# Hex Graph (npm · @levnikolaevich/hex-graph-mcp)

Deterministic layered code graph MCP server with framework overlays and SCIP interop.

- Trust score: 76/100 (medium)
- Change this week: +33
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@levnikolaevich/hex-graph-mcp`: 76/100 (this document), [markdown](https://verifymcp.io/servers/levnikolaevich-hex-graph-mcp/levnikolaevich-hex-graph-mcp.md), [page](https://verifymcp.io/servers/levnikolaevich-hex-graph-mcp/levnikolaevich-hex-graph-mcp)

## Channel facts

- Registry: `npm`
- Package: `@levnikolaevich/hex-graph-mcp`
- Version: `0.21.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (135 of 139), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (135 of 139), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to levnikolaevich/claude-code-skills).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 53 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 60/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2854 tokens (~178/item across 16 items; 16 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 99/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 97% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add levnikolaevich-hex-graph-mcp -- npx -y @levnikolaevich/hex-graph-mcp
```

### Codex

```bash
codex mcp add levnikolaevich-hex-graph-mcp -- npx -y @levnikolaevich/hex-graph-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "levnikolaevich-hex-graph-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@levnikolaevich/hex-graph-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add levnikolaevich-hex-graph-mcp --command npx --arg -y --arg @levnikolaevich/hex-graph-mcp
```

### Hermes

```yaml
mcp_servers:
  levnikolaevich-hex-graph-mcp:
    command: "npx"
    args: ["-y", "@levnikolaevich/hex-graph-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "levnikolaevich-hex-graph-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@levnikolaevich/hex-graph-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 76, +4)

- [functional improvement] Stability: unverified → 0.23

### 2026-08-02 (score 72, +53)

- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security improvement] Provenance: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [security] The attested source repository moved: levnikolaevich/claude-code-skills
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → good
- [functional] Licence: MIT

### 2026-07-31 (score 19, −24)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 43, +19)

- [functional improvement] Tool coverage: unverified → 100

### 2026-07-28 (score 24, −19)

- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 43)

First indexed and scored.

## MCP tools (16)

### `index_project` (~51 tokens)

Index Project

Scan and index a project into the graph kernel, honoring Git excludes by default and including precise/framework overlays when available.

Input parameters:

- `languages` (array): Filter indexed languages
- `path` (string, required): Project root directory

### `install_graph_providers` (~111 tokens)

Install Graph Providers

Detect graph-specific providers and optional SCIP exporters for the current project, then return exact remediation steps or install them on demand. This never installs runtimes or project dependencies.

Input parameters:

- `include_optional_scip` (boolean): Include optional SCIP exporter checks alongside precise providers.
- `mode` (string): `check` reports the plan and remediation steps only. `install` runs the provider install commands when they are available for the current platform.
- `path` (string, required): Project root used for language detection and provider planning

### `export_scip` (~239 tokens)

Export SCIP

Export indexed symbol facts to a binary SCIP artifact. TypeScript/JavaScript uses the native compiler lane; Python, PHP, and C# use their upstream SCIP indexers.

Input parameters:

- `environment_path` (string): Python only: optional path to a scip-python environment JSON file.
- `include_external_symbols` (boolean): Include lightweight metadata for declaration-file symbols when available.
- `language` (string): SCIP export backend. `typescript` uses the native compiler lane; `python`, `php`, and `csharp` orchestrate official SCIP indexers.
- `output_path` (string, required): Destination `.scip` path. Relative paths resolve from the project root.
- `path` (string, required): Indexed project root
- `project_name` (string): Python only: explicit SCIP project name. Defaults to pyproject/setup metadata or the project folder name.
- `project_namespace` (string): Python only: optional namespace prefix for generated symbols.
- `target_only` (string): Python only: optional subdirectory to index instead of the full project.
- `working_directory` (string): C# only: optional working directory passed through to scip-dotnet.

