codebase-memory-mcp alternative: trace-mcp vs codebase-memory-mcp

TL;DR. codebase-memory-mcp (DeusData) is the peer closest to trace-mcp’s premise: parse a repository into a persistent knowledge graph and serve it to agents over MCP, instead of letting them re-read files. Both do impact analysis, call-path tracing, cross-service linking and infrastructure-as-code as graph nodes.

The split is depth versus breadth, in both directions. codebase-memory-mcp is broader on languages (161 vs 81) and dramatically leaner on advertised tool cost. trace-mcp is deeper per repository: 88 framework integrations produce edges a language-agnostic parser cannot, and it can act on the graph — rename, move, codemod, remove dead code, scan for vulnerabilities — rather than only describe it.

Head-to-head

Capability	trace-mcp	codebase-memory-mcp
GitHub stars	175	43K
Languages	81	161
Framework integrations	✓ 88	✗ (partial REST routes)
Persistent knowledge graph	✓ SQLite + FTS5	✓
Knowledge-graph queries	✓ graph_query	✓ Cypher-like
Impact analysis	✓ reverse dependency traversal + decorator filter	✓ detect_changes
Call graph	✓ bidirectional	✓ trace_call_path
Cross-service / multi-repo	✓ cross-repo API linking	✓ cross-service HTTP linking
IaC as graph nodes	✓ K8s/Kustomize/HCL/Docker, cross-file resolved	✓ K8s/Kustomize/HCL/Docker
Clone / community detection	✓ AST Type-2 subtree hashing, 11 antipatterns	✓ MinHash near-clone, Louvain communities
Refactoring tools	✓ rename, move, signature, AST codemod, extract	✗
Security scanning	✓ OWASP Top-10, type-aware taint, SARIF 2.1.0	✗
Control-flow graph	✓ basic blocks, loop back-edges, try/catch merges	✗
Quality gates in CI	✓ complexity / security / coverage thresholds	✗
Code-linked decision memory	✓ decisions bound to symbol IDs, staleness-verified	partial (manage_adr markdown documents)
Runtime trace ingestion	✗	✓ ingest_traces
Graph visualization	✓ desktop app	✓ 3D web UI
MCP tools advertised (default)	29 (~11.6K tok); 182 on full	15 (~7K tok); profiles: 11 / 7
Supply-chain posture	OpenSSF Scorecard, CodeQL, Semgrep	SLSA L3, VirusTotal, OpenSSF Scorecard
Published benchmark	✓ PR review context, one task, losses published	✓ preprint, 31 repos, not independently reproduced
Written in	TypeScript	C

When to pick codebase-memory-mcp

This is the peer where the honest list is longest, so here it is in full:

• Your advertised tool budget is tight. 15 tools at roughly 7K tokens — or 7 with --tool-profile=scout — against trace-mcp’s ~11.6K on the shipped default path (down from ~50K; the preset-bypass bug is fixed and the default is now minimal). If you run several MCP servers in one client and every one of them is competing for the same context window, a ~1.7× difference still matters. This is the clearest place any competitor beats us, and we are not going to pretend otherwise on our own comparison page.
• You need a language we do not parse. 161 grammars against 81. If your repo has one in the gap, none of trace-mcp’s depth helps you.
• You want evidence across a broad workload. Its authors published a benchmark preprint (arXiv 2603.27277: 83% answer quality, ~10× fewer tokens, 2.1× fewer tool calls across 31 repositories). We have not reproduced it and it is not peer-reviewed. Ours — the PR review context benchmark, median 72.7% over 60 merged pull requests in 6 repositories we do not maintain — is the more auditable of the two — it ships the exact revisions, the losing cases and the command that re-runs it — but it measures one task, not general exploration, and theirs runs on real open-source repositories too. If breadth of workload is what you need evidence for, theirs is the wider claim.
• Supply-chain requirements are strict. SLSA Level 3 provenance plus VirusTotal-scanned reproducible release candidates is a stronger posture than ours, and in a regulated environment that can be the whole decision.
• You have runtime traces to fold in. ingest_traces enriches the graph with observed caller/callee counts — dynamic edges static analysis cannot see. trace-mcp has no equivalent.

When to pick trace-mcp

• Framework semantics. A graph that knows UserController exists but not that it renders Users/Show.vue via Inertia is missing the edges developers actually reason about. 88 integrations produce route → handler, controller → template, model → table and component edges; a language-agnostic parser produces none of them.
• You want the agent to change code. Rename across files with import rewriting, symbol and file moves, signature changes that update call sites, AST-based codemods with metavariable substitution, dead-code removal with orphan-import detection. codebase-memory-mcp is read-only.
• Security is part of the job. OWASP Top-10 rules, taint analysis with type-aware pruning, and OASIS-schema-validated SARIF 2.1.0 for CI ingestion.
• Memory should be code-linked and verified. manage_adr writes flat markdown documents. trace-mcp binds decisions to symbol IDs, checks at recall time that the linked code still resolves and is unchanged, and surfaces them inside get_change_impact — so a decision about code that was deleted stops being served.
• Gates, not just reports. Quality gates with configurable complexity, security and tech-debt thresholds, plus SARIF output, make the graph a CI participant rather than a chat aid.

The honest caveat on security scanning

Our security scanning has a ceiling, and it is stated on the comparisons page rather than only here. The control-flow graph is line-based, not AST-based, and taint analysis is lexical/regex, not a real dataflow engine. Type-aware pruning cuts false positives; it does not turn this into a dataflow analyser. A full AST/dataflow rewrite is out of scope for now.

FAQ

How similar are trace-mcp and codebase-memory-mcp? The closest pair in this space. Both parse with tree-sitter into a persistent knowledge graph, both do impact analysis and call-path tracing, both model IaC as nodes. The divergence is what sits on top: framework-aware edges, refactoring, security and code-linked memory for trace-mcp; raw language breadth and a much leaner advertised surface for codebase-memory-mcp.

It supports 161 languages and trace-mcp supports 81. Does that matter? Only if your repository contains a language in the gap. trace-mcp’s coverage targets the real-world long tail rather than a count; the depth goes into per-framework semantics instead.

Is codebase-memory-mcp cheaper in tokens? On advertised surface, yes — ~7K against our ~11.6K on the shipped default path as of August 29, 2026. The preset-bypass bug that put us at ~50K is fixed and the default preset is now minimal; the remaining ~1.7× gap is real and is the clearest place a competitor leads.

Does it have a published benchmark? Yes — a self-published preprint (arXiv 2603.27277) across 31 repositories, not independently reproduced and not peer-reviewed. So does trace-mcp, narrower: the PR review context benchmark, median 72.7% over 60 merged pull requests in 6 repositories nobody here maintains, with the losing cases and the re-run command shipped. Theirs is the wider workload; ours is the more auditable.

Can either one refactor code, not just read it? Only trace-mcp. codebase-memory-mcp is read-only analysis.

Next steps

• Learn how a persistent code graph reduces token costs on every turn: Code graph MCP server.
• Full field: how trace-mcp compares against 20+ code-graph and memory MCP servers.
• The other head-to-heads: vs Repomix · vs Serena · vs codegraph · vs CodeGraphContext · vs SocratiCode · vs jCodeMunch · vs TokenSave · vs GitNexus · vs Context Mode · vs code-review-graph · vs Narsil-MCP
• PR review context benchmark — measured input-token cost of code-review context on 60 merged pull requests.
• Decision memory — how code-linked decisions differ from a notes file.
• Get started — no configuration required.

Last updated: September 16, 2026