What is codebase-memory-mcp?
codebase-memory-mcp, from DeusData, parses a repository with 163 vendored tree-sitter grammars into a SQLite knowledge graph of functions, classes, files, imports, calls, routes and data flow, and keeps it in ~/.cache/codebase-memory-mcp between sessions. Since v0.12.0 the graph also takes in Markdown and PDF documentation, architecture decision records, Dockerfiles, Kubernetes manifests, Helm charts, Terraform and CI jobs, so an agent can follow a Service through its workload and image to the program the container runs. A Hybrid LSP pass refines call edges with type resolution for 11 language families, including Python, TypeScript, Go, Java and Rust.
The server exposes 17 MCP tools, among them search_graph (structural, BM25 and semantic search with an embedding model compiled into the binary), trace_path, detect_changes for the blast radius of a git diff, and a read-only Cypher-like query_graph. Its installer configures 46 client integrations, including Claude Code, Codex, Gemini CLI, Cursor and OpenCode. An optional browser viewer, CBM Lens, is in open beta.
The repo was created in February 2026, is MIT-licensed, written in C and has about 48,500 stars and 4,000 forks. The latest release is v0.12.1 from 16 October 2026. The npm wrapper logged about 12,100 downloads and the PyPI one about 2,100 in the week to 10 November.
How to install codebase-memory-mcp
curl -fsSL https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/install.sh | bashIs codebase-memory-mcp worth it?
codebase-memory-mcp covers more of a system than any other code graph in this category. Where CodeGraph and GitNexus stop at source files, it links code to the Dockerfiles, Kubernetes objects, Helm charts, Terraform modules and CI steps that build and deploy it, so trace_path can answer "what deploys this service?" as well as "who calls this function?". That breadth comes under MIT, which GitNexus's noncommercial licence cannot match.
The published numbers are large but come from the authors. A March 2026 arXiv preprint by the maintainers reports 10 times lower token use and 2.1 times fewer tool calls than file-by-file exploration across 31 repositories. The README times a full index of the Linux kernel, 28M lines in 75K files, at 3 minutes on an Apple M3 Pro, and Cypher queries at under 1 ms. We found no independent replication.
Privacy defaults are better than its rivals'. The README says the binary makes no network request of its own accord, checks for no updates and collects no telemetry, where CodeGraph and CocoIndex Code both report usage unless told not to. Semantic search runs on an embedding model compiled into the binary, so no Ollama or API key is involved. Releases carry SLSA Level 3 provenance, cosign signatures, checksums and VirusTotal scans; Microsoft Defender still flags some builds, which the project documents as a false positive.
The install is heavier than the tool list suggests. The quick start is a curl-to-bash script, and v0.12.0 binaries were 331 to 335 MB, large enough that they broke the npm, PyPI and Go installers until v0.12.1. The installer adds hooks by default; in Claude Code these include a non-blocking PreToolUse hook on Grep, Glob and Bash that injects graph context, removable with install --no-hooks. index_repository accepts any path unless CBM_ALLOWED_ROOT is set.
Maturity is the real question. About 487 issues are open, including a memory-leak report open since June and a high-CPU report since March, and v0.12.0 alone merged 231 pull requests. A team-shared graph artifact is opt-in, but the README warns that committing every refresh grew one team's history to about 6 GB over 350 commits.
Where it earns its place
A platform engineer at a company running its services on Kubernetes
Find out which deployments and images a change to a shared library reaches
Index the monorepo with index_repository, then ask the agent to run detect_changes on the branch and trace_path in deploy and run modes. It follows Service to workload to image to Dockerfile to program; templated Helm values it cannot resolve are left out, so confirm gaps with check_index_coverage.
A C/C++ team with a slow CI test suite
Run only the tests a pull request can affect
The experimental Smart CI layer combines static reachability with per-test coverage and falls back to run_all when evidence is missing. It narrows only C/C++ code with supported harnesses; start in report-only shadow mode, as the README advises.
