code-graph

Use to see who calls X right now. Direct callers of a function / method / class (one level: CALLS, INSTANTIATES, dispatch and framework edges into it), each with the call site file:line and confidence. For the full chain up to entry points use impact().

Use when cg finds nothing or you need to know if a file is indexed. Which languages and files this index covers. Per language: parser mode (exact, heuristic only when an exact-mode indexer such as rust-analyzer or scip-clang is missing, skipped when the toolchain is missing, with the install hint) and file completeness (discovered vs indexed, with parse failures, files over the size limit, unmapped files outside the source roots, excluded files); unsupported source types by extension or shebang (.go .qml .sh ...); blind spots: route / handler registrations cg does not model, with file:line. path (optional): a file or directory; says whether cg has it in the graph. all_files: list every file per bucket (default: the first 5). json_output: the completeness object as JSON. Not covered, heuristic or a blind spot means: use your normal search and file reading for that part.

Use to see what X ends up calling or reading (page -> routes -> tables). Forward dependencies of a node. On a combined graph a frontend page goes page -> composables/components -> HTTP endpoints -> backend routes -> controllers/services -> tables. Lists backend routes, tables touched (directly or via columns), columns, connections, config/env keys, each with one shortest evidence path. target: page:/reports/:id | app/pages/x.vue | Class::method | ... platform: only code built for that target (windows, linux, macos, ios, android, web): code under a platform condition that is false there (#[cfg], #if, Platform.OS / Platform.isX, kIsWeb, .ios.ts / .android.ts files, Dart conditional imports) is left out; the reply's first line names the filter and how many conditions could not be evaluated (those stay in).

Start here for a broad question ("how does X work") or a spec you have not pinned down. Resolves a few symbols and returns their source, entry points, call paths and blast radius in one call, inside budget_tokens. Prefer this over impact, downstream, path and snippet until you know which symbol matters. The reply ends with the fine-grained calls to run next. max_symbols caps how many matches are expanded (default 4).

Use when unsure which graph a question belongs to. Lists the graphs this server can query: name, repo roots, languages, indexed commit and freshness. One `cg-mcp` process serves every registered graph. Pass `graph` to other tools to choose one, or omit it and the server resolves from a path in the call, then MCP roots or the working directory, then the configured default. An ambiguous choice returns the list instead of guessing.

Use before editing a function: what a change to it affects. Reverse callers of a method (Class::method, short or FQN) up to entry points, with the shortest call path from each entry point. platform: only code built for that target (windows, linux, macos, ios, android, web): code under a platform condition that is false there (#[cfg], #if, Platform.OS / Platform.isX, kIsWeb, .ios.ts / .android.ts files, Dart conditional imports) is left out; the reply's first line names the filter and how many conditions could not be evaluated (those stay in).

Use after editing so later answers see the change. Re-index (static analysis only: never boots the app or touches a database). On a combined graph (any number of repos): with no arguments every repo is re-indexed from its recorded root and the cross-repo link is rebuilt; repo (a name used at link time) re-indexes just that repo; root is matched to the recorded repo roots (a repo directory, a path inside one, or a parent of several). A root that matches no repo, or a result with 0 nodes, is refused and the graph is left unchanged. On a single-repo graph root defaults to the indexed root; gates is a gate-scenario JSON path (defaults to the server's --gates). The project config file (.cg.yaml at the root) is read on every re-index; Python source roots given with `cg index --python-root` and `--include-generated` are kept. Generated, copied and vendored files stay out of the graph (the coverage tool lists them) unless the graph was indexed with --include-generated or .cg.yaml sets generated.include.

Use to inspect a symbol without reading its file. Details of one node: kind, FQN, file:line span, module, entry kinds, docblock (PHPDoc), and edge counts by kind (in/out) with a few neighbours. Specs: Class::method | file#name | table.column | table:<t> | route:<METHOD> <uri> | env:<KEY> | page:/path (more: resource cg://guide).

Use to answer "how does A reach B". Shortest forward evidence chain from source to target (e.g. page:/reports/:id -> SalesReportService::report), one hop per line with file:line and confidence. platform: only code built for that target (windows, linux, macos, ios, android, web): code under a platform condition that is false there (#[cfg], #if, Platform.OS / Platform.isX, kIsWeb, .ios.ts / .android.ts files, Dart conditional imports) is left out; the reply's first line names the filter and how many conditions could not be evaluated (those stay in).

