Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Koragraph

NPM · KORAGRAPHMCP · SCANNED SEP 20

Local multi-repo code graph over MCP. Blast radius, call graphs, and memory anchored to code.

Available components

+4 this week 68 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security92
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • Runs a script at install time (postinstall) that we could not recognise. It may be perfectly ordinary, but we do not read the published tarball, so we cannot say what it does. View diagnostics → Partial
  • 21 of 53 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency32
Schema Quality & AI Usability59
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 5431 tokens (~603/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management50
  • Stability observed for 15 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage95
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 85% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 9 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 10 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
  • Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Install

How do I install the Koragraph MCP server?

Koragraph runs locally as an npm package, launched with npx -y koragraphmcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · koragraphmcp

# add to Claude Code
claude mcp add in-koragraph-koragraph -- npx -y koragraphmcp
// .cursor/mcp.json
{
  "mcpServers": {
    "in-koragraph-koragraph": {
      "command": "npx",
      "args": [
        "-y",
        "koragraphmcp"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "in-koragraph-koragraph": {
      "command": "npx",
      "args": [
        "-y",
        "koragraphmcp"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add in-koragraph-koragraph -- npx -y koragraphmcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "in-koragraph-koragraph": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "koragraphmcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add in-koragraph-koragraph --command npx --arg -y --arg koragraphmcp
# ~/.hermes/config.yaml
mcp_servers:
  in-koragraph-koragraph:
    command: "npx"
    args: ["-y", "koragraphmcp"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "in-koragraph-koragraph": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "koragraphmcp"
      ]
    }
  }
}
# add to Vellum
assistant mcp add in-koragraph-koragraph -t stdio -c npx -a -y koragraphmcp
// mcp.json
{
  "mcpServers": {
    "in-koragraph-koragraph": {
      "command": "npx",
      "args": [
        "-y",
        "koragraphmcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 20 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 47 to 50. That category is still filling its 30-day observation window: 14 days of observed history at the previous scan, 15 at this one. The score rises as the window fills, whether or not the server changes.

  • 18 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.

  • 16 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.

  • 14 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

  • 13 Sept 26 +3
    • Stability: unverified → 0.27 functional
  • 6 Sept 26 +15
    • Malware scan: unverified → pass security
  • 5 Sept 26 46

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed npm/koragraphmcp@0.1.4

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Install scripts 1 script
Hook Tier Command
postinstall unreviewed node scripts/postinstall.js || true

Background: Why install scripts are a supply-chain risk →

Dependencies 53 packages
Packages resolved 53
Stale 21
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 9 exposed · ~4,521 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
blast_radius ~293

What depends on the files you are about to change. Answers "if I edit these, what could break, and what is untested?". Walks reverse CALLS/IMPORTS/DEPENDS_ON/USES/REFERENCES edges from every declaration in the given files and returns a ranked, capped risk surface: nearest first, then callers with no visible test coverage first. Over-approximates on purpose — heuristic calls are included here, because a missed caller is worse than an extra one.

NameTypeReqDescription
depthintegerOverride the walk depth. Omit to let task_type decide (bugfix 1, refactor 3), or 2 with no task_type.
detailstringconcise (default): a one-line answer plus the ranked head, file:line kept on every row. full: every row and every field.
files_changedarrayyesRepository-relative paths, exactly as they appear in the graph.
limitinteger
project_idinteger|stringOptional scope: a repository or project name exactly as overview prints it, or its numeric id. Omit when the graph holds one project.
task_typestringWhat you are doing. bugfix tightens the walk to one hop and admits statistical co-change as a labelled hint; refactor widens it to three hops and admits guess-grade calls. Omit for the neutral projec…

No output schema declared.

No examples provided.

changes_with ~282

Declaration-grain temporal coupling mined from git history: which functions have historically been edited in the same commits as this one. THIS IS NOT A CALL GRAPH. A CO_CHANGES edge is a statistical co-occurrence with no structural relationship implied — treat it as a hint about where else to look, never as evidence that one function invokes another. For structural relations use neighbours. Measured on a temporally split benchmark this lifted blast-radius recall@20 by 25%, but the gain was concentrated in one of four repositories and was flat in the other three. It is real and it is repo-dependent; weight it accordingly, and expect nothing at all on a repository with a short or squashed history.

NameTypeReqDescription
detailstringconcise (default): a one-line answer plus the ranked head, file:line kept on every row. full: every row and every field.
filestringOptional disambiguator when the symbol name is defined in more than one place. Full path or basename.
limitinteger
project_idinteger|stringOptional scope: a repository or project name exactly as overview prints it, or its numeric id. Omit when the graph holds one project.
symbolstringyesSymbol name. Bare ("readAsCSV"), qualified ("Session.get"), or "file.go:readAsCSV".

No output schema declared.

No examples provided.

explore ~196

Start here for the code itself, before grep/Read/find — call recall first if the symbol or an error looks like it might have bitten before. One call answers "how does X work / where do I change it": returns the ranked declarations for your query AND, for the top hits, their source, callers, and callees together — so you rarely need to open files, grep, or chain other tools. Use a symbol name or a plain-English phrase.

