Codna — repository intelligence

io.github.thyn-aiPublished by GitHub account thyn-aiv0.2.113Updated Nov 8, 2026

Repo intelligence: triage, fix PRs, SARIF reachability, recall. Free codna login to execute.

VerifiedSTDIODesktop onlyKnowledge & MemoryDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Codna gives an assistant repository intelligence: triage issues to suspect files, plan fixes, check SARIF findings for reachability, and recall code from…

What you can do
  • Triage a repository and locate code relevant to an issue, deterministically and without LLM tokens
  • Prove which SARIF scanner findings (CodeQL, Semgrep, Snyk, Trivy) are reachable, read-only
  • Recall code from on-device memory with semantic and lexical search, fully offline
  • Root-cause and plan a fix, read-only by default, or push a branch and open a real pull request
  • File a bug, feature request or question to the vendor's feedback repository
When to use it
Useful when an assistant works inside a codebase and needs to find the files behind a bug report, judge whether a scanner finding is actually reachable, retrieve relevant code from local memory, or produce a fix and optionally a pull request.
Requirements
Local Python package (pip, pipx or uv) on Python 3.12-3.13, macOS Apple silicon or Linux x86_64, with git on PATH; runs as a stdio server. A one-time free codna login is required to execute any tool. codna_fix also needs a provider key such as ANTHROPIC_API_KEY, OPENAI_API_KEY or GEMINI_API_KEY; open_pr=true and codna_report_bug need GITHUB_TOKEN.
Before you install
codna_fix with open_pr=true pushes a branch and opens a pull request, and codna_report_bug files an issue in a public feedback repository, so both write to remote services. fix and review send an issue-specific evidence bundle to the model provider you choose under your key. Provider keys and GITHUB_TOKEN are secrets; the README says keys are stored in the OS keychain and secret redaction is always on.

Installation

In SourceWeft

  1. Open Codna — repository intelligence in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Codna

Understand. Fix. Evolve.

Agents read your code. Codna understands it.

Codna maps a repository before it spends a token. It then reviews pull requests, fixes bugs and proves which scanner findings are reachable. The same codna command runs on your machine, in the GitHub Action and behind the GitHub App.

Runs on your machine or your cloud. Your code never leaves without your key.

Install

bash
pip install codna          # or: pipx install codna · uv tool install codnacodna --version

Python 3.12–3.13. Wheels for macOS on Apple silicon and Linux x86_64. git on your PATH. Nothing else to install: no Node, Bun, Docker or server. The agent runtime ships inside the wheel.

Local commands need no Codna key. fix and review use your own model provider key, stored in the OS keychain and never printed:

bash
codna key set anthropic    # also: openai, gemini, google, groq, mistral, openrouter, xai, cursor

Commands

bash
codna triage . --issue "checkout total is wrong"     # suspect files. Deterministic. 0 LLM tokens.codna review . --pr 123 --post                        # findings with a verdict on the pull requestcodna fix . --tests --apply --max-iterations 3        # patch, re-run your tests, re-fix until greencodna fix <git url> --ref <sha> --issue "…" --open-pr # push a branch and open a pull requestcodna secure . --from-sarif results.sarif             # which scanner findings are reachable. 0 LLM tokens.

codna fix prints the root cause, the impacted symbols, the blast radius, its confidence and a regression risk. --open-pr needs a git URL and a GitHub write token. codna review posts one inline comment per finding with severity, category and a suggestion block, and an Approve when the diff is clean at medium and high. codna secure reads SARIF 2.1.0 from CodeQL, Semgrep, Snyk, Trivy or any other scanner.

Other commands: init, status, doctor, login, key, impact, memory export, report. Full reference: docs.codna.ai/reference/cli.

MCP server

Run Codna as a Model Context Protocol server over stdio — the same engine the CLI uses, inside Cursor, Claude Desktop, or your own agent:

bash
pipx install "codna[mcp]"       # or: pip install "codna[mcp]"codna mcp                       # serve over stdiocodna mcp install --client cursor     # optional: write the client config for you (or --client claude)

Five tools, each returning JSON; a failure comes back as codna_<tool> error: … text and never crashes the server:

ToolWhat it doesNeeds
codna_triageUnderstand a repo and locate the code relevant to an issue. Deterministic, 0 LLM tokens.free codna login
codna_secureProve which SARIF scanner findings (CodeQL, Semgrep, Snyk, Trivy) are reachable. Read-only, 0 LLM tokens.free codna login
codna_recallRecall code from local on-device memory — semantic + lexical search, fully offline.free codna login (which also installs the on-device runtime)
codna_fixRoot-cause and plan a fix (read-only by default); with open_pr=true pushes a branch and opens a real PR.free codna login + provider key (BYOK; + GITHUB_TOKEN for open_pr=true)
codna_report_bugFile a bug, feature, or question to thyn-ai/feedback.free codna login + GITHUB_TOKEN (else returns a pre-filled URL)

Introspection (initialize/tools/list) needs no credentials. Executing any of the five tools requires the one-time free community login (codna login — device authorization, free community license) — fully offline thereafter. codna_fix additionally needs a provider key (BYOK, e.g. ANTHROPIC_API_KEY); codna_report_bug needs GITHUB_TOKEN or it returns a pre-filled issue URL; codna_recall additionally uses the on-device memory runtime that the same codna login installs. Full reference: docs.codna.ai/guides/mcp.

Code memory

Code memory and recall run on your machine after a one-time free codna login (device authorization), which also installs the signed on-device runtime. From then on, recall runs fully offline: no key, no network calls. The optional codna[memory] extra adds the on-device semantic reranker; without it, recall ranks lexically.

What leaves your machine

  • Repository mapping, triage, recall and impact run offline. No model is involved.
  • fix and review send one issue-specific evidence bundle to the provider you chose, under your key. Not the repository.
  • Secret redaction is always on and cannot be turned off.
  • privacy.egress: fail-closed in codna.yaml refuses to run tests without network denial and skips registry lookups during review.
  • Source distributions exclude runtime binaries, keys, .env files and logs.

Links

Source: README.md at commit f8cd448

Tools

0
SourceWeft started this package once in an isolated sandbox, without credentials, to list its tools. That failed: the package did not install.

Version history

16
  1. v0.2.112Nov 7, 2026
  2. v0.2.106Nov 6, 2026
  3. v0.2.104Nov 5, 2026
  4. v0.2.98Nov 5, 2026
  5. v0.2.97Nov 5, 2026
  6. v0.2.96Nov 1, 2026
  7. v0.2.95Oct 26, 2026
  8. v0.2.94Oct 16, 2026
  9. v0.2.93Oct 11, 2026
  10. v0.2.90Sep 28, 2026
  11. v0.2.89Sep 25, 2026
  12. v0.2.87Sep 24, 2026
  13. v0.2.86Sep 24, 2026
  14. v0.2.85Sep 23, 2026
  15. v0.2.84Sep 23, 2026
  16. v0.2.83Sep 23, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts