Calm Mcp

CALM — Coding Agent Liveness Map

[License: MIT] [CI] [npm] [Languages]

A live, graph-verified map of your codebase — so an AI coding agent can edit with its eyes open instead of grepping in the dark.

Real call graphs instead of vector-similarity guesses. Compiler-verified edges wherever a compiler is available. Hard safety gates on the write path itself, not just warnings an agent is free to scroll past. Measured claims in this README are tied either to a current CALM snapshot or to benchmark artifacts; repo-specific values change as the codebase changes.

New here? Quick start gets you running in under a minute — no clone, no Rust toolchain, works with Claude Code, VS Code, Cursor, Windsurf/Devin Desktop, Codex, Antigravity, and JetBrains. Comparing tools in this category? Jump straight to Proof, not promises. Want the internals? docs/architecture.md covers multi-tier indexing, the SCIP/LSP overlay system, the concurrency model, and the sanitization layer in full.

The problem

An AI agent that edits code without knowing who calls the function it's about to change will, sooner or later:

• Delete "dead code" that a dozen other files still call.
• Change a signature and miss half its call sites.
• Refactor a symbol it assumed was minor — and discover, after breaking the build, that it was the hub the whole module leaned on.

None of that is a reasoning failure. It's a visibility failure: the agent never had a map. Give it one, and the guessing stops.

Why "CALM"

Most coding agents operate the way anyone would in an unfamiliar codebase with only grep: no sense of what's wired to what, no way to know if touching this function ripples into fourteen others. That's not confidence — it's fast guessing.

CALM stands for Coding Agent Liveness Map. Liveness, because the map is never a stale snapshot — it watches the filesystem, reindexes incrementally as files change, and reports in every response how fresh it currently is (scanning → parsing → building_edges → ready). Map, because it's an actual graph — call edges, import edges, hub/coreness metrics — not a flat text index pretending to be one. Hand an agent a live, trustworthy map of the terrain, and it stops flailing. It gets calm.

What you get

• The agent stops guessing who depends on what. callers/callees/edit_context show every known caller before a change ships. Full tree-sitter call graphs cover 13 languages out of the box: Python, TypeScript, JavaScript, Java, Rust, and Go with zero configuration, plus C, C++, C#, Ruby, PHP, Shell, and R via the default tier0-5 grammar bundle. Eleven more (Kotlin, Swift, Scala, Dart, Lua, Elixir, Haskell, OCaml, Zig, PowerShell, Groovy) parse behind opt-in --features lang-X build flags — 24 languages parsed in total (see multi-tier indexing).
• Edits that can't silently break things. Every write is hash-verified against the exact line range and syntax-checked before it ever touches disk. Hub and high-fan-in symbols hard-refuse a write until the agent has reviewed the callers and explicitly confirmed — a policy only a tool with a real dependency graph can enforce, and one the published competitor benchmark found no other server enforcing.
• Every edge tells you how much to trust it. Call edges are confidence-graded (textual → inferred → resolved → formal), and when your compiler can double-check the graph, CALM asks it to: SCIP overlays (rust-analyzer, scip-go — including multi-module go.work workspaces — scip-python, scip-ruby, and more) and live LSP overlays (gopls, clangd) can upgrade best-guess edges to compiler-verified ground truth across 12 supported language integrations when their provider/toolchain is available; unavailable providers sit out without changing the base behavior.
• A codebase that grades itself. fitness_report turns hub concentration, dead code, complexity, and architecture-boundary violations into a queryable, CI-enforceable signal instead of a one-off audit — and remember/recall keep decisions and gotchas available across sessions.
• Plays well with others, and stays on your machine. A cross-process edit lock and single-writer indexing model mean two editor sessions on the same repo don't corrupt each other's writes or double-index — under the shared daemon, sessions can even see each other coming. No code leaves your machine for indexing, search, or editing; the default embedding model is vendored into the binary at build time and needs no runtime network when those weights are valid; if they are unavailable, a runtime fallback download is allowed by default and can be disabled for strict offline operation. MIT-licensed. (One more opt-in exception: building with --features otel and setting OTEL_EXPORTER_OTLP_ENDPOINT exports span attributes — file paths, symbol names, tool names, timing, never source bodies — to your own collector. Off by default; see docs/architecture.md and use https:// collectors only.)

