# GitMCP vs Graphify (slim)

> Graphify scores 68.8 (B) to GitMCP's 40.2 (E) for code repositories. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/gitmcp-vs-graphify.md (~4,950 tokens) · this version ~3,280 tokens · JSON https://www.anchorterminal.com/compare/gitmcp-vs-graphify.json · canonical https://www.anchorterminal.com/compare/gitmcp-vs-graphify
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Graphify scores 68.8 (B) on agent readiness against GitMCP's 40.2 (E), and leads in 6 of 7 scored categories. Both do code repositories.

- GitMCP: E 40.2, rank #1308 of 1486 · https://www.anchorterminal.com/tools/gitmcp.min.md
- Graphify: B 68.8, rank #271 of 1486 · https://www.anchorterminal.com/tools/graphify.min.md
- GitMCP, good for Quick, keyless library docs for public GitHub projects in a coding agent. Also A hosted endpoint, with nothing to install.
- Graphify, good for A person or team who wants a coding agent to query a structural map of a repository, with docs and papers folded in, before grepping. Ahead on Reliability, 58 against 15; Schema & documentation, 77 against 56; Agent ergonomics, 77 against 58; Security & auth, 66 against 42; Maintenance & community, 80 against 8; Transparency & trust, 81 against 36. Also Runs on your own machine; Free to start without a card.

| Category | GitMCP | Graphify |
| --- | --- | --- |
| Reliability (16%) | 15 | 58 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 56 | 77 |
| Agent ergonomics (13%) | 58 | 77 |
| Security & auth (14%) | 42 | 66 |
| Payments & pricing (10%) | 60 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 8 | 80 |
| Transparency & trust (7%) | 36 | 81 |

| Fact (where they differ) | GitMCP | Graphify |
| --- | --- | --- |
| Vendor | Ido Salomon (GitMCP open-source project) | Graphify Labs |
| Hosted endpoint | `https://gitmcp.io/{owner}/{repo}` | no (local only) |
| Transports | Streamable HTTP | stdio, Streamable HTTP |
| Licence | Apache-2.0 | Apache-2.0 since 0.9.25 of 22 July 2026. Contributions made before then remain available under MIT, with the original text kept in LICENSE-MIT and referenced from NOTICE |
| Tools exposed | 4 | 10 |
| Read-only variant documented | yes | no |
| llms.txt | no | yes |
| Last release | 2026-05-08 | 2026-11-01 |
| Terms last updated | no document linked | couldn't be read |
| Privacy policy last updated | no document linked | couldn't be read |
| Customer content may train models | not read yet | couldn't be read |
| Terms restrict automated access | not read yet | couldn't be read |
| Terms restrict benchmarking | not read yet | couldn't be read |
| Terms or service can change without notice | not read yet | couldn't be read |
| Arbitration or class-action waiver | not read yet | couldn't be read |
| Popularity | 8.5k stars | none |

