Symvanta

com.symvantaPublished by symvanta.comOfficial publisherv1.1.0Updated Oct 25, 2026

Hosted code graph over MCP: exact callers, dependencies, and cross-repo blast radius for AI agents.

VerifiedStreamable HTTPWeb executableKnowledge & MemoryDeveloper Tools

Overview

AI-generated overview

Hosted code-graph server that lets an assistant query callers, dependencies, blast radius and architecture across indexed repositories.

What you can do
Bind a session to a project and repository, list projects and repositories, and check index health and freshness, including reindexing and attaching repositories or creating projects with admin rights. Search and resolve code: text, symbol and semantic lookup, symbol definitions with signatures and line bounds, file symbol lists, and HTTP route resolution. Traverse the graph for callers, dependencies, blast radius and diff impact, and estimate scope before a change. Read source slices, commit history and recently changed files at the indexed revision, and pin reads to a branch or working tree. Map repository structure and architecture, find tests covering a symbol, and record or read ADRs. A
When to use it
Useful when an assistant works in a Symvanta-indexed codebase and needs exact callers, cross-repository impact, route handlers or architecture orientation instead of shell search, especially before editing a widely used symbol or merging a diff.
Requirements
A remote MCP endpoint (Symvanta Cloud by default, or a self-hosted URL including the /mcp path). OAuth sign-in on first connection; a static API key or bearer token is possible for headless use. Repositories must be indexed in a Symvanta workspace; private repositories need a GitHub App installation or workspace token. Network access to the server.
Before you install
The server reads indexed code and history from your workspace; attaching repositories, creating projects and reindexing change server-side state. Private repository access depends on GitHub App installations or a workspace token. The companion plugin's hooks read the stored Symvanta OAuth token from local credentials and send identifier terms, symbol names, file paths and the repository owner/name to the server, never file contents; hooks can be disabled by environment variable.

Installation

In SourceWeft

  1. Open Symvanta in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.symvanta%2Fcode-graph/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "symvanta": {
      "type": "http",
      "url": "https://mcp.symvanta.com/mcp"
    }
  }
}

README

Symvanta plugin for Claude Code

One-step setup for working in a Symvanta-indexed codebase. Installing this plugin:

  • registers the Symvanta MCP server (default https://mcp.symvanta.com/mcp, configurable for on-prem / self-hosted, OAuth on first connection), so you do not edit .mcp.json by hand;
  • injects standing context once at the start of every session so the agent reaches for the Symvanta code-graph tools instead of shell search;
  • ships a symvanta skill with the full tool decision matrix and conventions;
  • adds slash commands that wrap the common graph workflows.

Commands

Each command routes to the right Symvanta MCP tool so you do not have to remember tool names:

  • /symvanta:ask [question]: answer a behavior question (how does X work, why does Y happen) via ask_codebase, with file citations.
  • /symvanta:blast [symbol]: blast-radius safety check before editing a symbol.
  • /symvanta:trace [symbol]: map a function's call chain, callers, and dependencies.
  • /symvanta:route [METHOD /path]: find the handler for an HTTP route.
  • /symvanta:status: connection and index health snapshot (project, repositories, freshness, edge counts).
  • /symvanta:architecture: high-level module map (Louvain functional modules, PageRank hubs, cross-module coupling, and the repo-wide load-bearing functions) via map view:"architecture".
  • /symvanta:scope [symbol or change]: pre-flight scope/impact estimate before you size a change (estimate_scope).
  • /symvanta:branch [name | clear]: pin this session's reads to a tracked feature branch, or clear the pin (ref).
  • /symvanta:working-tree: overlay your uncommitted edits so the graph reflects changes you have not pushed (ref op:"index_working_tree").
  • /symvanta:tests [symbol]: find the tests that cover a symbol (list_tests_for).
  • /symvanta:recent [path]: recently changed files and recent commits (history).
  • /symvanta:setup [local]: write the Symvanta routing block into the project's CLAUDE.md (or CLAUDE.local.md with local). Re-running replaces the marked block in place. Subagents read CLAUDE.md, so the routing reaches them too.