Where CALM fits

"Code intelligence for AI agents" is a real category now, built up by open-source pioneers — Aider, Serena, Sourcegraph/Cody, and others — that proved an agent works better with real code structure under it than with grep and good intentions. CALM builds on that foundation with a different center of gravity: most tools in the category inform the read path — better search, better navigation, better context. CALM also guards the write path. The same graph that answers "who calls this?" enforces "you don't change it until you've looked": hub/high-risk edits require fresh pre-edit context plus explicit confirmation grounded in a real caller; the policy can be widened to every edit, and every write is hash- and syntax-verified before it lands.

The trade-off is stated plainly: CALM's full-call-graph tier out of the box is 13 languages, not the 40+ some pure-LSP tools reach — though with 24 languages parsed and 12 carrying a compiler-verified upgrade path when their providers are available, the gap is narrower than it looks. What the trade buys is the part most distinctly CALM's own: confidence-graded edges, hard pre-edit gates, and a codebase that grades its own health — each backed by a number you can reproduce yourself (Proof, not promises).

Is CALM the right fit?

Good fit: agents that edit code directly, not just answer questions about it · single-repo codebases in a Tier-0/Tier-0.5 language · projects running multiple MCP clients (see supported clients below) against the same repo · local-first users who don't want to depend on an embedding API.

Not the fit today: multi-repo/cross-repo enterprise search — tools purpose-built for that scale (Sourcegraph/Cody among them) will serve you better · a language nowhere in CALM's current 24-language tree-sitter set.

Quick start

Supported clients — CALM works with any MCP client that speaks stdio; these are wired up or documented today:

Full walkthrough for every client above, including exact global-config snippets for the ones that need one — docs/mcp-client-setup.md. Running inside a devcontainer/Codespace where stdio forwarding doesn't reach? See docs/http-transport.md (advanced, remote-dev only, opt-in, loopback by default).

Using CALM on your own project — no clone, no Rust toolchain:

{  "mcpServers": {    "calm": {      "command": "npx",      "args": ["-y", "@eilodon/calm-mcp", "serve"]    }  }}

Drop that into .mcp.json (Claude Code/Cursor) or .vscode/mcp.json (VS Code uses a top-level "servers" key instead of "mcpServers", same shape otherwise) at your project root. Claude Code plugin instead: /plugin marketplace add Eilodon/CALM then /plugin install calm@CALM.

Prefer a native binary over npx? curl -fsSL https://raw.githubusercontent.com/Eilodon/CALM/main/scripts/install.sh | sh, then run calm setup from inside your project — it writes the same MCP config automatically, pointing at the binary you just installed. Add calm setup --npx instead to write the portable npx entry (shareable/committable — teammates and CI don't need the binary). It pins to this binary's own version by default for reproducible cold installs; pass --track latest to always resolve npm's newest release instead.

Developing on CALM itself (this repo):

# 1. Build the binarycargo build --release -p calm-cli
# 2. Initialize config for your projectcalm init --project-root .
# 3. Build the index (embeds symbols too, if semantic search is enabled in config.json)calm index --project-root .
# 4. Run the MCP server over stdio — incremental reindex kicks in automatically if an index already existscalm serve --project-root .

This repo ships ready-made config for Claude Code (.mcp.json), Cursor (.cursor/mcp.json), and VS Code (.vscode/mcp.json) — all three point at scripts/mcp-launcher.sh, a shared launcher that finds an already-built binary, downloads a checksum-verified prebuilt release if you're on a matching git tag, or builds from source if nothing is available yet. Clone the repo and it just works — no manual build step required first.

Note: calm serve automatically adds .calm/ to .gitignore on startup so the index database never gets committed.

Example: an agent's actual workflow

agent: repo_overview()  → current files/symbols and `indexing_phase=ready` are reported live
agent: "I need to change getUserByEmail"  → locate("getUserByEmail")        # find the file + symbol metadata  → source("getUserByEmail")        # read just the function body, not the whole file  → edit_context("getUserByEmail")  # MANDATORY before any edit      → the live caller count and risk assessment determine whether the agent reviews callers before touching the signature  → edit_symbol("getUserByEmail", expected_hash=..., new_text=...)      → risk_assessment=high, is_hub=true, no confirm:true → refused, with an explanation  → edit_symbol(..., confirm=true, reason="checked getUserByToken, still returns the same shape")      # reason must cite a real caller edit_context returned — writes for real, reindexes immediately  → diff_impact(staged=true)        # verifies blast radius before commit

Proof, not promises

The table below is a CALM snapshot observed on 2026-08-12 from this checkout. Re-run repo_overview() and fitness_report() to refresh it; repo-specific values change as the codebase changes. Benchmark ratios are task-specific and remain in the benchmark artifacts:

How CALM works

Full technical detail lives in docs/architecture.md — including the design philosophy behind why every response carries suggested_next and why the risky steps are hard-gated instead of just recommended. Section-by-section summary:

• Multi-tier indexing — 13 languages with full call graphs by default, 11 more parsed behind opt-in grammar features, 24 in total.
• A call graph you can actually trust — every edge is labeled by confidence (resolved/inferred/formal/textual); SCIP and LSP overlays can upgrade edges to compiler-grade ground truth across 12 supported integrations when their providers/toolchains are available; unavailable providers sit out.
• Search that actually finds things — FTS5 + semantic embeddings fused via Reciprocal Rank Fusion, plus real grep/glob straight off disk for files the indexer never parses.
• Editing with an actual safety net — hash-verified writes, syntax validation before anything touches disk, and a three-part gate (fresh edit_context, confirm:true, a grounded reason) on hub/high-risk symbols.
• Concurrency & reliability — a shared daemon, cross-process edit lock, and single-instance indexing lock mean multiple editor sessions on one repo don't corrupt or duplicate work.
• The codebase grading itself — 11 fitness metrics, coverage-aware dead-code detection, declared architecture boundaries, doc-drift detection.
• An agent that remembers, and knows when it's stuck — durable cross-session notes, git co-change mining, a stuck-loop signal.
• Safe by default — credential-shaped content is redacted in source/understand, prompt-injection-shaped content is flagged, and scan_text covers external text; local-first by default with an explicit embedding fallback.

Crate layout

• crates/calm-core/ — the index engine: tree-sitter parsing, SQLite schema, the multi-tier resolver (conservative → inferred → formal/Stack-Graphs, SCIP, or LSP), graph algorithms (coreness, hub detection), FTS5/semantic search, analysis (hotspots, coverage, codeowners, diff-impact, dead-code), fitness metrics, gitignore management.
• crates/calm-server/ — the MCP server (rmcp over stdio or a unix-socket daemon), exposing 40 tools plus the incremental file watcher.
• crates/calm-cli/ — the CLI: calm init, calm index, calm serve, calm connect, calm setup, calm fitness-check, calm guard, calm doctor.

