Who code-graph-rag is for#
Platform teams enforcing compliance traceability
Map code to regulatory requirements (SOX, HIPAA, PCI-DSS) by adding custom compliance edges to the graph. Query which functions handle PII, trace data lineage across services, and audit cost attribution at the code level. The open schema extends to model team ownership, security classifications, and domain-specific relationships without vendor approval.
Skip if:
Your compliance needs fit into existing static analysis tools with predefined rule sets. Code-Graph-RAG's value is custom relationship modeling; if you don't need bespoke edge types, simpler linters may suffice.
AI engineers building code-aware RAG pipelines
Embed the knowledge graph into AI workflows for precise code retrieval. Natural language queries return exact function names, file paths, and line numbers instead of approximate text matches. Surgical code edits integrate into AI-driven refactoring agents that need structural targeting, not regex.
Skip if:
Your RAG pipeline works over documentation or text-heavy content, not source code. If you're indexing Markdown docs or API specs, standard vector search over text is simpler than parsing code into a graph.
Security researchers tracking data flow across services
FLOWS_TO taint edges trace values from sources to sinks across 10 languages. Query "show all paths from this user input to database writes" as a graph traversal. Use this to map attack surface, audit sensitive data handlers, and identify unvalidated flows. Dead code detection walks call edges from entry points to surface unreachable functions.
Skip if:
You're auditing a single-language codebase with mature static analysis tooling. Code-Graph-RAG's strength is cross-language taint tracking in polyglot monorepos; single-language projects often have specialized analyzers that run faster.
Teams managing legacy monorepos with mixed languages
Navigate codebases where Python microservices call TypeScript frontends that invoke Rust libraries. The unified graph schema surfaces cross-language dependencies that grep and IDE navigation miss. Incremental updates keep the graph current as the codebase evolves, so queries stay grounded in the actual structure.
Skip if:
You're maintaining one or two single-language projects with clear module boundaries. Small, well-organized codebases often don't need graph-based navigation; IDE "find usages" and grep suffice.
The problem it solves#
Understanding large codebases is slow, manual, and error-prone. Grep and text search miss structural relationships like call chains, data flow paths, and cross-file dependencies. Static analysis tools produce fragmented results that require manual assembly, and commercial code intelligence platforms charge per-seat fees that scale poorly for large teams while locking your code graph into proprietary systems.
The hardest part is querying across languages in a monorepo. A Python service calls a TypeScript API, which invokes a Rust library, and tracing that chain manually requires opening three repos, parsing three syntaxes, and keeping the call stack in your head. Most tools treat each language in isolation, forcing you to stitch the results together by hand.
How it solves it#
Multi-language Tree-sitter parsing
Parses 14 languages (Python, TypeScript, JavaScript, Rust, Go, Java, C, C++, C#, PHP, Lua, Dart, Ruby, Scala) with a unified graph schema. Every language produces the same node types (functions, classes, modules, imports), so cross-language queries work without language-specific logic. Adding a new language requires a single ast-grep YAML pattern file.
Memgraph knowledge graph backend
Stores code structure as an interconnected graph where functions, classes, and modules are nodes, and calls, imports, and data-flow edges are relationships. Cypher queries traverse call chains, find dead code by walking reference edges from entry points, and trace taint paths from sources to sinks. The graph persists across runs, so incremental updates avoid re-parsing unchanged files.
Natural language query interface
Ask questions in plain English and get answers grounded in the graph. "What functions handle authentication?" translates to a Cypher query, retrieves matching nodes, and returns the file paths and line numbers. The AI layer converts intent to precise graph queries without requiring manual Cypher knowledge.
AST-based surgical code editing
Replace code blocks by function name with exact AST targeting, not regex. The tool shows a visual diff preview before writing changes, so you approve edits before they touch the filesystem. Combined with the graph query layer, you can find and patch every function matching a structural pattern across the entire codebase.
