Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

trelix

PYPI · TRELIX-MCP

Semantic code search for AI agents — hybrid BM25+vector, call-graph, 20+ languages.

Available components

+12 this week 86 Trust /100

Last scanned (8 hours ago)

Scores higher than 87% of PyPI servers

Category Code Search and Documentation

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security100
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • Runs hatchling.build at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
  • 7 of 65 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency74
  • Repository check failed: no source repository is declared. See how to fix → View diagnostics → Fail
  • Cryptographically verified build provenance (signed, bound to sairam0424/trelix). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 8 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability74
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 3748 tokens (~234/item across 16 items; 15 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management77
  • Stability observed for 23 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage84
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 44% of tool parameters carry a description.Partial
  • Structured output schemas are declared (93% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
What we tested

Checks we ran (16)

  • Malware scan
  • Known CVEs
  • Install scripts
  • Dependency health
  • Source repository
  • Provenance
  • License
  • Maintenance
  • Security disclosure
  • Schema quality
  • Stability
  • Tool coverage
  • Injection markers
  • Destructive annotations
  • Judged manipulation
  • MCP protocol

Does not apply to this package (2)

  • Endpoint SecurityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
  • Transport & ReachabilityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.

The score does not measure everything. What the score does not measure →

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 7 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 73 to 77. That category is still filling its 30-day observation window: 22 days of observed history at the previous scan, 23 at this one. The score rises as the window fills, whether or not the server changes.

  • 6 Nov 26 −4
    • Stability: pass → 0.73 functional
  • 1 Nov 26 +15
    • Malware scan: unverified → pass ▲ security
  • 31 Oct 26 −14
    • Malware scan: pass → unverified ▼ security
    • Stability: 0.97 → pass security
  • 30 Oct 26 +14
    • Malware scan: unverified → pass ▲ security
    • Stability: pass → 0.97 functional
  • 29 Oct 26 −15
    • Malware scan: pass → unverified ▼ security
    • Package version: 3.5.0 → 3.5.1 functional
  • 28 Oct 26 +15
    • Malware scan: unverified → pass ▲ security
  • 27 Oct 26 −14
    • Malware scan: pass → unverified ▼ security
    • Schema quality: 165 → 234 ▼ functional
    • Destructive annotations: All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation. functional
    • Package version: 3.4.3 → 3.5.0 functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 7 Nov 2026 · Analysed pypi/trelix-mcp@3.5.1

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem pypi
Reason Verified
Discovered via Registry attestation endpoint
Source repo sairam0424/trelix
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/sairam0424/trelix/.github/workflows/release.yml@refs/tags/v3.5.1
Rekor log index 3566974040
Predicate type PyPI publish attestation https://docs.pypi.org/attestations/publish/v1
Subject digest sha256:f986b6a2e8bb0e6fa8e0d814ec750be90644ad7024c448063ecae5537c7297fa

Background: How many MCP packages publish verified provenance →

Install scripts 1 script
Hook Tier Command
build_backend Known build tool hatchling.build

Background: Why install scripts are a supply-chain risk →

Dependencies 65 packages
Packages resolved 65
Stale 6
No linked repository 1
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 15 exposed · ~3,308 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
agent_clear_session ~46

Delete a persisted agent session and all its turn history.

NameTypeReqDescription
repo_pathstringyesAbsolute path to the repository root.
session_idstringyesThe session to delete.

Structured output declared, but exposes no named fields.

No examples provided.

agent_list_sessions ~98

List recent agent sessions for a repo, most recently active first.

NameTypeReqDescription
limitinteger–Max sessions to return, from 1 up to TRELIX_MCP_MAX_K (default 50). The text is also capped at TRELIX_MCP_MAX_RESULT_CHARS characters; when the oldest sessions are left out, truncated is true and omi…
repo_pathstringyesAbsolute path to the repository root.

Structured output declared, but exposes no named fields.