CLI reference

calm init     --project-root .    # writes .calm/config.json with defaultscalm index    --project-root .    # one-shot full index (Scanning → Parsing → BuildingEdges → Ready)                                 # also embeds symbols+chunks if semantic_search.enabled=truecalm serve    --project-root .    # MCP server over stdio + incremental reindex + file watchercalm serve    --project-root . --listen unix:/path/to/daemon.sock   # run as a shared daemon (opt-in)calm connect  --project-root .    # lightweight forwarder to an already-running daemon (opt-in, Unix)calm serve    --project-root /project --db-path /data/index.db   # separate DB path (container deployment)calm serve    --project-root . --preset orient   # register only the "orient" phase's toolscalm doctor   --project-root .    # validates config, DB (symbols/files/metrics history), gitcalm setup    --project-root .    # writes/merges MCP config (.mcp.json/.cursor/.vscode) pointing at this binarycalm fitness-check --project-root .                             # CI gate, exits 1 on failurecalm fitness-check --project-root . --json                      # JSON outputcalm fitness-check --project-root . --config thresholds.toml    # custom thresholdscalm guard    --project-root .    # pre-commit/CI gate on the staged diff, exits 1 if aggregate risk >= --fail-on (default: high)calm guard    --project-root . --fail-on medium --json   # stricter threshold, machine-readable outputcalm guard    --project-root . --base origin/main         # review this branch/PR against a base ref instead of the staged diffcalm guard    --project-root . --commits HEAD~3..HEAD      # raw commit range, passed straight through to git diffcalm value-report --project-root .                        # real counts from .calm/audit.log: risky edits blocked, risk distribution on what was appliedcalm value-report --project-root . --json                 # machine-readable outputcalm scip-run --project-root . --lang go        # force one SCIP provider to run now, bypassing refresh policycalm scip-run --project-root .                  # --lang omitted = run every provider ("rust,go,python,javascript,java,csharp,php,ruby,c")calm index    --project-root . --scip-file build/index.scip --sub-root services/api   # ingest a pre-built SCIP index (CI/sandboxed, no external indexer install needed)

40 MCP tools for AI agents

CLI presets filter tools by workflow phase: orient, trace, edit, compound, full (default) via calm serve --preset or the preset field in config.json — or compose a custom set from toolset (module) names, e.g. --preset "trace,security" or --preset "full,-edit" (see AGENTS.md for the full toolset list). Every response carries suggested_next to point at the next step — full detail on each tool and the complete workflow lives in AGENTS.md.

| Recover | session_context, remember, recall | | Advanced | scip_refresh, lsp_refresh — force one or every SCIP/LSP provider to run now, bypassing the automatic refresh policy. scan_text — run the same prompt-injection/credential heuristics source/understand use against any text you supply (a WebFetch/WebSearch result, a subagent's report, pasted content) — local and offline, independent of any hosted LLM safety classifier. set_toolset — narrow or reset which tools this session exposes at runtime, without restarting the server (the safety floor — orient+guardrails+recover+edit — is always kept). All four: full preset only, not in the four workflow-phase presets above — deliberate manual/rare-use escape hatches, not steps in the default flow |

MCP Prompts — workflows packaged as slash-commands

Distinct from the tools above — MCP Prompts (prompts/list, prompts/get) return a single ready-made instruction message for a workflow you repeat often; MCP clients surface them as slash-commands:

One-line CI: the CALM Guard GitHub Action

action.yml wraps calm index + calm guard as a reusable composite action -- one-line adoption for a repo that just wants blast-radius review on every PR, no MCP client involved:

- uses: Eilodon/CALM@main  with:    fail-on: high   # default; "low"/"medium" also accepted

On a pull_request event it auto-detects the PR's base branch (fetching just that ref, since a default shallow checkout won't have it) and reviews the merge-base-relative range; on a plain push it reviews before..after. Both are overridable with base/commits inputs matching calm guard's own --base/--commits flags (see CLI reference above) -- set one explicitly for anything the auto-detection doesn't cover (workflow_dispatch, a merge-queue event, etc.). Requires an npm-published @eilodon/calm-mcp release reachable from the runner; nothing else to install.

