Serena, Repomix and 20+ code graph MCP servers compared

Most MCP servers in this space do one of three things: pack a repository into a prompt (Repomix), proxy a live language server (Serena), or build a persistent code graph MCP server (codegraph, codebase-memory-mcp, trace-mcp). trace-mcp is in the third group, and adds framework-aware edges and code-linked memory on top of the graph. This page is the whole field, tool by tool, with the evidence for each row and the date it was checked.

Before the tables: a capability table is the cheapest kind of evidence. Every ✓ below, ours included, is a feature claim. The one claim on this page that was measured rather than asserted is the token cost: a median 72.7% fewer input tokens to assemble code-review context, over 60 merged pull requests in 6 open-source repositories nobody here maintains. Cheaper context is only worth having if the review written from it holds up, so the same 60 pull requests were reviewed twice — once from each context — and scored blind by a judge against the PR’s own diff: trace-mcp’s arm understood the change 67% of the time against naive file loading’s 65%, at 0.80 false positives per PR against 0.58 — parity on a corpus this size, and inside the bar preregistered before the calls were made. We publish that half because a saving quoted without it is the asymmetry this page exists to refuse. Two peers below publish token benchmarks of their own — codebase-memory-mcp’s arXiv preprint (10× fewer tokens across 31 repos, which we have not reproduced) and codegraph’s self-run August 2026 measurement (62% fewer tokens across seven repos, the most transparent self-benchmark in this field). What separates ours is not that it exists: it is that the base and head SHAs, the losing cases, and the single command that re-runs the whole thing all ship inside the repository.

trace-mcp vs the main alternatives

The tables further down cover the whole field. This section covers the projects people actually evaluate against trace-mcp, in enough depth to decide from. Each major peer has a dedicated head-to-head page with a focused table, an honest “when to pick theirs” section, and an FAQ. Where the tables quote an advertised tool surface, that surface is a config knob as much as an architecture — tool presets decide what a session pays up front.

Every star count, licence and tool-surface figure in this section was re-read from the GitHub API and from each project’s own source on September 3, 2026 (CodeGraphContext on September 4, 2026), not carried over from the head-to-head pages. These summaries are written for the hub and rewritten on each pass — never pasted from a spoke, so the hub and its deep-dive pages stay distinct documents rather than drifting into near-duplicates.

trace-mcp vs Repomix — packing a repository vs indexing it

Repomix (yamadashy/repomix, 28.3K stars, TypeScript, MIT, v1.18.0) turns a repository into one prompt-shaped file. It ships an official MCP server (--mcp) and a tree-sitter --compress mode that keeps imports, classes, functions and signatures and drops the implementation bodies. It is the shortest path from “here is a repository” to “the model has read it”: no index build, no daemon, no config, and repomix --remote owner/name does the same for a codebase you do not own in seconds. For a small repo, a one-shot question, or pasting context into a web chat with no MCP client at all, that is the right shape of tool, and it is roughly 275× more popular than trace-mcp, which means far more third-party recipes when you need an answer at 2am.

What a pack cannot contain is an edge. --compress is lossy summarisation per file, so no compression level yields “who calls this” or “what breaks if I change this signature” — a pack holds the bytes that would answer those questions but computes nothing. A pack is also a fixed cost re-paid on every regeneration, and stale from the first edit after it is written (--watch re-packs the entire output after a 300 ms debounce, local directories only). trace-mcp pays the indexing cost once and amortises it across every query in the session, reindexes incrementally per changed file, resolves framework edges — route → handler, controller → template, model → table — through 88 integrations, and has a write path Repomix does not: rename across files, symbol moves, signature changes, AST codemods, verified dead-code removal. Pick Repomix when the repo fits in context; pick a graph when it does not, or when the question is structural. → trace-mcp vs Repomix

trace-mcp vs Serena — a live LSP proxy vs a precomputed graph

Serena (oraios/serena, 29.2K stars, Python, MIT) drives real language servers rather than parsing code itself: its README claims support for over 40 programming languages through LSP, plus an optional bridge into a running JetBrains IDE. That is a genuine precision lead in the cases AST heuristics get wrong — overloads, re-exports, generics, dynamic dispatch through interfaces — and it is on by default for Serena where it is opt-in for us. It is also the only peer that shapes its tool surface along two axes at once: fifteen client-specific contexts (Claude Code, Codex, Cursor-style IDE, ChatGPT, JetBrains and more) crossed with nine modes (planning, editing, one-shot, no-memories, …). Counted from source today, 50 tool classes are defined, 22 of them optional, leaving 28 enabled by default — exactly level with trace-mcp’s 28-tool minimal preset, so the honest comparison there is “the same size”, not “half”.

The structural difference is edges and durability. Serena is not stateless — SolidLanguageServer persists two pickled per-file document-symbol caches under .serena/cache/, so warm symbol lookups survive a restart — but it keeps no graph: no import graph, no call graph, no impact traversal. callHierarchy/incomingCalls exists in its LSP client layer and no tool class exposes it, so an agent cannot ask Serena for a call graph at all. Its memories are markdown files under .serena/memories with topic namespacing and cross-reference integrity checking, which is more than “notes” — but nothing ties a memory to a symbol and nothing rechecks it against the code at recall time, where trace-mcp’s decisions bind to symbol IDs, are verified as non-stale before they are served, and surface inside get_change_impact. Pick Serena for one mainstream language with a first-class language server, or if you need agent-driven debugging in JetBrains (something we deliberately do not chase — a static graph is the wrong tool for a running process). Pick trace-mcp for polyglot repositories, framework edges no language server models, transitive impact analysis, and the work that comes after navigation. → trace-mcp vs Serena

trace-mcp vs codebase-memory-mcp — the closest peer, opposite bet

codebase-memory-mcp (DeusData/codebase-memory-mcp, 43K stars, C, MIT) is the peer with the same premise as ours — a persistent tree-sitter knowledge graph of functions, classes, call chains, HTTP routes and cross-service links, served over MCP, fully local, no API key — and the opposite bet on how to spend the effort. It goes wide: 162 vendored grammars compiled into a single binary (against trace-mcp’s 81), with Hybrid LSP semantic type resolution layered on about a dozen of them, and 15 MCP tools at roughly 7K tokens of schema against our ~11.6K — trimmed further by positive allowlists, --tool-profile scout exposing seven tools and analysis eleven. That ~1.7× advertised-surface gap is the clearest place any competitor beats us, and this page is not going to pretend otherwise. Its supply-chain posture — SLSA Level 3 provenance, VirusTotal-scanned reproducible release candidates, OpenSSF Scorecard — is stronger than ours and can be the whole decision in a regulated shop. Its authors also published a benchmark preprint (arXiv 2603.27277: 83% answer quality, ~10× fewer tokens, 2.1× fewer tool calls across 31 repositories) that we have not reproduced.

Where it stops is depth and writes. A language-agnostic parser produces no framework edges: it knows UserController exists, not that it renders Users/Show.vue through Inertia. It is read-only — no rename with import rewriting, no symbol moves, no signature changes, no AST codemods, no dead-code removal. Its memory primitive, manage_adr, writes flat markdown documents rather than code-linked decisions, so nothing stops a decision about a deleted function from being replayed as if it still held. And it has no code-security analysis — no taint analysis, no SARIF output, no CI quality gates. trace-mcp’s OWASP taint analysis with type-aware pruning, configurable quality gates and SARIF 2.1.0 output make its graph a participant in CI rather than a chat aid. (Their supply-chain posture, above, is a different axis and a stronger one than ours.) One thing it has that we do not: ingest_traces folds observed runtime caller/callee counts into the graph — dynamic edges static analysis cannot see. → trace-mcp vs codebase-memory-mcp

trace-mcp vs codegraph — one advertised tool, tuned for orientation

codegraph (colbymchenry/codegraph, 70.5K stars, MIT, v1.6.0 — TypeScript over a native Rust extraction kernel with vendored C grammars) is the largest peer by stars and the sharpest single idea in this field. It defines eight MCP tools — search, callers, callees, impact, node, explore, status, files — and by default advertises exactly one. Re-verified in its source at the current commit: DEFAULT_MCP_TOOLS is the single-element set {explore}, the other seven stay fully implemented and re-enablable through a CODEGRAPH_MCP_TOOLS allowlist, and the stated reason in their own comment is that every other tool is a narrower slice of explore and presence itself steers mis-picks. The whole advertised surface costs roughly 1,900 tokens against our ~11.6K — about 6× cheaper, real money paid on every session. Its self-run August 2026 benchmark reports 88% fewer tool calls, 62% fewer tokens, 44% lower cost and 53% faster across seven repositories, disclosing the model, the queries, four runs per arm, and a correction to an earlier version of its own harness. It is not third-party reproduced, and it is still the most transparent self-benchmark here.

Two things it is honest about, which we repeat rather than quietly exploit: its README reports that its answers leave roughly 80% more retrieval context resident at the end of a multi-turn session than a file-reading agent’s do (67K tokens against 18K on VS Code) — fewer tokens processed and a larger persistent footprint are both true at once. And its scope stops at navigation by its own README’s account: no rename, no move, no codemod, no taint analysis, no SARIF, no dead-code removal, and no session memory of any kind. Its framework work links URL patterns to handlers across 17 frameworks and does it well, but does not model controller → template or model → table; it parses 34 languages against our 81. Pick codegraph when orientation in an unfamiliar codebase is the whole job and the advertised-surface budget is tight. Pick trace-mcp when the job continues past reading. → trace-mcp vs codegraph

trace-mcp vs Context Mode — the adjacent lane, not a rival

Context Mode (mksglu/context-mode, 22.1K stars, TypeScript, v1.0.169) is the one entry here that is regularly mistaken for a competitor and is not one. Read at its source: its eleven advertised tools (ctx_execute, ctx_execute_file, ctx_index, ctx_search, ctx_fetch_and_index, ctx_batch_execute, ctx_stats, ctx_doctor, ctx_upgrade, ctx_purge, ctx_insight) sit on eight runtime dependencies that contain no code parser at all — no tree-sitter, and nothing that resolves a symbol, an import edge or a call edge. Its “12 languages” are subprocess runtimes for executing scripts the agent writes, not grammars for parsing your code; reading that number as comparable to our 81 is the single easiest mistake to make about these two tools. Its headline 98% figure measures tool-output bytes across committed fixtures — Context7 docs, Playwright snapshots, vitest and tsc output, an nginx log, a 500-row CSV — not task success, and its BENCHMARK.md ships those fixtures, which is more than most claims in this field do.

