Hex Graph

NPM · @LEVNIKOLAEVICH/HEX-GRAPH-MCP · SCANNED AUG 3

Deterministic layered code graph MCP server with framework overlays and SCIP interop.

Available components

+33 this week 76 76 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (135 of 139), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (135 of 139), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency97

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Cryptographically verified build provenance (signed, bound to levnikolaevich/claude-code-skills). View diagnostics → Pass
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 53 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability60

AI-judged instruction clarity (good).Pass
Context-footprint check failed: tool/resource definitions use about 2854 tokens (~178/item across 16 items; 16 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management23

Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage99

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
97% of tool parameters carry a description.Partial

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @levnikolaevich/hex-graph-mcp

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add levnikolaevich-hex-graph-mcp -- npx -y @levnikolaevich/hex-graph-mcp

# add to Codex CLI

codex mcp add levnikolaevich-hex-graph-mcp -- npx -y @levnikolaevich/hex-graph-mcp

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "levnikolaevich-hex-graph-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@levnikolaevich/hex-graph-mcp"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add levnikolaevich-hex-graph-mcp --command npx --arg -y --arg @levnikolaevich/hex-graph-mcp

# ~/.hermes/config.yaml

mcp_servers:
  levnikolaevich-hex-graph-mcp:
    command: "npx"
    args: ["-y", "@levnikolaevich/hex-graph-mcp"]

// mcp.json

{
  "mcpServers": {
    "levnikolaevich-hex-graph-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@levnikolaevich/hex-graph-mcp"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

3 Aug 26 +4
- Stability: unverified → 0.23 ▲ functional
2 Aug 26 +53
- Known CVEs: unverified → partial ▲ security
- Install scripts: unverified → pass ▲ security
- Provenance: unverified → pass ▲ security
- Malware scan: unverified → pass ▲ security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- The attested source repository moved: levnikolaevich/claude-code-skills security
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Schema quality: unverified → good ▲ functional
- Licence: MIT functional
31 Jul 26 −24
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
30 Jul 26 +19
- Tool coverage: unverified → 100 ▲ functional
28 Jul 26 −19
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
27 Jul 26 43

First indexed and scored.

Show 4 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/@levnikolaevich/[email protected]

Provenance verified

Ecosystem: npm · Outcome: verified

Reason: verified

Source repo:: levnikolaevich/claude-code-skills
Certificate issuer:: https://token.actions.githubusercontent.com
Certificate SAN:: https://github.com/levnikolaevich/claude-code-skills/.github/workflows/publish-hex-graph.yml@refs/tags/hex-graph-v0.21.1
Rekor log index:: 1781079676
Predicate type:: https://slsa.dev/provenance/v1
Subject digest:: sha512:a0ee0a9bb4749d317fe87c683708a98af63a0aabfdaaba082cab06ed2bd161f32dd658b3271b725cc0a0d08e3c1b3c6d52548d69c71aafb5e69f5fa1a
Discovery method:: attestation_endpoint

Dependencies 135 packages

135 packages in the resolved dependency tree · 134 deprecated · 49 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 16 exposed · ~2,854 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

analyze_architecture Analyze Architecture ~112

Return a high-level architecture view with modules, dependency boundaries, cycles, coupling, framework surfaces, and top risks.

Input Output Examples

Name	Type	Req	Description
limit	number	—	Max module, cycle, coupling, and hotspot rows to surface (default: 5)
path	string	yes	Indexed project root
scope	string	—	Optional file path prefix filter
verbosity	string	—	Response budget. `minimal` returns the shortest actionable answer, `compact` keeps key reasoning visible, and `full` includes supporting detail.

No output schema declared.

No examples provided.

analyze_changes Analyze Changes ~168

Review a git diff, commit range, or worktree change set and return a compact semantic risk snapshot with changed symbols, deleted API warnings, and optional supporting paths.

