Codebase Memory MCP 🔌 MCP server Open source

What it does

Codebase Memory MCP turns a repository into a persistent knowledge graph that your coding agent can query, so it does not have to grep and read files one at a time. It is a single native binary written in C. It parses code with bundled tree-sitter grammars for more than 150 languages and adds type resolution for about a dozen major ones, including Python, TypeScript, Go, Java, C# and Rust. The graph holds functions, classes, call chains, imports, HTTP routes and cross-service links, and it also covers Dockerfiles and Kubernetes manifests. A background watcher keeps the index current as files change. There is no built-in LLM: your agent writes the queries, and the server runs them.

Tools it gives your agent

• index_repository, index_status, list_projects and delete_project for managing indexes
• search_graph (structural, BM25 and semantic search), search_code and get_code_snippet
• trace_path for callers and callees, detect_changes to map a git diff to the symbols it affects, and read-only Cypher-style query_graph
• get_architecture and get_graph_schema for an overview of the codebase
• manage_adr for keeping architecture decision records across sessions

Works with

It runs locally over stdio. The install command detects and configures dozens of clients, including Claude Code, Codex, Gemini CLI, OpenCode, Cursor, Windsurf, Kilo Code, Zed, Cline, Amp, Goose, Aider and VS Code Copilot. An optional 3D graph viewer runs on localhost.

How to connect

The README's one-line installer for macOS and Linux (npm, PyPI, Homebrew and other package channels are also listed):

curl -fsSL https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/install.sh | bash

Then restart your agent and ask it to index the project.

Cost and limits

Free under the MIT licence. It needs no API key, hosted service or language runtime. Indexes are stored in ~/.cache/codebase-memory-mcp/.

Safety notes

The installer writes to your agents' config files and adds skills, instructions and hooks. Use --skip-config if you only want the binary. The project says processing is fully local, that it collects no telemetry and that it makes no background network requests. Set CBM_ALLOWED_ROOT to limit which paths can be indexed. Microsoft Defender has flagged release builds, and the maintainers call that a false positive. You can check downloads against the published SHA-256 checksums.