So the two products solve different halves of the same budget. Context Mode compresses what tools return — browser automation, logs, big API responses — and routes the agent toward computing over data instead of reading it; trace-mcp makes questions about code cheap to ask. Neither substitutes for the other, and running both is a reasonable setup, with the honest caveat that you then pay both advertised surfaces at session start (its eleven tools are always fully loaded; there is no preset system and no deferred loading). Two practical notes before you adopt it: it ships under the Elastic License 2.0, not an OSI licence, which is a policy question at many companies before anyone reads a feature table; and its session-continuity coverage is uneven across hosts — full on Claude Code, OpenCode and KiloCode, partial on Cursor, Codex CLI and Kiro, absent on Antigravity IDE and Zed. → trace-mcp vs Context Mode

trace-mcp vs CodeGraphContext — the peer that drives the most SCIP indexers

CodeGraphContext (CodeGraphContext/CodeGraphContext, started by Shashankss1205, 4.2K stars, Python, MIT, v0.6.13 — self-classified Development Status :: 3 - Alpha, last pushed September 2, 2026) goes further on compiler-grade references than anyone else here, ourselves included. Read at source today: tree-sitter parsers for the 23 languages its README lists, plus an opt-in SCIP path (SCIP_INDEXER=true in ~/.codegraphcontext/.env) that shells out to eleven Sourcegraph indexer families — scip-python, scip-typescript, scip-go, scip-rust, scip-java, scip-clang, scip-dotnet, scip-php, scip-ruby, scip-swift and scip-ctags, covering more than twenty file extensions (nine at the September 4 reading; scip-rust and scip-swift landed since) — folds their symbol data into the same property graph, and supplements with tree-sitter for the files SCIP did not cover. We ship SCIP too and the table below says so, but our bridge auto-runs three (scip-typescript, scip-python, rust-analyzer) and otherwise ingests a .scip index you produced yourself, so their coverage of the driven-indexer path is three times ours. Both sides are opt-in and both cost the same thing: every language needs its indexer binary installed first, and C/C++ additionally need a compile_commands.json compilation database or CodeGraphContext logs a warning and falls back to tree-sitter for that repo. It also ships two things nobody else here has. Bundles are portable .cgc pre-indexed graph snapshots — exportable, importable, and downloadable from a public registry hosted as a Hugging Face dataset (cgc bundle load flask) — so you can skip indexing a dependency by fetching someone else’s graph of it; no other peer, ours included, offers that. And its datasource ingesters pull MySQL, Redis and Cassandra structure into the graph alongside the code.

Where it differs from us is surface, storage and scope. Its tool_definitions.py defines 29 tools and advertises all 29 — about 3.7K tokens of schema against our ~9.8K of schema, ~11.6K once the server-instructions block we also pay at session start is counted — with an mcp.json disabledTools denylist as the only trimming knob, the exact opposite of codegraph’s one-tool opt-in allowlist and of our presets. Storage is a decision you have to make rather than a detail you never see: six backend options (FalkorDB Lite, FalkorDB Remote, KuzuDB, LadybugDB, Neo4j, Nornic DB), defaulting to FalkorDB Lite on Unix with Python 3.12+ and documented with unusual honesty — their own dependency comments record that Kùzu was archived upstream in October 2025 and that redis-py is pinned to 5.x to keep FalkorDB Lite’s Unix-socket path working. trace-mcp ships one embedded SQLite+FTS5 store and no backend question at all. Framework awareness stops at two hardcoded Java Spring tools (find_java_spring_endpoints, find_java_spring_beans) rather than 88 integrations resolving route → handler, controller → template and model → table. And it reads and analyses rather than writes: find_dead_code, cyclomatic complexity and simulate_architectural_change all report — no refactoring, codemods, taint analysis, SARIF output or code-linked decision memory. One thing it has that our fixed tool set does not: execute_cypher_query, a raw graph query escape hatch, if you are willing to write Cypher.

Pick CodeGraphContext when compiler-grade references on a mainstream language justify installing an indexer toolchain, or when a pre-built bundle saves you an index you would otherwise build. If you are looking for a CodeGraphContext alternative, pick trace-mcp when you want one embedded store, framework edges and a write path. The full head-to-head, including where their reference resolution beats ours: trace-mcp vs CodeGraphContext.

trace-mcp vs SocratiCode — hybrid vector search vs zero-setup code intelligence

SocratiCode (giancarloerra/SocratiCode, 3.3K stars, TypeScript, AGPL-3.0-only / commercial dual license, v1.13.0) pairs Qdrant vector search with ast-grep AST syntax parsing across 19 languages. It delivers hybrid dense-vector plus keyword search via Reciprocal Rank Fusion (RRF), manages cross-agent concurrency locks for multi-agent workflows, and generates an interactive in-browser HTML graph visualization with Vis.js (codebase_graph_visualize).

Where it differs is infrastructure and semantics. SocratiCode requires Docker running local Qdrant and Ollama containers (or external API keys), advertises all 25 tools unconditionally without preset filtering, parses syntax without resolving framework connections, and ships under copyleft AGPL-3.0. trace-mcp runs locally with zero external infrastructure (your code and index stay on your machine — see privacy)—single npx trace-mcp with embedded SQLite+FTS5 and local ONNX embeddings—under permissive MIT, with 81 languages, 88 framework integrations, and active refactoring tools. Full head-to-head: trace-mcp vs SocratiCode.

trace-mcp vs TokenSave — 86 advertised tools vs framework-aware graph depth

TokenSave (aovestdipaperino/tokensave, 625 stars, Rust, MIT, v7.11.1) builds a code knowledge graph stored in embedded libSQL (a SQLite fork) with tree-sitter AST parsing across 50+ languages. It defines 86 specialized MCP tools, isolates grammar parsing in subprocess worker pools to guard against tree-sitter crashes, supports opt-in multi-branch indexing, and provides string replacement edit primitives (tokensave_str_replace, tokensave_insert_at).

Where it differs is prompt overhead, framework depth, and refactoring semantics. TokenSave advertises all 85+ tools by default on standard MCP hosts (only 5 carry anthropic/alwaysLoad), consuming ~12-15K tokens in schema listing before the agent begins work, and its extractors capture language syntax with zero framework route/controller/model awareness. Its code modification tools operate on text replacement slices rather than semantic AST nodes. trace-mcp ships a lean 28-tool minimal default (~11.6K tokens), constructs typed semantic edges across 88 frameworks, provides verified AST refactoring tools (refactor_rename, refactor_extract, refactor_move), and runs OWASP Top-10 taint analysis. Full head-to-head: trace-mcp vs TokenSave.

trace-mcp vs Narsil-MCP — 4-layer RDF graph vs framework-aware code intelligence

Narsil-MCP (postrv/narsil-mcp, 183 stars, Rust, MIT OR Apache-2.0, v1.7.0) models repositories according to the Code Context Graph (CCG) v0.2 specification, storing symbols and dependencies as RDF triples in an oxigraph SPARQL triple store with tantivy LZ4 search. It exposes 90 MCP tools across four presets (minimal, balanced, full, security-focused), an embedded Axum HTTP server with a React visualization SPA, and 147 syntactic security rules.

Where it differs is query ergonomics, framework depth, and code modification. Narsil-MCP exposes raw SPARQL querying over RDF triples, which introduces substantial prompt and URI hallucination overhead for AI models; trace-mcp exposes deterministic typed MCP primitives (get_callers, get_change_impact, find_usages). Narsil-MCP extracts syntax for 32 languages without framework route/controller/model awareness; trace-mcp constructs semantic edges across 88 frameworks. Crucially, Narsil-MCP is strictly read-only with zero refactoring write tools and zero session memory; trace-mcp executes atomic AST refactorings (refactor_rename, refactor_extract, refactor_move, refactor_codemod) and maintains code-linked decision memory with staleness verification. Full head-to-head: trace-mcp vs Narsil-MCP.

trace-mcp vs GitNexus — permissive graph intelligence vs proprietary PolyForm clustering

GitNexus (abhigyanpatwari/GitNexus, 47.2K stars, TypeScript / Node.js, PolyForm-Noncommercial-1.0.0, v1.6.11) is one of the largest code knowledge graph tools by stars. It pairs native C++ Tree-sitter grammars across 10 languages with embedded LadybugDB (a Kùzu fork) and in-memory Leiden community detection (graphology-communities-leiden) computing modularity cohesion scores (calculateCohesion). It exposes 17 MCP tools, including Program Dependence Graph analysis (analyze --pdg) with control dependence (CDG) and reaching definitions (REACHING_DEF), and an escape hatch for raw Cypher queries (cypher).

Where it differs is licensing, prompt efficiency, framework semantics, and write capabilities. GitNexus is distributed under PolyForm Noncommercial 1.0.0, which strictly forbids commercial and enterprise usage without a proprietary commercial license, whereas trace-mcp is 100% permissive open-source under MIT. Its raw Cypher querying tool shifts query formulation onto the LLM, inviting prompt overhead and syntax hallucinations, while trace-mcp serves typed, schema-validated MCP tools. GitNexus requires native C++ Tree-sitter builds via node-gyp-build, whereas trace-mcp runs anywhere via WASM-sandboxed web-tree-sitter. GitNexus extracts syntax without deep framework semantics, whereas trace-mcp maps 88 frameworks (route-to-handler, controller-to-template, ORM-to-table) and provides atomic AST refactoring write tools (refactor_rename, refactor_extract, refactor_move, refactor_codemod) and OWASP Top-10 taint analysis. Full head-to-head: trace-mcp vs GitNexus.

trace-mcp vs ast-grep — pattern search vs a persistent graph

ast-grep (ast-grep/ast-grep, 16K stars, Rust, MIT) is structural grep: patterns written as ordinary code with $METAVAR wildcards, matched against tree-sitter ASTs, rewritten in place, linted from YAML rules — multi-core, zero daemon, packaged on every installer. It is the sharpest tool in this field for shape-based rewrites (“every x && x() becomes x?.()”), and it wins that job outright against anything graph-shaped. What it has no answer for is the edge: no stored call graph, no transitive impact, no framework relations, no MCP surface — per-invocation scans rather than an index an agent queries across forty turns. Pick ast-grep for codemods and CI lint; pick the graph when the question is structural or the session is long. Full head-to-head: trace-mcp vs ast-grep.

trace-mcp vs Continue — the agent vs the index it queries

Continue (continuedev/continue, 36K stars, TypeScript, Apache-2.0) is the pioneering open-source coding agent: VS Code extension, JetBrains plugin and CLI with bring-your-own-model configuration. Read its maintenance notice before adopting — the README states the repository is read-only after its final 2.0.0 release. The comparison is barely a rivalry: Continue is the loop you talk to, trace-mcp is the persistent graph (81 languages, 88 framework integrations, SQLite + FTS5) that any agent queries for scoped structural answers instead of re-reading files. If you run a maintained agent today, the graph composes with that one instead. Full head-to-head: trace-mcp vs Continue.

trace-mcp vs Aider — the terminal loop vs the graph beside it

Aider (Aider-AI/aider, 49.2K stars, Python, Apache-2.0) is the terminal pair programmer everything else is measured against: repo map into the prompt, edit, lint/test retries, auto-commit with sensible messages, against almost any model including local ones. The map is the best “just give the model context” mechanism here, and on repos that fit in context it is simpler and often cheaper than any graph. Where it stops is edges and persistence: the map is rebuilt per session and the model re-derives structure from text, while the graph stores callers, impact and framework wiring as queryable edges with code-linked memory across sessions. Run the loop for edits; query the graph for the structural question before each one. Full head-to-head: trace-mcp vs Aider.

