code-graph

Tests and entry points a change reaches. files are whole repo-relative paths; base is a git revision and only the touched lines count (innermost symbol). A rename or deletion still resolves from the index, and a changed test is listed itself. quiet prints one test file path per line. max_depth keeps transitive tests near the target (0: any); unit_only leaves out UI / snapshot tests.

Frontend HTTP calls (method + path template) with call sites, request keys and the matched backend route + controller (combined graph). filter: all | unmatched | any substring (endpoint, route, caller, file) | a `*` glob (`GET /v1/*/orders*`, `*/staff/*`, `*useOrders*`) on the endpoint, its path, route, controller, caller or call-site file. `route:VERB /path` is an exact route match (verb case-insensitive; `:id`, `{id}` and `{order}` match one param segment). `route:POST /payments/*` or `route:* /payments` widens it. An unknown route returns `no such route` and the nearest routes. A call site with no entry point is marked `(no live caller)` and `filter='dead'` lists matched endpoints with no live call site.

Security views over recorded facts (#47): findings plus the inbound / outbound attack surface, with file:line evidence, confidence and the entry points reaching each finding. Findings: hardcoded (literal credential in a DSN, SDK constructor or config; the value is never shown), plaintext (external system without TLS, non-loopback host), unverified (webhook route that never verifies its signature), unguarded (inbound route / handler with no auth guard, the `routes` rule; strict: route guards only), exposed-listener (TCP / UDP bound to all interfaces), tls-off (certificate or SSH host key verification switched off), ipc-exposed (postMessage to '*', world-writable Unix socket, wildcard externally_connectable, Electron nodeIntegration / contextIsolation off; plaintext also covers insecure gRPC channels), ssrf (host or whole URL of an outbound HTTP call built from request input; a DNS lookup of request input is reported at medium severity; path- or query-only input and allow-listed hosts are recorded, not reported). inbound=true lists routes, webhooks, sockets, consumers and IPC handlers with guard state and whether they reach a write; outbound=true lists every external system with address source, credential source and TLS. protocol narrows both; finding: hardcoded | plaintext | unverified | unguarded | exposed-listener | tls-off | ipc-exposed | ssrf; min_confidence: heuristic | resolved | exact. Findings accepted in .cg.yaml surface.ignore are counted (show_ignored lists them). The structured reply carries the full result under `surface` (the `cg surface --format json` shape); SARIF is `cg surface --format sarif`. Details: `external_systems`, `protocol_links`, `routes`.

Web / native bridge calls: Capacitor plugins (registerPlugin / Plugins.X -> @CapacitorPlugin @PluginMethod, CAPPlugin), React Native and Expo native modules (NativeModules / TurboModuleRegistry / requireNativeModule -> @ReactMethod, Native*Spec overrides, RCT_EXPORT_METHOD / RCT_EXTERN_METHOD, Expo Function / AsyncFunction) and Flutter platform channels (MethodChannel.invokeMethod / EventChannel -> setMethodCallHandler / setStreamHandler). One endpoint per module method (endpoint:<protocol>:<module>#<method>) with its JS / Dart senders and the native receivers per platform; flags methods missing on a target (missing_on), sent methods of a module implemented here that no native code receives (no_receiver), native methods nothing sends (no_sender) and modules implemented outside the repo (external). Desktop process boundaries too: Electron IPC channels (endpoint:electron-ipc:<channel>, ipcRenderer.invoke / send / webContents.send -> ipcMain.handle / on, ipcRenderer.on), the context bridge (endpoint:electron-preload:<key>#<member>) and Tauri commands (endpoint:tauri:<command>, invoke -> #[tauri::command]); their receivers carry the process role (main / preload / renderer / webview / core). Native -> JS events (react-native-event, capacitor-event) and Cordova actions (cordova) too; calls with a dynamic name are listed as unresolved. pattern: endpoint name, substring or glob; protocol: capacitor | capacitor-event | cordova | react-native | react-native-event | flutter | flutter-event | pigeon | electron-ipc | electron-preload | tauri; unmatched: only endpoints with a check.

