Back to MCP Trust Indexm8ven
45
/ 100
1 month ago
glama

CodeGraph

Enables AI agents to search code by meaning, explore codebase structure, store and query knowledge with temporal facts, and read source code through a set of MCP tools.

→ Phoenixrr2113/codebase-graph· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Known vulnerabilities in dependencies: 1 critical
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 4 credentials: CEREBRAS_API_KEY, LLM_API_KEY, OPENROUTER_API_KEY, SUPERMEMORY_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies1 critical

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@3.2.4GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretCEREBRAS_API_KEY
configCGBENCH_DEBUG_MCP
configCGBENCH_FALKORDB_HOST
configCGBENCH_FALKORDB_PORT
configCODEGRAPH_DRIVER— echo "=falkordblite" > .env
configCODEGRAPH_EMBEDDING_DIM
configCODEGRAPH_EMBEDDING_PROVIDER— voyage # voyage local openrouter
configCODEGRAPH_RERANK_PROVIDER— jina # jina voyage
configFALKORDB_GRAPH
configFALKORDB_HOST
configFALKORDB_PORT
configHINDSIGHT_URL
🔐 secretLLM_API_KEY
configLLM_ENDPOINT
configLLM_MODEL
configLLM_PROVIDER
configNEXT_PUBLIC_API_URL
configOLLAMA_BASE_URL
configOLLAMA_MODEL
🔐 secretOPENROUTER_API_KEY
configPORT
🔐 secretSUPERMEMORY_API_KEY
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/phoenixrr2113-codebase-graph-1ptkj8)](https://m8ven.ai/mcp/phoenixrr2113-codebase-graph-1ptkj8)
commit: e37e6f58e64ec9208ffe91c1c9ab9f9b72f582c6
code hash: 741f10ac8a6b0e57d7fac0ed0be57f116963ccac42db4c94a37b06df0346ab03
verified: 6/16/2026, 1:28:40 PM
view raw JSON →