/ 100

1 month ago

glama

code-graph-rag-mcp

A powerful Model Context Protocol server that creates intelligent graph representations of your codebase with comprehensive semantic analysis capabilities, supporting 11 languages and 26 MCP methods.

→ er77/code-graph-rag-mcp · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

⚠️

Known vulnerabilities in dependencies: 2 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 3 credentials: CLOUDRU_API_KEY, MCP_EMBEDDING_API_KEY, OPENAI_API_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// known CVEs in dependencies2 high2 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.5.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.5.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

lownanoid@5.0.0GHSA-mwcw-c2x4-8c55

Predictable results in nanoid generation when given non-integer values

lowyaml@2.8.1GHSA-48c2-rrv3-qjmp

yaml is vulnerable to Stack Overflow via deeply nested YAML collections

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

🔐 secretCLOUDRU_API_KEY

configCLOUDRU_BASE_URL

configCLOUDRU_CONCURRENCY

configCLOUDRU_MAX_BATCH_SIZE

configCLOUDRU_TIMEOUT_MS

configCONDUCTOR_COMPLEXITY_THRESHOLD

configCONDUCTOR_LOAD_BALANCING_STRATEGY

configCONDUCTOR_MANDATORY_DELEGATION

configCONDUCTOR_MAX_CONCURRENCY

configCONDUCTOR_MAX_CONCURRENT_AGENTS

configCONDUCTOR_MAX_CPU_PERCENT

configCONDUCTOR_MAX_MEMORY_MB— Increase the coordinator/conductor limits (these gate task routing in-process): set COORDINATOR_MEMORY_LIMIT / CONDUCTOR_MEMORY_LIMIT and COORDINATOR_MAX_MEMORY_MB / , or edit config/default.yaml.

configCONDUCTOR_MAX_TASK_QUEUE_SIZE

configCONDUCTOR_MEMORY_LIMIT— Increase the coordinator/conductor limits (these gate task routing in-process): set COORDINATOR_MEMORY_LIMIT / and COORDINATOR_MAX_MEMORY_MB / CONDUCTOR_MAX_MEMORY_MB, or edit config/default.yaml.

configCONDUCTOR_PRIORITY

configCONDUCTOR_TASK_QUEUE_LIMIT

configCOORDINATOR_LOAD_BALANCING_STRATEGY

configCOORDINATOR_MAX_CONCURRENCY

configCOORDINATOR_MAX_CONCURRENT_AGENTS

configCOORDINATOR_MAX_CPU_PERCENT

configCOORDINATOR_MAX_MEMORY_MB— Increase the coordinator/conductor limits (these gate task routing in-process): set COORDINATOR_MEMORY_LIMIT / CONDUCTOR_MEMORY_LIMIT and / CONDUCTOR_MAX_MEMORY_MB, or edit config/default.yaml.

configCOORDINATOR_MAX_TASK_QUEUE_SIZE

configCOORDINATOR_MEMORY_LIMIT— Increase the coordinator/conductor limits (these gate task routing in-process): set / CONDUCTOR_MEMORY_LIMIT and COORDINATOR_MAX_MEMORY_MB / CONDUCTOR_MAX_MEMORY_MB, or edit config/default.yaml.

