# Koragraph (npm · koragraphmcp)

Local multi-repo code graph over MCP. Blast radius, call graphs, and memory anchored to code.

- Trust score: 68/100 (medium)
- Change this week: +4
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-20

## Components

- npm · `koragraphmcp`: 68/100 (this document), [markdown](https://verifymcp.io/servers/in-koragraph-koragraph/koragraphmcp.md), [page](https://verifymcp.io/servers/in-koragraph-koragraph/koragraphmcp)

## Channel facts

- Registry: `npm`
- Package: `koragraphmcp`
- Version: `0.1.4`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-20.

- **Supply Chain Security**: 92/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - Runs a script at install time (postinstall) that we could not recognise. It may be perfectly ordinary, but we do not read the published tarball, so we cannot say what it does.
  - 21 of 53 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 32/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - License check failed: the license (BUSL-1.1) isn't a recognized OSI-approved license.
  - Actively maintained (last published 9 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 59/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 5431 tokens (~603/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 50/100
  - Stability observed for 15 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 95/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 85% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 9 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 10 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### How do I install the Koragraph MCP server?

Koragraph runs locally as an npm package, launched with npx -y koragraphmcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add in-koragraph-koragraph -- npx -y koragraphmcp
```

### Cursor

```json
{
  "mcpServers": {
    "in-koragraph-koragraph": {
      "command": "npx",
      "args": [
        "-y",
        "koragraphmcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "in-koragraph-koragraph": {
      "command": "npx",
      "args": [
        "-y",
        "koragraphmcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add in-koragraph-koragraph -- npx -y koragraphmcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "in-koragraph-koragraph": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "koragraphmcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add in-koragraph-koragraph --command npx --arg -y --arg koragraphmcp
```

### Hermes

```yaml
mcp_servers:
  in-koragraph-koragraph:
    command: "npx"
    args: ["-y", "koragraphmcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "in-koragraph-koragraph": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "koragraphmcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add in-koragraph-koragraph -t stdio -c npx -a -y koragraphmcp
```

### Other

```json
{
  "mcpServers": {
    "in-koragraph-koragraph": {
      "command": "npx",
      "args": [
        "-y",
        "koragraphmcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-20 (score 68, +1)

No change was recorded against any check on this day. Stability & Change Management went from 47 to 50. That category is still filling its 30-day observation window: 14 days of observed history at the previous scan, 15 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-18 (score 67, +1)

No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-16 (score 66, +1)

No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-14 (score 65, +1)

No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-13 (score 64, +3)

- [functional improvement] Stability: unverified → 0.27

### 2026-09-06 (score 61, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-09-05 (score 46)

First indexed and scored.

## MCP tools (9)

### `explore` (~196 tokens)

Explore code

Start here for the code itself, before grep/Read/find — call recall first if the symbol or an error looks like it might have bitten before. One call answers "how does X work / where do I change it": returns the ranked declarations for your query AND, for the top hits, their source, callers, and callees together — so you rarely need to open files, grep, or chain other tools. Use a symbol name or a plain-English phrase.

Input parameters:

- `detail` (string): concise (default): a one-line answer plus the ranked head, file:line kept on every row. full: every row and every field.
- `project_id` (integer|string): Optional scope: a repository or project name exactly as overview prints it, or its numeric id. Omit when the graph holds one project.
- `query` (string, required): A symbol name or a short plain-English description of what you want to understand or change.

### `search_code` (~181 tokens)

Search code

Find declarations by name, path, or description — before grepping the source tree. Answers "where is the code that does X?". Returns declarations with file paths and line numbers, ranked; it does not return source bodies — read the files yourself. This is the entry point: every other tool takes a symbol or a path you get from here.

Input parameters:

- `detail` (string): concise (default): a one-line answer plus the ranked head, file:line kept on every row. full: every row and every field.
- `limit` (integer)
- `project_id` (integer|string): Optional scope: a repository or project name exactly as overview prints it, or its numeric id. Omit when the graph holds one project.
- `query` (string, required): What you are looking for. A symbol name, a path fragment, or a short phrase.