Fitness check — the CI gate

Run for real in .github/workflows/ci.yml's fitness-check job on every push/PR — calm index first (a fresh checkout has no .calm/index.db yet), then calm fitness-check --project-root . --config thresholds.toml. That --config flag is not optional: without it, [[boundaries]] and [config_drift] are silently treated as "no rules declared" rather than erroring — only the numeric thresholds have a real default.

calm fitness-check measures 11 metrics against thresholds declared in thresholds.toml:

Unless noted above, the table uses built-in numeric defaults; this repo's checked-in thresholds.toml is the effective CI policy. Every calm fitness-check run also snapshots metrics to the DB so edit_context can show a trend (delta versus the previous day).

Architecture boundaries — [[boundaries]]

Declare "module A must not import module B" directly in thresholds.toml (same file as [thresholds]), matched by path prefix (not glob/regex). Note this is for layering Rust's own crate/module boundaries don't already enforce — declaring "calm-core must not import calm-server" would be a no-op, since Cargo's dependency graph makes that structurally impossible already:

[[boundaries]]from = "crates/calm-core/src/indexer/"to = "crates/calm-core/src/analysis/"reason = "indexer (extraction) must stay upstream of analysis (dead-code, hotspots, fitness) — not the other way around"

calm fitness-check reports each violation concretely (the real from/to path, the rule, and the reason) outside --json mode; the default max_boundary_violations = 0 means a rule you bothered to declare is one you actually keep.

This repo's own thresholds.toml currently declares two: the one above, plus crates/calm-server/src/watcher.rs → crates/calm-server/src/tools/ ("the background reindex/watch loop must not depend on the MCP tool-handler layer it runs independently of") — both hold at 0 violations.

Deployment

• cargo build --release → static (musl on Linux) binaries via .github/workflows/release.yml, 5-target matrix with SHA256SUMS + build-provenance attestation for every asset: x86_64-unknown-linux-musl, aarch64-unknown-linux-musl, aarch64-apple-darwin, x86_64-apple-darwin, x86_64-pc-windows-msvc. scripts/mcp-launcher.sh/scripts/install.sh download and checksum-verify the right platform's build automatically on supported targets when checkout is on (or you're installing) a matching git tag; untagged, offline, or unsupported-platform paths fall back to an existing binary or a source build.
• Containerfile, multi-stage (rust:alpine → scratch) — a single static binary, no runtime image needed, published to ghcr.io/eilodon/calm-mcp (tagged by version + latest) on every git tag push.
• compose.yaml ships a hardened example (read_only, cap_drop: ALL, no-new-privileges, pids_limit: 64, mem_limit: 256m).
• The default embedding model's weights are vendored into the binary via include_bytes! — build.rs::ensure_embedding_weights fetches crates/calm-core/assets/potion-code-16m/*.safetensors from Hugging Face Hub and checksum-verifies it once at compile time, so a normal cargo build/release binary needs no network I/O at runtime when those weights are valid. No Git LFS is involved (the repo carries zero LFS content).

Runtime and transport

• Default mode is MCP stdio. The launcher uses the shared Unix daemon when invoked without extra launcher arguments on Unix; custom invocations, CI, and Windows can use one-process calm serve.
• HTTP is opt-in. calm serve --http binds to 127.0.0.1:8787 by default. Non-loopback exposure requires --allow-remote and a non-empty CALM_HTTP_TOKEN sent as a Bearer token.
• Remote HTTP is read-only. CALM forces the effective preset to remote-safe — every tool that declares read_only_hint = true, computed from the tool router itself rather than a hand-maintained list, so it can't silently miss a newly added state-mutating tool; terminate TLS at a reverse proxy. The built-in HTTP transport caps request body size and concurrent requests as defense-in-depth, but has no real rate limiting or per-IP DoS protection, so do not expose it directly to an untrusted network.