Why the edge:
- Maintenance & community, Graphify +72: GitMCP 8 (The last commit on main is 8 May 2026, 182 days before this check, and there are no tags or releases (0). Nothing in the last 90 days (0). Since May, outside issues and pull requests (#244 to #271, among them the security report #249 and fixes #256, #267 and #250) have gone without a maintainer reply or merge (3). Not found in the official MCP registry under any namespace (0). A run-tests workflow with vitest and a Playwright end-to-end workflow exist on push and pull request (5). 0 + 0 + 3 + 0 + 5 = 8.); Graphify 80 (0.9.100 was tagged and dated in CHANGELOG.md on 1 November 2026, the day of this check (30). PyPI's pages didn't resolve from the shell on 1 November, so release dates come from the tags and the changelog. 68 dated releases in the 90 days to 1 November, 0.9.33 (5 August) to 0.9.100 (20). The 0.9.97 to 0.9.100 entries credit community pull requests by name, with issue and pull request numbers up to #4933, and the default branch had commits on every day from 25 October to 1 November. Issue threads and reply times weren't read, a judgement call (18 of 25). The official MCP registry still holds only `io.github.Graphify-Labs/graphify`, Graphify Cloud's hosted server at api.graphify.com/mcp; the local `graphify-mcp` isn't listed. Published on PyPI (5 of 15). A frozen uv.lock in CI on four Python versions, dependency floors raised for named CVEs (Pillow and pypdf in 0.9.96, anyio in the `mcp` extra in 0.9.97), and trusted publishing. No Dependabot configuration, and the bandit and pip-audit jobs still carry `continue-on-error` (7 of 10). 30+20+18+5+7 = 80. The 26 October check published 81 on the same lines, which add to 80, so the score is corrected to the sum.)
- Transparency & trust, Graphify +45: GitMCP 36 (Apache-2.0, with the whole service in the public repository (30). The README says the service stores no personal data or queries and keeps no repository content permanently, but there is no privacy policy or terms page (8). No deprecation policy or dated notices; SSE was removed on 8 May 2026 while the README still shows an SSE config for VS Code (0). The hosting stack (Cloudflare Workers, Workers AI, Vectorize, an Analytics Engine dataset) is visible in wrangler.jsonc but no processor is named for users, and invocation logs were turned off on 8 May (5). 30 + 8 + 0 + 5 = 43.); Graphify 81 (The editorial half. Apache 2.0, with the MIT portion before 0.9.25 kept in LICENSE-MIT (30). The README's privacy section says what stays local, which env vars send docs to which provider, that Kimi routes to China and how to turn backends off, and the docs agree. The README still says every query is logged by default while the code and configuration docs say logging is off by default, and graphify.com's security page says the core makes no network calls of its own, which the `claude` CLI fallback for community names stretches (20 of 30). The changelog dates breaking changes and removals, SECURITY.md supports the latest 0.9.x only, and graph.json carries a schema version. No deprecation policy or notice period (8 of 20). No telemetry, stated in the README and on the security page, and none found in the source (20).)
- Reliability, Graphify +43: GitMCP 15 (Scored as a hosted MCP server. No status page found (0) and so no readable incident history (5). The maintainer confirmed on issue #245 that gitmcp.io was throttled by Cloudflare for a few hours in May 2026, outside the 90-day window. No rate limits are documented (0) and nothing on 429 or retries (0). No SLA (0). The service is live with no beta or preview label (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.); Graphify 58 (Read with the local-software lines, since the owner runs it. `graphifyy` installs from PyPI with uv or pipx, with `requires-python >=3.10` stated (20). The CI workflow runs pytest on Python 3.10, 3.12, 3.13 and 3.14, an end-to-end `graphify install`, the Pi guard tests and generated-skill checks on every push and pull request to v8, over 458 test files (workflow unchanged at 0.9.100). Whether the latest runs pass couldn't be read, because GitHub's web pages weren't reachable (15 of 25). Open issues weren't read. The changelog fixes many extraction regressions each release, each credited to a reporter and a pull request, which reads as handled rather than left open (15 of 25). CHANGELOG.md marks breaking changes, such as full-path node IDs in 0.9.0 and Java `inherits` edges in 0.8.18, and announces AST cache bumps, but on 0.x they ship in ordinary releases with no Breaking section (8 of 15). Version 0.9.100 of 1 November 2026 (0).)
