Koragraph
NPM · KORAGRAPHMCP · SCANNED SEP 20
Local multi-repo code graph over MCP. Blast radius, call graphs, and memory anchored to code.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security92
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs a script at install time (postinstall) that we could not recognise. It may be perfectly ordinary, but we do not read the published tarball, so we cannot say what it does. View diagnostics → Partial
- 21 of 53 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency32
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: the license (BUSL-1.1) isn't a recognized OSI-approved license. See how to fix → Fail
- Actively maintained (last published 9 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability59
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 5431 tokens (~603/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management50
- Stability observed for 15 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage95
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 85% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 9 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 10 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
How do I install the Koragraph MCP server?
Koragraph runs locally as an npm package, launched with npx -y koragraphmcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · koragraphmcp
claude mcp add in-koragraph-koragraph -- npx -y koragraphmcp
{
"mcpServers": {
"in-koragraph-koragraph": {
"command": "npx",
"args": [
"-y",
"koragraphmcp"
]
}
}
} {
"servers": {
"in-koragraph-koragraph": {
"command": "npx",
"args": [
"-y",
"koragraphmcp"
]
}
}
} codex mcp add in-koragraph-koragraph -- npx -y koragraphmcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"in-koragraph-koragraph": {
"type": "local",
"command": [
"npx",
"-y",
"koragraphmcp"
],
"enabled": true
}
}
} openclaw mcp add in-koragraph-koragraph --command npx --arg -y --arg koragraphmcp
mcp_servers:
in-koragraph-koragraph:
command: "npx"
args: ["-y", "koragraphmcp"] {
"McpServers": {
"in-koragraph-koragraph": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"koragraphmcp"
]
}
}
} assistant mcp add in-koragraph-koragraph -t stdio -c npx -a -y koragraphmcp
{
"mcpServers": {
"in-koragraph-koragraph": {
"command": "npx",
"args": [
"-y",
"koragraphmcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 47 to 50. That category is still filling its 30-day observation window: 14 days of observed history at the previous scan, 15 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 +3
- Stability: unverified → 0.27 ▲ functional
- 6 Sept 26 +15
- Malware scan: unverified → pass ▲ security
- 5 Sept 26 46
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/koragraphmcp@0.1.4
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| postinstall | unreviewed | node scripts/postinstall.js || true |
Background: Why install scripts are a supply-chain risk →
Dependencies 53 packages
| Packages resolved | 53 |
|---|---|
| Stale | 21 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
blast_radius Blast radius of a change ~293
What depends on the files you are about to change. Answers "if I edit these, what could break, and what is untested?". Walks reverse CALLS/IMPORTS/DEPENDS_ON/USES/REFERENCES edges from every declaration in the given files and returns a ranked, capped risk surface: nearest first, then callers with no visible test coverage first. Over-approximates on purpose — heuristic calls are included here, because a missed caller is worse than an extra one.
| Name | Type | Req | Description |
|---|---|---|---|
| depth | integer | – | Override the walk depth. Omit to let task_type decide (bugfix 1, refactor 3), or 2 with no task_type. |
| detail | string | – | concise (default): a one-line answer plus the ranked head, file:line kept on every row. full: every row and every field. |
| files_changed | array | yes | Repository-relative paths, exactly as they appear in the graph. |
| limit | integer | – | – |
| project_id | integer|string | – | Optional scope: a repository or project name exactly as overview prints it, or its numeric id. Omit when the graph holds one project. |
| task_type | string | – | What you are doing. bugfix tightens the walk to one hop and admits statistical co-change as a labelled hint; refactor widens it to three hops and admits guess-grade calls. Omit for the neutral projec… |
No output schema declared.
