repomap
NPM · @SYLPHX/REPOMAP · SCANNED SEP 26
A map of your codebase for AI agents: code graph, search, call paths and change impact. No API key.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security63
- No malware found by supply-chain analysis.Pass
- Known CVEs could not be checked: the version this server declares is not published in its registry.Unverified
- No install/post-install scripts declared.Pass
- Dependency health could not be checked: the version this server declares is not published in its registry.Unverified
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to SylphxAI/repomap). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability67
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1101 tokens (~183/item across 6 items; 6 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management3
- Stability observed for 1 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage93
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 78% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 6 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 7 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the repomap MCP server?
repomap runs locally as an npm package, launched with npx -y @sylphx/repomap. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @sylphx/repomap
claude mcp add sylphxai-repomap -- npx -y @sylphx/repomap
{
"mcpServers": {
"sylphxai-repomap": {
"command": "npx",
"args": [
"-y",
"@sylphx/repomap"
]
}
}
} {
"servers": {
"sylphxai-repomap": {
"command": "npx",
"args": [
"-y",
"@sylphx/repomap"
]
}
}
} codex mcp add sylphxai-repomap -- npx -y @sylphx/repomap
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"sylphxai-repomap": {
"type": "local",
"command": [
"npx",
"-y",
"@sylphx/repomap"
],
"enabled": true
}
}
} openclaw mcp add sylphxai-repomap --command npx --arg -y --arg @sylphx/repomap
mcp_servers:
sylphxai-repomap:
command: "npx"
args: ["-y", "@sylphx/repomap"] {
"McpServers": {
"sylphxai-repomap": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@sylphx/repomap"
]
}
}
} assistant mcp add sylphxai-repomap -t stdio -c npx -a -y @sylphx/repomap
{
"mcpServers": {
"sylphxai-repomap": {
"command": "npx",
"args": [
"-y",
"@sylphx/repomap"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 26 Sept 26 −11
- Known CVEs: pass → unverified ▼ security
- Dependency health: 1.00 → unverified ▼ functional
- Stability: unverified → 0.03 ▲ functional
- Package version: 1.2.2 → 1.3.2 functional
- Package version: 1.2.2 → 1.3.0 functional
- 25 Sept 26 80
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 26 Sept 2026 · Analysed npm/@sylphx/repomap@1.3.2
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | SylphxAI/repomap |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/SylphxAI/mcp-kit/.github/workflows/release.yml@refs/tags/v0 |
| Rekor log index | 2965692162 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:24412a9a57325275a7429ca858416f3906459e5b3fc61f6c7c6666466df9c9c88e4464858015e696d22484b6c813d3d199afd57b9408f64eaf3979ed5 |
Background: How many MCP packages publish verified provenance →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
context 360° view of a symbol or file ~149
Everything about one symbol or file: its code, who calls it (with call-site lines), what it calls, subtypes, members, imports, importers and the tests that touch it. Target forms: `path/to/file.ts`, `file.ts:42`, `Class.method`, `Class::method`, or a bare name.
| Name | Type | Req | Description |
|---|---|---|---|
| code_lines | integer | – | Lines of source to include for a symbol (default 60, 0 for none). |
| format | string | – | text (default, compact, file:line cited) or json. |
| root | string | – | Repository root. Defaults to the client's workspace root or the server's working directory. |
| target | string | yes | – |
No output schema declared.
No examples provided.
db Database map ~223
Map the database: tables, columns, primary and foreign keys, indexes, and the code that queries each table (file:line). By default it reads schema sources in the repo: SQL migrations, Prisma, Drizzle, SQLAlchemy and Diesel. To inspect a live Postgres, MySQL or SQLite database, pass `url_env` (the NAME of an environment variable holding the connection string). The connection is strictly read-only and the string is never stored or shown. Pass `table` for one table's full detail.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | text (default, compact, file:line cited) or json. |
| root | string | – | Repository root. Defaults to the client's workspace root or the server's working directory. |
| table | string | – | Focus on one table: columns, indexes, who references it, and where the code queries it. |
| url | string | – | Connection string (prefer url_env so secrets stay out of transcripts). |
| url_env | string | – | Name of an env var with the connection string, e.g. DATABASE_URL. |
No output schema declared.
No examples provided.
impact Change impact (blast radius) ~158
What breaks if this changes. Give `target` (symbol or file, or a list) or `changed: true` to analyse the current git diff. Returns a risk level, direct and indirect callers with call sites, importing files, modules touched, and the tests to run.
| Name | Type | Req | Description |
|---|---|---|---|
| base | string | – | Git ref for `changed` (default HEAD). |
| changed | boolean | – | Use the working-tree git diff (against `base`). |
| depth | integer | – | Caller depth (default 3). |
| format | string | – | text (default, compact, file:line cited) or json. |
| root | string | – | Repository root. Defaults to the client's workspace root or the server's working directory. |
| target | – | – | – |
No output schema declared.
No examples provided.
map Map the codebase ~142
Start here. A map of the repository: modules (communities of files that depend on each other), the most central files (PageRank), the most used symbols, and entry points. Pass `focus` (a directory) to zoom in and get an outline of its files and symbols with line numbers.
| Name | Type | Req | Description |
|---|---|---|---|
| focus | string | – | Directory to zoom into, e.g. src/server. |
| format | string | – | text (default, compact, file:line cited) or json. |
| limit | integer | – | Items per section (default 12). |
| root | string | – | Repository root. Defaults to the client's workspace root or the server's working directory. |
No output schema declared.
No examples provided.
search Search code ~173
Hybrid code search over AST chunks (whole functions, methods, classes): symbol names, BM25 keywords and a local code embedding model, so identifiers and plain questions both work, e.g. "parseConfig", "refresh token expiry" or "where are failed requests retried". Returns ranked file:line ranges with the matching lines.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | text (default, compact, file:line cited) or json. |
| include_tests | boolean | – | Default true (tests rank lower). |
| kind | string | – | – |
| limit | integer | – | Max results (default 10). |
| path | string | – | Only files whose path starts with or contains this. |
| query | string | yes | – |
| root | string | – | Repository root. Defaults to the client's workspace root or the server's working directory. |
No output schema declared.
No examples provided.
trace Trace call paths ~138
With `from` and `to`: the shortest call path between two symbols or files, each hop cited file:line (falls back to the file dependency path). With only `from`: the call tree below it (direction callees) or above it (direction callers).
| Name | Type | Req | Description |
|---|---|---|---|
| depth | integer | – | Tree depth (default 3). |
| direction | string | – | – |
| format | string | – | text (default, compact, file:line cited) or json. |
| from | string | yes | – |
| root | string | – | Repository root. Defaults to the client's workspace root or the server's working directory. |
| to | string | – | – |
No output schema declared.
No examples provided.
What is the repomap MCP server?
repomap is an MCP server listed in the public MCP registry as io.github.SylphxAI/repomap. A map of your codebase for AI agents: code graph, search, call paths and change impact. No API key. This page covers its npm package (@sylphx/repomap).
Is the repomap MCP server safe to use?
repomap scores 69 out of 100 on VerifyMCP. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the repomap MCP server expose?
repomap exposes 6 tools: map, search, context, trace, impact, db. Their descriptions and schemas cost roughly 983 tokens of context every time the server is loaded.
Is the repomap MCP server still maintained?
repomap is still listed as active in the MCP registry. We last reached this channel on 26 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the repomap MCP server under?
repomap declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.