### `neighbours` (~459 tokens)

Neighbours of a symbol

What is directly connected to this symbol. Answers "what calls this?" (direction "in") and "what does this call?" (direction "out"); both by default, because the inbound direction is the one you cannot get by reading the function body. Every relation carries the line it occurs on and how it was resolved, so you can tell a resolved call from an inferred one. Guess-grade edges (HEURISTIC_CALLS) and statistical co-change are excluded unless you ask for them; for co-change use changes_with instead. To trace a call chain, set depth > 1 and direction "out" (or "in" going backward) rather than calling neighbours again on each hop's result — one call then walks several hops and returns them tagged by hop number.

Input parameters:

- `depth` (integer): Hops to walk outward from symbol. 1 (default): its direct neighbours only. >1: also walk that many hops further (each additional hop costs more graph lookups, not more round-trips) — use this to trac…
- `detail` (string): concise (default): a one-line answer plus the ranked head, file:line kept on every row. full: every row and every field.
- `direction` (string)
- `edge_types` (array): Optional allow-list, e.g. ["CALLS"]. Default: every non-heuristic relation type.
- `file` (string): Optional disambiguator when the symbol name is defined in more than one place. Full path or basename.
- `include_cochange` (boolean): Include CO_CHANGES. Off by default: it is a statistical relation, not a call. Prefer changes_with.
- `include_heuristic` (boolean): Include HEURISTIC_CALLS — calls the resolver could not bind to one target. Guess-grade.
- `limit` (integer)
- `project_id` (integer|string): Optional scope: a repository or project name exactly as overview prints it, or its numeric id. Omit when the graph holds one project.
- `symbol` (string, required): Symbol name. Bare ("readAsCSV"), qualified ("Session.get"), or "file.go:readAsCSV".

### `changes_with` (~282 tokens)

What changes with this symbol

Declaration-grain temporal coupling mined from git history: which functions have historically been edited in the same commits as this one. THIS IS NOT A CALL GRAPH. A CO_CHANGES edge is a statistical co-occurrence with no structural relationship implied — treat it as a hint about where else to look, never as evidence that one function invokes another. For structural relations use neighbours. Measured on a temporally split benchmark this lifted blast-radius recall@20 by 25%, but the gain was concentrated in one of four repositories and was flat in the other three. It is real and it is repo-dependent; weight it accordingly, and expect nothing at all on a repository with a short or squashed history.

Input parameters:

- `detail` (string): concise (default): a one-line answer plus the ranked head, file:line kept on every row. full: every row and every field.
- `file` (string): Optional disambiguator when the symbol name is defined in more than one place. Full path or basename.
- `limit` (integer)
- `project_id` (integer|string): Optional scope: a repository or project name exactly as overview prints it, or its numeric id. Omit when the graph holds one project.
- `symbol` (string, required): Symbol name. Bare ("readAsCSV"), qualified ("Session.get"), or "file.go:readAsCSV".

### `blast_radius` (~293 tokens)

Blast radius of a change

What depends on the files you are about to change. Answers "if I edit these, what could break, and what is untested?". Walks reverse CALLS/IMPORTS/DEPENDS_ON/USES/REFERENCES edges from every declaration in the given files and returns a ranked, capped risk surface: nearest first, then callers with no visible test coverage first. Over-approximates on purpose — heuristic calls are included here, because a missed caller is worse than an extra one.

Input parameters:

- `depth` (integer): Override the walk depth. Omit to let task_type decide (bugfix 1, refactor 3), or 2 with no task_type.
- `detail` (string): concise (default): a one-line answer plus the ranked head, file:line kept on every row. full: every row and every field.
- `files_changed` (array, required): Repository-relative paths, exactly as they appear in the graph.
- `limit` (integer)
- `project_id` (integer|string): Optional scope: a repository or project name exactly as overview prints it, or its numeric id. Omit when the graph holds one project.
- `task_type` (string): What you are doing. bugfix tightens the walk to one hop and admits statistical co-change as a labelled hint; refactor widens it to three hops and admits guess-grade calls. Omit for the neutral projec…

