vitali87/code-graph-rag

No problems traced to this repository code in these checks. 2 static matches retained as context.

Reviewed as expected for a test run: wrote only to its own open file handles.

2 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The graph is stored in an embedded SQLite file by default: Real input produced the expected result: workspace__87bbb53e.codebase_rag.mcp.server.serve_stdio

  Source: The graph is stored in an embedded SQLite file by default.

  Input: {"tool": "resolve", "arguments": {"target": "serve_stdio", "project": "workspace__87bbb53e"}}

  Expected: qualified name in the graph

  Command: <guest-path> mcp-server tools/call {"tool": "resolve", "arguments": {"target": "serve_stdio", "project": "workspace__87bbb53e"}}

  Observed: workspace__87bbb53e.codebase_rag.mcp.server.serve_stdio\",\n \"path\": \"codebase_rag/mcp/server.py\",\n \"start_line\": 251,\n \"end_line\": 267\n }\n]"}], "isError": false}

• Code-Graph-RAG runs as an MCP server: Real input produced the expected result: workspace__87bbb53e.codebase_rag.mcp.server.serve_stdio

  Source: Code-Graph-RAG runs as an [MCP](https://modelcontextprotocol.io) server

  Input: {"tool": "resolve", "arguments": {"target": "serve_stdio", "project": "workspace__87bbb53e"}}

  Expected: tool result contains qualified name

  Command: <guest-path> mcp-server tools/call {"tool": "resolve", "arguments": {"target": "serve_stdio", "project": "workspace__87bbb53e"}}

  Observed: workspace__87bbb53e.codebase_rag.mcp.server.serve_stdio\",\n \"path\": \"codebase_rag/mcp/server.py\",\n \"start_line\": 251,\n \"end_line\": 267\n }\n]"}], "isError": false}

Examples

• Real-time watcher: cgr watch is a long-running foreground process; it is not a bounded documented command and is covered by source inspection only.

  Source: docs/guide/realtime-updates.md

  Expected: documented command completes successfully

  Observed: cgr watch is a long-running foreground process; it is not a bounded documented command and is covered by source inspection only.

Local or hosted: both

Install code-graph-rag at pinned commit and run cgr graph resolve plus cgr mcp-server resolve on the indexed checkout

cd <guest-path> && pwd && ls -la && id -u && python3 --version && cat README.md | head -200
ls <guest-path> ; ls /inputs 2>/dev/null; cd <guest-path> && git status 2>&1 | head -3
cd <guest-path> && git init -q && git remote add origin https://github.com/vitali87/code-graph-rag && timeout 120 git fetch --depth 1 origin 87541c13a09d55d8e6220acfb6d940f555e9782f 2>&1 | tail -5; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git log --oneline -1; which uv pipx rg; uv --version 2>&1; sed -n 200,400p README.md
cd <guest-path> && sed -n 1,120p docs/getting-started/installation.md
cd <guest-path> && sed -n 120,260p docs/getting-started/installation.md | grep -v '^$' | head -120; which rg || echo NO_RG
sudo -n true && echo SUDO_OK; (sudo -n apt-get update -qq && sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq ripgrep) 2>&1 | tail -3; rg --version | head -1; python3 -m venv <guest-path> && <guest-path> install -q uv 2>&1 | tail -3; <guest-path> --version
sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq python3.12-venv ><guest-path> 2>&1; echo rc=$?; rm -rf <guest-path> && python3 -m venv <guest-path> && <guest-path> install -q uv 2>&1 | tail -3; <guest-path> --version
cd <guest-path> && export PATH=<guest-path> && timeout 900 uv sync --extra treesitter-full --extra ast-grep 2>&1 | tail -15; echo rc=${PIPESTATUS[0]}; ls -la .venv/bin/cgr 2>&1
sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq build-essential ><guest-path> 2>&1; echo apt=$?; cd <guest-path> && export PATH=<guest-path> && timeout 900 uv sync --extra treesitter-full --extra ast-grep > <guest-path> 2>&1; echo rc=$?; tail -5 <guest-path>; ls -la .venv/bin/cgr
sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq python3.12-dev ><guest-path> 2>&1; echo apt=$?; cd <guest-path> && export PATH=<guest-path> && timeout 900 uv sync --extra treesitter-full --extra ast-grep > <guest-path> 2>&1; echo rc=$?; tail -5 <guest-path>; ls -la .venv/bin/cgr
cd <guest-path> && .venv/bin/cgr --version; .venv/bin/cgr --help 2>&1 | head -60; echo ----; grep -v '^$' docs/getting-started/quickstart.md | head -150
cd <guest-path> && grep -v '^$' docs/guide/mcp-server.md | head -170
cd <guest-path> && grep -v '^$' docs/guide/cli-reference.md | head -120; ls fixtures; ls examples | head -30
mkdir -p <guest-path> <guest-path> && cd <guest-path> && cat > shop.py <<'EOF'
def apply_discount(price, percent):
    return price - price * percent / 100