trace-mcp vs Cody — enterprise cloud search vs a local graph

Cody was Sourcegraph’s AI assistant on hosted code search — and the status notice comes first: Free, Pro and Starter ended July 23, 2025, the sourcegraph/cody repository is a 404, and only Cody Enterprise for existing customers plus an archived snapshot (3.8K stars) remain. What Cody Enterprise still owns is org-wide search over local and remote repos with someone else operating the infrastructure — the one thing a local-first tool cannot offer. What trace-mcp offers instead is the index living with the code: no account, no per-seat meter, no code leaving the machine, with framework edges and cross-session memory the hosted assistant does not keep. Full head-to-head: trace-mcp vs Cody.

trace-mcp vs ripwire — the per-call map vs the stored graph

ripwire (redhat-et/ripwire, 2.3K stars, C++, Apache-2.0) is the ripgrep of AI context: a zero-dependency offline binary rendering a ranked map — signatures, callers, blast radius, tests-to-run, quality deltas — per invocation, with the MCP server deliberately optional because schemas cost context. It is also the best-argued peer here: published evals with the defeats named, per-edge honesty labels, verdict-style outputs for orchestrators. The gap is the narrowest on this site — per-call map versus persistent index, CLI pipe versus MCP core product, syntax-and-calls versus 88 framework edges with an AST write path. Full head-to-head: trace-mcp vs ripwire.

trace-mcp vs IDE context — authored guidance vs derived structure

Cursor rules (.cursor/rules, team rules, AGENTS.md) and Copilot instructions (repo-wide file plus path-specific instruction files) are markdown guidance telling the agent how to work here — versioned, glob-scoped, team-enforceable, nearly free. No instruction file holds an edge: “check callers before editing” still sends the agent searching, while the graph answers in one call. Rules carry team judgement the code cannot contain; the graph carries resolved structure the rules cannot contain. Keep the rules; add the graph underneath. Full head-to-head: trace-mcp vs IDE context.

If you are comparing two of the alternatives to each other

Not every reader arrives having already picked us. Repomix vs codegraph puts those two head-to-head on their own terms — packing versus indexing — with where each is honestly weak (Repomix computes nothing; codegraph leaves a larger context footprint and says so; neither one writes code; neither benchmark is third-party) and where trace-mcp sits between them.

Verification methodology

How the rows below are checked, and when. Star counts render from docs/_data/competitors.yml, re-read from the live GitHub API rather than carried forward; a project not in that file keeps the figure from the pass that last checked it, written with a ~. Rows not named in a pass were not re-checked in it.

Pass of September 26, 2026 — current

Pass of September 26, 2026 (batch 1)

Pass of September 11, 2026

Pass of September 9, 2026

Pass of September 8, 2026

Pass of September 7, 2026

Pass of September 5, 2026

Pass of September 3, 2026

Pass of September 2, 2026

Pass of August 30, 2026

Standing caveats

vs. token-efficient code exploration

Tools that help AI agents read code with fewer tokens — AST parsing, outlines, context packing.

Capability trace-mcp Repomix Context Mode code-review-graph jCodeMunch codebase-memory-mcp cymbal
GitHub stars 175 28.3K 22.1K 31.3K 2.7K 43K 165
Tree-sitter AST parsing ✓ 81 languages ✓ compress only (~20) ✗ no code parsing ✓ 23 langs + Jupyter ✓ 70+ languages ✓ 162 languages ✓ 22 languages
Token-efficient symbol lookup ✓ outlines, symbols, bundles ✗ packs entire files ✗ no symbol index — compresses tool output instead ✓ ✓ core focus (~95% reduction) ✓ ✓ outline/show/context
Cross-file dependency graph ✓ directed edge graph ✗ ✗ ✓ incremental knowledge graph ✓ import graph ✓ knowledge graph ✓ refs/importers
Framework-aware edges ✓ 88 integrations ✗ ✗ ✗ ✓ 21 frameworks (route/middleware) partial (REST routes) ✗
Impact analysis ✓ reverse dep traversal + decorator filter ✗ ✗ ✓ blast-radius + Leiden communities ✓ blast radius + decorator filter ✓ detect_changes ✓ impact command
Call graph ✓ bidirectional, graph-based ✗ ✗ ✓ graph-based ✓ AST-based, bidirectional ✓ trace_call_path ✓ refs/importers
Refactoring tools ✓ rename, extract, dead code, codemod ✗ ✗ ✗ ✗ (dead code detect only) ✗ ✗
Security scanning ✓ OWASP Top-10, taint ✓ Secretlint ✗ ✗ ✗ ✗ ✗
Multi-repo subprojects ✓ cross-repo API linking ✓ remote repos ✗ ✓ multi-repo daemon ✓ GitHub repos ✓ cross-service HTTP linking ✗
IaC as graph nodes ✗ ✗ ✗ ✗ ✗ ✓ K8s/Kustomize/HCL/Docker ✗
Session memory ✓ built-in ✗ ✓ SQLite FTS5 journal ✗ ✓ index persistence ✓ persistent graph ✗
Written in TypeScript TypeScript TypeScript Python Python C Go

New entrants since April 2026 (local code-graph / packing lane, worth tracking): Repomix ships an official MCP server (--mcp) + tree-sitter --compress (signatures kept, bodies dropped); tokensave (625 stars, 86 tools, 50+ langs, Rust/libSQL; see vs tokensave); token-savior (Mibayy/token-savior, 1.1K stars, 75 tools, Python — AST navigation, git symbol diff, and type-checker diagnostics mapped to enclosing symbols); RTK (rtk-ai/rtk, 79.5K stars, Rust — CLI proxy intercepting shell commands to compress stdout by 60–90%, adjacent shell proxy lane complementing code graphs); codegraph (colbymchenry — function-level dep graph, tree-sitter→SQLite, auto-sync; went viral this cycle, now 70.5K stars; its August 2026 re-measurement claims 62% fewer tokens / 88% fewer tool calls / 44% lower cost across seven repos, with model, queries, run count and a correction to its own earlier harness disclosed — self-run, not third-party reproduced, and the most transparent self-benchmark in this field; see vs codegraph); Headroom (headroomlabs-ai/headroom, renamed from chopratejas/headroom; 69.2K stars — not a code-graph tool, a generic reversible compression layer for tool outputs/JSON/logs/RAG chunks, deployable as library/proxy/MCP server; its CodeCompressor is AST-aware for 7 languages but purely for shrinking output bytes, with no graph, no symbol index, no cross-file edges — complements rather than competes with token-efficient *symbol* lookup); repo-context-mcp (nduc99911, 103 stars, TypeScript — three tools: repo_map directory tree + entrypoint detection, search_code substring grep, pack_context token-budgeted markdown pack; no AST parsing, no symbol index, no dependency graph — a lighter-weight cousin of Repomix, not a code-graph competitor). cymbal could not be re-verified in June 2026 — possibly renamed or inactive. Context Mode is active and got its source deep-dive on August 30, 2026 (mksglu/context-mode, 22.1K stars): eleven MCP tools, all advertised, and no code parser at all — its eight runtime dependencies contain no tree-sitter, and none of its tools resolves a symbol, an import edge or a call edge. Its “12 languages” are subprocess runtimes for *executing* agent-written scripts, not grammars for parsing your code, and its 98% figure measures tool-output bytes on 14 committed fixtures rather than task success. It also ships under the Elastic License 2.0 rather than an OSI licence. It compresses what tools return; we make questions about code cheap to ask — adjacent lanes that compose rather than compete. See vs Context Mode. The June “could not verify” note was wrong and is retracted here.

codebase-memory-mcp’s stars more than doubled over two revisions (18.1K → 41.0K verified via GitHub API) — the fastest single-project jump we’ve tracked in this doc. Its authors also published a benchmark preprint (arXiv 2603.27277: “Codebase-Memory: Tree-Sitter-Based Knowledge Graphs for LLM Code Exploration via MCP”) reporting 83% answer quality, 10× fewer tokens, and 2.1× fewer tool calls vs. file-by-file exploration across 31 real-world repos — the first published third-party-style benchmark from a direct code-graph peer (vs. the self-reported numbers most others cite). We have not independently reproduced it. This doesn’t change our positioning (see “Honest assessment” below) but is worth flagging: a fast-growing peer with a real benchmark paper is a sharper competitive signal than a star count alone.

vs. AI session memory

Tools that persist context across AI agent sessions — activity logs, knowledge graphs, memory compression.

Capability trace-mcp Kage MemPalace claude-mem mem0 / OpenMemory engram ConPort
GitHub stars 175 new (2026) ~56.7K 93.5K ~64.3K ~6.4K 765
Cross-session context carryover ✓ get_wake_up { scope: "resume" } + decisions ✓ git-committed packets ✓ wings/rooms ✓ core focus ✓ multi-level (User/Session/Agent) ✓ branch-scoped handoffs ✓
Cross-session content search ✓ search_sessions FTS5 partial (JSON packets) ✓ vector+keyword+temporal (+optional rerank), 96.6% R@5 LongMemEval ✓ SQLite + Chroma hybrid ✓ hierarchical, ≤7K tok/retrieval (94.4 LongMemEval) ✓ local ONNX embeddings ✓ vector semantic
Decision knowledge graph ✓ temporal, code-linked ✓ temporal, code-linked ✓ temporal + “Closets” storage ✗ ✓ temporal + state-key supersession ✗ ✓ project-level
Code-graph-aware memory ✓ decisions → symbols & files ✓ + citation verification (staleness check) ✗ text-only ✗ text-only ✗ text-only ✗ text-only ✗ text-only
Auto-extraction from sessions ✓ pattern-based (0 LLM calls); hybrid LLM opt-in ✗ agent-written ✗ verbatim, zero extraction ✓ AI-compressed + citations ✓ single-pass hierarchical LLM ✗ ✗
Wake-up context ✓ ~300 tok (code-linked decisions) — ✓ ~170 tok (AAAK) ✓ progressive disclosure (~10×) + Endless Mode ✗ ✗ ✗
Decision enrichment in tools ✓ impact/plan_turn/resume ✗ ✗ standalone ✗ ✗ ✗ ✗
Service/subproject scoping ✓ decisions per service ✗ ✓ wings per project ✗ ✗ ✓ per branch ✓ per workspace
Published retrieval benchmark ✗ ✗ ✓ LongMemEval / LoCoMo / MemBench ✗ ✓ LoCoMo / LongMemEval / BEAM ✗ ✗
Code intelligence included ✓ 182 tools, 180+ edge types ✗ ✗ ✗ ✗ ✗ ✗
Works as standalone memory ✗ code-focused ✓ git-native, code-focused ✓ general-purpose ✗ Claude-specific ✓ agent-agnostic ✓ agent-agnostic ✓ project-scoped
Written in TypeScript — Python TypeScript TS + Python Go / Rust Python

Key difference: MemPalace stores “decided to use PostgreSQL” as text in ChromaDB. trace-mcp stores the same decision linked to src/db/connection.ts::Pool#class — and when you run get_change_impact on that symbol, the decision shows up in linked_decisions. General-purpose memory tools remember what you said. trace-mcp remembers what you said AND which code it’s about.

