If you use an AI coding agent — Claude Code, Codex CLI, Gemini CLI, Cursor, Zed, Aider, whatever — you've probably watched it burn through tens of thousands of tokens just trying to figure out who calls a function or where a route is defined. It greps, it reads files, it greps again, it reads more files. Eventually it answers your question, but it took a small forest of tokens and several tool calls to do it.
, extract it, and run the bundled install script.
Once installed, restart your coding agent and just say:
"Index this project"
That's the entire setup. If you want indexing to happen automatically whenever you open a new project, turn on auto-index:
codebase-memory-mcp config set auto_index true
After the initial index, a background watcher keeps the graph in sync with your git changes, so you're not manually re-indexing every time you commit.
What you get to ask it
Once a project is indexed, here's a sample of what's available through the 14 MCP tools:
search_graph— structured search by label, name pattern, file pattern, or degree filters
trace_call_path— BFS traversal showing what calls a function and what it calls, up to depth 5
get_architecture— a one-call overview of languages, packages, entry points, routes, hotspots, and clusters
detect_changes— maps your current git diff to the symbols it affects, with risk classification
query_graph— Cypher-like queries, e.g.MATCH (f:Function)-[:CALLS]->(g) WHERE f.name = 'main' RETURN g.name
semantic_query— vector search over the whole graph using bundled embeddings, no API key required
manage_adr— CRUD operations for Architecture Decision Records, so design decisions persist across sessions
get_code_snippet,search_code,ingest_traces, and several more
Everything is also callable directly from the command line if you want to script against it:
codebase-memory-mcp cli search_graph '{"name_pattern": ".*Handler.*", "label": "Function"}'
codebase-memory-mcp cli trace_call_path '{"function_name": "Search", "direction": "both"}'
On trust and security
Reasonable question to ask of any tool that reads your entire codebase: every release binary is scanned by 70+ antivirus engines on VirusTotal before publishing, carries SLSA Level 3 build provenance you can verify with gh attestation verify, is signed with Sigstore cosign, and ships SHA-256 checksums. There are zero runtime dependencies — every library is vendored at compile time, so there's no transitive supply chain to worry about. All processing happens locally; your code doesn't leave your machine.
Should you use it?
If your agent sessions are eating context on repetitive file exploration, or you work in a large monorepo where "where is this used" is a constant question, this is a low-effort, high-leverage addition to your setup. It's a single binary, the install is one command, and the worst case is you uninstall it and you're back where you started — codebase-memory-mcp uninstall cleanly removes configs, hooks, and instructions without touching your binary or databases.
Repo's here if you want to dig in further or check the source before running it: github.com/DeusData/codebase-memory-mcp
SOCIAL SHARE CARD GENERATOR