Input Output Examples

Name	Type	Req	Description
base_ref	string	yes	Git baseline ref used to compute the changed-symbol set
head_ref	string	—	Optional git head ref. If omitted, the current checkout/worktree is compared to `base_ref`.
include_paths	boolean	—	Include reverse mixed graph paths for the returned symbols. Default is false to keep the snapshot compact.
max_paths	number	—	Maximum supporting paths per symbol when `include_paths` is true (default: 3)
max_symbols	number	—	Maximum changed symbols to return after risk ranking (default: 10)
path	string	yes	Indexed project root

No output schema declared.

No examples provided.

analyze_edit_region Analyze Edit Region ~142

Inspect the semantic impact of editing a concrete file range: edited symbols, external callers, downstream flow, framework wiring, and duplicate/code-clone risk.

Input Output Examples

Name	Type	Req	Description
file	string	yes	File path inside the indexed project. Absolute paths are accepted when they stay inside the project root.
line_end	number	—	1-based ending line of the edited region
line_start	number	—	1-based starting line of the edited region
path	string	yes	Indexed project root
verbosity	string	—	Response budget. `minimal` returns the shortest actionable answer, `compact` keeps key reasoning visible, and `full` includes supporting detail.

No output schema declared.

No examples provided.

api_impact API Impact ~227

Inspect indexed API routes, inferred response-shape keys, client consumers, middleware, and route-level process facts before changing a handler or contract.

Input Output Examples

Name	Type	Req	Description
file	string	—	Optional route or handler file path inside the indexed project.
limit	number	—	Max routes and process rows to surface (default: 10, capped at 25)
name	string	—	Optional handler symbol name, paired with symbol_file
path	string	yes	Indexed project root
qualified_name	string	—	Optional handler qualified symbol name
route	string	—	Optional route path or method+path filter, for example `/api/users` or `GET /api/users`.
symbol_file	string	—	File path used with name to disambiguate the handler symbol
symbol_id	number	—	Optional handler symbol id
verbosity	string	—	Response budget. `minimal` returns the shortest actionable answer, `compact` keeps key reasoning visible, and `full` includes supporting detail.
workspace_qualified_name	string	—	Optional handler workspace-qualified symbol name

No output schema declared.

No examples provided.

audit_workspace Audit Workspace ~170

Audit the indexed workspace for cleanup and maintainability issues: unused exports, hotspots, and clone groups with a single review-oriented result.

Input Output Examples

Name	Type	Req	Description
clone_member_limit	number	—	Max clone members per group to surface (default: 3, or 10 with verbosity=full, capped at 25)
limit	number	—	Max unused, hotspot, and clone group rows to surface (default: 5, capped at 25)
path	string	yes	Indexed project root
scope	string	—	Optional file path prefix filter
show_suppressed	boolean	—	Include suppressed unused exports in the visible result
verbosity	string	—	Response budget. `minimal` returns the shortest actionable answer, `compact` keeps key reasoning visible, and `full` includes supporting detail.

No output schema declared.

No examples provided.

diagnose_graph Diagnose Graph ~41

Check indexed graph health: files, symbols, providers, framework routes, API-shape facts, and process facts.

Input Output Examples

Name	Type	Req	Description
path	string	yes	Indexed project root

No output schema declared.

No examples provided.

export_scip Export SCIP ~239

Export indexed symbol facts to a binary SCIP artifact. TypeScript/JavaScript uses the native compiler lane; Python, PHP, and C# use their upstream SCIP indexers.

Input Output Examples

Name	Type	Req	Description
environment_path	string	—	Python only: optional path to a scip-python environment JSON file.
include_external_symbols	boolean	—	Include lightweight metadata for declaration-file symbols when available.
language	string	—	SCIP export backend. `typescript` uses the native compiler lane; `python`, `php`, and `csharp` orchestrate official SCIP indexers.
output_path	string	yes	Destination `.scip` path. Relative paths resolve from the project root.
path	string	yes	Indexed project root
project_name	string	—	Python only: explicit SCIP project name. Defaults to pyproject/setup metadata or the project folder name.
project_namespace	string	—	Python only: optional namespace prefix for generated symbols.
target_only	string	—	Python only: optional subdirectory to index instead of the full project.
working_directory	string	—	C# only: optional working directory passed through to scip-dotnet.