Use before changing a column, table, connection, env key or symbol: everything that depends on it. Reverse transitive dependents of one or more targets (union), e.g. ["orders.customer_id", "connection:warehouse", "connection:tenant_*"]. Groups: RUNTIME (live; reached from http routes/schedules/jobs/listeners, or main()/exported FFI symbols in Rust/C/C++), LIBRARY (only via a library's public API), DEV (only tests/benches/examples/build scripts), OPERATOR (artisan commands / admin panels only: one-off import & provisioning), GATED (dead under the indexed gate scenario, e.g. code that only runs while a feature flag is off), NO-ENTRY. Inside each group items are grouped by `group_by` = module | entry_kind | class. Each line: symbol, entry kinds, depth, shortest evidence path (hops KIND@file:line; ~r = resolved, ~h = heuristic confidence). At most `max_per_group` lines per top-level group (shallowest first). min_confidence: heuristic | resolved | exact. A hop on a database connection other than the default shows `conn=<name>` (dynamic names as a pattern, `?` when it cannot be resolved). connection: only the table / column edges that go to that connection (a dynamic name by its pattern, e.g. `legacy_{store.id}`); no match lists the connections seen. platform: only code built for that target (windows, linux, macos, ios, android, web): code under a platform condition that is false there (#[cfg], #if, Platform.OS / Platform.isX, kIsWeb, .ios.ts / .android.ts files, Dart conditional imports) is left out; the reply's first line names the filter and how many conditions could not be evaluated (those stay in).

Use for route, auth and middleware questions. Routes with their middleware / guards / auth, in one call. Optional scope: writes="*" (routes that reach any DB write) or writes="<table>", reaches=[specs] (routes that reach any of these nodes: table, column, connection, method, env key...). Optional filters: missing="<name>" keeps routes with no guard whose name contains it (e.g. "auth:api", "ApiKeyGuard"), unguarded=true keeps routes with no auth guard (the framework presets' auth guards and the auth name pattern; extend with auth_pattern, a regex, or .cg.yaml auth.extra_patterns). An unconditional inline check on a Laravel action (authorize, Gate, a permission check, FormRequest::authorize, controller middleware, a shared-secret compare) is listed under guards as `inline:` and counts for unguarded. strict=true with unguarded counts only route-level guards. Each route: guards, what it reaches with one evidence chain, and the frontend callers on a combined graph. Guards come from Laravel middleware, Nest guards/interceptors, Express/Koa/Fastify/Hono/Elysia middleware, Next.js middleware.ts / handler wrappers, django-ninja auth= and Django/DRF view access checks. min_confidence: keep the default (heuristic) for reviews: every edge still shows its own label, and a stricter level names the routes it hides. platform: only code built for that target (windows, linux, macos, ios, android, web): code under a platform condition that is false there (#[cfg], #if, Platform.OS / Platform.isX, kIsWeb, .ios.ts / .android.ts files, Dart conditional imports) is left out; the reply's first line names the filter and how many conditions could not be evaluated (those stay in).

Use first to find a symbol instead of grep. Finds nodes by name / FQN substring (case-insensitive), optionally filtered by kind (class, method, route, command, table, column, connection, config, env, job, admin...). Also matches route middleware, guards, auth and access checks (e.g. "auth" finds `auth:api`, `ApiKeyGuard`, `IsAuthenticated`) and lists the routes that carry them. Platform-specific symbols carry their targets, e.g. `[ios, android]`. platform: only code built for that target (windows, linux, macos, ios, android, web): code under a platform condition that is false there (#[cfg], #if, Platform.OS / Platform.isX, kIsWeb, .ios.ts / .android.ts files, Dart conditional imports) is left out; the reply's first line names the filter and how many conditions could not be evaluated (those stay in).

Use instead of opening a whole file. Source of one symbol: a `path:start-end` header then the body with line numbers. Resolves a node id or a symbol / FQN (as node() and search() do); an ambiguous name lists the candidates instead of guessing. context adds lines around the span; max_lines caps the body (truncation noted).