narrow to these repository ids; omit to scan all. |
No output schema declared.
No examples provided.
map ~446
Token-efficient repo (or subtree) skeleton: directory tree with each file's classes (methods in parens), functions, and HTTP endpoints, from the graph. Orient before drilling in. Scope with "path", cap with "maxDepth", density:"full" adds properties. view:"architecture" instead returns a module map (Louvain clusters with hubs, paths and cross-module coupling), plus namedModules/totalModules: a module NAME comes from a generated summary and is provisional, its id (the member-set hash in the header) is the stable key, so pin modules by id and re-read names rather than caching them.
| Name | Type | Req | Description |
|---|---|---|---|
| commitSha | string | – | Pin reads to one indexed revision (7-40 hex). Graph tools error with revision_not_indexed when it is not an indexed revision of the scoped repository, or revision_not_servable when that revision's gr… |
| density | string | – | "compact" (default): classes/methods/functions/endpoints. "full" adds properties. |
| feedback | object | – | Optional: report how a previous answer worked out; piggybacks on any call. |
| maxDepth | integer | – | Drop files deeper than this many path segments. Omit for no cap. |
| path | string | – | Repo-relative subtree (e.g. "src/v1/mcp"). Omit for the whole repo. |
| projectId | string | – | Project id from init/list_projects. Omit for the active project. |
| repository | string | – | Repository full name, e.g. "owner/repo". Omit when the project has one repository. |
| view | string | – | "tree" (default): file/symbol skeleton. "architecture": module map with hubs, coupling, cycles. Module names come from generated summaries: cite a module by its id (the member-set hash printed in the… |
No output schema declared.
No examples provided.
quick_lookup ~188
Fast substring lookup of symbol DEFINITIONS by name: rows {name, kind, filePath, startLine, repositoryName} (displayName only when distinct from name), no ranking, no semantic. Cheaper alternative to locate (mode:symbol) for latency-sensitive pre-fetch (grep-augment hook); interactive search should prefer locate/find_node. Reads the latest indexed revision, no ref pin.
| Name | Type | Req | Description |
|---|---|---|---|
| feedback | object | – | Optional: report how a previous answer worked out; piggybacks on any call. |
| limit | integer | – | Max results (max 20). |
| projectId | string | – | Project id from init/list_projects. Omit for the active project. |
| query | string | yes | Substring to match against symbol names (no ranking). |
| repository | string | – | Repository full name, e.g. "owner/repo". Omit when the project has one repository. |
No output schema declared.
No examples provided.
ref ~408
Session-scoped branch / working-tree overlay / project binding. Ops: - use: pin a repository's reads to a branch (latest indexed revision). Branch must be tracked+indexed (open a PR, or add on the dashboard); else "indexing_in_progress". commitSha overrides. - clear: remove the pin, revert to default. - index_working_tree: overlay UNCOMMITTED edits (changedFiles path+content, optional deletedPaths/baseSha) on a short-lived synthetic revision pinned here; find_node/locate/relate reflect them, source and locate mode:semantic do NOT. Cap 100 files/256KB. - use_project: bind this session to projectId (from init.otherProjects / list_projects / create_project) so calls without projectId resolve there. init with repository:"owner/name" sets the same binding from the checkout's remote. - clear_project: drop the binding, back to the workspace default project.
| Name | Type | Req | Description |
|---|---|---|---|
| baseSha | string | – | Indexed base your edits sit on. Omit for the default-branch tip. |
| branch | string | – | op:use. The tracked branch to pin. |
| changedFiles | array | – | Changed/added files with current contents, repo-relative paths. |
| deletedPaths | array | – | Repo-relative deleted paths. |
| feedback | object | – | Optional: report how a previous answer worked out; piggybacks on any call. |
| op | string | yes | use: pin reads to a tracked branch. clear: revert to the default branch. index_working_tree: overlay uncommitted edits on a synthetic revision and pin it. use_project: bind this session to projectId… |
| projectId | string | – | Project id from init/list_projects. Omit for the active project. |
| repository | string | – | Repository full name, e.g. "owner/repo". Omit when the project has one repository. |
No output schema declared.
