codebase-synapse
NPM · CODEBASE-SYNAPSE
Indexes codebase into a local knowledge graph with 40+ AI tools and codebase-guard.
Available components
Last scanned (2 hours ago)
Scores higher than 87% of npm servers
Category Code Search and Documentation
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security94
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Declares code that runs automatically (postinstall) and that we could not recognise. It may be perfectly ordinary, but we have not established what it does. View diagnostics → Partial
- 0 of 6 dependencies flagged as unhealthy. View diagnostics → Pass
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to iwiels/codebase-synapse). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 93 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability68
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 2213 tokens (~42/item across 52 items; 52 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage68
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 3% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete_project" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 52 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities40
- Spec-recency check failed: implements MCP spec 2025-03-26; the latest is 2026-07-28. See how to fix → Fail
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 0
- Stability: 0.97 → pass security
- 3 Nov 26 0
- Security disclosure: unverified → fail ▼ functional
- Stability: pass → 0.97 functional
- 1 Nov 26 0
- Security disclosure: fail → unverified ▼ functional
- 28 Oct 26 0
- Stability: 0.97 → pass security
- 27 Oct 26 0
- Stability: pass → 0.97 functional
- 21 Oct 26 0
- Stability: 0.97 → pass security
- 20 Oct 26 0
- Stability: pass → 0.97 functional
- 17 Oct 26 +2
- Stability: 0.83 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/codebase-synapse@0.1.13
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | iwiels/codebase-synapse |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/iwiels/codebase-synapse/.github/workflows/release.yml@refs/tags/v0.1.13 |
| Rekor log index | 2275033137 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:5030e62569c7aa350b54e2594ae0e9c112fa752edd4bb1635aef9459280ace841feb9f5307717c0f91a4472122c863bd475b7a81db0f55f14ad12f899 |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| postinstall | unreviewed | node download.mjs |
Background: Why install scripts are a supply-chain risk →
Dependencies 6 packages
| Packages resolved | 6 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
check_boundaries ~61
Check if the import graph violates architecture rules defined in .codebase-synapse/boundaries.toml. Returns list of violations (from_file, to_file, rule). Run suggest_boundaries first if no config exists.
| Name | Type | Req | Description |
|---|---|---|---|
| project | string | yes | – |
No output schema declared.
No examples provided.
delete_project ~20
Delete an indexed project
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | – |
No output schema declared.
No examples provided.
detect_change_coupling ~70
Mines git commit history to detect files that frequently change together (evolutionary coupling). Stores results as graph edges and returns detected coupling patterns.
| Name | Type | Req | Description |
|---|---|---|---|
| min_co_changes | integer | – | Minimum number of co-changes to consider a coupling (default: 3) |
| project | string | yes | – |
No output schema declared.
No examples provided.
evaluate_plan_risk ~52
Simulates the regression risk of a proposed plan of changes by analyzing code dependencies, PageRank centrality, Git hotspots, and test contracts.
| Name | Type | Req | Description |
|---|---|---|---|
| project | string | yes | – |
| targets | array | yes | – |
No output schema declared.
No examples provided.
explain_code ~85
Synthesizes a comprehensive explanation of a symbol by combining: graph context (callers/callees), git history narrative (who created it, why it changed), related memories and decisions (ADRs), and structural metrics (complexity, PageRank). One call replaces 4-5 separate tool calls.
| Name | Type | Req | Description |
|---|---|---|---|
| node_id | integer | yes | – |
| project | string | yes | – |
No output schema declared.
No examples provided.
find_dead_code ~23
Find potentially unused functions and methods
| Name | Type | Req | Description |
|---|---|---|---|
| project | string | yes | – |
No output schema declared.
No examples provided.
find_path ~41
Find call path between two symbols
| Name | Type | Req | Description |
|---|---|---|---|
| from_node_id | integer | yes | – |
| max_depth | integer | – | – |
| to_node_id | integer | yes | – |
No output schema declared.
No examples provided.
find_similar ~37
Find structurally similar functions/methods to a given symbol
| Name | Type | Req | Description |
|---|---|---|---|
| node_id | integer | yes | – |
| threshold | number | – | – |
No output schema declared.
No examples provided.
find_symbol_everywhere ~40
Search for a symbol across ALL indexed projects (cross-project linking). Useful for monorepos and shared libraries.
| Name | Type | Req | Description |
|---|---|---|---|
| symbol_name | string | yes | – |
No output schema declared.
No examples provided.
generate_wiki ~39
Generate a Markdown architecture wiki for the project from Leiden clusters. Includes cluster breakdown, file lists, and boundary violations.
| Name | Type | Req | Description |
|---|---|---|---|
| project | string | yes | – |
No output schema declared.
No examples provided.
get_architecture ~37
Get project architecture overview: languages, entry points, packages, hotspots, dead code, and test coverage
| Name | Type | Req | Description |
|---|---|---|---|
| project | string | yes | – |
No output schema declared.