Use to see who calls X right now. Direct callers of a function / method / class (one level: CALLS, INSTANTIATES, dispatch and framework edges into it), each with the call site file:line and confidence. For the full chain up to entry points use impact().

Broadcast channels (Laravel Broadcast::channel, events' broadcastOn, Echo / pusher-js subscriptions on a combined graph). Without a pattern: one line per channel with its auth callback / checks, publishers and subscribers. With a pattern (`orders.{id}`, a concrete name like `orders.42`, or a glob `orders.*`): WHO CAN JOIN (broadcasting auth route + middleware, the callback with its source and every check it calls), PUBLISHED BY (events, the evaluated channel name, dispatch sites and the entry points that reach them) and LISTENED TO BY (client code, pages, events listened for). Flags private channels without a callback and subscriptions that match no backend channel.

Use when cg finds nothing or you need to know if a file is indexed. Which languages and files this index covers. Per language: parser mode (exact, heuristic only when an exact-mode indexer such as rust-analyzer or scip-clang is missing, skipped when the toolchain is missing, with the install hint) and file completeness (discovered vs indexed, with parse failures, files over the size limit, unmapped files outside the source roots, excluded files); unsupported source types by extension or shebang (.go .qml .sh ...); blind spots: route / handler registrations cg does not model, with file:line. path (optional): a file or directory; says whether cg has it in the graph. all_files: list every file per bucket (default: the first 5). json_output: the completeness object as JSON. Not covered, heuristic or a blind spot means: use your normal search and file reading for that part.

What this cg installation can index: versions of cg and the tools it uses, whether the Node / PHP / Dart extractor dependencies are installed, and per language whether indexing runs in exact or heuristic mode, why, and the command that installs what is missing. `root`: a project directory; also checks project conditions (a compile_commands.json, `.cg.yaml` rust.targets) and lists only its languages. `scip`: SCIP index files to check (documents, occurrences with a usable position, definitions; a warning when cg could not use them).

Use to see what X ends up calling or reading (page -> routes -> tables). Forward dependencies of a node. On a combined graph a frontend page goes page -> composables/components -> HTTP endpoints -> backend routes -> controllers/services -> tables. Lists backend routes, tables touched (directly or via columns), columns, connections, config/env keys, each with one shortest evidence path. target: page:/reports/:id | app/pages/x.vue | Class::method | ... platform: only code built for that target (windows, linux, macos, ios, android, web): code under a platform condition that is false there (#[cfg], #if, Platform.OS / Platform.isX, kIsWeb, .ios.ts / .android.ts files, Dart conditional imports) is left out; the reply's first line names the filter and how many conditions could not be evaluated (those stay in).

Start here for a broad question ("how does X work") or a spec you have not pinned down. Resolves a few symbols and returns their source, entry points, call paths and blast radius in one call, inside budget_tokens. Prefer this over impact, downstream, path and snippet until you know which symbol matters. The reply ends with the fine-grained calls to run next. max_symbols caps how many matches are expanded (default 4).

External systems the code connects to (#40): databases, caches, brokers, mail relays, directories, file-transfer hosts, object stores (external:<protocol>:<target>, target host:port when known from a DSN, .env.example or a docker-compose service, else env:<KEY>) and third-party HTTP hosts; per system the code and logical connections using it (CONNECTS_TO), the entry points reaching them, the address source and the credential source (location only, never the value), TLS when known. protocol: postgres | mysql | redis | smtp | amqp | mongodb | ldap | ssh | ftp | s3 | https ...; source: literal | env | env-example | compose | config; tls_off: only plaintext systems.

