What it is
code-review-graph parses a repository with tree-sitter into a graph of functions, classes, imports, calls and tests, stores it in a local SQLite file, and serves it to AI coding tools over MCP. When you review a change, the assistant asks the graph for the 'blast radius' (every caller, dependent and test the change could touch) and reads only those files. Hooks and a watch mode keep the graph updated incrementally.
It exposes 30 MCP tools and 5 prompts, from impact analysis and review context to execution-flow listing, architecture overviews, refactor previews and cross-repo search; a CRG_TOOLS setting trims the list. One install command detects and configures 16 AI tools, including Claude Code, Codex, Cursor, Windsurf, Zed, Gemini CLI and GitHub Copilot. A GitHub Action posts risk-scored review comments on pull requests.
The repo has about 32,300 GitHub stars; version 2.3.9 shipped on 18 September 2026. It is MIT licensed and needs Python 3.10 or later.
Install
pip install code-review-graph && code-review-graph installOur review
The idea is sound: instead of letting an assistant re-read large parts of a codebase for every review, precompute who depends on what and hand it a short list. The README reports a median 63-fold token reduction per question across six open-source repositories, with a maximum of 358 on the largest, fastapi. A cold build of a roughly 3,000-file repo took about 40 seconds in the maintainer's measurements, and a two-file edit re-indexes in about 2.5 seconds, 1.4 of which is process start-up.
The project is candid about its limits, which is rarer than it should be. It says its impact recall of 1.0 is circular (the ground truth comes from the same graph), reports an average F1 of 0.69 with precision of 0.55, admits that its co-change evaluation returned nothing usable, notes that graph context can cost more than a plain file read for tiny edits, and says flow detection is weaker for JavaScript and Go than for Python and PHP.
The trade-offs are footprint and control. The install step writes MCP entries, hooks, skills and rules-file instructions into every AI tool it finds, and 30 tool definitions take real context; the per-platform flag and CRG_TOOLS keep it tight. Most tools only read, but apply_refactor_tool edits source files. Everything stays local by default, but switching on a cloud embedding provider sends code snippets off the machine, which the tool warns about. With 186 open issues and no release since 18 September, maintenance is busy rather than idle, yet the backlog is long.
Against GitNexus it is the more permissive choice (MIT rather than a noncommercial licence) and more focused on review. Against Serena it is weaker at precise editing, since its graph comes from parsing rather than language servers, so a rename it previews is a structural guess, not a type-checked one.
Where it earns its place
A reviewer on a 3,000-file Python service using Claude Code
Review a pull request without the agent reading half the repo
Run code-review-graph install once (about 40 seconds to build for that size); the agent calls get_review_context_tool and get_impact_radius_tool and reads only the files in the blast radius. The README median is 63 times fewer tokens per question, though a two-line edit can cost more than reading the file.
An engineering manager who wants a risk signal on every pull request
Flag risky changes and untested hotspots in CI
The composite GitHub Action builds the graph on the runner and posts one sticky comment with risk-scored functions, affected flows and test gaps; fail-on-risk turns it into a merge gate. No code leaves the runner, so the only cost is CI minutes.
A developer joining a large, unfamiliar PHP codebase
Get an architecture map before touching anything
get_architecture_overview_tool and generate_wiki_tool build a view from detected code communities, and get_knowledge_gaps_tool points at untested hotspots. Flow detection is stronger for Python and PHP than JavaScript or Go, so the map is most trustworthy in those languages.
Before you commit
- Setup
- pip install code-review-graph, then code-review-graph install detects up to 16 AI tools and writes MCP entries, hooks, skills and rules instructions into each; restart the editor. Python 3.10+; code-review-graph uninstall removes only its own entries.
- Integrations
- 30 tools plus 5 MCP prompts such as review_changes and pre_merge_check. Most are read-only queries (impact radius, review context, callers and callees, flows, communities, hub and bridge nodes); build_or_update_graph_tool, embed_graph_tool, generate_wiki_tool and apply_refactor_tool write, the last to your source files.
- Data and privacy
- The graph is a local SQLite file; serve runs over stdio, and serve --http listens on localhost:5555. Optional cloud embeddings (Gemini, Voyage, MiniMax or any OpenAI-compatible endpoint) send code snippets off the machine, with a warning first. No security advisories are published.
- Cost at scale
- Free. Local embeddings default to all-MiniLM-L6-v2 on CPU; cloud embedding providers bill at their own rates. The saving is on the model bill: the README's sample questions return about 2,200 to 3,900 tokens instead of a whole corpus.
- Limits
- Impact recall is circular by the project's own account, with average F1 of 0.69 over 13 commits. Read-only tools have no timeout unless CRG_TOOL_TIMEOUT is set, and the write tools are never bounded by it.
What's good
- Blast-radius analysis aimed squarely at code review
- Local SQLite graph; no external service needed
- MIT licensed, with a GitHub Action for PR comments
- Documents its own benchmark limits
What's not
- 30 tools add context overhead unless trimmed
- Installer writes hooks and rules into every detected tool
- Flow detection weaker for JavaScript and Go
- 186 open issues; no release since September 2026
Best for
Teams using AI assistants for pull-request review on medium to large repositories who want a permissively licensed, local code graph.
Alternatives
code-review-graph: common questions
- Is code-review-graph worth it?
- Precomputed blast radius makes AI review cheaper on big repositories, and the project is unusually frank about where its numbers fall short; trim its 30 tools before installing. We rate it 4.0 out of 5.
- How much does code-review-graph cost?
- Free and open source (MIT). Optional cloud embedding providers (Gemini, Voyage, OpenAI-compatible) bill you separately.
- What are the downsides of code-review-graph?
- 30 tools add context overhead unless trimmed; installer writes hooks and rules into every detected tool; flow detection weaker for JavaScript and Go; 186 open issues; no release since September 2026.
- Who is code-review-graph best for?
- Teams using AI assistants for pull-request review on medium to large repositories who want a permissively licensed, local code graph.
- How much does code-review-graph cost for a team or in production?
- Free. Local embeddings default to all-MiniLM-L6-v2 on CPU; cloud embedding providers bill at their own rates. The saving is on the model bill: the README's sample questions return about 2,200 to 3,900 tokens instead of a whole corpus.
- Is code-review-graph safe for company data?
- The graph is a local SQLite file; serve runs over stdio, and serve --http listens on localhost:5555. Optional cloud embeddings (Gemini, Voyage, MiniMax or any OpenAI-compatible endpoint) send code snippets off the machine, with a warning first. No security advisories are published.
- What are the best code-review-graph alternatives?
- The closest alternatives we have reviewed are GitNexus, Serena, Semble and GitHub MCP Server.
Answers checked Oct 23, 2026.
Make code-review-graph? Show this rating on your site
