callgraph-mcp 1.4.4 → 1.4.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +27 -27
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -1,12 +1,12 @@
|
|
|
1
1
|
# callgraph-mcp
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
**CallGraph MCP Server** — exposes deterministic call-graph analysis for any codebase as MCP tool. Give your AI agent a precise, structural map of your code — no hallucination, no guessing.
|
|
4
4
|
|
|
5
|
-
|
|
5
|
+
Fully local. No cloud. No LLM. No telemetry.
|
|
6
6
|
|
|
7
|
-
|
|
7
|
+
Powered by [`@codeflow-map/core`](https://www.npmjs.com/package/@codeflow-map/core) and Tree-sitter WASM parsers.
|
|
8
8
|
|
|
9
|
-
|
|
9
|
+
**Supports:** TypeScript · JavaScript · TSX · JSX · Python · Go
|
|
10
10
|
|
|
11
11
|
|
|
12
12
|
|
|
@@ -16,13 +16,13 @@
|
|
|
16
16
|
|
|
17
17
|
## Why Deterministic Analysis Matters
|
|
18
18
|
|
|
19
|
-
|
|
19
|
+
Most AI coding tools answer structural questions about your codebase by reading source files as text and reasoning over them. This causes three compounding failure modes:
|
|
20
20
|
|
|
21
21
|
- **Hallucination.** When asked "what calls `processPayment`?", a model without structural grounding will guess based on naming patterns and training priors. It will confidently name callers that don't exist and miss ones that do.
|
|
22
22
|
- **Lost in the middle.** Research shows that LLMs systematically fail to recall information from the middle of long contexts. Paste a 200-file codebase into context and the model will answer based on whatever happened to land near the top or bottom.
|
|
23
23
|
- **Attention dilution.** Even when information is present, spreading the model's attention across tens of thousands of lines means each individual fact gets less weight. A critical edge in the call graph competed for attention with everything else.
|
|
24
24
|
|
|
25
|
-
|
|
25
|
+
**callgraph-mcp eliminates all three.** It never reads your code as prose. It parses every file into an AST using Tree-sitter, builds an exact directed call graph, and answers structural queries against that graph. Every caller, every callee, every reachable function, every cycle - returned as a precise index. The answer is always the same regardless of how large your codebase is, which files happen to be in context, or how deeply buried a function is. **There is no probability involved. There is no attention to dilute.**
|
|
26
26
|
|
|
27
27
|
---
|
|
28
28
|
|
|
@@ -33,7 +33,7 @@
|
|
|
33
33
|
|
|
34
34
|
### Option 1 — VS Code via `npx` (no install required)
|
|
35
35
|
|
|
36
|
-
|
|
36
|
+
Add to your project's `.vscode/mcp.json`:
|
|
37
37
|
|
|
38
38
|
```json
|
|
39
39
|
{
|
|
@@ -50,15 +50,15 @@
|
|
|
50
50
|
}
|
|
51
51
|
```
|
|
52
52
|
|
|
53
|
-
|
|
53
|
+
Start the server in your editor. WASM grammars are bundled — no environment variables needed.
|
|
54
54
|
|
|
55
55
|
> **Tip:** Create `.vscode/mcp.json` via the Command Palette -> **MCP: Add Server** -> **stdio**.
|
|
56
56
|
|
|
57
57
|
### Option 2 — HTTP-SSE (shared or remote server)
|
|
58
58
|
|
|
59
|
-
|
|
59
|
+
Use `FLOWMAP_TRANSPORT=http` for HTTP-SSE compatible clients.
|
|
60
60
|
|
|
61
|
-
|
|
61
|
+
Start the server:
|
|
62
62
|
|
|
63
63
|
```bash
|
|
64
64
|
FLOWMAP_TRANSPORT=http FLOWMAP_PORT=3100 npx callgraph-mcp
|
|
@@ -66,7 +66,7 @@ FLOWMAP_TRANSPORT=http FLOWMAP_PORT=3100 npx callgraph-mcp
|
|
|
66
66
|
# $env:FLOWMAP_TRANSPORT="http"; $env:FLOWMAP_PORT="3100"; npx callgraph-mcp
|
|
67
67
|
```
|
|
68
68
|
|
|
69
|
-
|
|
69
|
+
Then point your client at it:
|
|
70
70
|
|
|
71
71
|
```json
|
|
72
72
|
{
|
|
@@ -81,7 +81,7 @@ FLOWMAP_TRANSPORT=http FLOWMAP_PORT=3100 npx callgraph-mcp
|
|
|
81
81
|
|
|
82
82
|
## Tools Reference
|
|
83
83
|
|
|
84
|
-
|
|
84
|
+
Optional parameters shown in `[brackets]`.