- Security & auth, Graphify +24: GitMCP 42 (No credentials at all, so nothing to leak or scope (20). Every tool is a read of public content (15). Repository docs, code and fetched URLs reach the model unmarked, and fetch_generic_url_content fetches any absolute URL a document mentions, with no prompt-injection guidance in the README (2). No per-call visibility for the caller (0). SECURITY.md routes reports to a Google Form, but the server-side request forgery report in issue #249 (12 June 2026) and its proposed fix #256 have had no maintainer reply in almost five months. No certifications or bounty (5). 20 + 15 + 2 + 0 + 5 = 42.); Graphify 66 (Local-software reading, as for vibe-trading. 30 for what leaves the machine by default, 20 for approvals and least privilege, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Code parsing is local and no telemetry code was found. The HTTP server binds 127.0.0.1 with a Host allow-list and a constant-time key check, but only warns when bound to 0.0.0.0 without a key, and turns DNS-rebinding protection off for a wildcard bind. Headless `extract` sends docs to whichever provider's key is in the environment, with a printed notice, and community naming falls back to `claude -p` when no key is set (21). No MCP tool writes, and `uninstall --purge` refuses to delete the project or home folder. The Claude hooks add a reminder before every Bash, Grep, Read and Glob call once a graph exists (since 0.9.96 worded as facts rather than a MANDATORY command, though the Cursor rule still says MANDATORY), the default install edits the user-wide ~/.claude/CLAUDE.md, and git hooks rebuild on every commit and checkout. Settings files get a `.graphify-bak` copy (14). The semantic pass wraps each file in a hash-stamped `untrusted_source` block, defangs chat-template tokens, sanitises labels in MCP output and redacts credential-shaped text, and SECURITY.md says this lowers injection rather than stopping it (11). An opt-in query log, a stderr line naming the backend and the variable that chose it, and a local cost.json (8). SECURITY.md with private reporting and a threat table, a valid security.txt, one published advisory with a fix, PyPI trusted publishing, and bandit and pip-audit in CI set not to fail the build, and Security lines in the changelog for dependency floors (0.9.96, 0.9.97) and wider credential redaction (0.9.97). The SOC 2 engagement covers the hosted product only and has no report yet. No bug bounty (12).)
- Schema & documentation, Graphify +21: GitMCP 56 (Every tool registers a zod input schema, so inputs are typed JSON Schema (25). There is no llms.txt for GitMCP itself; the README on GitHub is the only Markdown documentation (5). Descriptions are generated per repository and say what each tool reads and when it helps ("Useful for general questions. Always call this tool first if asked about owner/repo"), but not when to avoid one (12). Inputs are a query string and an optional page number, with no enums or constraints beyond types (9). The README has three worked examples and no documented error responses (5). No versioning, tags, releases or changelog (0). 25 + 5 + 12 + 9 + 5 + 0 = 56.); Graphify 77 (MCP reading. All ten tools carry typed JSON Schema inputs in serve.py, though `get_node` and `get_neighbors` mark no field required and no tool has an output schema (20 of 25). llms.txt at docs.graphify.com, a Markdown copy of every page, llms-full.txt, and an MCP tool reference generated from serve.py (10). Descriptions say what each tool does in one sentence; the three PR tools also say when to call them, the graph tools don't say when not to (10 of 20). Types, defaults and a `bfs`/`dfs` enum, but `depth` is limited to 1 to 6 in text and code rather than in the schema, and `relation_filter` is a free string (10 of 15). Worked examples in the README and docs, documented exit codes 0, 3 and 4, refusals that list candidate nodes, and a troubleshooting page (12 of 15). A dated CHANGELOG.md with 243 dated entries on 1 November 2026, a docs changelog, and `schema_version` in graph.json (15).)
- Agent ergonomics, Graphify +19: GitMCP 58 (Four tools per repository endpoint and five on gitmcp.io/docs, each short (25). Code search pages 30 results with a page number, and documentation search returns matched chunks instead of the whole file, but there is no size control on the fetch tool (10). Errors come back as tool text with no documented codes (5). Every tool is a read and the source sets readOnlyHint, but issue #266 reports the annotations are passed in a position the MCP SDK ignores, and the fix #267 is unmerged (8). No parameters to set up and nothing to configure; there are no SDKs, which a keyless MCP endpoint doesn't need (10). 25 + 10 + 5 + 8 + 10 = 58.); Graphify 77 (MCP reading. Ten compact tools, about 7,900 characters of tool-definition source in serve.py (25). `token_budget` on `query_graph`, `get_neighbors` and `get_community` (default 2,000), `depth` capped at 6, `max_hops`, `top_n`, `relation_filter` and `context_filter`, and `--budget` on the CLI. No cursor paging (17 of 20). Exit codes for answer, ambiguous name and no match, ambiguous names refused with candidates instead of guessed, and a clear message when graph.json is missing or corrupt. MCP errors come back as text (15 of 20). Every tool reads, so calls are safe to repeat, but none carries readOnlyHint or destructiveHint (10 of 20). `graphify install` and `/graphify .` build a first graph, `graph_stats` is the documented first call, and code needs no key. Python only, though the CLI works from any language (10 of 15).)