### `import_scip_overlay` (~92 tokens)

Import SCIP Overlay

Import a binary SCIP artifact into provenance-tagged overlay facts without replacing the native graph. The import lane is derived from the artifact documents.

Input parameters:

- `artifact_path` (string, required): Path to a `.scip` artifact. Relative paths resolve from the project root.
- `path` (string, required): Indexed project root
- `replace_existing` (boolean): Clear prior `scip_import` overlay edges before importing this artifact.

### `find_symbols` (~85 tokens)

Find Symbols

Find candidate symbols by name or partial name before selecting a canonical identity for deeper graph analysis.

Input parameters:

- `kind` (string): Optional kind filter
- `limit` (number): Max detailed candidate symbols to return (default: 8)
- `path` (string, required): Indexed project root or a file/directory inside the indexed project
- `query` (string, required): Symbol name or partial name

### `inspect_symbol` (~253 tokens)

Inspect Symbol

Return a symbol-centric briefing: canonical resolution, local context, incoming and outgoing relations, reference summary, and implementation summary.

Input parameters:

- `expand` (array): Optional bounded expansion sections to materialize. Heavy tools return counts/previews by default and expand only the requested sections.
- `expand_limit` (number): Max rows to materialize for expanded sections (default: 10, capped at 25)
- `file` (string): File path used with name to disambiguate symbol
- `include_evidence` (boolean): Include supporting evidence in expanded rows. Defaults to false to keep payloads compact.
- `min_confidence` (string): Filter out facts below this confidence tier
- `name` (string): Symbol name (must be paired with file)
- `path` (string, required): Indexed project root or a file/directory inside the indexed project
- `qualified_name` (string): Canonical qualified symbol name
- `symbol_id` (number): Canonical symbol id
- `verbosity` (string): Response budget. `minimal` returns the shortest actionable answer, `compact` keeps key reasoning visible, and `full` includes supporting detail.
- `workspace_qualified_name` (string): Canonical workspace-qualified symbol name

### `trace_paths` (~396 tokens)

Trace Paths

Trace graph paths from a canonical symbol through calls, references, imports, type, flow, or mixed edges. Mixed traces can include framework overlay hops.

Input parameters:

- `depth` (number): Max traversal depth (default: 3)
- `direction` (string)
- `expand` (array): Optional bounded expansion sections to materialize. Heavy tools return counts/previews by default and expand only the requested sections.
- `expand_limit` (number): Max rows to materialize for expanded sections (default: 10, capped at 25)
- `file` (string): File path used with name to disambiguate symbol
- `include_evidence` (boolean): Include supporting evidence in expanded rows. Defaults to false to keep payloads compact.
- `limit` (number): Max paths (default: 10)
- `min_confidence` (string): Filter out facts below this confidence tier
- `name` (string): Symbol name (must be paired with file)
- `path` (string, required): Indexed project root or a file/directory inside the indexed project
- `path_kind` (string): Traversal edge set. `mixed` includes framework overlay hops when present.
- `qualified_name` (string): Canonical qualified symbol name
- `symbol_id` (number): Canonical symbol id
- `to_file` (string): Optional target file used with to_name
- `to_name` (string): Optional target symbol name (must be paired with to_file)
- `to_qualified_name` (string): Optional target qualified symbol name
- `to_symbol_id` (number): Optional target symbol id
- `to_workspace_qualified_name` (string): Optional target workspace-qualified symbol name
- `verbosity` (string): Response budget. `minimal` returns the shortest actionable answer, `compact` keeps key reasoning visible, and `full` includes supporting detail.
- `workspace_qualified_name` (string): Canonical workspace-qualified symbol name

### `find_references` (~299 tokens)

Find References

Find semantic usages of a canonical symbol identity, including framework overlay wiring when present.