No output schema declared.

No examples provided.

find_implementations Find Implementations ~242

Find implementations and overrides for a canonical symbol identity.

Input Output Examples

Name	Type	Req	Description
expand	array	—	Optional bounded expansion sections to materialize. Heavy tools return counts/previews by default and expand only the requested sections.
expand_limit	number	—	Max rows to materialize for expanded sections (default: 10, capped at 25)
file	string	—	File path used with name to disambiguate symbol
include_evidence	boolean	—	Include supporting evidence in expanded rows. Defaults to false to keep payloads compact.
limit	number	—	Max implementation rows to return (default: 10)
name	string	—	Symbol name (must be paired with file)
path	string	yes	Indexed project root or a file/directory inside the indexed project
qualified_name	string	—	Canonical qualified symbol name
symbol_id	number	—	Canonical symbol id
verbosity	string	—	Response budget. `minimal` returns the shortest actionable answer, `compact` keeps key reasoning visible, and `full` includes supporting detail.
workspace_qualified_name	string	—	Canonical workspace-qualified symbol name

No output schema declared.

No examples provided.

find_references Find References ~299

Find semantic usages of a canonical symbol identity, including framework overlay wiring when present.

Input Output Examples

Name	Type	Req	Description
expand	array	—	Optional bounded expansion sections to materialize. Heavy tools return counts/previews by default and expand only the requested sections.
expand_limit	number	—	Max rows to materialize for expanded sections (default: 10, capped at 25)
file	string	—	File path used with name to disambiguate symbol
include_evidence	boolean	—	Include supporting evidence in expanded rows. Defaults to false to keep payloads compact.
kind	string	—	Optional edge-kind filter. Includes semantic and framework kinds such as `route_to_handler`, `injects`, `registers`, `renders`, and `middleware_for`.
limit	number	—	Max references (default: 10)
min_confidence	string	—	Filter out facts below this confidence tier
name	string	—	Symbol name (must be paired with file)
path	string	yes	Indexed project root or a file/directory inside the indexed project
qualified_name	string	—	Canonical qualified symbol name
symbol_id	number	—	Canonical symbol id
verbosity	string	—	Response budget. `minimal` returns the shortest actionable answer, `compact` keeps key reasoning visible, and `full` includes supporting detail.
workspace_qualified_name	string	—	Canonical workspace-qualified symbol name

No output schema declared.

No examples provided.

find_symbols Find Symbols ~85

Find candidate symbols by name or partial name before selecting a canonical identity for deeper graph analysis.

Input Output Examples

Name	Type	Req	Description
kind	string	—	Optional kind filter
limit	number	—	Max detailed candidate symbols to return (default: 8)
path	string	yes	Indexed project root or a file/directory inside the indexed project
query	string	yes	Symbol name or partial name

No output schema declared.

No examples provided.

import_scip_overlay Import SCIP Overlay ~92

Import a binary SCIP artifact into provenance-tagged overlay facts without replacing the native graph. The import lane is derived from the artifact documents.

Input Output Examples

Name	Type	Req	Description
artifact_path	string	yes	Path to a `.scip` artifact. Relative paths resolve from the project root.
path	string	yes	Indexed project root
replace_existing	boolean	—	Clear prior `scip_import` overlay edges before importing this artifact.

No output schema declared.

No examples provided.

index_project Index Project ~51

Scan and index a project into the graph kernel, honoring Git excludes by default and including precise/framework overlays when available.

Input Output Examples

Name	Type	Req	Description
languages	array	—	Filter indexed languages
path	string	yes	Project root directory

No output schema declared.

No examples provided.

inspect_symbol Inspect Symbol ~253

Return a symbol-centric briefing: canonical resolution, local context, incoming and outgoing relations, reference summary, and implementation summary.