def checkout(cart):
    total = sum(item["price"] for item in cart)
    return apply_discount(total, 10)


class Cart:
    def add(self, item):
        self.items.append(item)
EOF
cd <guest-path> && export SQLITE_GRAPH_PATH=<guest-path> && timeout 600 .venv/bin/cgr start --repo-path <guest-path> --update-graph --project-name sample-shop --no-embeddings < /dev/null > <guest-path> 2>&1; echo rc=$?; tail -30 <guest-path>
cd <guest-path> && export SQLITE_GRAPH_PATH=<guest-path> && .venv/bin/cgr graph --help 2>&1 | sed 's/\x1b\[[0-9;]*m//g' | grep -v '^\s*$' | head -50; echo ----; .venv/bin/cgr graph resolve apply_discount -p sample-shop 2>&1 | tail -30; echo rc=$?
cd <guest-path> && export SQLITE_GRAPH_PATH=<guest-path> && .venv/bin/cgr graph callers sample-shop.shop.apply_discount -p sample-shop 2>&1; echo rc=$?; .venv/bin/cgr stats 2>&1 | sed 's/\x1b\[[0-9;]*m//g' | tail -15
cd <guest-path> && export SQLITE_GRAPH_PATH=<guest-path> && .venv/bin/cgr delete-project --project sample-shop </dev/null 2>&1 | tail -3; timeout 600 .venv/bin/cgr start --repo-path <guest-path> --update-graph --no-embeddings </dev/null > <guest-path> 2>&1; echo rc=$?; tail -2 <guest-path>; .venv/bin/cgr status 2>&1 | sed 's/\x1b\[[0-9;]*m//g' | tail -8; .venv/bin/cgr graph resolve apply_discount -p sample_repo__8b17e2d2 | head -12
mkdir -p <guest-path> && cat > <guest-path> <<'EOF'
import asyncio, os, json
from mcp import ClientSession, StdioServerParameters
from mcp.client.stdio import stdio_client

CGR = "<guest-path>"