No examples provided.

ask_agent ~406

Ask a question using the multi-turn ReAct agentic loop, with persistent memory. ⚠️ IMPORTANT: - repo_path must be an ABSOLUTE path to an already-indexed repository. - Session history is scoped to (repo_path, session_id) — a session_id created against one repo is invisible when querying a different repo_path. - Requires LLM configuration (e.g. OPENAI_API_KEY) — this tool always uses the agentic loop, unlike search_code which is retrieval-only. 🎯 When to Use: - Multi-step questions needing iterative retrieve/grep/get_symbol drilling. - Follow-up questions in the same conversation — pass back the session_id returned from the previous call to preserve context across calls. Session lifecycle: - Omit session_id on the first call — a new one is generated and returned. - Pass that session_id on subsequent related calls to resume with full turn history loaded from persistent storage. - Sessions are automatically evicted after TRELIX_RETRIEVAL_AGENT_SESSION_MAX_AGE_SECONDS of inactivity (default 7 days). Use agent_clear_session to delete one explicitly. Clarifying questions (SEP-2322, v3.3.0+): - When the agent's question is genuinely ambiguous, this tool returns an `InputRequiredToolResult` instead of the usual dict — an MCP client that supports SEP-2322 elicitation surfaces it as a form and resends this SAME call (same query/repo_path/session_id) with the answer attached as `inputResponses`; do not pass the answer as a new `query`. - A client that declines/cancels gets a normal dict answer back explaining the question could not be resolved — this tool never re-asks the same clarify question on a decline.

NameTypeReqDescription
querystringyes–
repo_pathstringyes–
session_id–––

No output schema declared.

No examples provided.

blast_radius ~149

Find all symbols that depend on (call or import) a given symbol. Useful for impact analysis: "if I change X, what else might break?"

NameTypeReqDescription
limitinteger–Most dependents to return, from 1 to 500 (default 100). The list is also capped at TRELIX_MCP_MAX_RESULT_CHARS characters (default 15000). When dependents are left out, the result carries a second te…
repo_pathstringyesAbsolute path to the repository root.
symbol_namestringyesName or qualified name of the symbol to analyse.
NameTypeReqDescription
resultarrayyes–

No examples provided.

build_knowledge_graph ~600

Build a knowledge graph for an indexed codebase. ⚠️ IMPORTANT: Run index_codebase first. repo_path must be absolute. 🎯 What this builds: - Unified code property graph (calls + imports + type hierarchy) - Community detection: clusters modules into architectural groups - Optional LLM concept extraction. extract_concepts=True is PAID: up to 10 LLM calls over the 200 most central symbols (batches of 20), and it requires an LLM API key. It does NOT cover the repository — on trelix's own 12,184-symbol index those 200 symbols are 1.6% of it — so concept_count describes that sample. Selection is by PageRank centrality descending, symbol id ascending. ✨ Returns: - node_count: number of symbols in the graph - edge_count: number of structural relationships - community_count: detected architectural clusters - community_summary: the largest clusters, size-ordered (see the caps below) - concept_count: concepts found in that sample, 0 unless extract_concepts=True - concept_symbols_considered / concept_symbols_total: the coverage those concepts came from — 200 of 12,184 on this repo. Both are 0 when extract_concepts=False, which is what distinguishes "extraction never ran" from "it ran over 200 symbols and found nothing"; concept_count=0 alone cannot tell those apart. community_summary used to ship every detected community, unsorted. Measured on trelix's own index that was **1,160,415 bytes — roughly 290,000 tokens** from a single tool call, larger than most context windows. 6,437 of the 6,497 entries (99.1%) were singleton communities carrying no architectural signal, while the five real clusters (514, 477, 393, 279, 277 nodes) accounted for almost none of the bytes. min_community_size=2 and max_communities=50 cut that to under 32 KB while keeping every significant cluster. Pass min_community_size=1 and max_communities=0 to restore the old uncapped array. singleton_count and communities_omitted are always reported: 6,437 singletons is a community-detection tu…

NameTypeReqDescription
extract_conceptsboolean––
max_communitiesinteger––
min_community_sizeinteger––
repo_pathstringyes–

Structured output declared, but exposes no named fields.

No examples provided.

federation_add_repo ~209

Register a repo for federated search across MCP tool calls. ⚠️ IMPORTANT: - path must be an ABSOLUTE path. - Run index_codebase on it separately before federation_search_all can return results from it — registering a repo does not index it. - The registry is capped at TRELIX_FEDERATION_MAX_REPOS entries (default 50) to prevent unbounded growth from a scripted client.

NameTypeReqDescription
aliasstringyesShort unique name for the repo (e.g. "auth-service").
config_path––Optional path to a custom repos.json. Must be a .json registry file (missing, empty or already a registry) inside ~/.config/trelix/ or <cwd>/.trelix/.
pathstringyesAbsolute path to the repo root.
weightnumber–RRF weight multiplier (default 1.0; higher = ranked higher in federation_search_all's fused results).