Install

In Claude Code:

/plugin marketplace add https://symvanta.com/plugin/marketplace.json/plugin install symvanta@symvanta

Sign in with OAuth when prompted on first connection. Your workspace's Getting Started page in the Symvanta dashboard shows the exact marketplace URL for your account.

Configuration

The plugin points at Symvanta Cloud (https://mcp.symvanta.com/mcp) by default, so Cloud users configure nothing. To point at a different Symvanta server, set the Symvanta MCP server URL (mcpUrl) plugin option: accept or change it when you enable the plugin, or later via the /plugin interface (Symvanta -> configure). Leave it blank to fall back to the Cloud default.

Use the full endpoint URL including the /mcp path, with no trailing slash, for example https://mcp.your-company.com/mcp. A bare host or a trailing slash will fail to connect.

Authentication. Every Symvanta MCP server (Cloud, staging, or on-prem) advertises its own OAuth endpoints, so Claude Code signs you in with OAuth on first connection whatever URL mcpUrl points at, nothing to configure in the plugin. On-prem supports the same OAuth flow: its gateway completes sign-in against your Symvanta cloud / license and the server verifies the issued token. Static API-key / bearer-token auth also exists for headless automation, but that is configured on the server or in your own MCP settings, not in this plugin.

Updating

/plugin update symvanta@symvanta

Then restart Claude Code. Claude Code reads the plugin (including hooks/hooks.json) when it loads, not continuously, so a running session keeps the previously loaded version until you restart. Until then a /plugin update is downloaded but not active.

What runs on your machine

The plugin executes small, readable Node hook scripts locally:

  • session-start.js: prints standing context once at the start of a session. Reads the checkout's git remote (owner/name) so it can tell the agent to call init with repository set to it, which binds the session to the project that holds this checkout instead of the workspace default. Sends nothing anywhere.
  • The augment hook family (on by default): five hooks sharing one core (lib.js). Each can only add context, never block: every error, timeout, or missing token is a clean pass-through, and the intercepted tool always runs untouched. Every hook first checks that the checkout it fires in is attached to a Symvanta project (one init call per checkout per ten minutes, memoized); a checkout attached nowhere, or a git checkout with no remote, keeps the hooks silent, so you never see another codebase's symbols while working in an unindexed one.
    • grep-augment.js: on Grep/Glob, looks up matching indexed symbol definitions (scoped to the repo you are searching, up to two identifiers from the pattern in parallel, 60s cache) and adds them alongside the raw search results.
    • edit-augment.js: on Edit/Write of a code file, injects the edited symbol's blast radius (upstream symbol count, files, layers, cross-repo edges, risk tier) before the change lands; a Write over an existing file lists the definitions the overwrite replaces. New files and non-code files stay silent.
    • read-augment.js: on the first Read of a code file per session, injects the file's symbol skeleton (names, kinds, line bounds) plus any architecture decision records anchored to it. Repeat reads exit instantly.
    • grep-rescue.js: after a Grep that found nothing, suggests graph candidates (auto text/semantic search) so a dead end becomes a lead; a grep with results exits right after the stdin parse, no reads, no network.
    • prompt-augment.js: identifier-shaped tokens in your message (backticked spans, snake_case, camelCase) resolve to indexed definitions at turn start. Plain prose never qualifies, so conversational prompts stay silent.

What the augmenters read, send, and write, exactly

To call the graph they need your Symvanta MCP token. They reuse the one Claude Code already stored when you connected, so there is no setup. The read is deliberately narrow and each script is short enough to audit in minutes:

  • They read only mcpOAuth[<the Symvanta entry>].accessToken from ~/.claude/.credentials.json (on macOS, Claude Code stores this in the login Keychain instead, under service Claude Code-credentials, so the hooks read that when the file is absent). Never your Anthropic token (claudeAiOauth) or any non-Symvanta server's token.
  • That token is sent only to the Symvanta MCP server, the same place it was issued for.
  • What leaves the machine per lookup: extracted identifier terms, matched symbol names, repo-relative file paths, and the checkout's GitHub remote as owner/name (the attachment check). Never file contents, and never your message text (the prompt hook sends at most two identifier tokens, not the prompt).
  • They write local files under ~/.symvanta/, never uploaded anywhere: grep-cache/ (the 60s result cache, one small file per key), repo-cache.json (path-to-repo memo), workspace-cache.json (per-checkout attachment memo, 10 minutes), keychain-cache.json (macOS only: a 5-minute memo of the Keychain read, so a busy session doesn't shell out to security on every tool call), read-seen/ (per-session first-read markers), and grep-augment.log (one JSONL line per run: hook, terms, repo, match count, latency, cache hit). The log exists so /symvanta:status can show what the hooks are doing; delete any of these files anytime.

Switches (restart Claude Code after changing):

# Supply your own token instead (dashboard -> Settings -> MCP connection -># regenerate gives a Passport mcp:read token); the credentials file is then# never read:export SYMVANTA_MCP_TOKEN="<token>"
# Turn the whole family off (no reads, no network on any tool call):export SYMVANTA_AUGMENT=off        # the legacy SYMVANTA_GREP_AUGMENT=off also works
# Or turn off individual hooks:export SYMVANTA_EDIT_AUGMENT=off   # Edit/Write blast radiusexport SYMVANTA_READ_AUGMENT=off   # first-read skeleton + ADRsexport SYMVANTA_GREP_RESCUE=off    # empty-grep suggestionsexport SYMVANTA_PROMPT_AUGMENT=off # prompt term lookup

You can also delete any hook's block from hooks/hooks.json to remove it entirely.

Bash and every tool without a hook above run untouched. All code navigation happens through the Symvanta MCP server over HTTPS, gated by OAuth. No telemetry, no background processes.

How the Grep/Glob augmenter works

Every gate fails safe to the same pass-through, and both pass-through and success land on "Grep runs normally": the hook can only add context, never block or delay the search to failure. SYMVANTA_GREP_AUGMENT=off short-circuits before anything is read or sent.

mermaid
flowchart TD    A["Agent runs Grep or Glob"] --> B{{"Claude Code fires the PreToolUse hook"}}    B --> D{"SYMVANTA_GREP_AUGMENT = off?"}    D -->|yes| RUN["Grep/Glob runs normally; results unchanged"]    D -->|no, default| TX["Extract up to 2 identifiers from the pattern; derive the repo from the search path"]    TX --> CACHE{"Fresh 60s cache hit?"}    CACHE -->|yes| F["Format matching definitions as additionalContext"]    CACHE -->|no| TOK["Token: SYMVANTA_MCP_TOKEN, else the stored Symvanta token from ~/.claude/.credentials.json (macOS: login Keychain)"]    TOK --> C["quick_lookup per term, in parallel, repo-scoped, hard cap 1.5s; falls back to locate mode:symbol"]
    subgraph cloud["Symvanta cloud (only the search TERMs leave your machine)"]        C --> M["mcp.symvanta.com"]        M --> DB[("Code graph in Postgres")]        DB --> M    end
    C --> OK{"Token valid and matches, in time?"}    OK -->|no, error, or timeout| LOG["Append one line to ~/.symvanta/grep-augment.log"]    OK -->|yes| CW["Cache for 60s"] --> F    F --> EM["Emit JSON to Claude Code"] --> LOG    LOG --> RUN    RUN --> O["Agent sees its grep results PLUS the Symvanta definitions, then reaches for find_node / relate / ask_codebase"]