configCOORDINATOR_PRIORITY

configCOORDINATOR_TASK_QUEUE_LIMIT

configDATABASE_CACHE_SIZE

configDATABASE_MMAP_SIZE

configDATABASE_MODE

configDATABASE_PATH

configDATABASE_SYNCHRONOUS

configDATABASE_TEMP_STORE

configDEV_AGENT_MAX_CONCURRENCY

configDEV_AGENT_MEMORY_LIMIT

configDEV_AGENT_PRIORITY

configDIST_JS

configDORA_AGENT_MAX_CONCURRENCY

configDORA_AGENT_MEMORY_LIMIT

configDORA_AGENT_PRIORITY

configDRAIN_AFTER_ALL_MS

configEMBEDDING_DEBUG

configINDEXER_AGENT_BATCH_SIZE

configINDEXER_AGENT_CACHE_SIZE

configINDEXER_AGENT_CACHE_TTL

configINDEXER_AGENT_MAX_CONCURRENCY

configINDEXER_AGENT_MEMORY_LIMIT

configINDEXER_AGENT_PRIORITY

configJEST_DETECT_OPEN_HANDLES

configJEST_FORCE_EXIT

configJEST_PER_FILE_CONCURRENCY

configJEST_WORKER_ID

configKOTLIN_ANALYZER_VERBOSE

configLOG_DIR

configLOG_ENABLE_CONSOLE

configLOG_FILE

configLOG_FORMAT

configLOG_LEVEL

configLOG_MAX_FILES

configLOG_MAX_FILE_SIZE

configMCP_AGENT_TIMEOUT

configMCP_DEBUG_DISABLE_SEMANTIC— The command logs progress to logs_llm/mcp-server-YYYY-MM-DD.log. Set =0 if you want embeddings enabled during the run.

configMCP_DEBUG_MODE

configMCP_DEV_INDEX_BATCH

🔐 secretMCP_EMBEDDING_API_KEY

configMCP_EMBEDDING_ENABLED

configMCP_EMBEDDING_FALLBACK

configMCP_EMBEDDING_MODEL— e =gemini-embedding-001 \

configMCP_EMBEDDING_PROVIDER— e =openai \

configMCP_MAX_CONCURRENT_AGENTS

configMCP_SEMANTIC_WARMUP_LIMIT— export =25

configMCP_SEMANTIC_WARMUP_TOPIC

configMCP_SERVER_HOST

configMCP_SERVER_PORT

configMCP_SERVER_TIMEOUT

configMCP_STDIO_ALLOW_STDOUT_LOGS— If you must see logs on stdout for local debugging, set =1 (not recommended for strict clients).

configMCP_USE_PARSER

configMEMORY_EMBED_DIM

configOLLAMA_AUTO_PULL

configOLLAMA_BASE_URL

configOLLAMA_CHECK_SERVER

configOLLAMA_CONCURRENCY

configOLLAMA_PULL_TIMEOUT_MS

configOLLAMA_TIMEOUT_MS

configOLLAMA_WARMUP_TEXT

🔐 secretOPENAI_API_KEY— e =YOUR_KEY \

configOPENAI_BASE_URL— e =https://generativelanguage.googleapis.com/v1beta/openai \

configOPENAI_CONCURRENCY

configOPENAI_MAX_BATCH_SIZE

configOPENAI_TIMEOUT_MS

configPARSER_AGENT_BATCH_SIZE

configPARSER_AGENT_CACHE_SIZE

configPARSER_AGENT_MAX_CONCURRENCY

configPARSER_AGENT_MEMORY_LIMIT

configPARSER_AGENT_PRIORITY

configPARSER_AGENT_WORKER_POOL_SIZE

configPARSER_BUFFER_SIZE

configPARSER_CACHE_SIZE

configPARSER_CACHE_TTL

configPARSER_DISABLE_CACHE

configPARSER_INCREMENTAL_ENABLED

configPARSER_LANGUAGES

configPARSER_MAX_FILE_SIZE

configPARSER_TIMEOUT

configPARSER_TREE_SITTER_ENABLED

configPROJECT_DIR

configQUERY_AGENT_CACHE_WARMUP

configQUERY_AGENT_COMPLEX_TIMEOUT

configQUERY_AGENT_MAX_CONCURRENCY

configQUERY_AGENT_MEMORY_LIMIT

configQUERY_AGENT_PRIORITY

configQUERY_AGENT_SIMPLE_TIMEOUT

configSEMANTIC_AGENT_BATCH_SIZE

configSEMANTIC_AGENT_DEBUG

configSEMANTIC_AGENT_MAX_CONCURRENCY

configSEMANTIC_AGENT_MEMORY_LIMIT

configSEMANTIC_AGENT_MODEL_PATH

configSEMANTIC_AGENT_PRIORITY

configSEND_AFTER_INDEX_MS

configTARGET_DIR

configTOTAL_TIMEOUT

configTRANSFORMERS_LOCAL_PATH

configTRANSFORMERS_QUANTIZED

configVECTOR_STORE_DEBUG

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/er77-code-graph-rag-mcp-1iabtu)](https://m8ven.ai/mcp/er77-code-graph-rag-mcp-1iabtu)

commit: a36174ae68b9a6d1364b20f36687a5adc35ed192

code hash: 432b40e372e8899581ab5d78b7acba9be1ec168fe4726ee63aa9ad2fba7708b3

verified: 6/9/2026, 10:44:36 AM

view raw JSON →