Structured output declared, but exposes no named fields.

No examples provided.

federation_list_repos ~133

List all repos registered for federated (multi-repo) search. When the server runs with --root or TRELIX_ALLOWED_REPO_ROOTS, a registered repo outside those roots is not listed or counted, and every response carries repos_outside_roots (how many were left out).

NameTypeReqDescription
config_path––Optional path to a custom repos.json. Must be a .json registry file (missing, empty or already a registry) inside ~/.config/trelix/ or <cwd>/.trelix/. Defaults to ~/.config/trelix/repos.json.

Structured output declared, but exposes no named fields.

No examples provided.

federation_remove_repo ~139

Unregister a repo from federated search by alias. When the server runs with --root or TRELIX_ALLOWED_REPO_ROOTS, a registered repo outside those roots cannot be removed: its alias is answered exactly like an unregistered one, and the registry file is not written.

NameTypeReqDescription
aliasstringyesThe alias to remove. No-op (removed=False) if not registered.
config_path––Optional path to a custom repos.json. Must be a .json registry file (missing, empty or already a registry) inside ~/.config/trelix/ or <cwd>/.trelix/.

Structured output declared, but exposes no named fields.

No examples provided.

federation_search_all ~403

Search across ALL registered repos simultaneously (federated search). ⚠️ IMPORTANT: - Requires repos to already be registered via federation_add_repo AND already indexed (run index_codebase on each repo path beforehand). A registered repo with no index is skipped, not searched, and not counted in repos_searched; repos_unindexed names its alias, and if none of the queried repos is indexed, error says so. - Results are merged via Reciprocal Rank Fusion weighted by each repo's registered weight, then deduplicated. - Only the first TRELIX_FEDERATION_MAX_REPOS registered repos (default 50) are actually queried; repos_skipped reports how many were omitted. - When the server runs with --root or TRELIX_ALLOWED_REPO_ROOTS, a registered repo outside those roots is not searched, and every response carries repos_outside_roots (how many were left out). 🎯 When to Use: - Cross-service / cross-repo questions ("where is auth handled across our microservices?") - You don't know which of several registered repos contains the answer. 📄 Pagination: same cursor/k contract as search_code — pages are sliced from one fixed-width fetch, independent of cursor, so page contents are stable across calls (results don't shift/duplicate/vanish between pages the way a cursor-scaled fetch width would cause). k is clamped to 1..TRELIX_MCP_MAX_K, a negative cursor is an error, and the text is capped at TRELIX_MCP_MAX_RESULT_CHARS (see search_code). 🪶 Detail: detail="concise" drops each body and returns a one-line signature.

NameTypeReqDescription
config_path–––
cursorinteger––
detailstring––
kinteger––
querystringyes–

Structured output declared, but exposes no named fields.

No examples provided.

get_symbol ~92

Look up a symbol by its fully-qualified name.

NameTypeReqDescription
max_body_charsinteger–Longest body to return, in characters (default 20000; 0 means no limit). A longer body is cut and body_truncated is true.
qualified_namestringyese.g. "MyClass.my_method" or "my_function".
repo_pathstringyesAbsolute path to the repository root.
NameTypeReqDescription
result–yes–

No examples provided.

graph_search_mcp ~245

Graph-traversal search: find structurally related symbols by starting from semantically similar seeds and following code relationships. ⚠️ IMPORTANT: Run index_codebase and optionally build_knowledge_graph first. 🎯 When to use: - "What other code is connected to X?" — follow call/import/type edges - "Find the blast radius of a class" — who calls or imports it? - "What lives in the same architectural cluster as X?" 📏 Size: - k is the most results, from 1 up to TRELIX_MCP_MAX_K (default 50). - detail="detailed" (default) returns each body (first 600 chars); detail="concise" returns a one-line signature instead. - The list is capped at TRELIX_MCP_MAX_RESULT_CHARS characters (default 15000). When results are left out, the result carries a second text block saying so and `_meta.trelix` has total_available and omitted.