No examples provided.
get_callees ~34
Find what a function or method calls
| Name | Type | Req | Description |
|---|---|---|---|
| max_depth | integer | – | – |
| node_id | integer | yes | – |
No output schema declared.
No examples provided.
get_callers ~33
Find what calls a function or method
| Name | Type | Req | Description |
|---|---|---|---|
| max_depth | integer | – | – |
| node_id | integer | yes | – |
No output schema declared.
No examples provided.
get_clusters ~45
Get Leiden cluster assignments for all files. Each cluster is a cohesive architectural module detected from import patterns. Use with suggest_boundaries to enforce module separation.
| Name | Type | Req | Description |
|---|---|---|---|
| project | string | yes | – |
No output schema declared.
No examples provided.
get_context ~33
Get a symbol with dependencies and dependents
| Name | Type | Req | Description |
|---|---|---|---|
| max_depth | integer | – | – |
| node_id | integer | yes | – |
No output schema declared.
No examples provided.
get_contracts ~50
What tests verify this symbol? Returns test contracts (test_of edges). Use BEFORE modifying any symbol to know what tests will break.
| Name | Type | Req | Description |
|---|---|---|---|
| node_id | integer | yes | – |
| project | string | yes | – |
No output schema declared.
No examples provided.
get_dependents ~27
Find all code that directly depends on a symbol
| Name | Type | Req | Description |
|---|---|---|---|
| node_id | integer | yes | – |
No output schema declared.
No examples provided.
get_edit_context ~29
Everything needed before editing
| Name | Type | Req | Description |
|---|---|---|---|
| node_id | integer | yes | – |
| project | string | yes | – |
No output schema declared.
No examples provided.
get_file_structure ~31
Get structural overview of a file
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | string | yes | – |
| project | string | yes | – |
No output schema declared.
No examples provided.
get_hotspots ~51
Technical debt hotspots: symbols with high complexity × git churn. Score = complexity × ln(1+churn). Requires index_git_history.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
| project | string | yes | – |
No output schema declared.
No examples provided.
get_imports ~26
Get all imports of a file or module
| Name | Type | Req | Description |
|---|---|---|---|
| node_id | integer | yes | – |
No output schema declared.
No examples provided.
get_pagerank ~52
Get the PageRank authority score for a node. Scores > 0.05 indicate critical architectural hubs that require impact_analysis before modification.
| Name | Type | Req | Description |
|---|---|---|---|
| node_id | integer | yes | – |
| project | string | yes | – |
No output schema declared.
No examples provided.
get_recent_semantic_changes ~55
What changed semantically in the last N hours? Returns structural changes: symbols added/removed, complexity shifts. More informative than 'which files changed'.
| Name | Type | Req | Description |
|---|---|---|---|
| hours | integer | – | – |
| project | string | yes | – |
No output schema declared.
No examples provided.
get_route_map ~27
List all HTTP routes and their handlers in the project
| Name | Type | Req | Description |
|---|---|---|---|
| project | string | yes | – |
No output schema declared.
No examples provided.
get_stats ~22
Get detailed statistics about indexed data
| Name | Type | Req | Description |
|---|---|---|---|
| project | string | yes | – |
No output schema declared.
No examples provided.
get_status ~15
Get server health and index status
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_working_set ~59
What is the AI's current working set? Returns most-accessed symbols in the last 24h with temporal decay weighting. Call at session start for efficient context preloading.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
| project | string | yes | – |
No output schema declared.
No examples provided.
git_archaeology ~62
Why does this code exist? Returns git history for a symbol: when introduced, who changed it, and why (feat/fix/refactor/perf). Run index_git_history first.
| Name | Type | Req | Description |
|---|---|---|---|
| node_id | integer | yes | – |
| project | string | yes | – |
No output schema declared.
No examples provided.
hybrid_search ~40
Combined full-text + semantic search with RRF fusion
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
| project | string | yes | – |
| query | string | yes | – |
No output schema declared.
No examples provided.
impact_analysis ~32
Analyze blast radius of changing a symbol
| Name | Type | Req | Description |
|---|---|---|---|
| max_depth | integer | – | – |
| node_id | integer | yes | – |
No output schema declared.
No examples provided.
index_git_history ~65
Index git commit history for a project. Enables get_hotspots and git_archaeology. Run once after index_repository. max_commits defaults to 500.
| Name | Type | Req | Description |
|---|---|---|---|
| max_commits | integer | – | – |
| project | string | yes | – |
| repo_path | string | yes | – |
No output schema declared.
No examples provided.
index_repository ~24
Index a repository into the knowledge graph
| Name | Type | Req | Description |
|---|---|---|---|
| repo_path | string | yes | – |
No output schema declared.