NameTypeReqDescription
detailstringconcise (default): a one-line answer plus the ranked head, file:line kept on every row. full: every row and every field.
project_idinteger|stringOptional scope: a repository or project name exactly as overview prints it, or its numeric id. Omit when the graph holds one project.
querystringyesA symbol name or a short plain-English description of what you want to understand or change.

No output schema declared.

No examples provided.

file_symbols ~138

Everything the graph extracted from one file, with line ranges. Answers "what is in here?" without reading the whole file, and gives you the exact symbol names the other tools want. Use it to disambiguate when neighbours reports a symbol defined in several places.

NameTypeReqDescription
detailstringconcise (default): a one-line answer plus the ranked head, file:line kept on every row. full: every row and every field.
limitinteger
node_typesarrayOptional filter, e.g. ["METHOD","CLASS"].
pathstringyesRepository-relative path as it appears in the graph.

No output schema declared.

No examples provided.

neighbours ~459

What is directly connected to this symbol. Answers "what calls this?" (direction "in") and "what does this call?" (direction "out"); both by default, because the inbound direction is the one you cannot get by reading the function body. Every relation carries the line it occurs on and how it was resolved, so you can tell a resolved call from an inferred one. Guess-grade edges (HEURISTIC_CALLS) and statistical co-change are excluded unless you ask for them; for co-change use changes_with instead. To trace a call chain, set depth > 1 and direction "out" (or "in" going backward) rather than calling neighbours again on each hop's result — one call then walks several hops and returns them tagged by hop number.

NameTypeReqDescription
depthintegerHops to walk outward from symbol. 1 (default): its direct neighbours only. >1: also walk that many hops further (each additional hop costs more graph lookups, not more round-trips) — use this to trac…
detailstringconcise (default): a one-line answer plus the ranked head, file:line kept on every row. full: every row and every field.
directionstring
edge_typesarrayOptional allow-list, e.g. ["CALLS"]. Default: every non-heuristic relation type.
filestringOptional disambiguator when the symbol name is defined in more than one place. Full path or basename.
include_cochangebooleanInclude CO_CHANGES. Off by default: it is a statistical relation, not a call. Prefer changes_with.
include_heuristicbooleanInclude HEURISTIC_CALLS — calls the resolver could not bind to one target. Guess-grade.
limitinteger
project_idinteger|stringOptional scope: a repository or project name exactly as overview prints it, or its numeric id. Omit when the graph holds one project.
symbolstringyesSymbol name. Bare ("readAsCSV"), qualified ("Session.get"), or "file.go:readAsCSV".

No output schema declared.

No examples provided.

overview ~167

What matters in this repository, without needing to know a name first. Every other tool needs a query or a symbol you already know; this is the one to call on your FIRST turn in an unfamiliar codebase, or before planning a change. Returns: the declarations the most code depends on (weighted by what the dependency is, and ignoring unresolved guesses); the declarations that historically change TOGETHER, mined from git history; import cycles; and the node and edge counts by type.

NameTypeReqDescription
detailstringconcise (default): a one-line answer plus the ranked head, file:line kept on every row. full: every row and every field.
limitinteger
repostringRepository name to scope to. Omit when the store holds one repository.

No output schema declared.

No examples provided.

recall ~441

Call this FIRST — before explore or search_code — whenever a symbol is unfamiliar or an error looks like it might have bitten before. It is one fast call, and skipping it risks re-discovering something a past session on this machine already learned the hard way. Read koramemory — prior experience with this code that is NOT in the code: an attempt that failed and the fix that worked, a hazard that keeps recurring, a revert, a rule the developer stated outright. Captured from this machine's own sessions and git history, anchored to a declaration, and expired automatically when the code it describes changes. THIS IS NOT A CALL GRAPH AND NOT SOURCE CODE. It returns no structure and no bodies — for structure use explore or neighbours, and read the file for the code. Call it with NO symbol and NO file to get this repository's most trouble-prone areas — the symbols and files that have needed repeated fixing, ranked by how often they recurred — which is the way to answer "what breaks most here / where should I be careful" without a name. When `file` (or `file`+`symbol`) names something with an open situational note anchored to it — "hold off on this for now", "mid-audit" — that surfaces too, alongside any facts. Silence is the common answer and means nothing was recorded, not that nothing happened. Every fact carries a tier — law (the developer said so) outranks observation (mechanically derived) — provenance, and an id: `koragraph practice why <id>` shows what produced it, and a wrong one can be killed by that id.

NameTypeReqDescription
detailstringconcise (default): a one-line answer plus the ranked head, file:line kept on every row. full: every row and every field.
filestringRepository-relative path. Use alone for file-level facts, or with symbol to disambiguate.
limitinteger
symbolstringSymbol name to recall about.
task_typestringWhat you are doing. Only reorders equally-ranked facts; it never hides one.

No output schema declared.