Use when unsure which graph a question belongs to. Lists the graphs this server can query: name, repo roots, languages, indexed commit and freshness. One `cg-mcp` process serves every registered graph. Pass `graph` to other tools to choose one, or omit it and the server resolves from a path in the call, then MCP roots or the working directory, then the configured default. An ambiguous choice returns the list instead of guessing.

Use before editing a function: what a change to it affects. Reverse callers of a method (Class::method, short or FQN) up to entry points, with the shortest call path from each entry point. platform: only code built for that target (windows, linux, macos, ios, android, web): code under a platform condition that is false there (#[cfg], #if, Platform.OS / Platform.isX, kIsWeb, .ios.ts / .android.ts files, Dart conditional imports) is left out; the reply's first line names the filter and how many conditions could not be evaluated (those stay in).

Use after editing so later answers see the change. Re-index (static analysis only: never boots the app or touches a database). On a combined graph (any number of repos): with no arguments every repo is re-indexed from its recorded root and the cross-repo link is rebuilt; repo (a name used at link time) re-indexes just that repo; root is matched to the recorded repo roots (a repo directory, a path inside one, or a parent of several). A root that matches no repo, or a result with 0 nodes, is refused and the graph is left unchanged. On a single-repo graph root defaults to the indexed root; gates is a gate-scenario JSON path (defaults to the server's --gates). The project config file (.cg.yaml at the root) is read on every re-index; Python source roots given with `cg index --python-root` and `--include-generated` are kept. Generated, copied and vendored files stay out of the graph (the coverage tool lists them) unless the graph was indexed with --include-generated or .cg.yaml sets generated.include.

Heuristic (#88 phase 3); `rules` is a comma-separated subset (default all). stale-async-result: a write of stored / UI state inside Task / launch / useEffect / async function / async def code after an await, using the awaited result of an input-dependent request, with no cancellation check and no comparison against a token / ID / generation captured before the await. two-writers: state written with real (computed) values by lifecycle code (init, onAppear, useEffect, LaunchedEffect) and by async code after an await or a completion callback. incomplete-cache-key: a cache / memo store whose key leaves out a parameter or instance field the cached value uses. echo-suppression: state that is written with a guard flag set (`isApplyingRemote`, `lastSent…`) so its observer returns early, but is also written from async code without the guard. file:line evidence; not proof.

LLM tools and MCP primitives (#66): tools offered to a model (OpenAI / Anthropic schema literals, LangChain @tool / StructuredTool / BaseTool, Agents SDK @function_tool, LlamaIndex FunctionTool, dict registries and if / match branches of agent loops) and MCP server tools / resources / prompts (FastMCP / MCPServer, low-level call_tool) with their handler, the tables the handler reaches, the agents offering them and the code calling them (MCP client call_tool / read_resource / get_prompt). Checks: no_receiver, no_sender, name_collision; plus agents (model, tools, handoffs), dynamic_dispatch (an agent loop picking the tool by a runtime name, not linked) and model calls. framework: mcp | openai | anthropic | langchain | openai-agents | llamaindex | custom.

Use to inspect a symbol without reading its file. Details of one node: kind, FQN, file:line span, module, entry kinds, docblock (PHPDoc), and edge counts by kind (in/out) with a few neighbours. Specs: Class::method | file#name | table.column | table:<t> | route:<METHOD> <uri> | env:<KEY> | page:/path (more: resource cg://guide).

Use to answer "how does A reach B". Shortest forward evidence chain from source to target (e.g. page:/reports/:id -> SalesReportService::report), one hop per line with file:line and confidence. platform: only code built for that target (windows, linux, macos, ios, android, web): code under a platform condition that is false there (#[cfg], #if, Platform.OS / Platform.isX, kIsWeb, .ios.ts / .android.ts files, Dart conditional imports) is left out; the reply's first line names the filter and how many conditions could not be evaluated (those stay in).

Fingerprint (sha1 of source lines) every modified target of a plan before implementing it, so plan_check(verify=true) can report changed/UNCHANGED. Writes plans/<name>.baseline.json (only file it writes).