Where the field moved (April → June 2026): (1) Retrieval became a published number — mem0 (94.4 LongMemEval, ≤7K tok/retrieval) and MemPalace (96.6% R@5) both ship benchmarks; trace-mcp’s decision recall is still FTS5-only with no published figure. (2) Kage is the first peer to share trace-mcp’s code-linked-memory premise and add what trace-mcp lacks: it verifies each memory’s cited code at recall and diff time, withholding decisions whose code was renamed/deleted (claimed 0% stale-served). (3) mem0 added search-time temporal decay (1.5× recency / 0.3× stale) and state-key supersession — close analogs to trace-mcp’s order_by:"heat" and invalidate_decision, but automatic.

vs. documentation generation & RAG

Tools that generate docs from code or provide embedding-based code search for AI retrieval.

Capability trace-mcp Repomix DeepContext smart-coding-mcp mcp-local-rag¹ knowledge-rag¹
GitHub stars 175 28.3K ~300 ~200 ~200 ~60
Real-time code understanding ✓ live graph, always current ✗ snapshot at pack time ✗ manual reindex partial (opt-in watcher) ✗ partial (file watcher)
Auto-generated project docs ✓ generate_docs from graph ✗ raw file dump ✗ ✗ ✗ ✗
Semantic code search ✓ search + query_by_intent ✗ no search ✓ Jina embeddings ✓ nomic embeddings ✓ vector search ✓ hybrid + reranking
Framework-aware context ✓ routes, models, components ✗ ✗ ✗ ✗ ✗
Task-focused context ✓ get_task_context — code subgraph ✗ packs everything ✗ ✗ ✗ ✗
No doc maintenance needed ✓ derived from code ✓ repacks on demand ✗ manual reindex partial (auto on startup) ✗ manual ingest partial (auto-reindex)
Works offline, no API keys ✓ graph + FTS5 + bundled ONNX embeddings ✓ ✗ requires cloud API ✗ requires local embeddings ✗ requires local embeddings ✗ requires local embeddings
Incremental updates ✓ file watcher, content hash ✗ full repack ✓ SHA-256 hashing ✓ file hash + opt-in watcher ✗ ✓ mtime + dedup
Written in TypeScript TypeScript TypeScript JavaScript TypeScript Python

¹ mcp-local-rag and knowledge-rag are document RAG tools (PDF, DOCX, Markdown) — not code-specific. Included for comparison as they occupy adjacent mindshare.

Key difference: RAG tools answer “find code similar to this query.” trace-mcp answers “show me the execution path, the dependencies, and the tests for this feature.” Graph traversal finds structurally relevant code that embedding similarity misses — and never returns stale results because the graph updates incrementally with every file save. (Independent evidence: the CodeCompass study, arXiv 2602.20048, reports +23.2 pp on hidden-dependency tasks from graph navigation over grep-style retrieval.)

vs. code graph MCP servers

Capability trace-mcp Serena code-review-graph codebase-memory-mcp SocratiCode Narsil-MCP Roam-Code
GitHub stars 175 29.2K 31.3K 43K 3.3K 183 ~510
Languages 81 40+ (73 LSP backends) 23 + Jupyter 161 19 32 28
Framework integrations 88 ✗ ✗ (Python entry points only) ✗ ✗ ✗ ~15 (ORM N+1 / API drift only)
Cross-language edges ✓ ✗ ✗ ✓ cross-service HTTP ✓ polyglot dep graph ✗ ✓ PHP↔TS API drift
MCP tools advertised (default) 29 minimal (~11.6K tok², default); 61 standard (~20.5k tok); 182 full (~52K) 28 default (50 defined) ~28 15 all / 11 analysis / 7 scout (~7K tok, schema only) 25 (~5.2K tok) 90 246 defined / 17 default core (8 presets)
Session memory ✓ ✓ (notes, not code-linked) ✗ ✓ partial (context artifacts, not code-linked) ✗ ✗
CI/PR reports ✓ ✗ ✓ blast-radius GitHub Action ✗ ✗ ✗ ✓ SARIF 2.1.0 + GH/GL/Azure
Multi-repo subprojects ✓ partial (query_project, optional, no cross-repo edges) ✓ multi-repo daemon ✓ cross-service ✓ cross-project search ✗ ✗
Control-flow / data-flow ✓ CFG w/ basic blocks + loop back-edges + dataflow ✗ ✗ ✗ ✓ codebase_flow (call flow) ✓ CFG w/ basic blocks + loop edges; type-aware taint ✗
Security scanning ✓ OWASP/taint, type-aware pruning ✗ ✗ ✗ ✗ ✓ 147 rules (taint/OWASP/CWE) + SBOM + OSV/supply-chain ✗
IaC as graph nodes ✓ K8s/Kustomize/HCL/Docker, cross-file resolved to real nodes ✗ ✗ ✓ K8s/Kustomize/HCL/Docker ✗ ✗ ✗
Compiler-grade precision ✓ opt-in LSP + offline SCIP ingestion (scip_resolved tier) ✓ live LSP (rename/refs/diagnostics) ✗ ✗ ✗ ✗ ✗
SARIF / CI-scanning output ✓ 2.1.0, OASIS-schema-validated ✗ ✓ blast-radius GitHub Action ✗ ✗ ✗ ✓ SARIF 2.1.0 + GH/GL/Azure
Graph visualization ✓ desktop app (cosmos.gl) ✗ ✗ ✓ 3D web UI ✓ interactive HTML ✓ SPA frontend ✗
Knowledge graph queries ✓ graph_query ✗ ✗ ✓ Cypher-like ✗ ✓ SPARQL / RDF ✗
Refactoring tools ✓ rename/move/signature/codemod/extract¹ ✓ rename/safe-delete; move/inline via JetBrains bridge only ✗ ✗ ✗ ✗ ✗
Antipatterns / clone detection ✓ 11 antipatterns + 4 code smells (debug artifacts across 10 langs) + AST Type-2 subtree hashing + name/signature duplication ✗ ✗ ✓ MinHash near-clone + Louvain communities ✗ ✗ ✓ 23 patterns + AST Type-2 subtree hashing
Architecture governance ✓ ✗ ✓ Leiden communities ✓ Louvain communities ✗ ✗ ✓ change-safety gates
Token savings tracking ✓ ✗ ✓ (~65× median claimed, whole-corpus baseline) ✓ ✓ (~61% claimed) ✗ ✓ (−80% input tokens claimed on a 41-cell A/B, labelled measured-at-an-older-kernel)
Written in TypeScript Python Python C TypeScript Rust Python

² Our token figures are the whole session-start cost: tools/list schema plus the server-instructions block, because that is what a client actually pays before asking anything. The schema-only split is in the measurement table under “Deep dive” below (minimal is ~9.8K schema + ~1.75K instructions). Peer figures are quoted on whatever basis their own source supports and labelled where it differs.

¹ apply_codemod now rewrites on @ast-grep/napi (true AST pattern matching, metavariable substitution, no false matches in strings/comments) with automatic regex fallback for non-AST languages; the native binding loads lazily and degrades to regex instead of crashing if missing. extract_function is re-enabled with AST free-variable analysis — it detects genuine multi-return-value slices and rejects them with a structured error rather than silently dropping a binding, and lowers confidence on shadowed-variable cases instead of misreporting them as clean (see “where competitors lead” below for what deep validation found).

New entrants since April 2026 (direct code-graph MCP peers): grafel (Rust, multi-repo daemon, cross-repo + IaC topology, watcher-driven, FlatBuffer in-memory graph); GitNexus (MCP-native KG, Leiden communities with cohesion scores); Code Pathfinder (5-pass AST indexing, NL queries, dataflow); CodeGraphContext (tree-sitter + optional SCIP indexers → property graph — profiled at source on September 4, 2026; see its summary above); Graphify (Python, 112.4K stars — deterministic tree-sitter AST → knowledge graph over 13 languages plus docs/SQL schemas/configs/PDFs/images, no vector store, /graphify Claude Code skill or standalone --mcp server, --neo4j Cypher export, --wiki crawlable markdown output; 3-tier edge provenance (EXTRACTED/INFERRED/AMBIGUOUS) is coarser than trace-mcp’s 4-tier resolution_tier, and it has no refactoring tools, security scanning, or framework-aware edges). Serena’s “debugger tool”, noted here in an earlier revision as a native feature, is on a re-read of the source an optional beta bridge into a running JetBrains IDE (JetBrainsDebugTool, alongside twelve other JetBrains* tools that proxy to their plugin) — it is not a debugger Serena implements, and it is off by default.

depgraph.ai (archview-ai, closed source, hosted) is the one peer on this SERP that is not in the table above, because it is not the same product: it indexes third-party packages, not your repository. Verified on its own site September 6, 2026 — it publishes one curated remote MCP endpoint per public package (https://mcp.archcontext.ai/github_<owner>_<repo>_branch_<branch>/mcp, e.g. github_shadcn-ui_ui_branch_main), advertising find / trace / prove over that package’s functions, classes and files across 20+ languages. There is nothing to run locally and nothing to point at your own code. Pricing is per user per month with quota measured in MCP-delivered context: Free 20 MB, Pro $15 / 100 MB, Max $75 / 400 MB. Its pricing page links a community repository at github.com/archview-ai/depgraph-community; that URL returned 404 on September 6, 2026, and the archview-ai account has one unrelated public repo, so there is no source to read and no star count to quote — which is why it is absent from docs/_data/competitors.yml, whose every entry must name a checkable repository. Take: complementary, not competing. Understanding a dependency you did not write and navigating the code you did write are different questions; a reader comparing the two should know they can hold both.

Why framework awareness matters: A graph that knows UserController exists but doesn’t know it renders Users/Show.vue via Inertia is missing the edges that matter most. Framework integrations turn a syntax graph into a semantic graph — the agent sees the same connections a developer sees.

Deep dive: how the two largest peers shape their tool surface

Both of the biggest projects in this space (by stars) made the same product call, independently, and it is the one place they are clearly ahead of trace-mcp today. Verified by reading their source on August 28, 2026, not their READMEs.

The 70.5K-star entrant (colbymchenry/codegraph, v1.6.0, TypeScript with a Rust kernel) defines eight MCP tools — search, callers, callees, impact, node, explore, status, files — and by default advertises exactly one of them. DEFAULT_MCP_TOOLS is the single-element set {explore}; the rest stay fully implemented and re-enablable through a CODEGRAPH_MCP_TOOLS allowlist env var, but are not listed to agents. The stated reason, in a source comment: every other tool is a narrower slice of what explore already does, and presence itself steers mis-picks. Their whole advertised surface costs roughly 1,900 tokens (~390 tokens of schema plus a ~5.8K-character server-instructions block). Two further mechanisms are worth noting: (1) explore carries a per-project adaptive output budget — total output cap, default file count, per-file cap and clustering threshold all tier on indexed file count, explicitly kept under the host’s ~25K-char inline tool-result cap so the result is never externalised to a file the agent has to read back; (2) their file-reading tool deliberately mirrors the host’s native Read contract byte-for-byte (offset/limit, <n>\t<line> output, “safe to Edit from”) so it can be substituted for Read rather than competing with it.

