Martin Vogel
c1eb3dd2d1
install.sh: - Wrap entire body in main() to prevent partial execution from curl|bash (interrupted download would execute truncated script) install.ps1: - Enforce TLS 1.2+ (older PowerShell defaults to TLS 1.0) PyPI (_cli.py): - Add SHA256 checksum verification against checksums.txt (was the only installer without checksums) npm (install.js): - Add SHA256 checksum verification against checksums.txt - Validate HTTPS on every redirect hop (max 5 redirects) - Replace execSync string interpolation with execFileSync array args (eliminates shell injection vector in tar/PowerShell calls) - Add path traversal check on extracted binary npm (bin.js): - Auto-download binary if missing (handles --ignore-scripts / pnpm) Go wrapper (main.go): - Custom HTTP client with CheckRedirect that rejects non-HTTPS redirects (Go's default http.Get follows redirects without scheme validation) - Fix variable name bug in error message (url → rawURL)
codebase-memory-mcp
The fastest and most efficient code intelligence engine for AI coding agents. Full-indexes an average repository in milliseconds, the Linux kernel (28M LOC, 75K files) in 3 minutes. Answers structural queries in under 1ms. Ships as a single static binary — this package downloads and runs it automatically.
High-quality parsing through tree-sitter AST analysis across 66 languages — producing a persistent knowledge graph of functions, classes, call chains, HTTP routes, and cross-service links. 14 MCP tools. Zero dependencies. Plug and play across 10 coding agents.
Installation
npm install -g codebase-memory-mcp
The binary for your platform is downloaded automatically at install time. Then configure your coding agents:
codebase-memory-mcp install
Restart your agent. Say "Index this project" — done.
Why codebase-memory-mcp
- Extreme indexing speed — Linux kernel (28M LOC, 75K files) in 3 minutes. RAM-first pipeline with LZ4 compression and in-memory SQLite.
- Plug and play — single static binary for macOS (arm64/amd64), Linux (arm64/amd64), and Windows (amd64). No Docker, no runtime dependencies, no API keys.
- 66 languages — vendored tree-sitter grammars compiled into the binary. Nothing to install, nothing that breaks.
- 120x fewer tokens — 5 structural queries: ~3,400 tokens vs ~412,000 via file-by-file search.
- 10 agents, one command —
installauto-detects Claude Code, Codex CLI, Gemini CLI, Zed, OpenCode, Antigravity, Aider, KiloCode, VS Code, and OpenClaw. - 14 MCP tools — search, trace, architecture, impact analysis, Cypher queries, dead code detection, cross-service HTTP linking, ADR management, and more.
Supported Platforms
| OS | Architecture |
|---|---|
| macOS | arm64, amd64 |
| Linux | arm64, amd64 |
| Windows | amd64 |
Usage
codebase-memory-mcp install # configure all detected coding agents
codebase-memory-mcp --version
codebase-memory-mcp --help
codebase-memory-mcp update # update to latest release
codebase-memory-mcp uninstall # remove agent configs
CLI Mode
Every MCP tool is also available directly from the command line:
codebase-memory-mcp cli index_repository '{"repo_path": "/path/to/repo"}'
codebase-memory-mcp cli search_graph '{"name_pattern": ".*Handler.*", "label": "Function"}'
codebase-memory-mcp cli trace_call_path '{"function_name": "main", "direction": "both"}'
codebase-memory-mcp cli get_architecture '{}'
MCP Tools
| Category | Tools |
|---|---|
| Indexing | index_repository, list_projects, delete_project, index_status |
| Querying | search_graph, trace_call_path, detect_changes, query_graph |
| Analysis | get_architecture, get_graph_schema, get_code_snippet, search_code |
| Advanced | manage_adr, ingest_traces |
Performance
Benchmarked on Apple M3 Pro:
| Operation | Time |
|---|---|
| Linux kernel full index (28M LOC, 75K files) | 3 min |
| Django full index | ~6s |
| Cypher query | <1ms |
| Trace call path (depth=5) | <10ms |
Full Documentation
See github.com/DeusData/codebase-memory-mcp for the full README including all MCP tools, configuration options, graph data model, and language support details.
License
MIT