No examples provided.
changes_with What changes with this symbol ~282
Declaration-grain temporal coupling mined from git history: which functions have historically been edited in the same commits as this one. THIS IS NOT A CALL GRAPH. A CO_CHANGES edge is a statistical co-occurrence with no structural relationship implied — treat it as a hint about where else to look, never as evidence that one function invokes another. For structural relations use neighbours. Measured on a temporally split benchmark this lifted blast-radius recall@20 by 25%, but the gain was concentrated in one of four repositories and was flat in the other three. It is real and it is repo-dependent; weight it accordingly, and expect nothing at all on a repository with a short or squashed history.
| Name | Type | Req | Description |
|---|---|---|---|
| detail | string | – | concise (default): a one-line answer plus the ranked head, file:line kept on every row. full: every row and every field. |
| file | string | – | Optional disambiguator when the symbol name is defined in more than one place. Full path or basename. |
| limit | integer | – | – |
| project_id | integer|string | – | Optional scope: a repository or project name exactly as overview prints it, or its numeric id. Omit when the graph holds one project. |
| symbol | string | yes | Symbol name. Bare ("readAsCSV"), qualified ("Session.get"), or "file.go:readAsCSV". |
No output schema declared.
No examples provided.
explore Explore code ~196
Start here for the code itself, before grep/Read/find — call recall first if the symbol or an error looks like it might have bitten before. One call answers "how does X work / where do I change it": returns the ranked declarations for your query AND, for the top hits, their source, callers, and callees together — so you rarely need to open files, grep, or chain other tools. Use a symbol name or a plain-English phrase.
| Name | Type | Req | Description |
|---|---|---|---|
| detail | string | – | concise (default): a one-line answer plus the ranked head, file:line kept on every row. full: every row and every field. |
| project_id | integer|string | – | Optional scope: a repository or project name exactly as overview prints it, or its numeric id. Omit when the graph holds one project. |
| query | string | yes | A symbol name or a short plain-English description of what you want to understand or change. |
No output schema declared.
No examples provided.
file_symbols Symbols in a file ~138
Everything the graph extracted from one file, with line ranges. Answers "what is in here?" without reading the whole file, and gives you the exact symbol names the other tools want. Use it to disambiguate when neighbours reports a symbol defined in several places.
| Name | Type | Req | Description |
|---|---|---|---|
| detail | string | – | concise (default): a one-line answer plus the ranked head, file:line kept on every row. full: every row and every field. |
| limit | integer | – | – |
| node_types | array | – | Optional filter, e.g. ["METHOD","CLASS"]. |
| path | string | yes | Repository-relative path as it appears in the graph. |
No output schema declared.
No examples provided.
neighbours Neighbours of a symbol ~459
What is directly connected to this symbol. Answers "what calls this?" (direction "in") and "what does this call?" (direction "out"); both by default, because the inbound direction is the one you cannot get by reading the function body. Every relation carries the line it occurs on and how it was resolved, so you can tell a resolved call from an inferred one. Guess-grade edges (HEURISTIC_CALLS) and statistical co-change are excluded unless you ask for them; for co-change use changes_with instead. To trace a call chain, set depth > 1 and direction "out" (or "in" going backward) rather than calling neighbours again on each hop's result — one call then walks several hops and returns them tagged by hop number.
| Name | Type | Req | Description |
|---|---|---|---|
| depth | integer | – | Hops to walk outward from symbol. 1 (default): its direct neighbours only. >1: also walk that many hops further (each additional hop costs more graph lookups, not more round-trips) — use this to trac… |
| detail | string | – | concise (default): a one-line answer plus the ranked head, file:line kept on every row. full: every row and every field. |
| direction | string | – | – |
| edge_types | array | – | Optional allow-list, e.g. ["CALLS"]. Default: every non-heuristic relation type. |
| file | string | – | Optional disambiguator when the symbol name is defined in more than one place. Full path or basename. |
| include_cochange | boolean | – | Include CO_CHANGES. Off by default: it is a statistical relation, not a call. Prefer changes_with. |
| include_heuristic | boolean | – | Include HEURISTIC_CALLS — calls the resolver could not bind to one target. Guess-grade. |
| limit | integer | – | – |
| project_id | integer|string | – | Optional scope: a repository or project name exactly as overview prints it, or its numeric id. Omit when the graph holds one project. |
| symbol | string | yes | Symbol name. Bare ("readAsCSV"), qualified ("Session.get"), or "file.go:readAsCSV". |
No output schema declared.