NameTypeReqDescription
detailstring––
kinteger––
querystringyes–
repo_pathstringyes–
NameTypeReqDescription
resultarrayyes–

No examples provided.

index_codebase ~169

Index a repository for code search. Run once before calling search_code. ⚠️ IMPORTANT: - Stores the index in <repo_path>/.trelix/index.db (zero external infra). - Re-run to refresh after large code changes; incremental update is fast. ✨ Providers: - local — no API key, CPU-only, fast for small repos - openai — requires OPENAI_API_KEY, best quality - azure — requires AZURE_API_KEY + AZURE_ENDPOINT - voyage — requires VOYAGE_API_KEY, best code-specific quality Defaults to TRELIX_EMBEDDER_PROVIDER (or "local" if that's unset too). Progress notifications are sent if the MCP client supports them.

NameTypeReqDescription
provider–––
repo_pathstringyes–

Structured output declared, but exposes no named fields.

No examples provided.

search_code ~435

Search the indexed codebase using natural language queries. ⚠️ IMPORTANT: - repo_path must be an ABSOLUTE path to an already-indexed repository. - Run index_codebase first if you receive an error about a missing index. 🎯 When to Use: - Find specific functions, classes, or implementations - Understand architecture before making changes - Locate all callers of a function before refactoring - Find similar patterns to follow when adding code 📄 Pagination: - Use cursor=0 for first page (default). A negative cursor is an error. - If next_cursor is not null, pass it as cursor for the next page. - k controls page size, from 1 up to TRELIX_MCP_MAX_K (default 50); page_size in the response is the k the server used. - The response text is capped at TRELIX_MCP_MAX_RESULT_CHARS (default 15000). When results are dropped to fit, truncated is true, omitted counts them and next_cursor points at the first dropped result. 🪶 Detail: - detail="detailed" (default) returns each result's body (first 800 chars). - detail="concise" drops body and returns a one-line signature instead. 🧭 Intent hint (optional): - If the calling agent already knows the query's intent, pass it as intent_hint (one of: symbol_lookup, file_overview, feature_flow, project_overview, comparison, config_lookup, dependency_map, blast_radius) to skip trelix's own internal LLM classification and route directly. An unrecognized value is never rejected — it falls through to normal classification. - hyde_snippet_hint (a short hypothetical code snippet) is only used when intent_hint is also valid.

NameTypeReqDescription
cursorinteger––
detailstring––
hyde_snippet_hint–––
intent_hint–––
kinteger––
querystringyes–
repo_pathstringyes–

Structured output declared, but exposes no named fields.

No examples provided.

subscribe_resource ~149

Register a subscription for a trelix:// resource URI. Registers the URI in this server process's in-memory subscription registry. The server does not advertise resources.subscribe and does not serve resources/subscribe, so this tool is the only way to register. A notifications/resources/updated (URI only, no content) is sent for a registered URI only if a file watcher runs inside this server process; nothing starts one today, so none is delivered yet.

NameTypeReqDescription
subscription_idstringyesClient-chosen correlation ID included in _meta of notifications.
uristringyesThe trelix:// resource URI to watch (e.g. trelix://repo//path/manifest).

Structured output declared, but exposes no named fields.

No examples provided.

unsubscribe_resource ~35

Deregister a resource subscription by its subscription ID.

NameTypeReqDescription
subscription_idstringyesThe ID returned when subscribe_resource was called.

Structured output declared, but exposes no named fields.

No examples provided.

Install

How do I install the trelix MCP server?

trelix runs locally as a PyPI package, launched with uvx trelix-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

pypi · trelix-mcp

# add to Claude Code
claude mcp add sairam0424-trelix -- uvx trelix-mcp
Common questions

What is the trelix MCP server?

trelix is an MCP server listed in the public MCP registry as io.github.sairam0424/trelix. Semantic code search for AI agents, hybrid BM25+vector, call-graph, 20+ languages. This page covers its PyPI package (trelix-mcp).

Is the trelix MCP server safe to use?

trelix scores 86 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 7 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the trelix MCP server expose?

trelix exposes 15 tools: index_codebase, search_code, get_symbol, blast_radius, build_knowledge_graph, and 10 more. Their descriptions and schemas cost roughly 3,308 tokens of context every time the server is loaded.

Is the trelix MCP server still maintained?

trelix is still listed as active in the MCP registry. We last reached this channel on 7 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the trelix MCP server under?

trelix declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

What did VerifyMCP test on the trelix MCP server?

VerifyMCP ran 16 checks on trelix, covering Malware scan, Known CVEs, Install scripts, Dependency health and 12 more. Endpoint Security and Transport & Reachability do not apply to a PyPI package, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.