No examples provided.
link_cross_project ~47
Create a cross-project dependency edge between two nodes in different projects.
| Name | Type | Req | Description |
|---|---|---|---|
| project | string | yes | – |
| source_node_id | integer | yes | – |
| target_node_id | integer | yes | – |
No output schema declared.
No examples provided.
list_projects ~15
List all indexed projects with statistics
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
manage_adr ~77
Manage Architecture Decision Records (ADRs): CRUD operations
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | – |
| adr_id | integer | – | – |
| consequences | string | – | – |
| context | string | – | – |
| decision | string | – | – |
| project | string | yes | – |
| status | string | – | – |
| title | string | – | – |
No output schema declared.
No examples provided.
memory_delete ~21
Delete a memory by ID
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | – |
No output schema declared.
No examples provided.
memory_list ~28
List stored memories by kind
| Name | Type | Req | Description |
|---|---|---|---|
| kind | string | – | – |
| project | string | yes | – |
No output schema declared.
No examples provided.
memory_search ~33
Search stored memories
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
| project | string | yes | – |
| query | string | yes | – |
No output schema declared.
No examples provided.
memory_store ~54
Store a persistent note, fact, or decision
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | yes | – |
| kind | string | – | – |
| node_id | integer | – | – |
| project | string | yes | – |
| tags | string | – | – |
No output schema declared.
No examples provided.
plan_change ~111
Given a list of files/symbols you plan to modify plus a natural-language description, returns: (1) risk-ordered change sequence, (2) tests that will break, (3) files in blast radius, (4) specific recommendations to reduce risk. Wraps evaluate_plan_risk with a cleaner interface for planning workflows.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | yes | What are you trying to accomplish? |
| files | array | yes | List of file paths you plan to modify |
| project | string | yes | – |
No output schema declared.
No examples provided.
prepare_task_context ~76
🎯 CALL FIRST: Given a natural-language task description, assembles an optimal context bundle — relevant symbols, their dependencies, impact analysis, related memories — all within a token budget. Eliminates the need for manual exploration.
| Name | Type | Req | Description |
|---|---|---|---|
| max_tokens | integer | – | – |
| project | string | yes | – |
| task | string | yes | – |
No output schema declared.
No examples provided.
project_overview ~24
Get high-level statistics of a project
| Name | Type | Req | Description |
|---|---|---|---|
| project | string | yes | – |
No output schema declared.
No examples provided.
query_graph ~37
Execute an openCypher read-only query on the codebase knowledge graph
| Name | Type | Req | Description |
|---|---|---|---|
| project | string | yes | – |
| query | string | yes | – |
No output schema declared.
No examples provided.
reindex_changed ~32
Incremental reindex of changed files
| Name | Type | Req | Description |
|---|---|---|---|
| files | array | – | – |
| repo_path | string | yes | – |
No output schema declared.
No examples provided.
search_code ~42
Full-text search across code (FTS5 + BM25)
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
| project | string | yes | – |
| query | string | yes | – |
No output schema declared.
No examples provided.
search_symbol ~36
Search symbols by name or pattern
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
| project | string | yes | – |
| query | string | yes | – |
No output schema declared.
No examples provided.
semantic_search ~38
Search code by semantic meaning using vector embeddings
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
| project | string | yes | – |
| query | string | yes | – |
No output schema declared.
No examples provided.
session_recall ~24
Recall a fact from the current session
| Name | Type | Req | Description |
|---|---|---|---|
| key | string | yes | – |
No output schema declared.
No examples provided.
session_remember ~40
Store a key-value fact in the current session
| Name | Type | Req | Description |
|---|---|---|---|
| key | string | yes | – |
| source | string | – | – |
| value | string | yes | – |
No output schema declared.
No examples provided.
suggest_boundaries ~46
Generate a starter .codebase-synapse/boundaries.toml based on Leiden cluster assignments. Freezes current architecture so boundary drift is intentional.
| Name | Type | Req | Description |
|---|---|---|---|
| project | string | yes | – |
No output schema declared.
No examples provided.
How do I install the codebase-synapse MCP server?
codebase-synapse runs locally as an npm package, launched with npx -y codebase-synapse. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · codebase-synapse
claude mcp add iwiels-codebase-synapse -- npx -y codebase-synapse
What is the codebase-synapse MCP server?
codebase-synapse is an MCP server listed in the public MCP registry as io.github.iwiels/codebase-synapse. Indexes codebase into a local knowledge graph with 40+ AI tools and codebase-guard. This page covers its npm package (codebase-synapse).
Is the codebase-synapse MCP server safe to use?
codebase-synapse scores 85 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the codebase-synapse MCP server expose?
codebase-synapse exposes 52 tools: get_stats, git_archaeology, get_recent_semantic_changes, prepare_task_context, find_dead_code, and 47 more. Their descriptions and schemas cost roughly 2,213 tokens of context every time the server is loaded.
Is the codebase-synapse MCP server still maintained?
codebase-synapse is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the codebase-synapse MCP server under?
codebase-synapse declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.