The 43K-star entrant (DeusData/codebase-memory-mcp, pure C) ships 15 MCP tools (~7K tokens of schema) and adds tool profiles: --tool-profile=scout exposes 7, --tool-profile=analysis exposes 11, default exposes all 15. Re-verified September 3, 2026: 162 languages (up from 161), Hybrid LSP semantic type resolution across 12 languages, and two tools we had not catalogued — manage_adr (create/replace an Architecture Decision Record document) and ingest_traces (ingest runtime caller/callee counts to enrich the graph). Supply-chain posture is a deliberate selling point: SLSA Level 3, VirusTotal scanning of three behaviourally identical release candidates, OpenSSF Scorecard.

Take: manage_adr is a flat markdown document with get/update/sections modes — not code-linked memory, and no reason to copy it; trace-mcp’s decisions already bind to symbol IDs and surface inside get_change_impact. ingest_traces is a genuinely missing capability (runtime-observed dynamic call edges that static analysis cannot see) but is a three-field payload — a thin veneer, worth revisiting only if users ask. The 161-language race stays out of lane, as before.

What we took — and where it landed. The August 2026 pass recorded a default tool surface small enough to be honest about as the thing to fix, and named a specific bug: the preset gate was silently bypassed on the default daemon-backed path, pinning every session at the full surface. That is now shipped and closed. Re-measured on August 30, 2026 with a real initialize + tools/list round-trip against the built server, reading the wire payload rather than counting names:

Configuration Tools tools/list wire Server instructions
preset: "minimal" (shipped default) 28 ~9.8K tok ~1.75K tok
preset: "standard" 55 ~18.8K tok ~1.75K tok
preset: "full" (explicit opt-in) 166 ~49.9K tok ~2.1K tok
standard + description_verbosity: "none" 55 ~8.4K tok 0

The tool counts in that table are what this repo serves, not the preset’s ceiling: registration is gated on detected frameworks, so minimal (29 tools) hits its ceiling here while standard (61 tools) serves 56 of its 61 and full (182 tools) serves 166. Quote the ceilings when comparing on paper and the live numbers when comparing session cost — the comparison table above quotes ceilings, so it stays checkable in CI. Measure the live surface on a cold index and you will read low: framework-gated registration only settles once the first index pass completes (a cold run measured 24 / 54 / 165).

So the honest default is ~11.6K tokens, not the ~51K this page used to quote — a 2.5× correction in our own favour, caused by four landed changes (preset honoured on the daemon path, seven deprecated aliases retired, compact_schemas extended to the whole surface, and the default preset moved to minimal once load_tools made everything outside it one call away) that this page had not caught up with. The minimal row’s ~9.8K is derived, not re-measured: the preset grew 25 → 28 tools and 30,540 → 34,041 serialized chars when it absorbed the always-load set, +11.5% on the ~8.8K that was measured live.

A third mechanism worth reading, from the budget-policy peer (GlitterKill/SDL-MCP, 467 stars, TypeScript; source read August 29, 2026, not its README). It solves the same problem losslessly rather than by dropping tools. src/gateway/index.ts registers four namespace tools — sdl.query, sdl.code, sdl.repo, sdl.agent — each of whose wire schema is a oneOf over per-action envelopes (buildGatewayWireSchema in src/gateway/thin-schemas.ts), with the 29 flat tool names kept only as deprecated aliases behind emitLegacyTools. src/gateway/compact-schema.ts then flattens the union and deduplicates repeated sub-schemas into $defs/$ref before the schema ever reaches tools/list. Two further pieces sit on top: src/mcp/response-projection/budgets.ts quantises every tool result into eight fixed budget classes (120 / 200 / 500 / 1K / 2K / 8K tokens) rather than accepting an arbitrary caller number, with Math.min(class, callerCap, 8K) as the rule; and a result that overflows its class is returned as an opaque handle (responseMode: "handle", recovered in 8 KiB pages) instead of being truncated, so nothing is silently lost. Their stated reason for fixed classes is that a size that varies per call makes responses prompt-cache-unstable — the same reasoning drives an explicit ban on timestamps, durations, session IDs, counters and machine paths in default responses.

Take, with numbers rather than admiration:

A fourth mechanism, from the largest LSP-native peer (oraios/serena, 29.2K stars, Python; source read August 30, 2026 at commit 7fcbca7e, not its README). It is the only peer that shapes its tool surface along two axes instead of one, and the axes are not the one we use.

Serena has no persistent code graph: its solidlsp layer drives 73 language-server backends live (the README’s “over 40 languages” counts languages, not backends), so there is no incremental index, no impact analysis, no PageRank, no co-change. It is not stateless, though — an earlier revision of this page said “every symbol query is an LSP round-trip”, and a second source read (August 30, 2026, commit 43ae021) found two pickled per-file document-symbol caches under .serena/cache/<language>/, versioned and keyed by content hash, loaded at startup. Warm symbol lookups survive a restart; what is never stored is edges. The rest of the comparison is about tool-surface shaping, which is where it is genuinely ahead.

The two axes are context (who is calling) and mode (what phase the work is in). Sixteen context files under src/serena/resources/config/contexts/ — claude-code.yml, codex.yml, vscode.yml, chatgpt.yml, desktop-app.yml and so on — each carry an excluded_tools list and a per-client prompt. Ten mode files (planning, editing, one-shot, no-memories, …) carry a second excluded_tools list plus phase-specific instructions. ToolSet.apply() in src/serena/agent.py composes them as ordered set operations over a default-enabled registry, with included_optional_tools re-adding, fixed_tools overriding wholesale, and a LEGACY_TOOL_NAME_MAPPING so renames don’t break configs.

Three details are worth recording precisely, because they are the reasoning and not just the shape:

  1. A host’s native tools are treated as capability already present, not as competition. The claude-code context excludes read_file, create_text_file, find_file, list_dir, search_for_pattern and execute_shell_command — six tools, deleted from the wire, on the stated grounds that a CLI agent already has them. The codex context excludes a slightly different set (it keeps search_for_pattern, drops replace_content). The suppression list is a per-host claim, and it is data in a YAML file rather than a branch in code.
  2. The prompt names the agent’s rationalizations and pre-refutes them. The claude-code prompt does not stop at a routing table; it carries an explicit “Disallowed reasoning” block listing the three excuses agents use for falling back to a native read — “I already know the path”, “one Read call is faster than three Serena calls”, “the built-in tool description says to use Read for known paths” — and instructs that catching yourself on one of them is the signal to switch. This is the same enforcement goal the budget-policy peer pursues by generating client-side hook files, solved in-band for the cost of a few hundred tokens and no files written to the user’s repo.
  3. Per-host wire quirks are configuration too. structured_tool_output: false in the claude-code context exists because that host does not unpack structured tool output and re-escapes it; single_project: true drops project-switching tools entirely whenever a project is given at startup, rather than advertising a switcher that cannot be used.

Take, with the boundary drawn:

A fifth mechanism, from the incremental-graph peer (tirth8205/code-review-graph, 31.3K stars, Python; source read September 2, 2026 at commit b58668751ab0, not its README). It is not a tool-surface idea at all — on that axis this peer is the furthest behind, registering 29 @mcp.tool() handlers in code_review_graph/main.py and advertising every one of them by default; its own docstring puts the cost at “~8k description tokens per LLM turn” and offers only a manual opt-in allowlist (serve --tools ... / CRG_TOOLS=) to trim it. The idea worth taking is somewhere else entirely: code_review_graph/uncertainty.py treats an empty result as a first-class answer that owes the caller a reason.

The reasoning in that file’s own module docstring is the part that generalises. A bare result_count: 0 is ambiguous between “the code really has no such relationship” and “this graph cannot see that relationship” — the target was never indexed, the graph is behind the working tree, or the language has a known static-analysis blind spot. An agent reads the first meaning, then either draws a wrong conclusion or abandons the graph and scans the whole repository by hand. So a single capped sentence on the empty case is a token saving, not a cost: roughly thirty tokens of honesty in place of a multi-thousand-token fallback. The implementation keeps that trade honest — a hard MAX_CONFIDENCE_CHARS = 140 budget, attached only when the result list is empty, so every response that carries results stays byte-identical.

What makes it more than a nice message is that the blind spots are data keyed by (language, query pattern), not scattered conditionals: a LanguageGap table pairs a language set with the exact query patterns the gap can affect, so a container-resolution caveat lands on callers_of and tests_for and never on a file summary, whose empty result has nothing to do with call resolution.

Take, with the boundary drawn:

Their storage model is otherwise conventional and holds no surprise for us: a single SQLite file with nodes / edges / metadata tables, qualified-name strings rather than ids as edge endpoints, tree-sitter via tree-sitter-language-pack, networkx for traversal, igraph only as an optional extra for communities. → trace-mcp vs code-review-graph

Does anyone here measure quality, or only tokens?

Every project on this page that publishes a number publishes a cost number. This section asks the other question — whether the tool changes how well the agent does the job — and answers it by reading each project’s own benchmark tree rather than its headline. Read September 7, 2026 through the GitHub API; nothing was cloned or executed.

The axis that matters is not “is there a benchmark”. It is what is being graded, against what ground truth, and next to what baseline. Retrieval metrics grade the ranked list. Capability inventories grade whether a tool can answer at all. Only an answer-level arm grades the thing a user actually cares about: did the agent get it right.

Project What its published benchmark grades Baseline arm Ground truth Published a result against itself
trace-mcp Answer level — did the review understand the change Naive file loading The PR’s own diff, judged blind Yes
jCodeMunch Tokens; separately nDCG@k / MRR@k / Recall@k grep-top-3 and read-all Pinned (query, expected ids) fixtures Yes, repeatedly
code-review-graph Impact precision/recall, search quality grep-top-3 Git co-change, plus a circular mode labelled as one Yes
LeanKG Context precision/recall/F1 and tokens No-tool arm Committed ground_truth.json Yes
codegraph Retrieval recall and MRR Per-benchmark A/B Expected symbol lists Per-experiment
Serena Capability delta over built-in tools Built-in tools, same tasks None — the agent judges itself Yes, qualitatively
codebase-memory-mcp Whether each tool answers 12 questions per language None Hand-graded PASS/PARTIAL/FAIL Per-language scores
Roam-Code Tokens and turns Vanilla agent Preregistered targets Yes — publishes MISSED
Context Mode Tool-output bytes Uncompressed output Committed fixtures No
CodeGraphContext, SocratiCode, CodeGraph (codegraph-ai) No quality benchmark — parser micro-benchmarks or one perf script — — —

What that table means, project by project, in the places where the summary line is doing too much work:

So the position, stated plainly: measuring the cost of context is normal here, and measuring what the context does to the answer is not. Four projects grade retrieval — which list came back — and one grades the agent’s own opinion of the workflow. None publishes a baseline-versus-tool comparison of whether the agent got the task right. That is the arm this project runs: the same 60 merged pull requests reviewed twice, scored blind against each PR’s own diff, at 67% understood against naive file loading’s 65% and 0.80 false positives per PR against 0.58. It is one task, one packing strategy and one judge, and it is not offered as proof of anything wider. Its credential is the run before this one: on September 6, 2026 the same harness published MISSED on both preregistered bars — 50% understood against the naive arm’s 65%, a 15-point loss — and that verdict stayed on the preregistration page while the defect behind it was found and fixed. A bar you can fail is the only kind worth declaring.