Uninstall

/plugin uninstall symvanta@symvanta/plugin marketplace remove symvanta

Layout

.claude-plugin/plugin.json   manifest + MCP server registrationhooks/hooks.json             SessionStart + augment family wiring (PreToolUse, PostToolUse, UserPromptSubmit)hooks/session-start.js       standing-context injectorhooks/lib.js                 shared augment core (auth, transport, cache, log)hooks/grep-augment.js        Grep/Glob definition augmenterhooks/edit-augment.js        Edit/Write blast-radius augmenterhooks/read-augment.js        first-read file skeleton + ADR augmenterhooks/grep-rescue.js         empty-grep graph suggestions (PostToolUse)hooks/prompt-augment.js      prompt identifier lookup (UserPromptSubmit)hooks/augment-stats.js       local activity summary for /symvanta:statuscommands/                    slash commands (ask, blast, trace, route, status, architecture, scope, branch, working-tree, tests, recent)skills/symvanta/SKILL.md     tool decision matrix and conventionsscripts/                     sync-skill.mjs (SKILL from source) + check-tool-prefixes.mjs (CI guard)

License

MIT

Source: README.md at commit 9b4e921

Tools

27

init

Call first, with repository:"owner/name" (your checkout's GitHub remote). Binds the session to the project holding that repository and returns it as the active project with its repositories, index health, and a `usage` field (decision matrix + routing). workspace.attached=false means the checkout is NOT indexed: nothing in the answer describes it; attach it (add_repository, create_project) or work without the graph, do not route through the projects listed. Without repository: the pinned project (ref op:"use_project") or the workspace default.

Parametersfeedbackrepository

locate

Search/lookup. Pick a mode, or omit with a bare query to AUTO-ROUTE (text, then semantic on empty; response carries answered_by). Modes: - text (replaces grep): literal identifier/string, one row/occurrence. queries:[...] (<=10 terms) searches several in one call (and implies this mode when mode is omitted). pathsOnly:true = "filePath:lineNumber" only (~5x cheaper). maxPerFile caps rows/file (default 5). Empty carries did_you_mean; do NOT retry reworded, use semantic. - symbol: symbols by name/symbolPath in one repo. kind filters node kind, layer one layer. Tests last unless includeTests:true. - semantic: vector search for symbols similar to a natural-language query (names unknown). - file: fuzzy filename search (basename); filenames only. - config (replaces grep for env/config keys): key/env-var usages with nearest-symbol context; queries:[...] batches several keys. - codebase: cross-repo candidate scan; narrow with repositoryIds.

ParameterskindmodenamelayerlimitqueryqueriesfeedbackcommitShapathsOnlyprojectIdmaxPerFile+4 more

relate

Graph relationship traversal via one kind (real edges, not text). Kinds (1-10 symbols; heritage/chain one): - callers: direct callers. granularity:'file' (default) one row/file, 'site' one row/caller. - dependencies: outgoing calls/imports. - blast_radius: upstream impact walk (every caller, importer and referencer up to 3 hops, no per-hop sampling) + co-change siblings; risk {level,signals}. includeCrossRepo defaults ON here (off for others). blastRadiusTotalCount is the number of distinct symbols that 3-hop walk reached, not the row count: the blastRadius array is capped by expansionLimit. blastRadiusTruncated:true means the rows are a sample of that total; blastRadiusTotalAtLeast:true means the count stopped at its 10000 bound, so quote it as "N+". The walk stops at 3 hops, so it can miss impact further away; it never overcounts. Never report the number of listed rows as the impact size. - implementers: classes implementing interfaces via heritage edges. - heritage: full hierarchy (ancestors+descendants) of ONE type. maxDepth caps it. - chain: call-chain paths for a node (nodeId OR selectors[0]); chain params tune the walk. - path: shortest connection between selectors[0] (from) and selectors[1] (to). Direction-agnostic hop-labeled path; found:false when none within 6 hops. minimal:true = {id,name,filePath,startLine}-only (~50% cheaper) on callers/dependencies/blast_radius/implementers; granularity on callers/blast_radius. Rows may carry confidence (tiers in init usage); a cross-repo callers/dependencies row joined by a SCIP moniker also carries package (the package name that bridged the repos). 0 results: call locate (mode:text), not Grep; reason:"no_edges_indexed" = no edges.