Testing

cargo test --workspace                        # unit + integration (embeddings is a default feature, included)cargo test --test parity_test test_formal_edges   # Stack Graphs regression corpus

Eleven CI jobs run on every PR (verified against .github/workflows/ci.yml's own job list, not hand-counted): verify (fmt/clippy/test/audit), calm-guard-dogfood (dogfoods action.yml against this repo's own PRs — continue-on-error: true, shadow mode while new), stack-graphs-corpus (formal-resolver parity), txn-crash-injection (WS-1's crash-injection suite — kills the process at every reachable TxState transition, real SIGKILL), embeddings (clippy + test with the embeddings feature), no-stack-graphs-formal (clippy + test with stack-graphs-formal off — the only CI coverage of the resolver::formal stub that feature gate compiles to), all-languages (fixture-repo indexing across all 24 parsed languages, plus lsp-overlay), js-client-interop (cross-checks the tool schema against a real JS MCP SDK client, not just Rust's own), otel-http-features (clippy + test with the otel/http features, plus a guard against opentelemetry core version skew), fitness-check (runs calm fitness-check against this repo's own index — see Fitness check below), status-drift (fails the build if docs/status.generated.md is stale, if any hand-authored doc's tool count drifted from it, or if the benchmark claims registry is structurally inconsistent).

The workspace contains 1,000+ tests; the latest CI verify job is the source of truth for pass/fail. A handful of #[ignore]d live-binary integration tests (e.g. rust-analyzer/scip-go/scip-java) need external tools not installed in every environment.

Further reading

• docs/architecture.md — the full technical deep-dive: multi-tier indexing, SCIP/LSP overlays, search internals, the edit safety net, concurrency, self-grading, memory, sanitization, and the design philosophy behind it all.
• docs/comparison.md — methodology-first positioning write-up against other tools in this category.
• docs/what-external-users-get.md — exactly what an npx/npm/MCP-Registry install gives you, as distinct from this repo's own dev checkout: install/distribution mechanics, the full tool and toolset breakdown, the edit safety layer, language coverage, and what never ships externally.
• docs/ — resolver internals, migration plans, and other design notes not covered by docs/architecture.md above.
• docs/adr/ — individual architecture decision records (Stack Graphs scope, the formal-resolver approach, the LSP-optional confidence upgrade, the daemon+forwarder concurrency model).
• docs/mcp-client-setup.md — every MCP client install path in detail, including Windsurf/Devin Desktop and Codex global config.
• docs/http-transport.md — the opt-in remote/HTTP transport (calm serve --http): loopback-by-default, the fail-closed --allow-remote + token requirement, why remote exposure forces a read-only preset, and the TLS/reverse-proxy expectation.
• AGENTS.md — the full tool-by-tool workflow guide this project's own agents follow.
• KNOWN_LIMITATIONS.md — an honest list of what CALM doesn't do yet (single-language unsandboxed verification, no multi-file change-set, no reference-impact tool, risk classification with no change-kind signal, and more), and why each is deliberately deferred rather than half-built.
• benchmarks/ — the measurement suite behind benchmark claims in this README, and a few more: b2_call_graph_quality/ (precision/recall vs. a SCIP oracle), b3_search_quality/ (hybrid RRF vs. FTS-only vs. raw grep, NDCG@10), b4_token_efficiency/ (token cost vs. a naive baseline, per task), b6_tool_call_efficiency/ (round-trips: naive multi-call vs. one MCP call), b7_task_correctness/ (real rename refactors across 6 language corpora — fd/Rust, flask/Python, express/JS, zod/TS, gin/Go, spring-petclinic/Java — checked against an independent pass/fail oracle, not an LLM judge), b11_extended_competitor_ab/ (real calls against 4 other live MCP servers, not self-reported numbers), b12_tier1_tier2_tool_correctness/ (9 tools driven live over JSON-RPC against 6 external OSS repos, ground-truthed against regex/git grep), resolution/ (tier-distribution baseline across 19 real OSS repos, one per language). Unflattering results are published alongside good ones on purpose — benchmarks/README.md states that policy.

License

MIT