← Back to search

io.github.BigJai/codemunch-pro

BigJai Scanned 1d ago

Code indexing MCP: 13 tools, 10 languages, hybrid search, call graphs, O(1) retrieval.

C
73.6 / 100

Versions

0.1.1latest
first seen Jun 5, 2026
1.2.0
first seen May 19, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 15

index_folder
annotations: none low

Index a local directory. Extracts symbols from source files using tree-sitter AST parsing. Supports 10 languages: Python, JavaScript, TypeScript, Go, Rust, Java, C, C++, C#, Ruby. Uses incremental indexing — only re-parses files that changed (SHA-256 comparison). Generates vector embeddings for semantic search. Args: path: Absolute path to the directory to index. include_patterns: Optional glob patterns to include (e.g. ["src/**/*.py"]). exclude_patterns: Optional glob patterns to exclude (e.g. ["tests/**"]). embed: Whether to generate vector embeddings (default True, set False for faster indexing).

path str embed bool exclude_patterns string include_patterns string
index_repo
annotations: none low

Index a GitHub or GitLab repository by downloading its tarball. No git binary needed. Downloads the repo archive, extracts, and indexes. Subsequent calls use a cache — only re-downloads if new commits exist. Args: url: Repository URL (e.g. "https://github.com/owner/repo"). branch: Branch to index (default: repo's default branch). token: Optional auth token for private repos (GitHub PAT or GitLab token). sparse_paths: Optional list of paths to index (e.g. ["src/", "lib/"]). embed: Whether to generate vector embeddings (default True).

url str embed bool token str branch str sparse_paths string
list_repos
annotations: none low

List all indexed repositories with stats. Returns repository paths, file counts, symbol counts, and languages.

invalidate_cache
annotations: none low

Force re-index a repository by clearing its cache. Deletes the stored hashes so all files are re-parsed on next index. Args: repo_path: Path to the repository to invalidate.

repo_path str
file_tree
annotations: none low

Get the directory tree of an indexed repository. Shows files with their language, size, and symbol count. Args: repo_path: Path to the indexed repository. path_prefix: Optional path prefix to filter (e.g. "src/"). depth: Maximum directory depth to show (default 3).

depth int repo_path str path_prefix str
file_outline
annotations: none low

List all symbols in a single file, ordered by line number. Shows functions, classes, methods, types, and interfaces with their signatures. Args: repo_path: Path to the indexed repository. file_path: Relative path to the file within the repo (e.g. "src/main.py").

file_path str repo_path str
repo_outline
annotations: none low

List all symbols in the repository (summary view). Returns a compact list of all functions, classes, methods, etc. Use kind_filter to show only specific types. Args: repo_path: Path to the indexed repository. kind_filter: Optional filter: "function", "class", "method", "type", "interface". limit: Maximum symbols to return (default 200, max 500).

limit int repo_path str kind_filter str
get_symbol
annotations: none low

Get the full source code of a specific symbol using O(1) byte-offset seek. Retrieves the exact bytes of a function, class, or method without reading the entire file. This is the key token-saving feature — get exactly what you need. Args: repo_path: Path to the indexed repository. qualified_name: Fully qualified name (e.g. "MyClass.my_method" or "my_function").

repo_path str qualified_name str
get_symbols
annotations: none low

Batch get source code for multiple symbols at once. More efficient than calling get_symbol repeatedly. Returns all requested symbols with their full source code. Args: repo_path: Path to the indexed repository. qualified_names: List of fully qualified names to retrieve.

repo_path str qualified_names string
search_symbols
annotations: none low

Hybrid search across all symbols using FTS5 + vector similarity. Combines keyword matching (BM25) with semantic similarity (embeddings) using Reciprocal Rank Fusion for best results. Args: repo_path: Path to the indexed repository. query: Search query (natural language or code terms). kind: Optional filter: "function", "class", "method", "type", "interface". limit: Maximum results (default 20).

kind str limit int query str repo_path str
search_text
annotations: none low

Full-text search in file contents (strings, comments, config values). Searches the raw text of all indexed files, not just symbol names. Useful for finding string literals, TODO comments, config values, error messages. Args: repo_path: Path to the indexed repository. query: Text to search for. glob: Optional file glob pattern (e.g. "*.py", "src/**/*.ts"). limit: Maximum results (default 20).