And the one place this audit puts us behind — which is not where we expected. A retrieval-quality regression gate is deterministic and costs no model calls: frozen query fixtures, aggregate rank and recall metrics, a committed golden baseline, a build that fails on a relative drop. We already have that harness. benchmarks/replay/ holds the fixtures and scripts/replay-eval.ts scores them against benchmarks/replay/baseline.json. What we do not have is the wire: no workflow runs it, no contributor doc mentions it, and the committed baseline is dated April 30, 2026 at a flat 1.0 on every metric. So between a ranking change and a release there is nothing — the harness that would object has not run in four months. That is worse than not having one, because the file in the tree reads like coverage. Filed internally against the existing context-quality gate work.

Honest assessment: where competitors lead

No tool is uniformly ahead. trace-mcp is the only one combining framework-aware code intelligence + a refactoring engine + code-linked session memory in a single local MCP server — but on individual axes, specialists go deeper. As of July 2026, six of the seven gaps identified in the June re-verification have shipped and gone through an adversarial deep-validation pass (not just unit tests — a second pass that tried specifically to break each feature). That pass surfaced real bugs, which is itself worth being transparent about:

Shipped and adversarially validated:

Closed the same day it was found (September 5, 2026). The September 5 profiling pass found one project in this table doing something none of the rest do, us included: it commits a preregistration before it measures — question, metric formula, frozen corpus, a pass bar declared unadjustable after seeing data, a recorded prediction — then publishes a MISS against its own bar together with a control showing the bar had been calibrated against a corpus nobody can obtain. Our numbers were measured but neither preregistered nor stamped with the build they came from. Both figures on public surfaces now carry a preregistration (PR review context, aggregate response tokens), each labelled retrospective because the bars were written after the results were known, and each carries the version and commit it was measured at. The response-token figure publishes as MISSED, twice and on opposite halves of its bar. The first run cleared 25% at 29.3% but covered only 88.4% of recorded call volume against a declared 90%. Measuring the tail took coverage to 97.2% and the figure down to 21.1% — the unmeasured calls held the worst per-call ratios in the product, plus 1,731 calls to mutating tools that had been credited a Read/Grep baseline they never had. So the second run clears coverage and misses the headline. The bar was declared unadjustable and was not adjusted; the figure stays on the storefront at 21% with the miss stated next to it. tests/docs/savings-claims.test.ts fails CI on a published figure without a stamp or a preregistration.

Still genuinely open (honest, not closed by the validation pass):

Deliberately NOT chasing (out of lane or vanity): live runtime debugging (Serena reaches it by proxying to a JetBrains IDE — runtime, not static graph, and not something a standalone local server can offer); counterfactual architecture simulation / multi-agent swarm (Roam-Code — unverified, speculative); the 161-language count race (codebase-memory-mcp — trace-mcp’s 81 already covers the real-world long tail); the tool-count arms race for its own sake (Roam 246, Narsil 90 — quality of edges beats tool count; note this is a claim about which tools to build, not about how many to advertise by default, where we are currently behind — see above); verbatim chat storage and 20× “Endless Mode” (MemPalace / claude-mem — trace-mcp’s extract-then-store model is deliberate, and Endless Mode adds 60–90s latency per tool).

FAQ

What is the best MCP server for giving an AI agent codebase context?

It depends on the shape of the question you want the agent to ask. To hand the agent a whole small repository in one prompt, Repomix packs it into a single file. To resolve a symbol with compiler-grade precision in a language you already run a language server for, Serena proxies that server. To ask cheap structural questions repeatedly across a large codebase — who calls this, what breaks if I change it, which route reaches this handler — a precomputed graph is the fit, which is where codegraph, codebase-memory-mcp and trace-mcp sit. The tables on this page compare them row by row.

What is the difference between packing a repository and indexing it?

Packing serialises the source into one artifact the agent reads: cost scales with repository size and every question re-reads the same text. Indexing parses the source once into a queryable structure — symbols, imports, call edges — and the agent queries it: cost scales with the answer, not with the repository, and the index has to be kept fresh. Repomix vs codegraph is that trade-off head-to-head between two tools that each pick one side.

Do any of these need a language server or a compiler installed?

Serena does by design — it is a language-server proxy, so its coverage is whatever server you have installed for that stack. trace-mcp parses with tree-sitter across 81 languages and needs no toolchain; LSP enrichment is opt-in and only raises the resolution tier of edges it already has. That is the core precision-versus-breadth trade in trace-mcp vs Serena.

How many tools does each server advertise, and why does it matter?

Every tool a server advertises costs tokens in tools/list before the agent asks anything. On the shipped default preset trace-mcp advertises 28 tools at roughly 11.6K tokens; codegraph advertises one, at roughly 1,900 tokens; codebase-memory-mcp ships 15 at roughly 7K. We are behind the cheapest peers on that axis and say so in the deep dive above rather than leaving it to the tables.

How current is this comparison?

Each figure carries the date of the pass that checked it. Star counts render from a single data file re-read from the GitHub API rather than copied between tables, and the verification methodology section lists what each pass actually read — source, README, or API only. The profiling depth tracker at the end marks which entries have had a real source read and which are still README-level.

Profiling depth tracker

Which entries above got a real read of their architecture/code and a concrete take-or-pass decision, vs. which are still table rows filled from README/star-count checks only. Used to pick where the next competitor-intel pass digs deeper instead of re-scanning the same surface facts.

Profiled deep (architecture/code read, explicit take-or-pass with reasoning): Graphify, Headroom, Kage, mem0/OpenMemory, MemPalace, codebase-memory-mcp, codegraph, SDL-MCP, Serena, code-review-graph, CodeGraphContext, LeanKG, Roam-Code, Repomix, marm-memory, CodeGraph (codegraph-ai), SocratiCode, jCodeMunch, TokenSave, Graft, Narsil-MCP, RTK, claude-mem, Token Savior, AFT, GitNexus, Code Pathfinder, grafel.

Tracked, still surface-level only (README + stars, no code/architecture read yet): cymbal, DeepContext, smart-coding-mcp, mcp-local-rag, knowledge-rag, ConPort, engram, repo-context-mcp.

SDL-MCP profiled this pass (August 29, 2026 — repo cloned and read: src/gateway/, src/mcp/response-projection/, docs/architecture.md, docs/tool-output-contract.md, docs/tool-enforcement.md). Findings and the take-or-pass on each are in the tool-surface deep dive above. Three things beyond the budget layer are worth recording here rather than re-discovering: it runs on an embedded graph database (LadybugDB / Kuzu engine) rather than SQLite+FTS5; it ships client-side enforcement generation (sdl-mcp init --client claude-code --enforce-agent-tools writes .claude/settings.json hooks, a subagent, and repo-local instruction files whose job is to stop the agent falling back to native Read/Bash) — a distribution idea, not a code idea, and the one place a peer is doing something we are not; and it treats native-tool substitution as a design goal, mirroring the host’s Read contract byte-for-byte, which is the same move the largest peer makes.

Serena profiled this pass (August 30, 2026 — repo cloned at commit 7fcbca7e and read: src/serena/agent.py, src/serena/tools/, src/serena/config/, all sixteen context and ten mode YAMLs, src/solidlsp/, CHANGELOG.md). Findings and the take-or-pass on each are in the fourth mechanism under “Deep dive” above; it also corrected the debugger claim this page carried. A second, deeper read followed on August 30 at commit 43ae021, and it corrected this page as much as it corrected theirs — see the vs Serena page for the four rows that moved in Serena’s favour. Two facts worth recording here rather than re-deriving: it keeps no persistent graph, but it does persist per-file document-symbol caches (an earlier revision of this page wrongly said every symbol query is a live LSP round-trip), and its “memory” is markdown files under .serena/memories — topic-namespaced and cross-referenced, but neither code-linked nor staleness-verified, which is why our row reads “✓ (notes, not code-linked)”.

Context Mode profiled this pass (August 30, 2026 — read via the GitHub API at commit 8a35367, no clone: package.json, src/server.ts, src/executor.ts, BENCHMARK.md, LICENSE). Findings are on the vs Context Mode page: eleven MCP tools, no code parser among its eight runtime dependencies, “12 languages” that are subprocess runtimes rather than grammars, a 98% figure that measures tool-output bytes on committed fixtures, and Elastic License 2.0 rather than an OSI licence.

code-review-graph profiled this pass (September 2, 2026 — repo cloned at commit b58668751ab0 and read: pyproject.toml, code_review_graph/graph.py, main.py, uncertainty.py, scoped_resolver.py, parser.py, README.md). Findings and the take-or-pass are in the fifth mechanism under “Deep dive” above; see vs code-review-graph. Three facts worth recording here rather than re-deriving: its stars have moved from the ~19K this page carried to 31.1K (GitHub API, this pass), current release v2.3.8 (2026-08-21), MIT, Python; its graph is a plain SQLite nodes/edges schema keyed on qualified-name strings, with an edge confidence model of only two values (EXTRACTED / INFERRED) against our five resolution tiers; and its advertised surface is 29 tools with no default trimming at all, the opposite end of the same axis from the largest peer.

codegraph re-verified this pass (September 2, 2026 at commit b9ca4b7981116909900368cc1686a1074cd4d4c1, source re-read rather than carried forward from the August 28 reading this page had been quoting). The claim holds exactly: src/mcp/tools.ts defines eight tools and DEFAULT_MCP_TOOLS is literally new Set(['explore']), with the other seven reachable only through CODEGRAPH_MCP_TOOLS. One caveat for anyone re-checking: a comment inside getTools() says “the default 4-tool surface” and is stale prose — the set it points at contains one entry. Stars 69.2K at that reading, re-checked at 69.4K on September 3, 2026.

CodeGraphContext profiled this pass (September 4, 2026 — read through the GitHub API at main, no clone: repository metadata, pyproject.toml, README.md, src/codegraphcontext/tool_definitions.py, server.py, tools/scip_indexer.py, tools/indexing/scip_pipeline.py, core/bundle_registry.py). It had been a table row since April on README and stars alone; this pass exists because /comparisons.html ranks first for codegraphcontext in Search Console on two passing mentions, which is a poor reason for a reader to arrive and find nothing (measured by the SEO Agent during review of PR #842). Facts worth recording rather than re-deriving: the repo moved from Shashankss1205/CodeGraphContext to its own CodeGraphContext org, 4,155 stars at this reading, v0.6.10 and still self-classified alpha; 29 tools defined and all 29 advertised, trimmable only by an mcp.json disabledTools denylist; the SCIP path is off by default and needs a per-language Sourcegraph indexer binary, with C/C++ additionally requiring compile_commands.json; and its .cgc bundle registry is a Hugging Face dataset (codegraphcontext/registry), the only shareable pre-built graph distribution anyone in this field ships. The September 4 pass deliberately shipped no /vs/ spoke — not because the format underperforms, but because none of the six existing spokes has been indexed yet (GSC URL Inspection, September 6, 2026: two “Discovered — currently not indexed”, four unknown to Google). Reversed on September 6, 2026, and only for this peer: TRA-1022 established the same day that Google’s copy of the sitemap was five days stale and one spoke had never been in it at all, so “the spokes are not indexed” was partly a submission fact rather than a demand fact, and the sitemap has since been resubmitted and refetched. This is also the one peer with a measured brand query arriving on the hub, which gives the spoke a landing target the other six were built without. /vs/codegraphcontext.html re-verifies the facts above at repository head on September 6, 2026 — 0.6.13, eleven SCIP families, 4.2K stars. Structure and internal linking of the spoke remain the SEO autopilot’s call; the content is this page’s.