ParameterskinddepthlimitintentnodeIdminimalfeedbackmaxDepthmaxPathscommitShadirectionprojectId+12 more

source

Raw file/git access at the indexed commit, for cloud agents with no clone; with a clone prefer your own Read/Grep/git. Ops: - read: content of filePath, whole file or slice startLine..endLine. ifHash (a prior read's hash) returns {unchanged:true}, no content. compact:true strips blank/comment-only lines. - list: files+subdirs at path. grep: ripgrep pattern (glob/pathPrefix). tree: layout from path. stat: size/lines/language/binary for filePath. blame: authorship for filePath. diff: fromSha..toSha. Keys: {op:"read",filePath:"src/a.ts"}, {op:"grep",pattern:"foo"}, {op:"list",path:"src"}. filePath is the file, path the directory. Gated by the Source Access add-on; else source_access_required.

ParametersopglobpathlimitquerytoShaifHashcompactendLinefromShapatternfeedback+7 more

history

Indexed commit history. Ops: - commits: recent commits (metadata + file list); <=200/call, default 50. With a clone prefer git log. - commit: one commit by sha with its diff summary (added/modified/deleted/renamed); null if outside the indexed window. - recently_changed: files ranked by change frequency in the indexed window ("what's hot").

ParametersoprequiredshapathlimitsinceuntilauthorfeedbackprojectIdrepository

library

Library catalog lookups. Ops: - packages: list indexed npm packages (specifier, ecosystem, owner/name, indexed-at, sha). Tenant-scoped, no projectId. - version: one package's resolved version for a project (sha, version, dep type, indexed-at, status indexed|indexing|failed|not_found). "indexing" means a job for that revision is in flight, so retrying later converges; "failed" carries a reason and does not change on its own.

ParametersoprequiredlimitfeedbackprojectIdspecifier

ref

Session-scoped branch / working-tree overlay / project binding. Ops: - use: pin a repository's reads to a branch (latest indexed revision). Branch must be tracked+indexed (open a PR, or add on the dashboard); else "indexing_in_progress". commitSha overrides. - clear: remove the pin, revert to default. - index_working_tree: overlay UNCOMMITTED edits (changedFiles path+content, optional deletedPaths/baseSha) on a short-lived synthetic revision pinned here; find_node/locate/relate reflect them, source and locate mode:semantic do NOT. Cap 100 files/256KB. - use_project: bind this session to projectId (from init.otherProjects / list_projects / create_project) so calls without projectId resolve there. init with repository:"owner/name" sets the same binding from the checkout's remote. - clear_project: drop the binding, back to the workspace default project.

ParametersoprequiredbranchbaseShafeedbackprojectIdrepositorychangedFilesdeletedPaths

adr

Architecture decision records: the WHY behind code, anchored to a symbol/file/project. Survive reindexes; find_node attaches a node's decisions. Ops: - record: needs title+decision. Anchor with repository+symbolPath or +filePath; omit both for project-wide. Optional context, consequences, status. - list: records for a project, filter by repository/symbolPath/filePath/status. - update: needs id; status:"superseded"+supersededById, or "deprecated".

ParametersidoprequiredlimittitlestatuscontextdecisionfeedbackfilePathprojectIdrepositorysymbolPath+2 more

diff_impact

Impact of a diff between two indexed revisions of one repo (base..head): changed files + symbols, union blast radius (layers + cross-repo fallout), affected endpoints, test suites, and co-change reminders. Replaces per-symbol relate (kind:blast_radius) loops before merging. Defaults: head = session's effective revision, base = previous indexed. For UNCOMMITTED edits, run ref (op:"index_working_tree"), then call with no shas.

ParametersbaseheadfeedbackprojectIdrepositoryexpansionLimitincludeCrossRepo

estimate_scope

Pre-flight estimate before graph traversal: coarse count of files a task likely touches and whether it spans layers (common/browser/node/electron-main/...) or repositories. Decides single-file edit vs consulting the graph. Heuristic, from symbol-name + text matches.

ParametersfeedbackprojectIddescriptionrequired

list_projects

List all projects with indexing summaries. Find a project by name or check which exist.