MCP server integration
Runs as an MCP server with 15 tools for indexing, querying, editing, and searching. Claude Code and other MCP clients can query the graph, retrieve source code, and perform surgical replacements directly from the IDE. Setup: `claude mcp add code-graph-rag` after installing the tool.
Data-flow taint tracking
FLOWS_TO edges trace values from sources through assignments, function calls, and returns to I/O sinks. Supported in Python, JavaScript, TypeScript, Go, Java, Rust, C++, C, C#, and Lua. Security researchers use this to map blast radius, track PII handlers, and audit compliance requirements by walking provenance as graph reachability.
Strengths and trade-offs#
Strengths
- MIT license with full self-hostingThe self-hosted tier is MIT licensed, so you can run it on your infrastructure, modify the graph schema, and use it commercially without restrictions. Unlike Sourcegraph (proprietary, per-seat billing) or GitHub Copilot (API-only, no graph export), you pay once for the server and own the pipeline.
- Unified schema across 14 languagesEvery language produces the same graph node types (Function, Class, Module, Import edges), so cross-language queries work without language-specific Cypher. A monorepo mixing Python, TypeScript, and Rust gets one coherent graph, not three isolated trees. Other multi-language tools emit different schemas per language, forcing you to write separate queries for each.
- Incremental graph updatesThe `cgr start --update-graph` command re-parses only changed files, leaving the rest of the graph intact. Large monorepos avoid full re-indexing on every run. The shared Memgraph instance holds multiple projects simultaneously, so adding one repo does not wipe the others.
- Structural search and replace with ast-grepMatch and rewrite code by AST pattern, not text or regex. Find every function with a specific parameter type, or replace all instances of a deprecated API call across the codebase. The MCP tool `structural_replace` shows a dry-run diff before writing changes, so you approve transformations before they touch files.
Trade-offs
- -Docker and Memgraph required for self-hostingThe graph backend runs in a Memgraph Docker container, and the semantic search tier needs Qdrant. A minimal deployment requires Docker installed and at least 2GB RAM for the database. Lightweight VPS instances under 1GB will hit resource limits on large codebases. Cloud deployment or a dedicated small server resolves this, but it is not a zero-dependency install.
- -AI provider API key needed for Cypher generationNatural language queries translate to Cypher via an LLM (Google Gemini, DeepSeek, or OpenAI). You need an API key for the chosen provider. The tool does not bundle a local model, so air-gapped environments require manual Cypher queries or a self-hosted LLM endpoint.
- -Graph indexing time scales with codebase sizeInitial indexing parses every source file and writes the graph. A 100k-line monorepo takes several minutes; a million-line codebase can take 30+ minutes. Incremental updates mitigate this after the first run, but cold-start indexing for very large repos is not instant.
code-graph-rag vs alternatives#
Code-Graph-RAG vs Sourcegraph
Both provide code intelligence for large codebases, but Code-Graph-RAG is MIT licensed with full self-hosting while Sourcegraph is proprietary with per-seat pricing.
| Feature | Code-Graph-RAG | Sourcegraph |
|---|---|---|
| License | MIT | Proprietary |
| Self-hosting | Yes, Docker-based | Limited (free tier capped) |
| Graph backend | Memgraph (open) | Proprietary index |
| Multi-language | 14 languages, unified schema | 40+ languages |
| Natural language queries | Yes, via LLM | Search syntax only |
| Pricing | Free self-hosted | $99+/user/month |
Code-Graph-RAG wins when you need data ownership, custom graph schema extensions (compliance edges, team ownership), and structural queries beyond text search. The unified schema across 14 languages enables cross-language dependency queries. The open Memgraph backend lets you write custom Cypher queries and integrate the graph into external workflows.
Sourcegraph is better when you need IDE integrations across 40+ languages, a polished search UI with no setup, and enterprise support. Its batch change system is more mature. If your team values zero infrastructure management and can afford per-seat pricing, the managed service removes the Docker layer.