No examples provided.
overview Orient in a repository ~167
What matters in this repository, without needing to know a name first. Every other tool needs a query or a symbol you already know; this is the one to call on your FIRST turn in an unfamiliar codebase, or before planning a change. Returns: the declarations the most code depends on (weighted by what the dependency is, and ignoring unresolved guesses); the declarations that historically change TOGETHER, mined from git history; import cycles; and the node and edge counts by type.
| Name | Type | Req | Description |
|---|---|---|---|
| detail | string | – | concise (default): a one-line answer plus the ranked head, file:line kept on every row. full: every row and every field. |
| limit | integer | – | – |
| repo | string | – | Repository name to scope to. Omit when the store holds one repository. |
No output schema declared.
No examples provided.
recall What we already know about this ~441
Call this FIRST — before explore or search_code — whenever a symbol is unfamiliar or an error looks like it might have bitten before. It is one fast call, and skipping it risks re-discovering something a past session on this machine already learned the hard way. Read koramemory — prior experience with this code that is NOT in the code: an attempt that failed and the fix that worked, a hazard that keeps recurring, a revert, a rule the developer stated outright. Captured from this machine's own sessions and git history, anchored to a declaration, and expired automatically when the code it describes changes. THIS IS NOT A CALL GRAPH AND NOT SOURCE CODE. It returns no structure and no bodies — for structure use explore or neighbours, and read the file for the code. Call it with NO symbol and NO file to get this repository's most trouble-prone areas — the symbols and files that have needed repeated fixing, ranked by how often they recurred — which is the way to answer "what breaks most here / where should I be careful" without a name. When `file` (or `file`+`symbol`) names something with an open situational note anchored to it — "hold off on this for now", "mid-audit" — that surfaces too, alongside any facts. Silence is the common answer and means nothing was recorded, not that nothing happened. Every fact carries a tier — law (the developer said so) outranks observation (mechanically derived) — provenance, and an id: `koragraph practice why <id>` shows what produced it, and a wrong one can be killed by that id.
| Name | Type | Req | Description |
|---|---|---|---|
| detail | string | – | concise (default): a one-line answer plus the ranked head, file:line kept on every row. full: every row and every field. |
| file | string | – | Repository-relative path. Use alone for file-level facts, or with symbol to disambiguate. |
| limit | integer | – | – |
| symbol | string | – | Symbol name to recall about. |
| task_type | string | – | What you are doing. Only reorders equally-ranked facts; it never hides one. |
No output schema declared.
No examples provided.
remember Remember this ~2,364
Save something about THIS repository to koramemory — the durable, code-anchored memory for this codebase — so it never has to be learned twice: a rule the developer stated, a hazard that cost real time, an approach that was tried and does not work. koramemory is where such a fact belongs, in preference to writing it into a notes or memory file, which cannot anchor to code and cannot expire when that code changes. When you save one, tell the developer you saved it to koramemory. Call this whenever the developer tells you how things are done here, corrects you, says "remember that" / "note that" / "from now on", or when you have just spent significant effort discovering something that is not visible in the code. Recording it is one call and it is cheap; call it before you reply. You supply the coordinates, not the developer. `symbol` is the one that matters: a fact anchored to a declaration follows it through a rename and dies with it, which is the whole reason this store beats a notes file. A fact anchored to a file, or to nothing, is a notes file with a path attached — it cannot expire and it will still be asserted long after the code it describes is gone. So: decide what declaration the rule is ABOUT and pass it as `symbol`. If you do not already know the name, look it up — you have explore and search_code, and one lookup is cheaper than a fact that can never expire. Reach for `file` only when you looked and no single declaration owns the rule, and for neither only when the rule is genuinely true of the whole repository ("we use commonjs everywhere", "never add a dependency without asking"). Those exist and are fine; what is not fine is defaulting to them because naming the declaration took a step. A rule that mentions a declaration is almost always ABOUT that declaration: "cacheSet takes ttl in milliseconds" is a fact about cacheSet, not a fact about the repository. The same applies to an open_loop when it is about something specific: "hold off on touching the pa…