No examples provided.
reindex_repository ~222
Dispatch a reindex job for an already-attached repository (repositoryId from list_repositories / add_repository). Optional commit_sha pin. force:true re-applies the current parser even when unchanged at HEAD: it bypasses the per-file hash-skip AND re-runs the SCIP indexer subprocesses (no same-sha .scip cache serve), so a parser fix inside a SCIP runner, an external-moniker re-pin, or a toolchain upgrade takes effect without a version bump.
| Name | Type | Req | Description |
|---|---|---|---|
| commit_sha | string | – | Pin to a commit (omit for latest) |
| feedback | object | – | Optional: report how a previous answer worked out; piggybacks on any call. |
| force | boolean | – | Re-parse every file AND re-run the SCIP indexer subprocesses even if unchanged at HEAD (for a parser fix without a version bump) |
| projectId | string | – | Project id from init/list_projects. Omit for the active project. |
| repositoryId | string | yes | Encoded repository ID (from list_repositories/add_repository) |
No output schema declared.
No examples provided.
relate ~996
Graph relationship traversal via one kind (real edges, not text). Kinds (1-10 symbols; heritage/chain one): - callers: direct callers. granularity:'file' (default) one row/file, 'site' one row/caller. - dependencies: outgoing calls/imports. - blast_radius: upstream impact walk (every caller, importer and referencer up to 3 hops, no per-hop sampling) + co-change siblings; risk {level,signals}. includeCrossRepo defaults ON here (off for others). blastRadiusTotalCount is the number of distinct symbols that 3-hop walk reached, not the row count: the blastRadius array is capped by expansionLimit. blastRadiusTruncated:true means the rows are a sample of that total; blastRadiusTotalAtLeast:true means the count stopped at its 10000 bound, so quote it as "N+". The walk stops at 3 hops, so it can miss impact further away; it never overcounts. Never report the number of listed rows as the impact size. - implementers: classes implementing interfaces via heritage edges. - heritage: full hierarchy (ancestors+descendants) of ONE type. maxDepth caps it. - chain: call-chain paths for a node (nodeId OR selectors[0]); chain params tune the walk. - path: shortest connection between selectors[0] (from) and selectors[1] (to). Direction-agnostic hop-labeled path; found:false when none within 6 hops. minimal:true = {id,name,filePath,startLine}-only (~50% cheaper) on callers/dependencies/blast_radius/implementers; granularity on callers/blast_radius. Rows may carry confidence (tiers in init usage); a cross-repo callers/dependencies row joined by a SCIP moniker also carries package (the package name that bridged the repos). 0 results: call locate (mode:text), not Grep; reason:"no_edges_indexed" = no edges.
| Name | Type | Req | Description |
|---|---|---|---|
| commitSha | string | – | Pin reads to one indexed revision (7-40 hex). Graph tools error with revision_not_indexed when it is not an indexed revision of the scoped repository, or revision_not_servable when that revision's gr… |
| depth | integer | – | chain. Chain length. |
| direction | string | – | chain. 'downstream' leaves, 'upstream' entry points, 'both' (default). |
| edgeFilter | string | – | chain. 'calls' | 'imports' | 'calls_imports' (default). |
| expansionLimit | integer | – | Caps returned count (not heritage/chain). Default 15. |
| feedback | object | – | Optional: report how a previous answer worked out; piggybacks on any call. |
| followPolymorphism | boolean | – | chain. Walk polymorphic dispatch edges (default false; untraversed hops in polymorphicBranchPoints). |
| granularity | string | – | callers/blast_radius. 'file' one row/file, 'site' one row/node. |
| includeCrossRepo | boolean | – | Walk cross-repo edges. Default true for blast_radius, false otherwise. |
| intent | string | – | Rerank by trigram similarity (not heritage/chain). |
| kind | string | – | Relationship to traverse. See the tool description for each kind. |
| landmarkFilter | string | – | chain. Keep only paths through a node matching this. |
| limit | integer | – | Per-selector candidate cap (not heritage/chain). |
| maxDepth | integer | – | Max depth for heritage; also caps the kind:path walk (clamped to <=6). |
| maxPaths | integer | – | chain. Cap on returned paths. |
| minimal | boolean | – | {id,name,filePath,startLine}-only, ~50% cheaper; not heritage/chain. |
| minimalImplementers | boolean | – | Alias of minimal for implementers. |
| nodeId | string | – | Start node for chain (OR selectors[0]). |
| projectId | string | – | Project id from init/list_projects. Omit for the active project. |
| pruneSetupMethods | boolean | – | chain. Drop framework bootstrap steps. |
| repository | string | – | Repository full name, e.g. "owner/repo". Omit when the project has one repository. |
| selectors | array | – | Symbols to traverse from (1-10). heritage uses selectors[0]; chain: OR nodeId. |
| staysWithinClass | boolean | – | chain. Surface intra-class dispatch order. |
| terminalFilter | string | – | chain. Restrict to paths ending at a node matching this. |
No output schema declared.
