parecode-explore — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited parecode-explore (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP server that gives coding agents context-window-aware search and safe, atomic multi-file edits — built to cut token usage on large codebases without giving up correctness.
fetch-free runtime).PATH (rg on Linux/macOS, rg.exe on Windows). Install via your package manager:brew install ripgrepapt install ripgrepwinget install BurntSushi.ripgrep.MSVC or choco install ripgrepParecode does not bundle ripgrep — it shells out to the system binary so you stay on a single, audited version.
npm install -g parecodePure JavaScript — no native dependencies, no C/C++ toolchain required.
Register the server with Claude Code:
parecode init # user scope; installs MCP + SessionStart hook + parecode-explore plugin (defaults)
parecode init --scope project # commit MCP config + hook to the repo
parecode init --no-hook # register MCP only; skip the SessionStart hook
parecode init --no-plugin # skip the parecode-explore Claude Code plugin
parecode init --print # print the equivalent command without running it
parecode init --remove-hook # remove the SessionStart hook (MCP stays registered)
parecode init --remove-plugin # uninstall the parecode-explore Claude Code pluginThe SessionStart hook injects a short directive at the start of each session telling Claude to prefer ParecodeSearch / ParecodeEdit over the equivalent native tools. Without it, Claude's first-party Grep / Read / Edit tools typically win by default and Parecode's token savings never land. The hook payload is a static string; parecode hook session-start prints it. Pass --no-hook if you would rather opt in explicitly per session via your own tooling.
The bundled parecode-explore Claude Code plugin adds a read-only subagent (pinned to Haiku, given only ParecodeSearch) and a matching skill, so exploration-style questions ("where is X?", "how does Y work?", "find all usages of Z") get answered in a cheap, isolated context window instead of burning tokens in your main session. init registers a local marketplace pointing at the npm-installed copy and runs claude plugin install parecode-explore@parecode. If your Claude Code build doesn't support the plugin subcommand the step soft-fails with a warning and the rest of init still succeeds; pass --no-plugin to skip it entirely, or --with-plugin to make any plugin-step failure hard-fail.
Then in any session, the ParecodeSearch, ParecodeExpand, and ParecodeEdit tools become available. Run parecode doctor to confirm registration, hook status, and .codegraph/ pairing if present.
pattern accepts a single string or an array of strings; arrays dispatch parallel ripgrep runs sharing the same paths / contextLines, and each match carries a patterns: string[] field listing which input patterns contributed. One call replaces N back-to-back greps for related-keyword flow tracing.contextLines), with bridging lines loaded from disk.estimatedTokens are returned so the agent can self-budget before consuming results.relatedSymbols: true surfaces likely event-flow neighbours (Handle<X>, On<X>, <X>Handler/Listener/Closed/Completed/Started) discovered in each match, capped at 10.ParecodeExpand without re-reading the whole file.(file, startLine, endLine) range with optional contextBefore / contextAfter padding. Designed as the natural follow-up to a ParecodeSearch match. Returns the same estimatedTokens shape so the same self-budgeting heuristic applies. Prefer this over a full-file Read after locating a line.stat conflict detection, and atomic same-directory rename writes. Cross-file edits run in parallel.On search-and-edit tasks — finding call sites, multi-file refactors, "do X to every Y" — Parecode cut cost ~40% and assistant turns ~75–83% in matched A/B tests:
| repo | task | cost | turns |
|---|---|---|---|
| TypeScript | find every call site of a symbol, edit each (17 sites, 8 files) | −43% | −83% |
| Unity / C# | find every call site of a symbol, edit each (11 sites, 5 files) | −41% | −76% |
_Method: the identical task run with Parecode on vs off, a fresh session per run, n=3 per arm with alternated order, Sonnet 4.6. Savings come from collapsing many Grep / Read / Edit round-trips into single ParecodeSearch / ParecodeEdit calls — so the win scales with how much searching and multi-file fan-out a task involves, and shrinks toward zero on single-file or reasoning-heavy tasks. These are measured per-session token and cost numbers, not the estimates in the scan below._
Curious how much Parecode would have saved you if you had installed it earlier? You can scan your past Claude Code sessions:
parecode stats --retroactive --since 30dSample output:
Parecode — last 30d (retroactive scan)
─────────────────────
Sessions: 42
Tool calls: 156
Calls batched (est): 89
Tokens saved (est): 1,200,000
* Note: Retroactive savings are estimated, not measured.Privacy disclaimer: This scan runs entirely locally against Claude Code's session transcripts (~/.claude/projects/**). By default, it parses only structured fields (tool names, paths, patterns, and token counts). It does not send any data over the network. The --include-content flag (which allows reading tool input/output) is strictly opt-in and loudly flagged if used.
Parecode performs no network calls at runtime. Session logs are written to your OS data directory (resolved via env-paths) with 0600 permissions on Unix. Logs are self-maintaining: each server start prunes session data older than 30 days and caps the envelope log at 5 MB. Prune earlier with parecode prune <days> or wipe the data dir. Update to the latest release (and refresh hooks/plugin) with parecode update.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.