glob str limit int query str repo_path str
get_callees
annotations: none low

Get what a function calls (outgoing call graph edges). Traces the call graph from a function to see what it invokes. Use depth > 1 for transitive callees. Args: repo_path: Path to the indexed repository. qualified_name: Fully qualified name of the function to trace from. depth: How deep to traverse (1 = direct calls, 2 = calls of calls, etc).

depth int repo_path str qualified_name str
get_callers
annotations: none low

Get who calls a function (incoming call graph edges). Traces the call graph backwards to find all callers of a function. Use depth > 1 for transitive callers. Args: repo_path: Path to the indexed repository. qualified_name: Fully qualified name of the function to trace. depth: How deep to traverse (1 = direct callers, 2 = callers of callers, etc).

depth int repo_path str qualified_name str
diff_symbols
annotations: none low

Re-index a repository and show what symbols changed since last index. Compares the current state of files against the stored index to find: - New symbols (added since last index) - Removed symbols (deleted since last index) - Modified symbols (same name but different content hash) Useful for code review, PR analysis, and understanding what changed. Args: repo_path: Path to an already-indexed repository.

repo_path str
dependency_map
annotations: none low

Show what a file depends on and what depends on it. Maps import/call relationships at the file level. Useful for understanding how a file fits in the codebase before modifying it. Args: repo_path: Path to the indexed repository. file_path: Relative path to the file (e.g. "src/main.py").

file_path str repo_path str

Permissions 3

network medium
Server uses network capabilities via: httpx, urllib
filesystem low
Server uses filesystem capabilities via: open(), os, pathlib, shutil, tempfile
database medium
Server uses database capabilities via: sqlite3

Scan Findings 41

info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
low
Tool 'index_folder' has no annotations annotation_checker · 100%
low
Tool 'index_repo' has no annotations annotation_checker · 100%
low
Tool 'list_repos' has no annotations annotation_checker · 100%
low
Tool 'invalidate_cache' has no annotations annotation_checker · 100%
low
Tool 'file_tree' has no annotations annotation_checker · 100%
low
Tool 'file_outline' has no annotations annotation_checker · 100%
low
Tool 'repo_outline' has no annotations annotation_checker · 100%
low
Tool 'get_symbol' has no annotations annotation_checker · 100%
low
Tool 'get_symbols' has no annotations annotation_checker · 100%
low
Tool 'search_symbols' has no annotations annotation_checker · 100%
low
Tool 'search_text' has no annotations annotation_checker · 100%
low
Tool 'get_callees' has no annotations annotation_checker · 100%
low
Tool 'get_callers' has no annotations annotation_checker · 100%
low
Tool 'diff_symbols' has no annotations annotation_checker · 100%
low
Tool 'dependency_map' has no annotations annotation_checker · 100%
medium
Vulnerable dependency: sqlite-vec@0.1.0 (GHSA-vrcx-gx3g-j3h8) dependency_analyzer · 95%
medium
Vulnerable dependency: sqlite-vec@0.1.0 (PYSEC-2026-1938) dependency_analyzer · 95%
info
pyproject.toml metadata manifest_parser · 100%
info
Tool: index_folder manifest_parser · 90%
info
Tool: index_repo manifest_parser · 90%
info
Tool: list_repos manifest_parser · 90%
info
Tool: invalidate_cache manifest_parser · 90%
info
Tool: file_tree manifest_parser · 90%
info
Tool: file_outline manifest_parser · 90%
info
Tool: repo_outline manifest_parser · 90%
info
Tool: get_symbol manifest_parser · 90%
info
No dependency files found for SBOM generation sbom_generator · 100%
info
Tool: get_symbols manifest_parser · 90%
info
Tool: search_symbols manifest_parser · 90%
info
Tool: search_text manifest_parser · 90%
info
Tool: get_callees manifest_parser · 90%
info
Tool: get_callers manifest_parser · 90%
info
Tool: diff_symbols manifest_parser · 90%
info
Tool: dependency_map manifest_parser · 90%
info
Transport: streamable-http manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 90%
low
Permission: filesystem access detected permission_analyzer · 90%
medium
Permission: database access detected permission_analyzer · 90%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%