No examples provided.
source ~705
Raw file/git access at the indexed commit, for cloud agents with no clone; with a clone prefer your own Read/Grep/git. Ops: - read: content of filePath, whole file or slice startLine..endLine. ifHash (a prior read's hash) returns {unchanged:true}, no content. compact:true strips blank/comment-only lines. - list: files+subdirs at path. grep: ripgrep pattern (glob/pathPrefix). tree: layout from path. stat: size/lines/language/binary for filePath. blame: authorship for filePath. diff: fromSha..toSha. Keys: {op:"read",filePath:"src/a.ts"}, {op:"grep",pattern:"foo"}, {op:"list",path:"src"}. filePath is the file, path the directory. Gated by the Source Access add-on; else source_access_required.
| Name | Type | Req | Description |
|---|---|---|---|
| commitSha | string | – | Pin reads to one indexed revision (7-40 hex). Graph tools error with revision_not_indexed when it is not an indexed revision of the scoped repository, or revision_not_servable when that revision's gr… |
| compact | boolean | – | read: strip blank/comment-only lines (heuristic; content no longer maps 1:1 to lines). |
| endLine | integer | – | read/blame: last line, 1-based. |
| feedback | object | – | Optional: report how a previous answer worked out; piggybacks on any call. |
| filePath | string | – | read/stat/blame: the file to open (required; `path` is accepted as an alias). |
| fromSha | string | – | diff: base commit (required), reachable from the indexed branch. |
| glob | string | – | grep: limit to files matching this glob. |
| ifHash | string | – | read: a prior read's hash; if it still matches, returns {unchanged:true}, no content. |
| limit | integer | – | grep: max matches. |
| maxDepth | integer | – | tree: max recursion depth, default 3. |
| op | string | – | See the tool description for each op. Omitted: inferred from the other args (pattern -> grep, fromSha/toSha -> diff, filePath/path -> read, nothing -> list). |
| path | string | – | list/tree/diff: dir path in the repo (default root). On read/stat/blame it is read as filePath, on grep as pathPrefix. |
| pathPrefix | string | – | grep: limit to files under this prefix. |
| pattern | string | – | grep: ripgrep pattern (required; `query` is accepted as an alias). |
| projectId | string | – | Project id from init/list_projects. Omit for the active project. |
| query | string | – | grep: alias for pattern. |
| repository | string | – | Repository full name, e.g. "owner/repo". Omit when the project has one repository. |
| startLine | integer | – | read/blame: first line, 1-based. |
| toSha | string | – | diff: target commit (required), reachable from the indexed branch. |
No output schema declared.
No examples provided.
What is the Symvanta MCP server?
Symvanta is an MCP server listed in the public MCP registry as com.symvanta/code-graph. Hosted code graph over MCP: exact callers, dependencies, and cross-repo blast radius for AI agents. This page covers its hosted endpoint (https://mcp.symvanta.com/mcp).
Is the Symvanta MCP server safe to use?
Symvanta scores 88 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Symvanta MCP server expose?
Symvanta exposes 27 tools: init, locate, relate, source, history, and 22 more. Their descriptions and schemas cost roughly 8,506 tokens of context every time the server is loaded.
Does the Symvanta MCP server require authentication?
Yes. Symvanta asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the Symvanta MCP server still maintained?
Symvanta is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.