An engineering manager at a regulated firm rolling agents out across engineering
Give everyone code-graph context without a vendor contract or data leaving laptops
MIT licence, no telemetry and no hosted service mean nothing to negotiate. Set CBM_ALLOWED_ROOT in the managed config to confine indexing, and decide up front whether to keep the default hooks or install with --no-hooks.
Before you commit
- Setup
- curl the install.sh script (or install.ps1 on Windows), or use npm, PyPI, Homebrew, AUR, Nix or go install; a Claude Code plugin is also offered. The installer detects clients and writes MCP config, skills, three agent profiles and hooks; restart the agent and say "Index this project". auto_index is off by default.
- Integrations
- 17 tools: index_repository, list_projects, delete_project, index_status, check_index_coverage, search_graph, trace_path, detect_changes, query_graph, get_graph_schema, compare_graphs, get_code_snippet, get_file_outline, get_architecture, search_code, manage_adr and ingest_traces. No tool edits source: writes go to the index, its ADR document and, only with persistence: true, a graph snapshot in the repository's .codebase-memory folder.
- Data and privacy
- Indexes and graph live locally in ~/.cache/codebase-memory-mcp; the README says the binary sends no telemetry and makes no unprompted network requests. CBM Lens listens on 127.0.0.1 only when started, and its optional browser model downloads from Hugging Face. No security advisories are published.
- Cost at scale
- Free; the only costs are local CPU, RAM and disk. Indexing memory can be capped with index_max_rss_mb or CBM_MEM_BUDGET_MB. The saving lands on the model bill through fewer file reads per question.
- Limits
- stdio only; a native HTTP transport is an open feature request. Long synchronous index calls can exceed client deadlines, so large repos need async mode. Hybrid LSP covers 11 language families; others fall back to textual resolution. All active processes must run the exact same build.
What’s good
- Graph spans code, docs, Docker, Kubernetes, Helm, Terraform and CI
- MIT licence; no telemetry or network calls from the binary
- Read-only Cypher queries and diff blast radius in 17 tools
- Signed releases with SLSA Level 3 provenance
What’s not
- About 487 open issues, including memory and CPU reports
- Installer adds hooks to agent tool calls by default
- Binaries above 330 MB; curl-to-bash quick start
- Headline token savings are the maintainers' own study
Best for
Teams whose agents need to trace changes across services and deployment config, under a licence an employer will accept, with nothing leaving the machine.
codebase-memory-mcp alternatives
codebase-memory-mcp: common questions
- Is codebase-memory-mcp worth it?
- The widest code graph you can run under MIT, reaching from functions to Helm charts with no telemetry, provided you can live with its install-time hooks and a backlog of nearly 500 open issues. We rate it 4.2 out of 5.
- How much does codebase-memory-mcp cost?
- Free and open source (MIT). No hosted tier, account or API key.
- What are the downsides of codebase-memory-mcp?
- About 487 open issues, including memory and CPU reports; installer adds hooks to agent tool calls by default; binaries above 330 MB; curl-to-bash quick start; headline token savings are the maintainers' own study.
- Who is codebase-memory-mcp best for?
- Teams whose agents need to trace changes across services and deployment config, under a licence an employer will accept, with nothing leaving the machine.
- How much does codebase-memory-mcp cost for a team or in production?
- Free; the only costs are local CPU, RAM and disk. Indexing memory can be capped with index_max_rss_mb or CBM_MEM_BUDGET_MB. The saving lands on the model bill through fewer file reads per question.
- Is codebase-memory-mcp safe for company data?
- Indexes and graph live locally in ~/.cache/codebase-memory-mcp; the README says the binary sends no telemetry and makes no unprompted network requests. CBM Lens listens on 127.0.0.1 only when started, and its optional browser model downloads from Hugging Face. No security advisories are published.
- What are the best codebase-memory-mcp alternatives?
- The closest alternatives we have reviewed are CodeGraph, GitNexus, code-review-graph, Serena and CocoIndex Code.
Answers checked Nov 11, 2026.
Make codebase-memory-mcp? Show this rating on your site