Code-Graph-RAG vs GitHub Copilot Workspace
| Feature | Code-Graph-RAG | Copilot Workspace |
|---|---|---|
| License | MIT | Proprietary |
| Self-hosting | Yes | No |
| Graph backend | Memgraph | Proprietary index |
| Pricing | Free self-hosted | $10-20/user/month |
| Data-flow tracing | Yes (10 languages) | Limited |
Code-Graph-RAG wins for self-hosting (compliance, air-gapped, cost control). The Memgraph backend exposes the full code graph for custom queries. Data-flow taint tracking with FLOWS_TO edges enables security audits that Copilot does not surface.
Copilot Workspace is better if your team uses GitHub, values zero setup, and needs AI-assisted PR generation in the web UI. Its GitHub Issues integration is tighter than Code-Graph-RAG's external MCP workflow.
Install and self-host#
Self-hosting requires Docker, cmake, and ripgrep installed.
```bash
# Install with uv (recommended)
uv tool install "code-graph-rag[treesitter-full,semantic]"
# Or with pipx
pipx install "code-graph-rag[treesitter-full,semantic]"
# Start the Memgraph + Qdrant stack
cgr daemon up
# Index a repository
cgr start --repo-path /path/to/repo --update-graph
# Add as MCP server in Claude Code
claude mcp add code-graph-rag --transport stdio \
--env TARGET_REPO_PATH="$(pwd)" \
--env CYPHER_PROVIDER=google \
--env CYPHER_MODEL=gemini-2.5-flash \
--env CYPHER_API_KEY=your-api-key \
cgr mcp-server
```What it's built on#
- Languages
- Python
FAQ#
Is Code-Graph-RAG free to use?
Yes. The self-hosted version is MIT licensed and free to run on your infrastructure. You pay for the server (Docker, Memgraph, Qdrant), the AI provider API key for natural language queries, and nothing else. There is no per-seat pricing, no usage caps, and no vendor fees.
Can I use Code-Graph-RAG without an AI API key?
Yes, but you lose the natural language query layer. You can index the codebase, build the graph, and write manual Cypher queries directly against Memgraph. The surgical editing, structural search, and dead code detection features work without an LLM. For teams with air-gapped environments, manual Cypher or a self-hosted LLM endpoint are the two paths.
How does Code-Graph-RAG compare to Sourcegraph?
Code-Graph-RAG is MIT licensed and self-hosted with no per-seat fees. Sourcegraph is proprietary with per-user pricing that scales poorly for large teams. Code-Graph-RAG stores the graph in Memgraph, which you control; Sourcegraph locks your code intelligence data into their platform. Sourcegraph has stronger IDE integrations and a mature search UI; Code-Graph-RAG offers deeper graph-based structural queries and custom relationship modeling.
What languages does Code-Graph-RAG support?
Python, TypeScript, TSX, JavaScript, Rust, Go, Java, C, C++, C#, PHP, Lua, and Dart are fully supported. Scala is in development, and Ruby has structural support (modules, functions, classes, imports). Data-flow taint tracking works in Python, JavaScript, TypeScript, Go, Java, Rust, C++, C, C#, and Lua. Adding a new language requires a single ast-grep YAML pattern file that defines the AST extraction rules.
Can Code-Graph-RAG handle very large monorepos?
Yes, but initial indexing time scales with codebase size. A 100k-line repo indexes in minutes; a million-line repo takes 30+ minutes on the first run. Incremental updates (cgr start --update-graph) re-parse only changed files, so subsequent runs are much faster. The graph persists in Memgraph, and queries run in milliseconds regardless of codebase size once indexed.
Similar open-source tools#
Embabel
Agentic AI framework for the JVM
codebase-memory-mcp
Efficient code intelligence for AI coding agents
Flue Framework
Build powerful, autonomous agents with TypeScript.
DeepSeek TUI
A coding agent that lives in your terminal.
FerretDB
Run MongoDB apps on PostgreSQL with no code changes needed
Amplication
Generate production-ready backends for platform engineers