### `recall` (~441 tokens)

What we already know about this

Call this FIRST — before explore or search_code — whenever a symbol is unfamiliar or an error looks like it might have bitten before. It is one fast call, and skipping it risks re-discovering something a past session on this machine already learned the hard way. Read koramemory — prior experience with this code that is NOT in the code: an attempt that failed and the fix that worked, a hazard that keeps recurring, a revert, a rule the developer stated outright. Captured from this machine's own sessions and git history, anchored to a declaration, and expired automatically when the code it describes changes. THIS IS NOT A CALL GRAPH AND NOT SOURCE CODE. It returns no structure and no bodies — for structure use explore or neighbours, and read the file for the code. Call it with NO symbol and NO file to get this repository's most trouble-prone areas — the symbols and files that have needed repeated fixing, ranked by how often they recurred — which is the way to answer "what breaks most here / where should I be careful" without a name. When `file` (or `file`+`symbol`) names something with an open situational note anchored to it — "hold off on this for now", "mid-audit" — that surfaces too, alongside any facts. Silence is the common answer and means nothing was recorded, not that nothing happened. Every fact carries a tier — law (the developer said so) outranks observation (mechanically derived) — provenance, and an id: `koragraph practice why <id>` shows what produced it, and a wrong one can be killed by that id.

Input parameters:

- `detail` (string): concise (default): a one-line answer plus the ranked head, file:line kept on every row. full: every row and every field.
- `file` (string): Repository-relative path. Use alone for file-level facts, or with symbol to disambiguate.
- `limit` (integer)
- `symbol` (string): Symbol name to recall about.
- `task_type` (string): What you are doing. Only reorders equally-ranked facts; it never hides one.

### `remember` (~2364 tokens)

Remember this

Save something about THIS repository to koramemory — the durable, code-anchored memory for this codebase — so it never has to be learned twice: a rule the developer stated, a hazard that cost real time, an approach that was tried and does not work. koramemory is where such a fact belongs, in preference to writing it into a notes or memory file, which cannot anchor to code and cannot expire when that code changes. When you save one, tell the developer you saved it to koramemory. Call this whenever the developer tells you how things are done here, corrects you, says "remember that" / "note that" / "from now on", or when you have just spent significant effort discovering something that is not visible in the code. Recording it is one call and it is cheap; call it before you reply. You supply the coordinates, not the developer. `symbol` is the one that matters: a fact anchored to a declaration follows it through a rename and dies with it, which is the whole reason this store beats a notes file. A fact anchored to a file, or to nothing, is a notes file with a path attached — it cannot expire and it will still be asserted long after the code it describes is gone. So: decide what declaration the rule is ABOUT and pass it as `symbol`. If you do not already know the name, look it up — you have explore and search_code, and one lookup is cheaper than a fact that can never expire. Reach for `file` only when you looked and no single declaration owns the rule, and for neither only when the rule is genuinely true of the whole repository ("we use commonjs everywhere", "never add a dependency without asking"). Those exist and are fine; what is not fine is defaulting to them because naming the declaration took a step. A rule that mentions a declaration is almost always ABOUT that declaration: "cacheSet takes ttl in milliseconds" is a fact about cacheSet, not a fact about the repository. The same applies to an open_loop when it is about something specific: "hold off on touching the pa…

Input parameters:

- `body` (string): The rule, in the developer's own words where they stated it. One sentence. Not a summary of the code. Omit entirely when this call is a `fact_id`/`confirm` verdict on an existing fact — there is noth…
- `confirm` (boolean): Facts only (never an open_loop — that only ever takes `resolve`). Pair with `fact_id` (or a resolvable `symbol`/`file`): you just read the code behind an "(unconfirmed since …)" flag and it is still…
- `detail` (string): concise (default): a one-line answer plus the ranked head, file:line kept on every row. full: every row and every field.
- `fact_id`: Resolve a verdict against an EXISTING fact instead of storing a new one — pair with `confirm:true` (still accurate) or `verified:"contradicted"` (no longer accurate). One id, or an array to report on…
- `file` (string): Repository-relative path this is about — the FALLBACK for when you looked and no single declaration owns the rule ("keep this file under 200 lines", a rule about a config or schema file). It is weake…
- `kind` (string): law: the developer said so. hazard: this bites. ritual: how a command is run here. tombstone: tried and abandoned. correction: you were corrected. open_loop: a sticky note / unfinished task to resurf…
- `loop_id` (integer): open_loop + resolve: the loop#N to close, if you have it. Otherwise the body is matched.
- `note`: With verified:"contradicted"/"unverifiable" (either use above): one sentence on what you actually found (what the code does now, or why you could not tell). Shown next to the fact. Array form aligns…
- `repo` (string): Name of the repository this is about, when your own working directory is NOT a checkout of it (a different project's session, a scratch/notes directory, a subagent). Omit when your cwd IS the repo th…
- `resolve` (boolean): open_loop only: mark the loop DONE instead of opening one. Match by loop_id, or by restating its body. Idempotent — closing an already-closed loop is a no-op.
- `source` (string): user: the developer stated it in this session. import: read out of an instruction file. Omit if unsure.
- `symbol` (string): The declaration this fact is ABOUT — the coordinate to prefer over every other, and the only one that makes the fact expire on its own. A fact/hazard anchored here dies when that declaration is rewri…
- `verified`: Two uses. (1) Importing a rule someone else wrote (a CLAUDE.md/AGENTS.md line) rather than stating your own — read the current code the rule names FIRST, then say what you found. "confirmed": you rea…

