code-graph

Quick start

pipx install cg-code-graph          # or: uv tool install cg-code-graphcg index . --db out/graph.db        # prints starter queries for your repocg install --host cursor    # or claude, codex, vscode, …: registers the MCP server and a "use cg first" agent rulecg reaches table:orders --db out/graph.db   # any table, connection or config key

Try it on a bundled sample, link a frontend to a backend, or connect an agent over MCP: Quick start guide. Other install options (install.sh, Windows, exact-mode toolchains): Install.

cg reaches table:store_books on the bundled Django sample:

dependents: 18 nodes  (code: 6, entry points: 9, other: 3)== RUNTIME (reached from http_route / ... / queue_job / listener): 5 functions/methods    catalog.api.create_book  depth=1 conf=resolved  http_route(1)        path: function:catalog.api.create_book          -WRITES_TABLE[resolved @ catalog/api.py:27]-> table:store_books    catalog.signals.review_saved  depth=3 conf=resolved  listener(1)        path: function:catalog.signals.review_saved          -DISPATCHES[exact @ catalog/signals.py:12]-> job:catalog.tasks.recompute_rating          -HANDLED_BY[exact @ catalog/tasks.py:13]-> function:catalog.tasks.recompute_rating          -READS_TABLE[resolved @ catalog/tasks.py:14]-> table:store_books

[Terminal demo: cg indexes the bundled Laravel and Nuxt sample apps, links them, then runs reaches, path, impact and plan check]

Supported languages

Go and others: import a SCIP index with cg index --scip FILE. Run cg doctor to see exact / heuristic per language on your machine.

What you get

• reaches, impact, path: every caller, route, job and page that reaches a table, config key or method.
• cg affected --base main: the tests and entry points a change reaches (--quiet feeds your test runner).
• Across repos: cg link matches client HTTP calls (frontends and Laravel / Guzzle backends) to server routes, and checks request keys (Laravel FormRequest, Elysia schemas, Nuxt / TypeScript bodies).
• Route guards: cg routes --writes --unguarded lists routes that write with no auth guard. Laravel checks inside the action count as inline guards unless --strict.
• Security views: cg surface lists the inbound / outbound attack surface and findings (hardcoded credentials, plaintext protocols, unverified webhooks, unguarded handlers, listeners on all interfaces, disabled TLS / SSH verification, plaintext gRPC, exposed IPC, outbound URLs built from request input) as text, JSON or SARIF, with --fail-on for CI.
• MCP server (cg-mcp) so agents query the graph instead of grepping. One server can serve many graphs (graphs plus an optional graph argument); a single --db stays one graph. See MCP.
• Visual view (cg serve) and plan checks (cg plan check) for planned changes.

Docs

Install · Quick start · CLI · MCP · Configuration · Architecture · Limitations

Changelog · Contributing · Security · MIT License

More recordings: docs/media.