All five head-to-head peers re-verified this pass (September 3, 2026 — read through the GitHub API, no clones: each project’s repository metadata, package.json or equivalent, README, and the specific source files behind the claims this page makes about tool surfaces). This pass exists because the per-competitor summaries above were written for the hub rather than copied from the head-to-head pages, and every figure in them had to hold at source today. Four numbers moved and are corrected throughout: codegraph 69.4K stars, codebase-memory-mcp 42.1K and 162 languages, Serena 28.8K, Context Mode 20.3K. One claim moved against a previous reading: Serena’s registry now defines 50 tool classes with 22 optional, so its default surface is 28 tools rather than the 29 read on August 30 — exactly level with ours. One number was retired rather than re-quoted: Repomix no longer publishes a percentage for --compress in its README or its code-compress guide, so this page no longer quotes one.

LeanKG profiled this pass (September 5, 2026 — read through the GitHub API at main, no clone: repository metadata, src/mcp/tools.rs, src/mcp/toon.rs, src/mcp/token_budget.rs, src/budget.rs, and the eight per-client packaging directories). Facts worth recording rather than re-deriving: 216 stars, Rust, Apache-2.0, v0.26.1 (2026-08-22) and pushed to daily; ToolRegistry::list_tools() returns 76 tools with no gating of any kind — the opposite end of the surface axis from the peer that advertises one, and roughly 2.7× our shipped default; it ships install packages for eight separate hosts (Claude Code, Cursor, OpenCode, Kilo, Antigravity, Gemini, CommandCode, plus an instructions/ rules tree), which is the widest per-client distribution anyone in this field ships.

Four mechanisms were read at source and each got a decision:

Two things deliberately passed without filing: report_query_outcome, a tool the agent calls to report whether a query answered its question (our session mining reconstructs the same signal without asking the agent to spend a call on it), and their unguarded 76-tool surface, which is the problem the preset work already solved for us.

Roam-Code profiled this pass (September 5, 2026 — read through the GitHub API at main, no clone and nothing executed: repository metadata, src/roam/mcp_server.py — the preset tables and the tool registrar — docs/mcp-tools.md, README.md, and both benchmark trees under benchmarks/). Facts worth recording rather than re-deriving: 514 stars (GitHub API, this pass), Python, Apache-2.0, v14.0.2 released the day of this reading and pushed to daily; the surface is 246 tools defined but 17 advertised by default, not the flat 224 this page carried — _PRESETS in mcp_server.py names eight selectable sets (core, review, refactor, debug, architecture, compliance, compile-curated, full) chosen by a ROAM_MCP_PRESET env var, with one always-registered meta-tool that reports what the other presets hold. Their headline savings figure is no longer the “~92%” this page quoted; the README now leads with −83% turns / −80% input tokens from a 41-cell A/B and labels the row with the kernel version it was measured at.

Three mechanisms were read at source and each got a decision:

Repomix profiled this pass (September 5, 2026 — read through the GitHub API at main, no clone and nothing executed: repository metadata, src/mcp/mcpServer.ts and the eight files under src/mcp/tools/, src/cli/cliTokenBudget.ts, src/core/treeSitter/ including the parse strategies and the sixteen per-language query files, and the src/core/skill/ tree). It had been a table row on README and stars alone since this page’s first revision, which was wrong for the largest entry we track. 28.2K stars, MIT, TypeScript, v1.18.0 (2026-08-08), pushed daily.

What the row was missing: it is no longer only a packer. It ships an MCP server of eight tools — pack local, pack remote, read and grep the packed output, attach an existing pack, generate an Agent Skill, and two raw filesystem tools — and --compress is tree-sitter query captures, keeping signature, comment and import lines and dropping bodies, with five per-language strategies over a shared stateless base and a deduplicating chunk set.

Three mechanisms were read at source and each got a decision:

marm-memory profiled this pass (September 5, 2026 — read through the GitHub API at MARM-main, no clone and nothing executed: repository metadata, marm_graph/core/cbm_client.py, marm_graph/core/tool_router.py, marm_graph/config/settings.py, marm_mcp_server/server_stdio.py and marm_mcp_server/services/stdio_graph_tools.py). 350 stars, Apache-2.0, Python, v2.47.0 (2026-09-02). The row this page carried described it as session history, codebase index and a concept graph in one SQLite layer. Two thirds of that is right and the middle third is not: it does not index code itself.

CbmClient spawns another project’s code-graph MCP server as a long-lived stdio child, pins its version in a constant, and re-publishes its answers as five of its own fourteen tools. tool_router.py calls exactly six tools on that child by name — list_projects, index_status, search_code, search_graph, get_graph_schema, detect_changes — and reshapes each response for its own surface. The child command is an environment variable, so the binary is swappable; the six names and their response shapes are not.

The decision that matters is not about a feature:

CodeGraph (codegraph-ai) profiled this pass (September 7, 2026 — read through the GitHub API at main, no clone and nothing executed: repository metadata, Cargo.toml, crates/codegraph/src/storage/, crates/codegraph-server/src/mcp/tools.rs, crates/codegraph-server/src/backend.rs, crates/codegraph-memory/src/storage.rs). 80 stars (GitHub API, this pass), Apache-2.0, Rust, v0.20.1 (last pushed August 2026). The row this page carried described it as C; reading the source corrects it: it is a 43-crate Cargo workspace in Rust (edition 2021), with the C classification arising from vendored tree-sitter grammars. It runs a dual LSP server (tower_lsp) + MCP stdio/SSE server (codegraph-server), backed by RocksDB with namespaced keys and column families (rocksdb_backend.rs) plus an in-memory graph store.

What the row was missing:

Three mechanisms were read at source and each got a decision:

SocratiCode profiled this pass (September 7, 2026 — read through the GitHub API at main, no clone and nothing executed: package.json, src/constants.ts, src/config.ts, src/index.ts, src/tools/, src/services/code-graph.ts, src/services/graph-impact.ts). 3,287 stars (GitHub API, this pass), AGPL-3.0-only / commercial dual license, TypeScript, v1.13.0 (released September 2026). It had been a table row on ~900 stars and 21 tools; reading the source corrects both: 3.3K stars (3,287) and 25 MCP tools advertised by default (all 25 exposed unconditionally: 9 index/manage tools, 7 graph tools, 5 query/symbol tools, 4 context tools). Storage is Docker-managed Qdrant (qdrant/qdrant:v1.17.0) on :16333 + Ollama (ollama/ollama:latest) on :11435 with nomic-embed-text (768 dimensions), with optional external/cloud Qdrant URLs. AST parsing uses @ast-grep/napi across 19 languages with zero framework awareness. See the full head-to-head: trace-mcp vs SocratiCode.

Three mechanisms were read at source and each got a decision:

Quality-measurement audit, and two registry debts closed with it (September 7, 2026 — read through the GitHub API at each project’s default branch, no clones and nothing executed). Files read in full: benchmarks/METHODOLOGY.md and benchmarks/README.md (jCodeMunch); code_review_graph/eval/benchmarks/{impact_accuracy,agent_baseline,search_quality}.py (code-review-graph); docs/04-evaluation/010_methodology.md and 030_results/000_evaluation-results.md (Serena); docs/BENCHMARK.md and docs/EVALUATION_PLAN.md (codebase-memory-mcp); benchmark/README.md (LeanKG); __tests__/evaluation/scoring.ts (codegraph); benchmarks/agent-eval/README.md and its tree (Roam-Code). Findings are the section above. Three facts worth recording rather than re-deriving:

pi-shazam added to the registry (gjczone/pi-shazam, 7 stars, TypeScript, MIT, pi-shazam@0.31.0, first release June 2026, last pushed August 16, 2026). Small, and on this page for shape rather than size: four of its seven tools — project overview, symbol lookup, blast radius, and git-diff-by-symbol — map one-to-one onto ours, over the same tree-sitter-plus-LSP substrate. What is worth recording is the packaging, not the features: it ships as a native extension of its host agent, with an MCP server offered second, for “everyone else”. That is the same overhead argument that got a 15-tool MCP peer dropped from a host’s extension set in August 2026, and it is an axis on which a seven-tool native surface wins by construction. Its /shazam-doctor health check — LSP status, recent errors, slow calls — was a real gap when this entry was first written and is no longer one: trace doctor shipped in September 2026. Nothing else to take at this size; kept in the registry so the next pass does not rediscover it.

jCodeMunch profiled this pass (September 7, 2026 — read through the GitHub API at main, no clone and nothing executed: repository metadata, pyproject.toml, LICENSE, src/jcodemunch_mcp/server.py, src/jcodemunch_mcp/counter.py, src/jcodemunch_mcp/tier_switch_cost.py, src/jcodemunch_mcp/storage/sqlite_store.py, src/jcodemunch_mcp/tools/_call_graph.py, src/jcodemunch_mcp/tools/plan_refactoring.py, src/jcodemunch_mcp/parser/context/framework_profiles.py). 2,668 stars (GitHub API, this pass), Dual-Use License v1.1 (free for non-commercial use only; commercial use prohibited without license), Python, v1.108.317 (released September 2026). It defines ~90 MCP tools and fronts them on first-ever installs through “The Counter” (a 3-tool meta-dispatch surface: order, menu, route). Storage is SQLite WAL with tables for symbols, files, and runtime tracking (runtime_calls, runtime_edges). Route detection across ~13 frameworks uses regexes in context providers rather than true semantic graph edges. See the full head-to-head: trace-mcp vs jCodeMunch.

Three mechanisms were read at source and each got a decision:

TokenSave profiled this pass (September 8, 2026 — read through the GitHub API at master, no clone and nothing executed: repository metadata, Cargo.toml, server.json, src/mcp/tools/definitions.rs, src/mcp/server.rs, src/tokensave/memory.rs, src/tokensave/staleness.rs, src/accounting/, src/extraction_worker.rs). 621 stars (GitHub API, this pass), MIT, Rust (edition 2021), v7.11.1. It defines 86 MCP tools in get_tool_definitions() and advertises all 85+ on standard MCP hosts, with only 5 tools carrying anthropic/alwaysLoad: true (tokensave_search, tokensave_context, tokensave_callees, tokensave_impact, tokensave_status). Storage is embedded libSQL (SQLite fork) with FTS5 and local ONNX runtime (ort) embeddings. AST extraction covers 50+ languages across three compilation tiers (lite 11, medium +9, full +40 more) with zero framework awareness. See the full head-to-head: trace-mcp vs TokenSave.