No examples provided.

remember ~2,364

Save something about THIS repository to koramemory — the durable, code-anchored memory for this codebase — so it never has to be learned twice: a rule the developer stated, a hazard that cost real time, an approach that was tried and does not work. koramemory is where such a fact belongs, in preference to writing it into a notes or memory file, which cannot anchor to code and cannot expire when that code changes. When you save one, tell the developer you saved it to koramemory. Call this whenever the developer tells you how things are done here, corrects you, says "remember that" / "note that" / "from now on", or when you have just spent significant effort discovering something that is not visible in the code. Recording it is one call and it is cheap; call it before you reply. You supply the coordinates, not the developer. `symbol` is the one that matters: a fact anchored to a declaration follows it through a rename and dies with it, which is the whole reason this store beats a notes file. A fact anchored to a file, or to nothing, is a notes file with a path attached — it cannot expire and it will still be asserted long after the code it describes is gone. So: decide what declaration the rule is ABOUT and pass it as `symbol`. If you do not already know the name, look it up — you have explore and search_code, and one lookup is cheaper than a fact that can never expire. Reach for `file` only when you looked and no single declaration owns the rule, and for neither only when the rule is genuinely true of the whole repository ("we use commonjs everywhere", "never add a dependency without asking"). Those exist and are fine; what is not fine is defaulting to them because naming the declaration took a step. A rule that mentions a declaration is almost always ABOUT that declaration: "cacheSet takes ttl in milliseconds" is a fact about cacheSet, not a fact about the repository. The same applies to an open_loop when it is about something specific: "hold off on touching the pa…

NameTypeReqDescription
bodystringThe rule, in the developer's own words where they stated it. One sentence. Not a summary of the code. Omit entirely when this call is a `fact_id`/`confirm` verdict on an existing fact — there is noth…
confirmbooleanFacts only (never an open_loop — that only ever takes `resolve`). Pair with `fact_id` (or a resolvable `symbol`/`file`): you just read the code behind an "(unconfirmed since …)" flag and it is still…
detailstringconcise (default): a one-line answer plus the ranked head, file:line kept on every row. full: every row and every field.
fact_idResolve a verdict against an EXISTING fact instead of storing a new one — pair with `confirm:true` (still accurate) or `verified:"contradicted"` (no longer accurate). One id, or an array to report on…
filestringRepository-relative path this is about — the FALLBACK for when you looked and no single declaration owns the rule ("keep this file under 200 lines", a rule about a config or schema file). It is weake…
kindstringlaw: the developer said so. hazard: this bites. ritual: how a command is run here. tombstone: tried and abandoned. correction: you were corrected. open_loop: a sticky note / unfinished task to resurf…
loop_idintegeropen_loop + resolve: the loop#N to close, if you have it. Otherwise the body is matched.
noteWith verified:"contradicted"/"unverifiable" (either use above): one sentence on what you actually found (what the code does now, or why you could not tell). Shown next to the fact. Array form aligns…
repostringName of the repository this is about, when your own working directory is NOT a checkout of it (a different project's session, a scratch/notes directory, a subagent). Omit when your cwd IS the repo th…
resolvebooleanopen_loop only: mark the loop DONE instead of opening one. Match by loop_id, or by restating its body. Idempotent — closing an already-closed loop is a no-op.
sourcestringuser: the developer stated it in this session. import: read out of an instruction file. Omit if unsure.
symbolstringThe declaration this fact is ABOUT — the coordinate to prefer over every other, and the only one that makes the fact expire on its own. A fact/hazard anchored here dies when that declaration is rewri…
verifiedTwo uses. (1) Importing a rule someone else wrote (a CLAUDE.md/AGENTS.md line) rather than stating your own — read the current code the rule names FIRST, then say what you found. "confirmed": you rea…

No output schema declared.

No examples provided.

search_code ~181

Find declarations by name, path, or description — before grepping the source tree. Answers "where is the code that does X?". Returns declarations with file paths and line numbers, ranked; it does not return source bodies — read the files yourself. This is the entry point: every other tool takes a symbol or a path you get from here.

NameTypeReqDescription
detailstringconcise (default): a one-line answer plus the ranked head, file:line kept on every row. full: every row and every field.
limitinteger
project_idinteger|stringOptional scope: a repository or project name exactly as overview prints it, or its numeric id. Omit when the graph holds one project.
querystringyesWhat you are looking for. A symbol name, a path fragment, or a short phrase.

No output schema declared.

No examples provided.

Common questions

What is the Koragraph MCP server?

Koragraph is an MCP server listed in the public MCP registry as in.koragraph/koragraph. Local multi-repo code graph over MCP. Blast radius, call graphs, and memory anchored to code. This page covers its npm package (koragraphmcp).

Is the Koragraph MCP server safe to use?

Koragraph scores 68 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Koragraph MCP server expose?

Koragraph exposes 9 tools: explore, search_code, neighbours, changes_with, blast_radius, and 4 more. Their descriptions and schemas cost roughly 4,521 tokens of context every time the server is loaded.

Is the Koragraph MCP server still maintained?

Koragraph is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Koragraph MCP server under?

Koragraph declares the BUSL-1.1 licence, which is not on the OSI-approved list. Read the terms before using it at work, and note this covers the source only, not the cost of any service it calls.