|
|
85
85
|
|
|
86
86
|
<table>
|
|
87
87
|
<colgroup><col width="22%"><col width="38%"><col width="40%"></colgroup>
|
|
@@ -99,7 +99,7 @@ FLOWMAP_TRANSPORT=http FLOWMAP_PORT=3100 npx callgraph-mcp
|
|
|
99
99
|
</tbody>
|
|
100
100
|
</table>
|
|
101
101
|
|
|
102
|
-
|
|
102
|
+
**`workspacePath`** — absolute path to the repo root (e.g. `/home/user/my-project` or `C:\projects\my-app`).
|
|
103
103
|
|
|
104
104
|
---
|
|
105
105
|
|
|
@@ -127,13 +127,13 @@ FLOWMAP_TRANSPORT=http FLOWMAP_PORT=3100 npx callgraph-mcp
|
|
|
127
127
|
|
|
128
128
|
> *"I just modified `processPayment`. Without reading any code, tell me every function that could break and rank them by how many hops away they are from the change."*
|
|
129
129
|
|
|
130
|
-
|
|
130
|
+
The agent calls `flowmap_get_callers("processPayment", workspacePath)` for the direct impact radius (1 hop), then recursively traverses callers-of-callers to build a ranked list by distance.
|
|
131
131
|
|
|
132
132
|
---
|
|
133
133
|
|
|
134
134
|
> *"We're about to merge a PR that touches `validateCart`. Give me an impact report — what's the worst case if this function throws."*
|
|
135
135
|
|
|
136
|
-
|
|
136
|
+
The agent calls `flowmap_get_flow("validateCart", workspacePath)` to map every function reachable downstream, then `flowmap_get_callers("validateCart", workspacePath)` to map every upstream caller.
|
|
137
137
|
|
|
138
138
|
---
|
|
139
139
|
|
|
@@ -141,13 +141,13 @@ FLOWMAP_TRANSPORT=http FLOWMAP_PORT=3100 npx callgraph-mcp
|
|
|
141
141
|
|
|
142
142
|
> *"Which functions in this codebase are architectural nasty-surprises — called by everything but calling a lot themselves. I want names, file paths, and exact counts."*
|
|
143
143
|
|
|
144
|
-
|
|
144
|
+
The agent calls `flowmap_analyze_workspace(workspacePath)` to get the full graph, then filters for nodes with high in-degree (many callers) and high out-degree (many callees). These are the structural chokepoints — functions where a bug propagates in both directions. Returned with exact counts. No approximation.
|
|
145
145
|
|
|
146
146
|
---
|
|
147
147
|
|
|
148
148
|
> *"Find every cycle in the call graph. For each one tell me which file I should break the dependency in to resolve it cleanly."*
|
|
149
149
|
|
|
150
|
-
|
|
150
|
+
The agent calls `flowmap_find_cycles(workspacePath)`. Each cycle is returned as an ordered list of functions with file paths and the exact call edges forming the loop — no post-processing needed. Because the graph is exact, cycle membership is exact — not a guess about which modules "seem" circular.
|
|
151
151
|
|
|
152
152
|
---
|
|
153
153
|
|
|
@@ -155,7 +155,7 @@ FLOWMAP_TRANSPORT=http FLOWMAP_PORT=3100 npx callgraph-mcp
|
|
|
155
155
|
|
|
156
156
|
> *"I want to delete code safely. Give me every function that is provably unreachable — not called by anything, not an entry point. Include file and line number."*
|
|
157
157
|
|
|
158
|
-
|
|
158
|
+
The agent calls `flowmap_find_orphans(workspacePath)`. This returns every function not reachable from any entry point in the call graph — with file path and line number for each one.
|
|
159
159
|
|
|
160
160
|
---
|
|
161
161
|
|
|
@@ -163,7 +163,7 @@ FLOWMAP_TRANSPORT=http FLOWMAP_PORT=3100 npx callgraph-mcp
|
|
|
163
163
|
|
|
164
164
|
> *"I just joined this team. Walk me through this codebase starting from the entry points — explain each major flow in plain English without me having to read a single file."*
|
|
165
165
|
|
|
166
|
-
|
|
166
|
+
The agent calls `flowmap_list_entry_points(workspacePath)` to find every main, route handler, CLI command, and React root. Then it calls `flowmap_get_flow` on each one to trace the execution.
