codebase-memory-mcp

The server holds no credentials and talks to no outside service; it runs as the local user and reads and writes files with that user's rights. Its main narrowing is a workspace policy that refuses to index the home directory, shallow system paths and known credential folders such as .ssh and .aws, plus an optional allowed-root setting and per-user grants managed from the command line. With nothing configured, any other directory the user can read can be indexed and its source returned, so the narrowing is a short deny list rather than a least-privilege allowlist.

As a tool server it relies on the MCP host to ask the user before calls, and it gives the host accurate information to decide with: every one of its 17 tools carries hard-coded read-only and destructive labels, and only index_repository, manage_adr and delete_project are marked as writing. A server-enforced read-only tool profile exists, but it is only used when the client launches the server with that flag; the default entry exposes all tools. There is no dry-run or preview for the destructive tools, and deleting an index or replacing an ADR has no undo, though both affect only local data.

Tools are narrow, purpose-built graph operations rather than general shells or HTTP clients. File reads are checked against the indexed root after resolving symlinks, project names are validated, result sizes and traversal depths are clamped, and the Cypher interface accepts only a read subset. Weaker spots: arguments that reach helper commands are checked with a character deny list, the index root is not restricted beyond the sensitive-root deny list by default, and the default tool set includes the three write tools.

The server has no tool that runs model-written code, but several tools (search_code, detect_changes and the git-history passes) build command lines for git, grep and find as shell strings that include model-supplied values such as search scopes, file patterns and branch names. The only guard is a character filter that rejects quotes, semicolons, pipes and similar metacharacters; there is no sandbox, and the helpers run on the host as the user with the full environment apart from git's repository variables. No second layer sits behind that filter: the helpers have the same reach as the user.

Everything the server returns comes from repository content the user did not write, such as source code, comments and docstrings. Results are structured: code comes back with its file path and line numbers, and the server's own guidance sits in separate hint fields rather than mixed into the content. Nothing marks repository text as untrusted for the host. The installed hooks also push repository-derived symbol names into some agents' context outside any tool call. The server itself has no outbound channel, but its write tools and the host's own tools remain available to a hijacked model.

The server keeps a persistent graph per project and an architecture decision record (ADR) that the model can overwrite at will through manage_adr; that text is stored in the project database and returned in later sessions with no review or history. When a repository contains a committed graph snapshot (.codebase-memory/graph.db.zst) and there is no local index yet, it is imported automatically; the source notes that imported content is trusted as-is. The only repository file that can widen what the server indexes, a manifest of extra roots, needs an explicit approval from the command line that lapses when the file changes. The per-project config file can only map file extensions.

The server loads no third-party code at runtime: its 158 language grammars, the embedding model and SQLite are compiled into the binary, SQLite extension loading is compiled out, and it installs no packages or plugins. Updates are done by the install script or a package manager, never by the running server.

The server holds no API keys or tokens, sends nothing to any third party and has no telemetry. Its configuration scanners drop values that look like secrets before storing them in the graph, private key files are skipped during discovery, and the request log records only tool names and timings, never arguments or results. Source returned to the model is not redacted, though: search_code and get_code_snippet return whatever the files contain, and helper processes inherit the full environment.

Every tool call handled by the shared daemon is logged with the tool name, error status and duration to an owner-only log file in the user's cache folder, outside the indexed repository. The log does not record arguments, the project acted on or which client asked, so it cannot show what a call actually did. The file is capped at 5 MB with one rotated copy, and logging failures do not stop actions.

The server bounds most of its own work: Cypher queries and code searches stop after 30 seconds, traversal limits and snippet sizes are clamped to hard ceilings, and in-flight indexing and searches can be cancelled when the client goes away. Indexing size limits are off by default, the stdio bridge waits up to 24 hours for a request, and asynchronous index jobs and the background watcher keep running until the shared daemon stops.