Parametersfeedback

list_repositories

List repositories in a project. Find repository names to scope a query to one repo.

ParametersfeedbackprojectId

list_file_symbols

List symbols in one file (name + kind + line bounds). Step 1 of the two-step read: get line bounds, then pass startLine/endLine to source (op:read) for that slice only (~4-15x fewer tokens). For one symbol + signature, use find_node {symbol, filePath}.

ParametersfeedbackfilePathrequiredcommitShaprojectIdrepository

map

Token-efficient repo (or subtree) skeleton: directory tree with each file's classes (methods in parens), functions, and HTTP endpoints, from the graph. Orient before drilling in. Scope with "path", cap with "maxDepth", density:"full" adds properties. view:"architecture" instead returns a module map (Louvain clusters with hubs, paths and cross-module coupling), plus namedModules/totalModules: a module NAME comes from a generated summary and is provisional, its id (the member-set hash in the header) is the stable key, so pin modules by id and re-read names rather than caching them.

ParameterspathviewdensityfeedbackmaxDepthcommitShaprojectIdrepository

list_tests_for

Test suites and cases whose suite name matches a symbol name (case-insensitive substring). Call before adding tests to see existing coverage and mirror its shape.

ParametersfeedbackselectorrequiredcommitShaprojectIdrepository

quick_lookup

Fast substring lookup of symbol DEFINITIONS by name: rows {name, kind, filePath, startLine, repositoryName} (displayName only when distinct from name), no ranking, no semantic. Cheaper alternative to locate (mode:symbol) for latency-sensitive pre-fetch (grep-augment hook); interactive search should prefer locate/find_node. Reads the latest indexed revision, no ref pin.

ParameterslimitqueryrequiredfeedbackprojectIdrepository

freshness

Returns lastIndexedSha, lastIndexedAt, and the current remote HEAD sha for a repository: detect index drift from remote. Reports what Symvanta knows, not local git. currentRemoteSha is null when no GitHub credential is configured. Echoes the active ref pin (pinnedBranch, pinnedSha).

ParametersfeedbackprojectIdrepository

index_health

Per-project index health. pendingLibraryVersions: cross-repo specifiers still indexing (an empty result may mean "not indexed yet", not "not in code"); call when a query is surprisingly empty. A row with status "skipped" is never going to arrive (a dev or optional dependency, which the catalog does not index) and status "failed" means discovery found no source, so only "indexing" is worth waiting on. architecture: per-repo Louvain module count + modularity Q (low Q = tangled), plus circular-dependency and mutually-recursive-symbol counts (inspect via map view:"architecture"). versionDrift: joined cross-repo SCIP edges whose consumer-pinned package version differs from the sibling's current version (package, pinned vs current, edge count). externalsCoverage: per-repo count of external references joined onto a sibling definition vs left as materialized stubs. unindexableRepositories: repos whose last index produced no graph and left a status (no_default_branch = the remote has no resolvable default branch, e.g. an empty repo; awaiting_upload = an upload-provider repo with no zip yet; remote_head_unresolvable = the remote could not be reached to resolve its head, so this is a network or credential problem, not a repository one), with the worker's log line as indexStatusDetail; explains a silently-empty repo. degradedRepositories: repos that DID index but lost a derived artifact (community_detection_skipped = Louvain clustering did not run, so map view:"architecture" has no modules; raise COMMUNITY_EDGE_CEILING or set COMMUNITY_DETECTION=true, then reindex). Both carry a human-readable reason.

ParametersfeedbackprojectIdrepository

find_http_route

Resolve an HTTP route by path + optional method to endpoint + handler (filePath + line bounds). Use instead of grep/locate for URL paths: follows framework router metadata (Express, Fastify, Hono, Laravel, FastAPI, etc.) and resolves dynamic segments, prefix groups, and middleware-mounted routers text search misses.

