Tempograph — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Tempograph (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- mcp-name: io.github.Elmoaid/tempograph -->
<a href="https://glama.ai/mcp/servers/Elmoaid/TempoGraph"> <img src="https://glama.ai/mcp/servers/Elmoaid/TempoGraph/badges/card.svg" alt="TempoGraph MCP server" width="400"> </a>
Your AI agent finds the right files. Every time.
TempoGraph builds a dependency graph of your codebase and gives your AI coding agent exactly the files it needs before making changes. One tool call. No guessing.
<p align="center"> <img src="docs/demo.gif" alt="TempoGraph demo" width="700"> </p>
AI coding agents guess which files to look at. They search by filename, grep for keywords, and hope for the best. In large codebases, they miss critical dependencies, break things downstream, and waste tokens reading irrelevant code.
pip install tempographAdd to your MCP config (Claude Code, Cursor, Windsurf, or any MCP client):
{
"mcpServers": {
"tempograph": {
"command": "tempograph-server",
"args": []
}
}
}Your agent calls prepare_context with a task description. TempoGraph returns the exact files that matter — based on real dependency analysis, not text matching.
Tested on real PRs from django, flask, httpx, fastapi, requests, and pydantic. Task: predict which files need to change.
| Model | Without TempoGraph | With TempoGraph | Improvement |
|---|---|---|---|
| GPT-4o | 21.7% F1 | 27.5% F1 | +27% |
| GPT-4o-mini | 19.2% F1 | 24.5% F1 | +28% |
| qwen2.5-coder:32b | — | — | +18.6% (p=0.049) |
Consistent improvement across every model. 2-3x more tasks helped than hurt. No other code context tool publishes retrieval benchmarks with statistical significance.
your repo ──→ tree-sitter parse ──→ symbols + edges ──→ SQLite graph
│
AI agent calls prepare_context ─────────┘
│
◄── KEY FILES + callers + callees + risk signalsBeyond prepare_context, TempoGraph exposes 24 MCP tools for deeper analysis when your agent needs it:
| Tool | When to use it |
|---|---|
blast_radius | "What breaks if I change this file?" |
focus | "Show me everything related to auth" |
hotspots | "Which files are riskiest to change?" |
dead_code | "What can I safely delete?" |
diff_context | "What's the impact of my current changes?" |
overview | "Orient me in this new codebase" |
<details> <summary>All 24 tools</summary>
| Tool | What it does |
|---|---|
prepare_context | One-shot context for a task — the primary tool |
overview | Repository orientation: size, languages, entry points |
focus | Connected subgraph around a symbol — callers, callees |
blast_radius | What breaks if you change this file or symbol |
diff_context | Impact analysis of changed files |
hotspots | Ranked risk list — complexity x coupling x size |
dead_code | Unreferenced symbols — cleanup candidates |
lookup | "Where is X?", "What calls X?" |
dependencies | Circular imports, dependency layers |
architecture | Module-level dependency view |
symbols | Full symbol inventory |
file_map | File tree with top symbols per file |
search_semantic | Hybrid keyword + vector + structural search |
cochange_context | Files that historically change together |
suggest_next | Predicts the next useful tool call |
run_kit | Composable multi-tool workflows |
stats | Token budget estimates |
get_patterns | Codebase conventions and idioms |
report_feedback | Log whether output was useful |
learn_recommendation | Suggestions from feedback history |
index_repo | Build or rebuild the graph |
watch_repo / unwatch_repo | Live incremental updates |
embed_repo | Generate vector embeddings |
</details>
# Orient in a new repo
tempograph ./my-project --mode overview
# What's connected to auth?
tempograph ./my-project --mode focus --query "authentication"
# What breaks if I touch db.ts?
tempograph ./my-project --mode blast --file src/lib/db.ts
# Find dead code to clean up
tempograph ./my-project --mode deadfrom tempograph import build_graph
graph = build_graph("./my-project")
results = graph.search_symbols("handleLogin")
importers = graph.importers_of("src/lib/db.ts")
dead = graph.find_dead_code()Python, TypeScript, JavaScript, Rust, Go, Java, C#, and Ruby get deep extraction (custom tree-sitter handlers). 170+ additional languages are supported via generic handler. pip install tempograph[full] for everything.
If TempoGraph saves you time, consider sponsoring the project. Sponsors get early access to new features.
TempoGraph is AGPL-3.0 — free to use, modify, and distribute. If you use TempoGraph in a network service (SaaS, hosted IDE, AI coding platform), AGPL requires you to open-source your service code. If that doesn't work for you, commercial licenses are available.
Contact [email protected] for commercial licensing terms.
AGPL-3.0 — free to use. Network service use requires source disclosure, or a commercial license.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.