### `file_symbols` (~138 tokens)

Symbols in a file

Everything the graph extracted from one file, with line ranges. Answers "what is in here?" without reading the whole file, and gives you the exact symbol names the other tools want. Use it to disambiguate when neighbours reports a symbol defined in several places.

Input parameters:

- `detail` (string): concise (default): a one-line answer plus the ranked head, file:line kept on every row. full: every row and every field.
- `limit` (integer)
- `node_types` (array): Optional filter, e.g. ["METHOD","CLASS"].
- `path` (string, required): Repository-relative path as it appears in the graph.

### `overview` (~167 tokens)

Orient in a repository

What matters in this repository, without needing to know a name first. Every other tool needs a query or a symbol you already know; this is the one to call on your FIRST turn in an unfamiliar codebase, or before planning a change. Returns: the declarations the most code depends on (weighted by what the dependency is, and ignoring unresolved guesses); the declarations that historically change TOGETHER, mined from git history; import cycles; and the node and edge counts by type.

Input parameters:

- `detail` (string): concise (default): a one-line answer plus the ranked head, file:line kept on every row. full: every row and every field.
- `limit` (integer)
- `repo` (string): Repository name to scope to. Omit when the store holds one repository.

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Dependencies. The full working is on the page: https://verifymcp.io/servers/in-koragraph-koragraph/koragraphmcp#diagnostics

## Score history

- 2026-09-20: 68
- 2026-09-19: 67
- 2026-09-18: 67
- 2026-09-17: 66
- 2026-09-16: 66
- 2026-09-15: 65
- 2026-09-14: 65
- 2026-09-13: 64
- 2026-09-12: 61
- 2026-09-11: 61
- 2026-09-10: 61
- 2026-09-09: 61
- 2026-09-08: 61
- 2026-09-07: 61
- 2026-09-06: 61
- 2026-09-05: 46

## Common questions

### What is the Koragraph MCP server?

Koragraph is an MCP server listed in the public MCP registry as in.koragraph/koragraph. Local multi-repo code graph over MCP. Blast radius, call graphs, and memory anchored to code. This page covers its npm package (koragraphmcp).

### Is the Koragraph MCP server safe to use?

Koragraph scores 68 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Koragraph MCP server expose?

Koragraph exposes 9 tools: explore, search_code, neighbours, changes_with, blast_radius, and 4 more. Their descriptions and schemas cost roughly 4,521 tokens of context every time the server is loaded.

### Is the Koragraph MCP server still maintained?

Koragraph is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Koragraph MCP server under?

Koragraph declares the BUSL-1.1 licence, which is not on the OSI-approved list. Read the terms before using it at work, and note this covers the source only, not the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/koragraphmcp
- Socket report: https://socket.dev/npm/package/koragraphmcp
- Repository: https://github.com/Koragraph/KoragraphMCP
- Website: https://www.koragraph.in/
- Changelog RSS feed: https://verifymcp.io/servers/in-koragraph-koragraph/koragraphmcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/in-koragraph-koragraph/koragraphmcp.json
- HTML version of this page: https://verifymcp.io/servers/in-koragraph-koragraph/koragraphmcp