async def main():
    env = dict(os.environ)
    env.update({"TARGET_REPO_PATH": "<guest-path>",
                "SQLITE_GRAPH_PATH": "<guest-path>"})
    params = StdioServerParameters(command=CGR, args=["mcp-server"], env=env)
    async with stdio_client(params) as (r, w):
        async with ClientSession(r, w) as s:
            await s.initialize()
            tools = await s.list_tools()
            for t in tools.tools:
                if t.name in ("resolve", "list_projects", "callers"):
                    print(t.name, json.dumps(t.inputSchema)[:400])
            res = await s.call_tool("resolve", {"target": "apply_discount"})
            print("RESOLVE isError=", res.isError)
            for c in res.content:
                print(getattr(c, "text", c))
asyncio.run(main())
EOF
cd <guest-path> && timeout 180 <guest-path> -I <guest-path> 2>&1 | tail -40
cd <guest-path> && ls -la && wc -l check.py && grep -n "env\|def \|\"stdin\"\|expected_file\|source_file\|README" check.py | head -120
cd <guest-path> && sed -n 40,47p check.py; sed -n 788,830p check.py; sed -n 856,930p check.py
cd <guest-path> && echo HOME=$HOME; unset SQLITE_GRAPH_PATH; time (timeout 1200 .venv/bin/cgr start --repo-path <guest-path> --update-graph --no-embeddings </dev/null > <guest-path> 2>&1); echo rc=$?; tail -3 <guest-path>; ls -la $HOME/.cgr 2>&1 | head; cd <guest-path> && git status --short | head -5
cd <guest-path> && .venv/bin/cgr graph resolve serve_stdio -p workspace__87bbb53e 2>&1 | head -12; .venv/bin/cgr graph definition codebase_rag.mcp.server.serve_stdio -p workspace__87bbb53e 2>&1 | head -12; .venv/bin/cgr graph resolve apply_discount -p workspace__87bbb53e 2>&1 | head -3
cd <guest-path> && grep -v '^$' docs/guide/realtime-updates.md | head -60; grep -rn "def watch\|once\|--now" codebase_rag/cli*.py codebase_rag/*/watch*.py 2>/dev/null | head; grep -rln "debounce" codebase_rag | head
cd <guest-path> && grep -n "cgr start --repo-path /path/to/repo --update-graph" README.md; grep -n "embedded SQLite" README.md; grep -n "uv sync --extra treesitter-full" README.md docs/getting-started/installation.md | head -3; grep -n "TARGET_REPO_PATH" docs/guide/mcp-server.md | head -3; ls <guest-path>; ls -la .coldpass 2>/dev/null; cat <guest-path> >/dev/null 2>&1; ps aux | grep -c "[c]gr mcp-server"
cd <guest-path> && grep -n "examples\|cycles\|report\|outcome\|fault_owner\|detected\|stuck_step\|plain_failure" checker/check.py | head -80; grep -n -i "mcp" workspace/README.md | head -5
cd <guest-path> && sed -n 955,975p checker/check.py; sed -n 1154,1175p checker/check.py; sed -n 1020,1060p checker/check.py | grep -n "argv\|expected_file\|expected_code\|cwd\|env" | head -20; grep -n "report.json\|'report'" checker/check.py | head; grep -n "def load\|read_json\|json.load" checker/check.py | head
cd <guest-path> && sed -n 1095,1112p checker/check.py; sed -n 1126,1140p checker/check.py
cd <guest-path> && mkdir -p .coldpass/.. && python3 -I - <<'EOF'
import json, os
d='<guest-path>'
os.makedirs(d, exist_ok=True)
cgr='<guest-path>'
cwd='<guest-path>'
tool='resolve'
args={"target":"serve_stdio","project":"workspace__87bbb53e"}
exp='workspace__87bbb53e.codebase_rag.mcp.server.serve_stdio'
probe={"kind":"mcp","argv":[cgr,"mcp-server"],"cwd":cwd,"tool":tool,"arguments":args,"expected_text":exp,
       "env":{"TARGET_REPO_PATH":cwd}}
claims=[
 {"kind":"claim","claim":"The graph is stored in an embedded SQLite file by default",
  "source":"The graph is stored in an embedded SQLite file by default.",
  "input":"resolve serve_stdio in the indexed checkout","expected":"qualified name in the graph",
  "probe_kind":"mcp","argv":[cgr,"mcp-server"],"tool":tool,"arguments":args,"expected_text":exp,"cwd":cwd},
 {"kind":"claim","claim":"Code-Graph-RAG runs as an MCP server",
  "source":"Code-Graph-RAG runs as an [MCP](https://modelcontextprotocol.io) server",
  "input":"resolve serve_stdio over stdio MCP","expected":"tool result contains qualified name",
  "probe_kind":"mcp","argv":[cgr,"mcp-server"],"tool":tool,"arguments":args,"expected_text":exp,"cwd":cwd},
]
examples=[{"claim":"Real-time watcher","source":"docs/guide/realtime-updates.md",
  "reason":"cgr watch is a long-running foreground process; it is not a bounded documented command and is covered by source inspection only.",
  "deferred":True}]
cycles={"detected":False,"reason":"cgr watch (docs/guide/realtime-updates.md) runs until Ctrl+C and is a foreground watcher, not a scheduled or looping product cycle; no cron/--once trigger is documented, so no bounded cycle replay was run."}
report={"outcome":"working","fault_owner":None,"operation":"Install code-graph-rag at pinned commit and run cgr graph resolve plus cgr mcp-server resolve on the indexed checkout",
 "steps":["Installed uv 0.13.5 via pip into <guest-path>","apt-get installed python3.12-venv, build-essential, python3.12-dev, ripgrep 14.1.0","uv sync --extra treesitter-full --extra ast-grep","cgr --version 0.2.24","cgr start --repo-path sample and --update-graph offline indexing","cgr graph resolve serve_stdio -p workspace__87bbb53e","MCP stdio resolve probe via cgr mcp-server"],
 "deviations":["uv was missing and installed via pip","System packages installed: python3.12-venv, build-essential, python3.12-dev, ripgrep","Sample repo indexed for early tests; sample-shop project deleted with cgr delete-project","cycles.json detected:false because cgr watch is not a bounded cycle"],
 "stuck_step":None,"plain_failure":None}
for name,obj in [('probe.json',probe),('claims.json',claims),('examples.json',examples),('cycles.json',cycles)]:
    json.dump(obj,open(os.path.join(d,name),'w'),indent=2)
os.makedirs(os.path.join(d,'report_parent'),exist_ok=True) if False else None
json.dump(report,open(os.path.join(d,'report.json'),'w'),indent=2)
print('ok')
EOF
ls -la .coldpass; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60