Deterministic check of a plan against the real graph. Default reply: a compact summary (counts per section and per check, the top `max_items` missing items, failed requirements, middleware gaps, forbidden paths, open findings, verify counts); details=true gives the full report (every item with file:line evidence and call chains, up to max_items per list). plan mode: 1 RESOLVE (references, route middleware requirements, middleware differences between entry routes of the same modified code), 2 MISSING FROM PLAN (writers/readers of changed tables, Filament/API resources, $fillable, form requests, entry points + callers of modified methods, frontend pages and external client snapshots calling affected routes, parallel/legacy mirrors, precedents), 3 CONFLICTS (forbidden paths still in the code with their call chain, open findings touching the same nodes, linked or not), plus entry call chains. verify=true (after implementation + re-index): also 4 VERIFY: planned nodes/edges exist now (with evidence), modified targets changed vs baseline, forbidden paths gone or guarded, requirements met.

List planned-change files (plans/*.yaml): name, status, title, counts, schema errors.

Show one plan (name or path): planned nodes (+), modified targets with intent (~), planned edges, forbidden paths (x), requirements (!), covers/out_of_scope, precedents, linked issues, schema errors.

Schema check + does every referenced existing node resolve in the graph (unresolved / ambiguous specs with candidates); planned nodes that already exist are flagged.

Where per-platform implementations diverge: VARIANTS (a symbol implemented per platform, by platform files, conditional imports or #[cfg] / #if alternatives, with the declared targets no variant covers), API SURFACE (a variant lacks a public symbol its siblings define) and REFERENCED WHERE THE CALLEE IS NOT BUILT (a call or import that is live on a target where the callee does not exist: a build or runtime failure there). Each finding has file:line evidence. target: only findings that affect this target. kind: variants | api_surface | missing_callee.

Platform-specific code in this graph: the targets (declared in .cg.yaml platforms.targets, or detected from Flutter platform folders, Expo app.json, React Native, Electron / Tauri, or the conditions themselves), how many conditions (#[cfg], cfg!, #if, Platform.OS / Platform.select, Platform.isX / kIsWeb, .ios.ts / .android.ts / .native.ts files, Dart conditional imports) were found and evaluated, and files / symbols per target. Pass `platform` to reaches / impact / downstream / path / routes / search to see one target's build.

Every protocol endpoint in one view (#31 model): HTTP client endpoints and routes (http / ws / graphql), Pusher broadcast channels and subscriptions, NestJS microservice messages (nest-rpc / nest-event / nest-ws / grpc), job queues (bull, laravel-queue, celery), application events (laravel-event, nest-event-emitter, django-signal), web / native bridges and desktop IPC (capacitor, react-native, flutter, electron-ipc, tauri ...) and the generic endpoint:<protocol>:<name> nodes (code -SENDS_TO-> endpoint -RECEIVED_BY-> handler, MATCHES_ENDPOINT for wildcard / template matches; MQTT, NATS, AMQP, Kafka, Redis pub/sub, Socket.IO, raw TCP / UDP sockets by port). listeners: every listening TCP / UDP socket with bind address, exposure and handler. Without arguments: one line per protocol (endpoints, send / receive sides, linked, check counts). With a pattern (name, id, substring or glob) / protocol / side (send | receive) / unmatched: one block per endpoint with senders (and, for a few endpoints, the entry points reaching them), receivers, guards, matches and checks: no_receiver, no_sender, test_sender_only, ambiguous, schema_mismatch, unguarded, external (.cg.yaml protocols.external, third-party origins, bridge packages). impact / reaches / path / downstream follow SENDS_TO / RECEIVED_BY / MATCHES_ENDPOINT as usual.