Input parameters:

- `expand` (array): Optional bounded expansion sections to materialize. Heavy tools return counts/previews by default and expand only the requested sections.
- `expand_limit` (number): Max rows to materialize for expanded sections (default: 10, capped at 25)
- `file` (string): File path used with name to disambiguate symbol
- `include_evidence` (boolean): Include supporting evidence in expanded rows. Defaults to false to keep payloads compact.
- `kind` (string): Optional edge-kind filter. Includes semantic and framework kinds such as `route_to_handler`, `injects`, `registers`, `renders`, and `middleware_for`.
- `limit` (number): Max references (default: 10)
- `min_confidence` (string): Filter out facts below this confidence tier
- `name` (string): Symbol name (must be paired with file)
- `path` (string, required): Indexed project root or a file/directory inside the indexed project
- `qualified_name` (string): Canonical qualified symbol name
- `symbol_id` (number): Canonical symbol id
- `verbosity` (string): Response budget. `minimal` returns the shortest actionable answer, `compact` keeps key reasoning visible, and `full` includes supporting detail.
- `workspace_qualified_name` (string): Canonical workspace-qualified symbol name

### `find_implementations` (~242 tokens)

Find Implementations

Find implementations and overrides for a canonical symbol identity.

Input parameters:

- `expand` (array): Optional bounded expansion sections to materialize. Heavy tools return counts/previews by default and expand only the requested sections.
- `expand_limit` (number): Max rows to materialize for expanded sections (default: 10, capped at 25)
- `file` (string): File path used with name to disambiguate symbol
- `include_evidence` (boolean): Include supporting evidence in expanded rows. Defaults to false to keep payloads compact.
- `limit` (number): Max implementation rows to return (default: 10)
- `name` (string): Symbol name (must be paired with file)
- `path` (string, required): Indexed project root or a file/directory inside the indexed project
- `qualified_name` (string): Canonical qualified symbol name
- `symbol_id` (number): Canonical symbol id
- `verbosity` (string): Response budget. `minimal` returns the shortest actionable answer, `compact` keeps key reasoning visible, and `full` includes supporting detail.
- `workspace_qualified_name` (string): Canonical workspace-qualified symbol name

### `trace_dataflow` (~226 tokens)

Trace Dataflow

Find deterministic source-to-sink dataflow paths between anchored flow points.

Input parameters:

- `expand` (array): Optional bounded expansion sections to materialize. Heavy tools return counts/previews by default and expand only the requested sections.
- `expand_limit` (number): Max rows to materialize for expanded sections (default: 10, capped at 25)
- `flow_kind` (string)
- `include_evidence` (boolean): Include supporting evidence in expanded rows. Defaults to false to keep payloads compact.
- `limit` (number): Max flow paths (default: 10)
- `max_hops` (number): Max flow propagation hops (default: 4)
- `min_confidence` (string): Filter out facts below this confidence tier
- `path` (string, required): Indexed project root or a file/directory inside the indexed project
- `sink` (object)
- `source` (object, required)
- `verbosity` (string): Response budget. `minimal` returns the shortest actionable answer, `compact` keeps key reasoning visible, and `full` includes supporting detail.

### `analyze_changes` (~168 tokens)

Analyze Changes

Review a git diff, commit range, or worktree change set and return a compact semantic risk snapshot with changed symbols, deleted API warnings, and optional supporting paths.

Input parameters:

- `base_ref` (string, required): Git baseline ref used to compute the changed-symbol set
- `head_ref` (string): Optional git head ref. If omitted, the current checkout/worktree is compared to `base_ref`.
- `include_paths` (boolean): Include reverse mixed graph paths for the returned symbols. Default is false to keep the snapshot compact.
- `max_paths` (number): Maximum supporting paths per symbol when `include_paths` is true (default: 3)
- `max_symbols` (number): Maximum changed symbols to return after risk ranking (default: 10)
- `path` (string, required): Indexed project root

### `analyze_edit_region` (~142 tokens)

Analyze Edit Region

Inspect the semantic impact of editing a concrete file range: edited symbols, external callers, downstream flow, framework wiring, and duplicate/code-clone risk.