Four mechanisms were read at source and each got a decision:

One take from the September 6 reading of the same project is not in the list above, because it is about us rather than about them. Its verify_design / design_gaps tools index a markdown document, pull the backtick-wrapped identifiers out of it, and check each against the graph — forward asks whether what the doc claims exists actually exists, reverse asks which public symbols the doc never mentions, and each miss comes back with the heading path that owns it. We had no equivalent, and that is a real gap. We generate documentation from the graph (generate_docs) and we gate published numbers in CI, but nothing checked an already-written document against the code, which is the direction that catches drift. Filed and shipped as tests/docs/doc-path-refs.test.ts; the first page it failed on was this one.

Graft profiled this pass (September 6, 2026 — read through the GitHub API at main, no clone and nothing executed: repository metadata, README.md, CHANGELOG.md, src/mcp/server.ts, src/mcp/tool-names.ts, the src/graph/ tree including its sixteen queries/*.scm grammars and refresh.ts/check.ts, and the src/claude/ and src/hosts/ wiring trees). This is a new name on this page, not a re-check: the repository was created July 3, 2026, is MIT, TypeScript, published as @nanonets/graft, pushed daily, and sits at 5,656 stars — two months from zero, which is faster than any other entrant here reached its count.

What it is: a tree-sitter structural graph, plus an optional LLM enrichment pass under the user’s own provider key that writes prose summaries. The artefact is a folder of linked markdown files (graft/, gitignored as a regenerable cache) rather than a database — the agent opens and greps them like any other file. There is no daemon and no persistent index process: every query re-derives the structural graph against the working tree first, which their README puts at ~3 ms when nothing moved, and graft check is the freshness signal. It wires into hosts rather than waiting to be called: graft init writes Claude Code hooks, a statusline and an AGENTS.md section, and there are per-host modules for Cursor, Codex and Antigravity alongside a retract path that removes them again.

Four mechanisms were read at source and each got a decision:

One thing recorded and not acted on: they ship a GitHub App that posts a blast-radius review on every PR, which is a distribution surface rather than a code idea — the same category as the packer that emits an Agent Skill, noted in the September 5 pass.

Narsil-MCP profiled this pass (September 8, 2026 — read through the GitHub API at main, no clone and nothing executed: repository metadata, Cargo.toml, src/tool_metadata.rs, src/config/preset.rs, src/taint/, src/persistence/sparql.rs, docs/architecture.md, docs/ccg-spec.md). 182 stars (GitHub API, this pass), Rust (edition 2021), MIT OR Apache-2.0, v1.7.0. It defines 90 tools across 11 categories and exposes four curated presets: minimal (20-30 tools), balanced (40-50), full (70+), and security-focused (~30). Storage combines tantivy (LZ4 full-text search) with postcard (binary serialization with memmap2) and oxigraph (SPARQL/RDF knowledge graph). Its headline concept is Code Context Graph (CCG), which structures code representations into 4 progressive disclosure tiers: Layer 0 (~1-2KB JSON-LD manifest with repo identity, symbol counts, languages, and security summary), Layer 1 (~10-50KB architecture), Layer 2 (~100-500KB gzipped N-Quads symbol index), and Layer 3 (~1-20MB full RDF).

Four mechanisms were read and evaluated:

RTK profiled this pass (September 8, 2026 — read through the GitHub API at master, no clone and nothing executed: repository metadata, Cargo.toml, README.md, src/cmds/system/read.rs, src/core/filter.rs, src/cmds/git/, src/cmds/js/vitest_cmd.rs). 79,509 stars (GitHub API, this pass), Apache-2.0, Rust, v0.2.14. A high-performance CLI shell proxy that wraps bash/terminal execution in AI agent environments (Claude Code, Aider, Codex) to compress command output by 60–90% before it enters model context. It intercepts commands (ls, git status, git diff, cargo test, npm test, pytest, docker ps, grep), strips passing test logs, trims tracebacks, and collapses tables.

Three mechanisms were read and evaluated:

claude-mem profiled this pass (September 8, 2026 — read through the GitHub API at main, no clone and nothing executed: repository metadata, package.json, src/servers/mcp-server.ts, src/services/smart-file-read/, src/services/sqlite/types.ts). 93,476 stars (GitHub API, this pass), Apache-2.0, TypeScript, v13.24.1. The dominant session memory system for Claude Code, which recently expanded into code reading with smart_search, smart_outline, and smart_unfold. It utilizes 24 tree-sitter grammars to parse files dynamically on the fly (walkDir), folding bodies to display symbol signatures.

Three mechanisms were read and evaluated:

Token Savior profiled this pass (September 8, 2026 — read through the GitHub API at main, no clone and nothing executed: repository metadata, src/token_savior/server.py, src/token_savior/diagnostics.py, src/token_savior/tool_schemas.py, src/token_savior/tool_annotations.py). 1,146 stars (GitHub API, this pass), Python, v4.0. It defines 75 tools with an adaptive auto and optimized profile.

Three mechanisms were read and evaluated:

AFT profiled this pass (September 9, 2026 — read through the GitHub API at main, no clone and nothing executed: repository metadata, Cargo.toml, package.json, README.md, src/index/graph.rs, src/index/trigram.rs, src/tools/ast_grep.rs, src/transport/). 278 stars (GitHub API, this pass), MIT, Rust + TypeScript, v0.7.2. Designed as a sensorimotor cortex / code intelligence sidecar for OpenCode and Pi agents, integrating a 30-language tree-sitter symbol graph, trigram search, and an embedded ast-grep engine.

Four mechanisms were read and evaluated:

GitNexus profiled this pass (September 9, 2026 — read through the GitHub API at main, no clone and nothing executed: repository metadata, package.json, gitnexus/package.json, gitnexus/src/mcp/tools.ts, gitnexus/src/core/ingestion/community-processor.ts, gitnexus/src/core/ingestion/pipeline.ts, gitnexus/src/core/lbug/). 47,177 stars (GitHub API, this pass), PolyForm-Noncommercial-1.0.0 (non-commercial only; commercial use prohibited without license), TypeScript / Node.js monorepo (gitnexus, gitnexus-web, gitnexus-shared), v1.6.11. It compiles native C++ Tree-sitter grammars (node-gyp-build, node-addon-api) across 10 languages (TS, JS, Python, Go, Rust, C#, C++, Java, PHP, Ruby). Storage pairs embedded LadybugDB graph database (@ladybugdb/core / Kùzu fork) with Cypher query execution, graphology, and in-memory Leiden community detection (graphology-communities-leiden). It defines 17 MCP tools (list_repos, query, cypher, context, detect_changes, check, rename, impact, explain, pdg_query, route_map, tool_map, shape_check, api_impact, group_list, group_sync, trace) and features Program Dependence Graph analysis (analyze --pdg) recording control dependence (CDG) and reaching definitions (REACHING_DEF).

Five mechanisms were read at source and each got a decision:

Code Pathfinder profiled this pass (September 9, 2026 — read through the GitHub API at main, no clone and nothing executed: repository metadata, server.json, sast-engine/mcp/tools.go, sast-engine/graph/initialize.go, sast-engine/graph/callgraph/builder/builder.go, sast-engine/graph/callgraph/doc.go). 140 stars (GitHub API, this pass), Apache-2.0, Go core (sast-engine using smacker/go-tree-sitter) + Python SDK (python-sdk) for security rules, MCP server v2.1.1. Static code analysis engine exposing 13 MCP tools (get_index_info, find_symbol, find_module, list_modules, get_callers, get_callees, get_call_details, resolve_import, find_dockerfile_instructions, find_compose_services, get_dockerfile_details, status, get_docker_dependencies) across Python, Go, Java, Dockerfiles, and Docker Compose.

Four mechanisms were read at source and each got a decision:

grafel profiled this pass (September 11, 2026 — read through the GitHub API at main, no clone and nothing executed: go.mod, cmd/grafel/, internal/mcp/, internal/substrate/, internal/responseshapediff/, internal/tautology/, internal/stubdetector/, internal/mmapview.go). 15 stars (GitHub API, this pass), MIT, Go (Go 1.23+ with cgo Tree-sitter), v0.x. Multi-repo code knowledge graph daemon for AI agents exposing 22 MCP tools (grafel_whoami, grafel_find, grafel_inspect, grafel_expand, grafel_trace, grafel_traces, grafel_clusters, grafel_orient, grafel_effects, grafel_control_flow, grafel_endpoint_posture, grafel_payload_drift, grafel_literal_parity, grafel_auth_posture_diff, grafel_stub_detector, grafel_response_shape_diff, grafel_security_findings, grafel_pure_functions, grafel_import_cycles, grafel_def_use, grafel_data_flows, grafel_stats). Storage uses an in-memory/mmap graph substrate (mmapview.go) with file-watcher driven incremental cache updates.

Four mechanisms were read at source and each got a decision:

Priority for next deep-dive: Narsil-MCP (postrv/narsil-mcp, Rust, 182★, CCG 4-layer progressive disclosure) and a re-read of Graft (trailhq/Graft, 7.0K★, fastest-growing peer).

Narsil-MCP profiled this pass (September 11, 2026 — read through the GitHub API at main, no clone and nothing executed: Cargo.toml, src/ccg/mod.rs, src/ccg/layers.rs, src/callgraph.rs, src/cfg.rs, src/taint/, src/mcp.rs, docs/CODE_CONTEXT_GRAPH_SIZING_ARCH.md). 183 stars (GitHub API, this pass), Apache-2.0, Rust, v0.x. High-performance code intelligence MCP server written in Rust with 32 Tree-sitter parsers, hybrid BM25/neural embeddings, and a multi-layer Code Context Graph (CCG) generation pipeline.

Four mechanisms were read at source and each got a decision:

Graft profiled this pass (September 11, 2026 — read through GitHub repository at main: package.json, README.md, src/cli/, src/graph/, src/mcp/). 7,056 stars (7.1K, GitHub API, this pass), MIT, TypeScript, v0.x (@nanonets/graft / trailhq/Graft). Rapidly growing context layer for AI coding agents (Claude Code, Cursor) that generates plain-language subsystem and concept explanation nodes in markdown files.

Three mechanisms were read at source and each got a decision:

Priority for next deep-dive: SDL-MCP client-side hook generation and RTK (Real-Time Knowledge).

Bottom line: trace-mcp’s moat — framework-aware graph + refactoring + code-linked memory in one local MCP — is intact and unmatched as a combination. Six of seven gaps identified in the June 2026 re-verification are now shipped; the adversarial validation pass that followed found and fixed 15+ real bugs (several of them “the feature silently didn’t work at all,” not cosmetic) rather than taking the initial implementation on faith. The one deliberately-open gap (a peer-reviewed validated health metric) is honestly labeled as such rather than oversold.

Next steps

Last updated: September 26, 2026