Use before changing a column, table, connection, env key or symbol: everything that depends on it. Reverse transitive dependents of one or more targets (union), e.g. ["orders.customer_id", "connection:warehouse", "connection:tenant_*"]. Groups: RUNTIME (live; reached from http routes/schedules/jobs/listeners, or main()/exported FFI symbols in Rust/C/C++), LIBRARY (only via a library's public API), DEV (only tests/benches/examples/build scripts), OPERATOR (artisan commands / admin panels only: one-off import & provisioning), GATED (dead under the indexed gate scenario, e.g. code that only runs while a feature flag is off), NO-ENTRY. Inside each group items are grouped by `group_by` = module | entry_kind | class. Each line: symbol, entry kinds, depth, shortest evidence path (hops KIND@file:line; ~r = resolved, ~h = heuristic confidence). At most `max_per_group` lines per top-level group (shallowest first). min_confidence: heuristic | resolved | exact. A hop on a database connection other than the default shows `conn=<name>` (dynamic names as a pattern, `?` when it cannot be resolved). connection: only the table / column edges that go to that connection (a dynamic name by its pattern, e.g. `legacy_{store.id}`); no match lists the connections seen. platform: only code built for that target (windows, linux, macos, ios, android, web): code under a platform condition that is false there (#[cfg], #if, Platform.OS / Platform.isX, kIsWeb, .ios.ts / .android.ts files, Dart conditional imports) is left out; the reply's first line names the filter and how many conditions could not be evaluated (those stay in).

Who reads a DB table, a column or a stored property. `prop` is `table`, `table:X`, `table.column` / `column:table.column` (READS_TABLE / READS_COLUMN edges, grouped by column; heuristic string-literal MENTIONS_COLUMN matches come last and are labelled) or `Type.prop` / `Class::$prop` (READS_PROP edges: Swift, Kotlin, Python, TypeScript, PHP). Each site with the entry-point kinds that reach it; test code's property reads come last. An unknown spec lists what was tried, the table's columns and close matches. A site on a database connection other than the default shows `conn=<name>`; `connection` keeps only the sites on that connection (no match lists the connections seen).

Every place a concept (e.g. 'timezone', 'locale') is resolved, deterministically: assignment/return sites whose value is a `??`/`?:` chain or an ordered sequence of early returns, expanded into a fallback chain of request input keys (FormRequest rules / $request->input / $filters['x'] through helper calls), settings (getSetting(key, default)), model columns, config/env and literal defaults. Sites are grouped into lettered chains by signature; the divergence section shows pairwise where chains first differ; each chain lists the routes that reach it. On a combined graph, also the frontend side: whether each matched client call sends the key (builder keys + call-site argument keys) and client literal fallbacks (`x ?? 'UTC'`). `within` filters owning functions by substring (e.g. 'Report'); `detail=True` lists every client call site and the keys it passes (default: one line per client request with its verdict).

Heuristic (#88): does a stored property `Type.prop` round-trip through a lossy transform? Each write site with the lossy call it passes through (clamp, min/max, round, truncating casts, `fit*`, `.cg.yaml` `lossy:` names, `@cg-lossy` functions; within the function plus one hop through direct callers), each read site that seeds UI state (init, onAppear, remember, useState(initial), mounted), and un-narrowed ranges drawn next to such a read. Findings are heuristic evidence with file:line, not proof.

Use for route, auth and middleware questions. Routes with their middleware / guards / auth, in one call. Optional scope: writes="*" (routes that reach any DB write) or writes="<table>", reaches=[specs] (routes that reach any of these nodes: table, column, connection, method, env key...). Optional filters: missing="<name>" keeps routes with no guard whose name contains it (e.g. "auth:api", "ApiKeyGuard"), unguarded=true keeps routes with no auth guard (the framework presets' auth guards and the auth name pattern; extend with auth_pattern, a regex, or .cg.yaml auth.extra_patterns). An unconditional inline check on a Laravel action (authorize, Gate, a permission check, FormRequest::authorize, controller middleware, a shared-secret compare) is listed under guards as `inline:` and counts for unguarded. strict=true with unguarded counts only route-level guards. Each route: guards, what it reaches with one evidence chain, and the frontend callers on a combined graph. Guards come from Laravel middleware, Nest guards/interceptors, Express/Koa/Fastify/Hono/Elysia middleware, Next.js middleware.ts / handler wrappers, django-ninja auth= and Django/DRF view access checks. min_confidence: keep the default (heuristic) for reviews: every edge still shows its own label, and a stricter level names the routes it hides. platform: only code built for that target (windows, linux, macos, ios, android, web): code under a platform condition that is false there (#[cfg], #if, Platform.OS / Platform.isX, kIsWeb, .ios.ts / .android.ts files, Dart conditional imports) is left out; the reply's first line names the filter and how many conditions could not be evaluated (those stay in).