Input parameters:

- `file` (string, required): File path inside the indexed project. Absolute paths are accepted when they stay inside the project root.
- `line_end` (number): 1-based ending line of the edited region
- `line_start` (number): 1-based starting line of the edited region
- `path` (string, required): Indexed project root
- `verbosity` (string): Response budget. `minimal` returns the shortest actionable answer, `compact` keeps key reasoning visible, and `full` includes supporting detail.

### `api_impact` (~227 tokens)

API Impact

Inspect indexed API routes, inferred response-shape keys, client consumers, middleware, and route-level process facts before changing a handler or contract.

Input parameters:

- `file` (string): Optional route or handler file path inside the indexed project.
- `limit` (number): Max routes and process rows to surface (default: 10, capped at 25)
- `name` (string): Optional handler symbol name, paired with symbol_file
- `path` (string, required): Indexed project root
- `qualified_name` (string): Optional handler qualified symbol name
- `route` (string): Optional route path or method+path filter, for example `/api/users` or `GET /api/users`.
- `symbol_file` (string): File path used with name to disambiguate the handler symbol
- `symbol_id` (number): Optional handler symbol id
- `verbosity` (string): Response budget. `minimal` returns the shortest actionable answer, `compact` keeps key reasoning visible, and `full` includes supporting detail.
- `workspace_qualified_name` (string): Optional handler workspace-qualified symbol name

### `diagnose_graph` (~41 tokens)

Diagnose Graph

Check indexed graph health: files, symbols, providers, framework routes, API-shape facts, and process facts.

Input parameters:

- `path` (string, required): Indexed project root

### `analyze_architecture` (~112 tokens)

Analyze Architecture

Return a high-level architecture view with modules, dependency boundaries, cycles, coupling, framework surfaces, and top risks.

Input parameters:

- `limit` (number): Max module, cycle, coupling, and hotspot rows to surface (default: 5)
- `path` (string, required): Indexed project root
- `scope` (string): Optional file path prefix filter
- `verbosity` (string): Response budget. `minimal` returns the shortest actionable answer, `compact` keeps key reasoning visible, and `full` includes supporting detail.

### `audit_workspace` (~170 tokens)

Audit Workspace

Audit the indexed workspace for cleanup and maintainability issues: unused exports, hotspots, and clone groups with a single review-oriented result.

Input parameters:

- `clone_member_limit` (number): Max clone members per group to surface (default: 3, or 10 with verbosity=full, capped at 25)
- `limit` (number): Max unused, hotspot, and clone group rows to surface (default: 5, capped at 25)
- `path` (string, required): Indexed project root
- `scope` (string): Optional file path prefix filter
- `show_suppressed` (boolean): Include suppressed unused exports in the visible result
- `verbosity` (string): Response budget. `minimal` returns the shortest actionable answer, `compact` keeps key reasoning visible, and `full` includes supporting detail.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/levnikolaevich-hex-graph-mcp/levnikolaevich-hex-graph-mcp#diagnostics

## Score history

- 2026-08-03: 76
- 2026-08-02: 72
- 2026-08-01: 19
- 2026-07-31: 19
- 2026-07-30: 43
- 2026-07-28: 24
- 2026-07-27: 43

## Links

- npm package: https://www.npmjs.com/package/@levnikolaevich/hex-graph-mcp
- Socket report: https://socket.dev/npm/package/@levnikolaevich/hex-graph-mcp
- Repository: https://github.com/levnikolaevich/claude-code-skills
- Changelog RSS feed: https://verifymcp.io/servers/levnikolaevich-hex-graph-mcp/levnikolaevich-hex-graph-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/levnikolaevich-hex-graph-mcp/levnikolaevich-hex-graph-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/levnikolaevich-hex-graph-mcp/levnikolaevich-hex-graph-mcp