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | – | The rule, in the developer's own words where they stated it. One sentence. Not a summary of the code. Omit entirely when this call is a `fact_id`/`confirm` verdict on an existing fact — there is noth… |
| confirm | boolean | – | Facts only (never an open_loop — that only ever takes `resolve`). Pair with `fact_id` (or a resolvable `symbol`/`file`): you just read the code behind an "(unconfirmed since …)" flag and it is still… |
| detail | string | – | concise (default): a one-line answer plus the ranked head, file:line kept on every row. full: every row and every field. |
| fact_id | – | – | Resolve a verdict against an EXISTING fact instead of storing a new one — pair with `confirm:true` (still accurate) or `verified:"contradicted"` (no longer accurate). One id, or an array to report on… |
| file | string | – | Repository-relative path this is about — the FALLBACK for when you looked and no single declaration owns the rule ("keep this file under 200 lines", a rule about a config or schema file). It is weake… |
| kind | string | – | law: the developer said so. hazard: this bites. ritual: how a command is run here. tombstone: tried and abandoned. correction: you were corrected. open_loop: a sticky note / unfinished task to resurf… |
| loop_id | integer | – | open_loop + resolve: the loop#N to close, if you have it. Otherwise the body is matched. |
| note | – | – | With verified:"contradicted"/"unverifiable" (either use above): one sentence on what you actually found (what the code does now, or why you could not tell). Shown next to the fact. Array form aligns… |
| repo | string | – | Name of the repository this is about, when your own working directory is NOT a checkout of it (a different project's session, a scratch/notes directory, a subagent). Omit when your cwd IS the repo th… |
| resolve | boolean | – | open_loop only: mark the loop DONE instead of opening one. Match by loop_id, or by restating its body. Idempotent — closing an already-closed loop is a no-op. |
| source | string | – | user: the developer stated it in this session. import: read out of an instruction file. Omit if unsure. |
| symbol | string | – | The declaration this fact is ABOUT — the coordinate to prefer over every other, and the only one that makes the fact expire on its own. A fact/hazard anchored here dies when that declaration is rewri… |
| verified | – | – | Two uses. (1) Importing a rule someone else wrote (a CLAUDE.md/AGENTS.md line) rather than stating your own — read the current code the rule names FIRST, then say what you found. "confirmed": you rea… |
No output schema declared.
No examples provided.
search_code Search code ~181
Find declarations by name, path, or description — before grepping the source tree. Answers "where is the code that does X?". Returns declarations with file paths and line numbers, ranked; it does not return source bodies — read the files yourself. This is the entry point: every other tool takes a symbol or a path you get from here.
| Name | Type | Req | Description |
|---|---|---|---|
| detail | string | – | concise (default): a one-line answer plus the ranked head, file:line kept on every row. full: every row and every field. |
| limit | integer | – | – |
| project_id | integer|string | – | Optional scope: a repository or project name exactly as overview prints it, or its numeric id. Omit when the graph holds one project. |
| query | string | yes | What you are looking for. A symbol name, a path fragment, or a short phrase. |
No output schema declared.
No examples provided.
What is the Koragraph MCP server?
Koragraph is an MCP server listed in the public MCP registry as in.koragraph/koragraph. Local multi-repo code graph over MCP. Blast radius, call graphs, and memory anchored to code. This page covers its npm package (koragraphmcp).
Is the Koragraph MCP server safe to use?
Koragraph scores 68 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Koragraph MCP server expose?
Koragraph exposes 9 tools: explore, search_code, neighbours, changes_with, blast_radius, and 4 more. Their descriptions and schemas cost roughly 4,521 tokens of context every time the server is loaded.
Is the Koragraph MCP server still maintained?
Koragraph is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Koragraph MCP server under?
Koragraph declares the BUSL-1.1 licence, which is not on the OSI-approved list. Read the terms before using it at work, and note this covers the source only, not the cost of any service it calls.