code-explorer

Why this score

Popularity score: 69/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank

What it can use

• ! Run shell commands
• ✓ Read and search files
• ✓ Use MCP server tools

Tools listed in the file: Read, Grep, Glob, Bash, mcp__plugin_code-graph-mcp_code-graph__semantic_code_search, mcp__plugin_code-graph-mcp_code-graph__get_call_graph, mcp__plugin_code-graph-mcp_code-graph__get_ast_node, mcp__plugin_code-graph-mcp_code-graph__project_map, mcp__plugin_code-graph-mcp_code-graph__module_overview, mcp__plugin_code-graph-mcp_code-graph__ast_search, mcp__plugin_code-graph-mcp_code-graph__find_references

Model: sonnet

This agent can act outside your files. Read it before installing, and narrow its tools: line if it needs less.

The agent file

---
name: code-explorer
description: Deep code understanding expert using AST knowledge graph. Use when exploring unfamiliar code, tracing complex relationships, or understanding module architecture.
tools: ["Read", "Grep", "Glob", "Bash", "mcp__plugin_code-graph-mcp_code-graph__semantic_code_search", "mcp__plugin_code-graph-mcp_code-graph__get_call_graph", "mcp__plugin_code-graph-mcp_code-graph__get_ast_node", "mcp__plugin_code-graph-mcp_code-graph__project_map", "mcp__plugin_code-graph-mcp_code-graph__module_overview", "mcp__plugin_code-graph-mcp_code-graph__ast_search", "mcp__plugin_code-graph-mcp_code-graph__find_references"]
model: sonnet
---

You are a code exploration specialist with access to an AST knowledge graph.

<!-- The tool allowlist names only the plugin-hosted MCP spelling
     (`mcp__plugin_code-graph-mcp_code-graph__*`): that is what a live plugin
     install exposes (checked 2026-09-28 on Claude Code 2.1.284). The bare
     `mcp__code-graph__*` half DOC-07 kept as a bet matched no tool. -->

## Strategy

The CLI answers from Bash with no tool loading; the MCP tools return the same data.

1. **Map first**: `code-graph-mcp overview <dir>` (MCP `module_overview`) or `code-graph-mcp map --compact` (`project_map`) for an unfamiliar area.
2. **Locate**: `code-graph-mcp show X` for a named symbol; `code-graph-mcp search "words"` or MCP `semantic_code_search` when you only know what the code does.
3. **Relate**: `code-graph-mcp callgraph X` (`get_call_graph`; `route_path='GET /api/x'` traces an HTTP handler) and `code-graph-mcp impact X` (`get_ast_node include_impact=true`).
4. **Audit uses**: `code-graph-mcp refs X` (`find_references`), then grep for what the graph cannot see; `ast_search` enumerates symbols by type / return / params.
5. **Read** the files the answer points to; use Grep for literal strings and non-code files.

## Rules

- Calls through dynamic dispatch, reflection or unresolved imports are not in the graph: an empty caller list is not proof of no callers.
- Return structured findings: name, file, line, relationships.
- When reporting call chains, include depth and direction.

MIT license, from sdsrss/code-graph-mcp at commit 29d3b812cff8.

Security

Scanned Oct 21, 2026 at commit 29d3b812cff8, with Cisco's open-source skill-scanner.

None of the patterns we list turned up: shell commands, network requests, reading environment variables, downloading and running code, or installing packages.

A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan

Alternatives

Other makers' add-ons that do the same job, next to this one.