ParameterspathrequiredmethodfeedbackcommitShaprojectIdrepository

find_node

Resolve 1-10 symbols to filePath + line bounds + signature. selectors: array keyed by symbol (bare name) / symbolPath / filePath / nodeId; a flat query/name/single field also works. includeSource=true adds the excerpt, includeSummaries=true AI summaries. A node from a SCIP-indexed package also carries scip_package_name (and scip_package_version / scip_manager when known). For a class/interface/struct/protocol it carries a compact heritage field (<=5 ancestors, <=20 descendants, omitted when empty); includeHeritage:false skips it, includeCrossRepo:true walks cross-repo heritage. {resolved:false, candidates} = no confident match.

ParameterslimitfeedbackcommitShaprojectIdselectorsrequiredrepositorysourceModeincludeSourceexpansionLimitincludeHeritageincludeCommunityincludeCrossRepo+1 more

ask_codebase

Synthesis Q&A for behavior/architecture questions: answer + citations in one call. HEAVY (~2-4 s, ~3-5 k tokens): prefer context, find_node, or locate when they suffice. scope:"repo" (default) = ONE repo; scope:"all" = cross-repo (repositoryIds narrows, omit spans all; rejects repository). If sufficient_to_answer=true, answer without further tool calls. commitSha pins a revision.

ParameterslimitqueryscopefeedbackquestioncommitShaprojectIdrepositoryrepositoryIds

add_repository

Attach a GitHub repository to a project (owner + repo_name; clone URL derived; projectId defaults to the bound / default project). Public repos need nothing else. Private repos need installation_id from list_installations (a GitHub App installation that covers the repo) or a workspace PAT saved on the dashboard; without either the attach is refused (private_repository_needs_credential) instead of failing on the queued clone. Idempotent. First attach dispatches an indexing job; response carries visibility, credential ("installation" | "pat" | null), indexing_status ("queued" | "already_indexed") and indexing_job_id to poll. Needs mcp:admin.

ParametersownerrequiredfeedbackprojectIdrepo_namerequireddefault_branchinstallation_id

create_project

Create a project in the workspace (name; slug derived and made unique). Needs mcp:admin; plan project caps apply (plan_limit_exceeded). Then attach repositories with add_repository { projectId, owner, repo_name } and bind the session with ref op:"use_project" (or init with the checkout's repository once attached).

Parametersnamerequiredfeedback

list_installations

GitHub App installations connected to this workspace and the repositories each can reach (private included). Use before add_repository for a private repository: pass the installation's id as installation_id. pat_configured says whether a workspace PAT exists as the fallback credential. Empty = connect the GitHub App on the dashboard (Project > Repositories). An installation whose GitHub call failed carries error and an empty list.

Parametersfeedback

reindex_repository

Dispatch a reindex job for an already-attached repository (repositoryId from list_repositories / add_repository). Optional commit_sha pin. force:true re-applies the current parser even when unchanged at HEAD: it bypasses the per-file hash-skip AND re-runs the SCIP indexer subprocesses (no same-sha .scip cache serve), so a parser fix inside a SCIP runner, an external-moniker re-pin, or a toolchain upgrade takes effect without a version bump.

ParametersforcefeedbackprojectIdcommit_sharepositoryIdrequired

context

First-touch task orientation. Pass a natural-language task; returns the top 5 relevant files with their symbols and best-matching snippets in one call (~1-1.5k tokens, ~500 ms, no LLM). Replaces chaining locate (text) + locate (semantic) + list_file_symbols. Known symbol: find_node/locate. Synthesized explanation: ask_codebase.

ParameterstaskrequiredfeedbackcommitShaprojectIdrepository

bundle

Run up to 10 independent tool calls in parallel in one round-trip. Calls share the bundle-level project/repository scope unless a call sets its own args.repository, which scopes that call alone. Supported: locate (args.mode text|symbol|semantic|file|config, not codebase), relate (kind:callers only), find_node, list_file_symbols, find_http_route. Returns results in input order; unsupported tool names return {error}.

ParameterscallsrequiredfeedbackcommitShaprojectIdrepository

Version history

1
  1. v1.1.0LatestSep 16, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.