Use first to find a symbol instead of grep. Finds nodes by name / FQN substring (case-insensitive), optionally filtered by kind (class, method, route, command, table, column, connection, config, env, job, admin...). Also matches route middleware, guards, auth and access checks (e.g. "auth" finds `auth:api`, `ApiKeyGuard`, `IsAuthenticated`) and lists the routes that carry them. Platform-specific symbols carry their targets, e.g. `[ios, android]`. platform: only code built for that target (windows, linux, macos, ios, android, web): code under a platform condition that is false there (#[cfg], #if, Platform.OS / Platform.isX, kIsWeb, .ios.ts / .android.ts files, Dart conditional imports) is left out; the reply's first line names the filter and how many conditions could not be evaluated (those stay in).

Code parallel to a symbol that often needs the same change: classes sharing its parent/interface/trait, the same method in sibling classes, other code touching the same tables/columns/config/connections, and co-callers (methods calling the same helpers; Jaccard on callees).

Use instead of opening a whole file. Source of one symbol: a `path:start-end` header then the body with line numbers. Resolves a node id or a symbol / FQN (as node() and search() do); an ambiguous name lists the candidates instead of guessing. context adds lines around the span; max_lines caps the body (truncation noted).

Starter queries derived from this graph, each with the tool call to run: the write route without an auth guard that writes the most tables, the most-written / most-read table, the most-used DB connection and env key, the page with the largest backend reach, the most-called functions. A good first call on an unfamiliar repository.

Index metadata and node/edge counts by kind.

Tests that exercise a symbol, route or table. DIRECT: the test code itself calls / instantiates it or sends an HTTP request to the route ($this->getJson('/x'), Playwright request.get). TRANSITIVE: through application code (test -> route -> controller -> service -> target). target: Class::method | Class | route:VERB /uri | `VERB /path` or /path (matched against route URIs) | table.column | any node id. Tests are PHPUnit / Pest (tests/), Vitest / Jest / Playwright / Cypress spec files; they never count as callers in the other queries. A base / interface method also lists the tests of its overrides, marked `via override X`; `Sub.method` for an inherited method resolves to the definition it inherits (noted). Transitive tests are kept near the target: at most max_depth hops (0: any depth), not through an app entry point (`@main` types and their members such as `App.body`, Android `*Activity` classes, exclude_roots symbols; through_roots=true keeps them). UI / snapshot / screenshot tests (XCUITest, Compose UI / Espresso, Playwright / Cypress, *UITests / androidTest folders) are listed apart, or left out with unit_only=true. The summary line counts what was left out and why.

Who writes a DB table, a column or a stored property. `table` is `table`, `table:X`, `table.column` / `column:table.column` (WRITES_TABLE / WRITES_COLUMN edges; for a column, the writers of that column, then a separate "table-level writes (columns not recorded)" group) or `Type.prop` / `Class::$prop` (WRITES_PROP edges: Swift, Kotlin, Python, TypeScript, PHP). Grouped by module, with the columns written, evidence lines and the entry-point kinds that reach each writer. A writer on a database connection other than the default shows `conn=<name>`; `connection` keeps only the writers on that connection (no match lists the connections seen).