codegraph-mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited codegraph-mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Always pass active_project_root (absolute repo root) on every tool call. Reuse the same path throughout a session.
Primary goal: answer or edit with the least token usage possible. GraphRAG is a swiss-army-knife for repo discovery — far better than grep — but only when you use it surgically. Every extra search or read wastes tokens.
`search_codebase_intent` is the only GraphRAG tool. Use it for all repo discovery.
Do not use native Grep, SemanticSearch, or iterative file hunting to explore the codebase.
search_codebase_intent call. A second search is allowed only when something specific is still missing (wrong anchor, no cite for a symbol you need, gap in the call path).search_codebase_intent once with intent queries and any known symbol names.startLine:endLine:filepath). Merge overlapping spans in the same file into one read.Second search — only when a specific gap remains after step 2 (missing symbol, wrong file, incomplete path). Refine queries or symbols; still no grep.
Never re-read a cite span or re-run search for information already in context.
## Search
grep#1:
resolve_redirects: 557:653:src/foo.py
Session.send -> resolve_redirects (anchor) -> get_redirect_target
Session.send: 412:520:src/foo.py
get_redirect_target: 89:102:src/foo.py
searchQuery#1:
resolve_redirects: 557:653:src/foo.py
Session.send -> resolve_redirects (anchor) -> rebuild_method
Session.send: 412:520:src/foo.py
rebuild_method: 654:700:src/foo.pygrep#N and searchQuery#N block returns up to top 2 matches.active_project_root: /abs/path/to/repo
search_queries: ["intent phrase about the behavior"]
grep_terms: ["SymbolName", "other_symbol"]Dos:
search_codebase_intent first for any "where/how" question.Don'ts:
No source code bodies, no node IDs, no snippets — use native Read for content.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.