|
|
167
167
|
|
|
168
168
|
---
|
|
169
169
|
|
|
@@ -171,7 +171,7 @@ FLOWMAP_TRANSPORT=http FLOWMAP_PORT=3100 npx callgraph-mcp
|
|
|
171
171
|
|
|
172
172
|
> *"I want to extract the payment logic into its own module. Based purely on call relationships, which functions naturally belong together and which ones would need to stay behind."*
|
|
173
173
|
|
|
174
|
-
|
|
174
|
+
The agent calls `flowmap_analyze_workspace(workspacePath)` and uses the graph to find the connected component of functions reachable from payment-related entry points.
|
|
175
175
|
|
|
176
176
|
---
|
|
177
177
|
|
|
@@ -179,13 +179,13 @@ FLOWMAP_TRANSPORT=http FLOWMAP_PORT=3100 npx callgraph-mcp
|
|
|
179
179
|
|
|
180
180
|
> *"Cursor just made changes across 14 files. Based on what it touched, what else in the codebase should I be nervous about that it didn't touch."*
|
|
181
181
|
|
|
182
|
-
|
|
182
|
+
The agent calls `flowmap_get_callers` for each modified function and `flowmap_get_flow` for each modified function. The union of those results — minus the files already touched — is the set of functions that depend on the changes but weren't updated. These are the places where silent breakage is most likely. Returned as a precise list, not a guess about what "might be related".
|
|
183
183
|
|
|
184
184
|
---
|
|
185
185
|
|
|
186
186
|
### Agentic code generation with structural guardrails
|
|
187
187
|
|
|
188
|
-
|
|
188
|
+
When an agent is generating new code, it can call `flowmap_analyze_workspace` before and after to verify:
|
|
189
189
|
- New functions are connected to the call graph (not accidentally orphaned)
|
|
190
190
|
- No existing entry points were broken
|
|
191
191
|
- The intended call relationships were actually created
|
|
@@ -196,9 +196,9 @@ FLOWMAP_TRANSPORT=http FLOWMAP_PORT=3100 npx callgraph-mcp
|
|
|
196
196
|
|
|
197
197
|
> *"We've been using an AI agent to build this codebase for 3 months. How much logic has it silently duplicated?"*
|
|
198
198
|
|
|
199
|
-
|
|
199
|
+
Agents optimize for the current instruction, not long-term architecture. It copies, tweaks slightly, and moves on. It satisfied the local goal.
|
|
200
200
|
|
|
201
|
-
|
|
201
|
+
The agent calls `flowmap_find_duplicates(workspacePath)`. Each cluster in the result is a group of functions with different names — often in different components — that call the same set of dependencies.
|
|
202
202
|
|
|
203
203
|
---
|
|
204
204
|
|
|
@@ -206,7 +206,7 @@ FLOWMAP_TRANSPORT=http FLOWMAP_PORT=3100 npx callgraph-mcp
|
|
|
206
206
|
|
|
207
207
|
> *"The agent has been adding features for weeks. Are there any circular call dependencies I should know about before this becomes a production problem?"*
|
|
208
208
|
|
|
209
|
-
|
|
209
|
+
The agent calls `flowmap_find_cycles(workspacePath)`. Every cycle is returned with the exact functions involved.
|
|
210
210
|
|
|
211
211
|
---
|
|
212
212
|
|
|
@@ -218,7 +218,7 @@ FLOWMAP_TRANSPORT=http FLOWMAP_PORT=3100 npx callgraph-mcp
|
|
|
218
218
|
4. Entry points are detected: functions that are never called but call others
|
|
219
219
|
5. The graph is partitioned into independent execution flows via BFS from each entry point
|
|
220
220
|
|
|
221
|
-
|
|
221
|
+
Files are parsed in parallel batches of 50. Results are cached for 30 seconds — repeated calls within a session are instant.
|
|
222
222
|
|
|
223
223
|
---
|
|
224
224
|
|
|
@@ -231,4 +231,4 @@ FLOWMAP_TRANSPORT=http FLOWMAP_PORT=3100 npx callgraph-mcp
|
|
|
231
231
|
|
|
232
232
|
## License
|
|
233
233
|
|
|
234
|
-
|
|
234
|
+
MIT
|