Input Output Examples

Name	Type	Req	Description
expand	array	—	Optional bounded expansion sections to materialize. Heavy tools return counts/previews by default and expand only the requested sections.
expand_limit	number	—	Max rows to materialize for expanded sections (default: 10, capped at 25)
file	string	—	File path used with name to disambiguate symbol
include_evidence	boolean	—	Include supporting evidence in expanded rows. Defaults to false to keep payloads compact.
min_confidence	string	—	Filter out facts below this confidence tier
name	string	—	Symbol name (must be paired with file)
path	string	yes	Indexed project root or a file/directory inside the indexed project
qualified_name	string	—	Canonical qualified symbol name
symbol_id	number	—	Canonical symbol id
verbosity	string	—	Response budget. `minimal` returns the shortest actionable answer, `compact` keeps key reasoning visible, and `full` includes supporting detail.
workspace_qualified_name	string	—	Canonical workspace-qualified symbol name

No output schema declared.

No examples provided.

install_graph_providers Install Graph Providers ~111

Detect graph-specific providers and optional SCIP exporters for the current project, then return exact remediation steps or install them on demand. This never installs runtimes or project dependencies.

Input Output Examples

Name	Type	Req	Description
include_optional_scip	boolean	—	Include optional SCIP exporter checks alongside precise providers.
mode	string	—	`check` reports the plan and remediation steps only. `install` runs the provider install commands when they are available for the current platform.
path	string	yes	Project root used for language detection and provider planning

No output schema declared.

No examples provided.

trace_dataflow Trace Dataflow ~226

Find deterministic source-to-sink dataflow paths between anchored flow points.

Input Output Examples

Name	Type	Req	Description
expand	array	—	Optional bounded expansion sections to materialize. Heavy tools return counts/previews by default and expand only the requested sections.
expand_limit	number	—	Max rows to materialize for expanded sections (default: 10, capped at 25)
flow_kind	string	—	—
include_evidence	boolean	—	Include supporting evidence in expanded rows. Defaults to false to keep payloads compact.
limit	number	—	Max flow paths (default: 10)
max_hops	number	—	Max flow propagation hops (default: 4)
min_confidence	string	—	Filter out facts below this confidence tier
path	string	yes	Indexed project root or a file/directory inside the indexed project
sink	object	—	—
source	object	yes	—
verbosity	string	—	Response budget. `minimal` returns the shortest actionable answer, `compact` keeps key reasoning visible, and `full` includes supporting detail.

No output schema declared.

No examples provided.

trace_paths Trace Paths ~396

Trace graph paths from a canonical symbol through calls, references, imports, type, flow, or mixed edges. Mixed traces can include framework overlay hops.

Input Output Examples

Name	Type	Req	Description
depth	number	—	Max traversal depth (default: 3)
direction	string	—	—
expand	array	—	Optional bounded expansion sections to materialize. Heavy tools return counts/previews by default and expand only the requested sections.
expand_limit	number	—	Max rows to materialize for expanded sections (default: 10, capped at 25)
file	string	—	File path used with name to disambiguate symbol
include_evidence	boolean	—	Include supporting evidence in expanded rows. Defaults to false to keep payloads compact.
limit	number	—	Max paths (default: 10)
min_confidence	string	—	Filter out facts below this confidence tier
name	string	—	Symbol name (must be paired with file)
path	string	yes	Indexed project root or a file/directory inside the indexed project
path_kind	string	—	Traversal edge set. `mixed` includes framework overlay hops when present.
qualified_name	string	—	Canonical qualified symbol name
symbol_id	number	—	Canonical symbol id
to_file	string	—	Optional target file used with to_name
to_name	string	—	Optional target symbol name (must be paired with to_file)
to_qualified_name	string	—	Optional target qualified symbol name
to_symbol_id	number	—	Optional target symbol id
to_workspace_qualified_name	string	—	Optional target workspace-qualified symbol name
verbosity	string	—	Response budget. `minimal` returns the shortest actionable answer, `compact` keeps key reasoning visible, and `full` includes supporting detail.
workspace_qualified_name	string	—	Canonical workspace-qualified symbol name

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug