{ "data": { "similar": [ { "grade": "C", "json": "https://www.anchorterminal.com/tools/sourcegraph-mcp.json", "name": "Sourcegraph MCP Server", "score": 57.5, "shared": [ "code.repo", "code.git" ], "slug": "sourcegraph-mcp" }, { "grade": "D", "json": "https://www.anchorterminal.com/tools/graft.json", "name": "graft", "score": 52.5, "shared": [ "code.git", "code.repo" ], "slug": "graft" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/zep.json", "name": "Zep", "score": 73.9, "shared": [ "memory.graph" ], "slug": "zep" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/github-mcp-server.json", "name": "GitHub MCP Server", "score": 70.3, "shared": [ "code.repo" ], "slug": "github-mcp-server" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/graphicle.json", "name": "Graphicle", "score": 69.8, "shared": [ "memory.graph" ], "slug": "graphicle" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/glean.json", "name": "Glean", "score": 69.8, "shared": [ "memory.graph" ], "slug": "glean" } ], "tool": { "slug": "graphify", "name": "Graphify", "vendor": "Graphify Labs", "vendorUrl": "https://graphify.com", "kind": "mcp", "category": "code", "summary": "Graphify is an open-source Python tool from Graphify Labs that turns a repository, plus its docs and media, into a knowledge graph a coding agent queries through a CLI, an installed assistant skill or a local ten-tool MCP server.", "url": "https://www.anchorterminal.com/tools/graphify", "markdownUrl": "https://www.anchorterminal.com/tools/graphify.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/graphify.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/graphify.json", "repo": "https://github.com/Graphify-Labs/graphify", "license": "Apache-2.0 since 0.9.25 of 22 July 2026. Contributions made before then remain available under MIT, with the original text kept in LICENSE-MIT and referenced from NOTICE", "transports": [ "stdio", "streamable-http" ], "packages": [ { "registry": "pypi", "name": "graphifyy" } ], "auth": "none", "authNotes": "No account with Graphify Labs. The stdio MCP server and the CLI need no credentials. The optional Streamable HTTP server binds 127.0.0.1 by default and requires a key only when `GRAPHIFY_API_KEY` or `--api-key` is set, sent as `Authorization: Bearer \u003ckey\u003e` or `X-API-Key`. The optional model step uses the owner's own provider key, a local Ollama or an authenticated `claude` CLI. The PR tools use the owner's `gh` login (https://docs.graphify.com/mcp/shared-http.md).", "pricing": "free", "pricingNotes": "Free under the Apache 2.0 licence, with nothing to buy to run the package. The owner pays any model provider used for the semantic pass, or nothing with Ollama or a code-only graph. Graphify Cloud is a separate hosted product with a Free plan, Pro at $15 a month and Teams from $29 a seat a month, not graded here (https://docs.graphify.com/pricing/overview.md, checked 2026-10-26).", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "A local package with nothing to buy. No x402, MPP or L402 in the README, the docs or the source at 0.9.95 (checked 2026-10-26).", "endpoints": [] }, "toolCount": 10, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-26" }, "docsUrl": "https://docs.graphify.com", "llmsTxt": "https://docs.graphify.com/llms.txt", "capabilities": [ "code.repo", "memory.graph", "code.git", "diagram.architecture" ], "tags": [ "open-source", "local", "self-hosted", "free", "no-card", "python", "apache-2.0", "mcp", "cli", "stdio", "coding-agent", "agent-skills", "hooks", "knowledge-graph", "llms-txt", "no-telemetry", "docker", "pre-1.0" ], "lastRelease": "2026-10-23", "graded": true, "anchor": { "graded": true, "score": 69, "grade": "B", "agentReady": false, "rank": 217, "ranked": true, "rankOf": 1211, "categoryRank": 4, "methodology": "0.6", "run": "2026-10-01", "scores": { "ergonomics": 77, "maintenance": 81, "payments": 60, "reliability": 58, "schema": 77, "security": 66, "transparency": 83 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 58, "points": 11.6, "reason": "Read with the local-software lines, since the owner runs it. `graphifyy` installs from PyPI with uv or pipx, with `requires-python \u003e=3.10` stated (20). The CI workflow runs pytest on Python 3.10, 3.12, 3.13 and 3.14, an end-to-end `graphify install`, the Pi guard tests and generated-skill checks on every push and pull request to v8, over 458 test files. Whether the latest runs pass couldn't be read, because GitHub's web pages weren't reachable (15 of 25). Open issues weren't read. The changelog fixes many extraction regressions each release, each credited to a reporter and a pull request, which reads as handled rather than left open (15 of 25). CHANGELOG.md marks breaking changes, such as full-path node IDs in 0.9.0 and Java `inherits` edges in 0.8.18, and announces AST cache bumps, but on 0.x they ship in ordinary releases with no Breaking section (8 of 15). Version 0.9.95 (0).", "checked": "2026-10-26" }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 77, "points": 12.51, "reason": "MCP reading. All ten tools carry typed JSON Schema inputs in serve.py, though `get_node` and `get_neighbors` mark no field required and no tool has an output schema (20 of 25). llms.txt at docs.graphify.com, a Markdown copy of every page, llms-full.txt, and an MCP tool reference generated from serve.py (10). Descriptions say what each tool does in one sentence; the three PR tools also say when to call them, the graph tools don't say when not to (10 of 20). Types, defaults and a `bfs`/`dfs` enum, but `depth` is limited to 1 to 6 in text and code rather than in the schema, and `relation_filter` is a free string (10 of 15). Worked examples in the README and docs, documented exit codes 0, 3 and 4, refusals that list candidate nodes, and a troubleshooting page (12 of 15). A dated CHANGELOG.md with 238 entries, a docs changelog, and `schema_version` in graph.json (15).", "checked": "2026-10-26" }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 77, "points": 12.51, "reason": "MCP reading. Ten compact tools, about 7,900 characters of tool-definition source in serve.py (25). `token_budget` on `query_graph`, `get_neighbors` and `get_community` (default 2,000), `depth` capped at 6, `max_hops`, `top_n`, `relation_filter` and `context_filter`, and `--budget` on the CLI. No cursor paging (17 of 20). Exit codes for answer, ambiguous name and no match, ambiguous names refused with candidates instead of guessed, and a clear message when graph.json is missing or corrupt. MCP errors come back as text (15 of 20). Every tool reads, so calls are safe to repeat, but none carries readOnlyHint or destructiveHint (10 of 20). `graphify install` and `/graphify .` build a first graph, `graph_stats` is the documented first call, and code needs no key. Python only, though the CLI works from any language (10 of 15).", "checked": "2026-10-26" }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 66, "points": 11.55, "reason": "Local-software reading, as for vibe-trading. 30 for what leaves the machine by default, 20 for approvals and least privilege, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Code parsing is local and no telemetry code was found. The HTTP server binds 127.0.0.1 with a Host allow-list and a constant-time key check, but only warns when bound to 0.0.0.0 without a key, and turns DNS-rebinding protection off for a wildcard bind. Headless `extract` sends docs to whichever provider's key is in the environment, with a printed notice, and community naming falls back to `claude -p` when no key is set (21). No MCP tool writes, and `uninstall --purge` refuses to delete the project or home folder. The Claude hooks inject a MANDATORY instruction before every Bash, Grep, Read and Glob call once a graph exists, the default install edits the user-wide ~/.claude/CLAUDE.md, and git hooks rebuild on every commit and checkout. Settings files get a `.graphify-bak` copy (14). The semantic pass wraps each file in a hash-stamped `untrusted_source` block, defangs chat-template tokens, sanitises labels in MCP output and redacts credential-shaped text, and SECURITY.md says this lowers injection rather than stopping it (11). An opt-in query log, a stderr line naming the backend and the variable that chose it, and a local cost.json (8). SECURITY.md with private reporting and a threat table, a valid security.txt, one published advisory with a fix, PyPI trusted publishing, and bandit and pip-audit in CI set not to fail the build. The SOC 2 engagement covers the hosted product only and has no report yet. No bug bounty (12).", "checked": "2026-10-26" }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 60, "points": 7.5, "reason": "Read with the self-hosted rule. No payment protocol (0). The package is free under Apache 2.0, needs no account or card, and builds a code graph with no key, so 20, 20 and 20 on the last three lines. Graphify Cloud, a separate hosted product with public plan prices, is not scored here.", "checked": "2026-10-26" }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 81, "points": 7.09, "reason": "0.9.95 was published on 23 October 2026, three days before this check (30). 67 PyPI versions in the 90 days to 26 October, 0.9.29 to 0.9.95 (20). The 0.9.95 entry credits 21 community pull requests and the changelog names reporters on most fixes, with issue numbers past #4700. Issue threads and reply times weren't read, a judgement call (18 of 25). The official MCP registry holds `io.github.Graphify-Labs/graphify`, but that entry is Graphify Cloud's hosted server; the local `graphify-mcp` isn't listed. Published on PyPI (5 of 15). A frozen uv.lock in CI on four Python versions, dependency floors raised for named CVEs (starlette 1.3.1), and trusted publishing. No Dependabot configuration, and the audit jobs don't block (7 of 10).", "checked": "2026-10-26" }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 83, "points": 7.26, "note": "editorial 78, provenance 88", "reason": "The editorial half. Apache 2.0, with the MIT portion before 0.9.25 kept in LICENSE-MIT (30). The README's privacy section says what stays local, which env vars send docs to which provider, that Kimi routes to China and how to turn backends off, and the docs agree. The README still says every query is logged by default while the code and configuration docs say logging is off by default, and graphify.com's security page says the core makes no network calls of its own, which the `claude` CLI fallback for community names stretches (20 of 30). The changelog dates breaking changes and removals, SECURITY.md supports the latest 0.9.x only, and graph.json carries a schema version. No deprecation policy or notice period (8 of 20). No telemetry, stated in the README and on the security page, and none found in the source (20).", "checked": "2026-10-26" } ], "assessment": { "date": "2026-10-26", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "MCP reading. Ten compact tools, about 7,900 characters of tool-definition source in serve.py (25). `token_budget` on `query_graph`, `get_neighbors` and `get_community` (default 2,000), `depth` capped at 6, `max_hops`, `top_n`, `relation_filter` and `context_filter`, and `--budget` on the CLI. No cursor paging (17 of 20). Exit codes for answer, ambiguous name and no match, ambiguous names refused with candidates instead of guessed, and a clear message when graph.json is missing or corrupt. MCP errors come back as text (15 of 20). Every tool reads, so calls are safe to repeat, but none carries readOnlyHint or destructiveHint (10 of 20). `graphify install` and `/graphify .` build a first graph, `graph_stats` is the documented first call, and code needs no key. Python only, though the CLI works from any language (10 of 15).", "maintenance": "0.9.95 was published on 23 October 2026, three days before this check (30). 67 PyPI versions in the 90 days to 26 October, 0.9.29 to 0.9.95 (20). The 0.9.95 entry credits 21 community pull requests and the changelog names reporters on most fixes, with issue numbers past #4700. Issue threads and reply times weren't read, a judgement call (18 of 25). The official MCP registry holds `io.github.Graphify-Labs/graphify`, but that entry is Graphify Cloud's hosted server; the local `graphify-mcp` isn't listed. Published on PyPI (5 of 15). A frozen uv.lock in CI on four Python versions, dependency floors raised for named CVEs (starlette 1.3.1), and trusted publishing. No Dependabot configuration, and the audit jobs don't block (7 of 10).", "payments": "Read with the self-hosted rule. No payment protocol (0). The package is free under Apache 2.0, needs no account or card, and builds a code graph with no key, so 20, 20 and 20 on the last three lines. Graphify Cloud, a separate hosted product with public plan prices, is not scored here.", "reliability": "Read with the local-software lines, since the owner runs it. `graphifyy` installs from PyPI with uv or pipx, with `requires-python \u003e=3.10` stated (20). The CI workflow runs pytest on Python 3.10, 3.12, 3.13 and 3.14, an end-to-end `graphify install`, the Pi guard tests and generated-skill checks on every push and pull request to v8, over 458 test files. Whether the latest runs pass couldn't be read, because GitHub's web pages weren't reachable (15 of 25). Open issues weren't read. The changelog fixes many extraction regressions each release, each credited to a reporter and a pull request, which reads as handled rather than left open (15 of 25). CHANGELOG.md marks breaking changes, such as full-path node IDs in 0.9.0 and Java `inherits` edges in 0.8.18, and announces AST cache bumps, but on 0.x they ship in ordinary releases with no Breaking section (8 of 15). Version 0.9.95 (0).", "schema": "MCP reading. All ten tools carry typed JSON Schema inputs in serve.py, though `get_node` and `get_neighbors` mark no field required and no tool has an output schema (20 of 25). llms.txt at docs.graphify.com, a Markdown copy of every page, llms-full.txt, and an MCP tool reference generated from serve.py (10). Descriptions say what each tool does in one sentence; the three PR tools also say when to call them, the graph tools don't say when not to (10 of 20). Types, defaults and a `bfs`/`dfs` enum, but `depth` is limited to 1 to 6 in text and code rather than in the schema, and `relation_filter` is a free string (10 of 15). Worked examples in the README and docs, documented exit codes 0, 3 and 4, refusals that list candidate nodes, and a troubleshooting page (12 of 15). A dated CHANGELOG.md with 238 entries, a docs changelog, and `schema_version` in graph.json (15).", "security": "Local-software reading, as for vibe-trading. 30 for what leaves the machine by default, 20 for approvals and least privilege, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Code parsing is local and no telemetry code was found. The HTTP server binds 127.0.0.1 with a Host allow-list and a constant-time key check, but only warns when bound to 0.0.0.0 without a key, and turns DNS-rebinding protection off for a wildcard bind. Headless `extract` sends docs to whichever provider's key is in the environment, with a printed notice, and community naming falls back to `claude -p` when no key is set (21). No MCP tool writes, and `uninstall --purge` refuses to delete the project or home folder. The Claude hooks inject a MANDATORY instruction before every Bash, Grep, Read and Glob call once a graph exists, the default install edits the user-wide ~/.claude/CLAUDE.md, and git hooks rebuild on every commit and checkout. Settings files get a `.graphify-bak` copy (14). The semantic pass wraps each file in a hash-stamped `untrusted_source` block, defangs chat-template tokens, sanitises labels in MCP output and redacts credential-shaped text, and SECURITY.md says this lowers injection rather than stopping it (11). An opt-in query log, a stderr line naming the backend and the variable that chose it, and a local cost.json (8). SECURITY.md with private reporting and a threat table, a valid security.txt, one published advisory with a fix, PyPI trusted publishing, and bandit and pip-audit in CI set not to fail the build. The SOC 2 engagement covers the hosted product only and has no report yet. No bug bounty (12).", "transparency": "The editorial half. Apache 2.0, with the MIT portion before 0.9.25 kept in LICENSE-MIT (30). The README's privacy section says what stays local, which env vars send docs to which provider, that Kimi routes to China and how to turn backends off, and the docs agree. The README still says every query is logged by default while the code and configuration docs say logging is off by default, and graphify.com's security page says the core makes no network calls of its own, which the `claude` CLI fallback for community names stretches (20 of 30). The changelog dates breaking changes and removals, SECURITY.md supports the latest 0.9.x only, and graph.json carries a schema version. No deprecation policy or notice period (8 of 20). No telemetry, stated in the README and on the security page, and none found in the source (20)." }, "sources": [ { "what": "git clone of v8 at 92741d1 (23 October 2026), the source read for every code fact", "url": "https://github.com/Graphify-Labs/graphify", "seen": "2026-10-26" }, { "what": "README (install, privacy section, platforms, extras)", "url": "https://github.com/Graphify-Labs/graphify/blob/v8/README.md", "seen": "2026-10-26" }, { "what": "CHANGELOG.md (238 dated entries, relicensing in 0.9.25, Fortran fix in 0.9.70)", "url": "https://github.com/Graphify-Labs/graphify/blob/v8/CHANGELOG.md", "seen": "2026-10-26" }, { "what": "SECURITY.md (supported versions, reporting, threat table)", "url": "https://github.com/Graphify-Labs/graphify/blob/v8/SECURITY.md", "seen": "2026-10-26" }, { "what": "LICENSE, LICENSE-MIT and NOTICE", "url": "https://github.com/Graphify-Labs/graphify/blob/v8/NOTICE", "seen": "2026-10-26" }, { "what": "pyproject.toml (package name, version, extras, entry points)", "url": "https://github.com/Graphify-Labs/graphify/blob/v8/pyproject.toml", "seen": "2026-10-26" }, { "what": "MCP server source (ten tools, HTTP key check, Host allow-list)", "url": "https://github.com/Graphify-Labs/graphify/blob/v8/graphify/serve.py", "seen": "2026-10-26" }, { "what": "model backends, auto-detection order and the claude CLI labelling fallback", "url": "https://github.com/Graphify-Labs/graphify/blob/v8/graphify/llm.py", "seen": "2026-10-26" }, { "what": "assistant installers (CLAUDE.md, settings.json hooks, GEMINI.md, AGENTS.md, Cursor rule)", "url": "https://github.com/Graphify-Labs/graphify/blob/v8/graphify/install.py", "seen": "2026-10-26" }, { "what": "hook-guard nudge and strict-mode deny payloads", "url": "https://github.com/Graphify-Labs/graphify/blob/v8/graphify/cli.py", "seen": "2026-10-26" }, { "what": "git hooks and graph.json merge driver", "url": "https://github.com/Graphify-Labs/graphify/blob/v8/graphify/hooks.py", "seen": "2026-10-26" }, { "what": "query log (off by default)", "url": "https://github.com/Graphify-Labs/graphify/blob/v8/graphify/querylog.py", "seen": "2026-10-26" }, { "what": "PR commands and the triage backend", "url": "https://github.com/Graphify-Labs/graphify/blob/v8/graphify/prs.py", "seen": "2026-10-26" }, { "what": "CI and trusted-publishing workflows", "url": "https://github.com/Graphify-Labs/graphify/blob/v8/.github/workflows/ci.yml", "seen": "2026-10-26" }, { "what": "PyPI project page and release history (263 versions, trusted publishing)", "url": "https://pypi.org/project/graphifyy/", "seen": "2026-10-26" }, { "what": "PyPI robots.txt", "url": "https://pypi.org/robots.txt", "seen": "2026-10-26" }, { "what": "OSV query for graphifyy and the record for GHSA-pcc4-rvhr-2pr8", "url": "https://api.osv.dev/v1/vulns/GHSA-pcc4-rvhr-2pr8", "seen": "2026-10-26" }, { "what": "docs llms.txt and robots.txt", "url": "https://docs.graphify.com/llms.txt", "seen": "2026-10-26" }, { "what": "docs, MCP setup", "url": "https://docs.graphify.com/mcp/overview.md", "seen": "2026-10-26" }, { "what": "docs, HTTP server options and key", "url": "https://docs.graphify.com/mcp/shared-http.md", "seen": "2026-10-26" }, { "what": "docs, MCP tool reference", "url": "https://docs.graphify.com/reference/mcp-tools.md", "seen": "2026-10-26" }, { "what": "docs, configuration (backends, query log off by default)", "url": "https://docs.graphify.com/reference/configuration.md", "seen": "2026-10-26" }, { "what": "docs, edge confidence labels", "url": "https://docs.graphify.com/concepts/provenance.md", "seen": "2026-10-26" }, { "what": "docs, plans and pricing (Cloud; open-source CLI free and separate)", "url": "https://docs.graphify.com/pricing/overview.md", "seen": "2026-10-26" }, { "what": "docs, Claude Code integration", "url": "https://docs.graphify.com/integrations/claude-code.md", "seen": "2026-10-26" }, { "what": "graphify.com robots.txt, home page and sitemap", "url": "https://graphify.com/robots.txt", "seen": "2026-10-26" }, { "what": "graphify.com terms of service (3 October 2026)", "url": "https://graphify.com/terms", "seen": "2026-10-26" }, { "what": "graphify.com privacy policy (October 2026)", "url": "https://graphify.com/privacy", "seen": "2026-10-26" }, { "what": "graphify.com subprocessors (hosted service)", "url": "https://graphify.com/subprocessors", "seen": "2026-10-26" }, { "what": "graphify.com security page (SOC 2 engagement started, no report)", "url": "https://graphify.com/security", "seen": "2026-10-26" }, { "what": "graphify.com official-site page (graphify.net not affiliated)", "url": "https://graphify.com/graphify-net-vs-graphify-com", "seen": "2026-10-26" }, { "what": "security.txt", "url": "https://graphify.com/.well-known/security.txt", "seen": "2026-10-26" }, { "what": "Y Combinator company page (Summer 2026, active) and its robots.txt", "url": "https://www.ycombinator.com/companies/graphify-labs", "seen": "2026-10-26" }, { "what": "official MCP registry search (only the hosted Cloud server is listed)", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=graphify", "seen": "2026-10-26" }, { "what": "RDAP for graphify.com", "url": "https://rdap.org/domain/graphify.com", "seen": "2026-10-26" } ], "openQuestions": [ "Category. code, because the main job is reading a repository's structure for a coding agent, beside sourcegraph-mcp and rea. agent-memory was the alternative, since the graph persists between sessions and Graphicle sits there, but Graphify keeps no record of decisions or past sessions beyond an opt-in Q\u0026A memory folder. Judgement call.", "Kind is `mcp`, as for rea and Graphicle, though the installed skill and CLI are the surfaces most assistants use. Graded with the local-software Reliability lines, the MCP lines for Schema and Ergonomics, the local-software reading of Security and the self-hosted Payments rule.", "firstReleased is 4 April 2026, the date of 0.1.1, the earliest version on PyPI. CHANGELOG.md has a 0.1.0 entry dated 3 April 2026 that PyPI doesn't list.", "unchecked: github.com/robots.txt. The shell's proxy answered the request with an API error and WebFetch's permission request timed out, so no GitHub web page was fetched and the repository was read from a `git clone --depth 1` instead.", "unchecked: the GitHub star count, CI run results, issue and pull request threads and the GitHub release pages. The lead's 135K matches the 135.4k in graphify.com's header on 26 October 2026 (135.3k on the terms page minutes later). YC's profile says 116K+ and its launch post 108K+. All three are the vendor's figures and none is used as popularity.", "unchecked: PyPI download counts. PyPI's robots.txt disallows `/pypi/*/json`. The YC profile's 6.5M+ downloads is the vendor's claim.", "The lead's about 40 languages matches the README's own count and the extension table in detect.py. graphify.com's security page says 36 bundled grammars. The lead's 20 and more assistants matches the README's table of 24 install targets.", "Benchmark figures in the README and BENCHMARKS.md (LOCOMO recall@10 of 0.497 against mem0 and supermemory, 82 per cent key-fact coverage), Graphify Cloud's 80 per cent token saving and the YC post's first to cross 100K stars mid-batch are Graphify Labs' claims, not checked and not deducted.", "The privacy policy says Graphify Labs maintains a SOC 2 Type II programme, while the security page says the engagement has started with no report. Both concern the hosted product. Recorded, not deducted.", "Deduction of 1 for GHSA-pcc4-rvhr-2pr8, fixed in 0.9.70 and disclosed in the changelog the day of the fix, weighed below vibe-trading's critical advisories. Judgement call.", "The claude CLI fallback for community names and the auto-detection of a backend from ambient keys are recorded as weaknesses, not deductions, because both print a notice and are documented in the code and the README's privacy section. Judgement call.", "Graphify Cloud (app.graphify.com and the OAuth MCP server at api.graphify.com/mcp) is a separate hosted product and wasn't graded. It could take its own listing.", "Graphicle. Its listing says its code-graph engine is a Rust port of Graphify. A grep of data/tools/graphicle.json for that line also printed part of its transparency note, which wasn't used.", "Our own products. Graphify doesn't do LocalGhost's job (a personal AI server over the owner's own data) or letme's (choosing tools from our grades). Graded the normal way.", "Nothing was installed or run. Tool counts, defaults and behaviour come from reading the source at 0.9.95." ] }, "negative": -1, "negativeNotes": [ "2026-10-19. GHSA-pcc4-rvhr-2pr8 (moderate). In 0.7.2 to 0.9.69 the Fortran extractor's `cpp` step followed absolute and traversing `#include` lines in an untrusted `.F` file, reading host files into graph.json, the report and the model context on the default offline path. Fixed in 0.9.70 of 27 September 2026, with a Security line in the changelog the same day and the advisory published three weeks later. Fixed and documented, so -1. https://api.osv.dev/v1/vulns/GHSA-pcc4-rvhr-2pr8" ], "verdict": "Graphify parses code locally with tree-sitter, ships near-daily releases with a dated changelog, and keeps its ten MCP tools read-only and compact. The optional model step picks a cloud provider from whichever API key is set, and community naming can fall back to the `claude` CLI, so `GRAPHIFY_BACKEND=none` is needed to keep everything on the machine.", "bestFor": "A person or team who wants a coding agent to query a structural map of a repository, with docs and papers folded in, before grepping.", "strengths": [ "Code graphs build offline with tree-sitter, with no embeddings and no model call, and no telemetry code was found in the source", "Ten MCP tools with typed JSON Schema inputs, all of them reads, with token budgets on the larger ones", "67 PyPI releases in the 90 days to 26 October 2026, each with a dated CHANGELOG.md entry crediting the pull requests", "Edges are labelled EXTRACTED, INFERRED or AMBIGUOUS, and ambiguous names are refused with candidates and exit code 3", "Docs at docs.graphify.com with llms.txt and a Markdown copy of every page, plus a valid security.txt" ], "weaknesses": [ "Headless extraction sends docs to whichever cloud provider's key is set, Gemini first and Kimi in China second, unless `GRAPHIFY_BACKEND` is set", "Community naming falls back to the `claude` CLI when no key is set, which sends node names to Anthropic through the owner's plan", "Version 0.9.95, with breaking changes such as node IDs in 0.9.0 shipped inside 0.x releases", "One moderate advisory, a host-file read through the Fortran extractor in 0.7.2 to 0.9.69, fixed in 0.9.70", "No readOnlyHint or destructiveHint annotations, and the local server isn't in the official MCP registry" ], "agentNotes": [ "Install `graphifyy` with two y's; other `graphify*` packages on PyPI are not the project's", "Set `GRAPHIFY_BACKEND=none` or use `--code-only` when no source or doc text may leave the machine", "Pass an absolute path to graph.json in the MCP config, and run `graph_stats` first to check the graph loaded", "Set `GRAPHIFY_API_KEY` before binding the HTTP server to 0.0.0.0; it only warns when no key is set", "Run 0.9.70 or later before indexing an untrusted repository, because earlier versions carry the Fortran file-read advisory" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.6", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 69 } ], "editorialScores": { "ergonomics": 77, "maintenance": 81, "payments": 60, "reliability": 58, "schema": 77, "security": 66, "transparency": 78 }, "provenanceScore": 88, "checked": { "categories": { "ergonomics": "2026-10-26", "maintenance": "2026-10-26", "payments": "2026-10-26", "reliability": "2026-10-26", "schema": "2026-10-26", "security": "2026-10-26", "transparency": "2026-10-26" }, "last": "2026-10-26", "oldest": "2026-10-26", "stale": false, "staleAfterDays": 90 }, "scoreHistory": [ { "date": "2026-10-26", "grade": "B", "kind": "listed", "method": "0.6", "score": 69 } ] }, "connect": { "install": "uv tool install \"graphifyy[mcp]\" # then: graphify install, and /graphify . in the assistant", "claudeCode": "claude mcp add --transport stdio graphify -- graphify-mcp /absolute/path/to/repo/graphify-out/graph.json", "config": { "mcpServers": { "graphify": { "args": [ "/absolute/path/to/repo/graphify-out/graph.json" ], "command": "graphify-mcp" } } }, "headless": { "command": "graphify query \"$QUESTION\" --budget 2000" } }, "letme": { "capability": "https://letme.dev/code.repo", "tool": "https://letme.dev/graphify" }, "notable": [ "Code is parsed locally with tree-sitter, with no embeddings, vector store or model call. `graphify update .` and `graphify extract --code-only` run offline; docs, PDFs and images need a semantic pass through the assistant's model or a configured backend (https://github.com/Graphify-Labs/graphify/blob/v8/README.md)", "Each edge carries a confidence label, EXTRACTED, INFERRED or AMBIGUOUS. AMBIGUOUS comes from the semantic pass, and INFERRED edges can also come from static name and import resolution with no model (https://docs.graphify.com/concepts/provenance.md)", "Headless `graphify extract` picks a backend from whichever key is set, in the order Gemini, Kimi, Claude, OpenAI, DeepSeek, Azure, Bedrock, then Ollama, and prints the variable that chose it. Kimi routes to Moonshot AI in China. `GRAPHIFY_BACKEND=none` turns every backend off (https://github.com/Graphify-Labs/graphify/blob/v8/graphify/llm.py)", "`graphify label`, and `graphify cluster-only` when no labels file exists, fall back to naming communities through the `claude` CLI when no key is set and the CLI is on PATH. The prompt carries up to 12 node names per community. The fallback is announced on stderr and `GRAPHIFY_BACKEND=none` stops it (https://github.com/Graphify-Labs/graphify/blob/v8/graphify/llm.py)", "`graphify claude install` writes a graphify section to ./CLAUDE.md and two PreToolUse hooks to .claude/settings.json (Bash|Grep and Read|Glob, 10-second timeout), keeping a `.graphify-bak` copy. When a graph exists the hooks add a MANDATORY instruction to run `graphify query` first; `--strict` denies the first raw read in each session (https://github.com/Graphify-Labs/graphify/blob/v8/graphify/install.py)", "`graphify hook install` adds post-commit, post-checkout, post-merge and post-rewrite blocks that rebuild the code-only graph in a detached process, and registers a union merge driver for graph.json in the local git config and .gitattributes. The rebuild makes no model call (https://github.com/Graphify-Labs/graphify/blob/v8/graphify/hooks.py)", "One GitHub advisory, GHSA-pcc4-rvhr-2pr8 (moderate), published 19 October 2026. The Fortran extractor's `cpp` step let an untrusted `.F` file read host files into the graph in 0.7.2 to 0.9.69. Fixed in 0.9.70 of 27 September 2026 (https://api.osv.dev/v1/query, package graphifyy)", "No telemetry code was found in the source at 0.9.95. Outbound calls are the chosen model backend, URLs the owner passes to `graphify add`, and `gh` for the PR commands. The local query log is off by default, though the README still describes it as on (https://github.com/Graphify-Labs/graphify/blob/v8/graphify/querylog.py)", "PyPI lists 263 versions of `graphifyy`, from 0.1.1 on 4 April 2026 to 0.9.95 on 23 October 2026, published through trusted publishing. The README warns that other `graphify*` packages on PyPI are not affiliated (https://pypi.org/project/graphifyy/)", "Y Combinator's directory lists Graphify Labs in Summer 2026, active, in San Francisco, with Safi Shamsi as founder. Star counts of 108K, 116K and 135.4k appear on the YC launch post, the YC profile and graphify.com's header; GitHub's own page wasn't read (https://www.ycombinator.com/companies/graphify-labs)", "Graphicle, listed as graphicle, is a separate product from KarLex AI whose code-graph engine is a Rust port of Graphify. Graphify does neither LocalGhost's job nor letme's" ], "area": "developer", "details": [ { "label": "Where it runs", "value": "The owner's machine. PyPI package `graphifyy` for Python 3.10 or newer, installed with uv or pipx, with optional extras for MCP, PDFs, Office files, video, Leiden clustering, Neo4j, FalkorDB and each model provider. A Dockerfile ships in the repository for the HTTP MCP server" }, { "label": "Surfaces", "value": "The `/graphify` skill typed in an assistant chat, the `graphify` CLI (`query`, `path`, `explain`, `affected`, `update`, `extract`, `prs`), the `graphify-mcp` server over stdio or Streamable HTTP, git hooks and a `watch` mode" }, { "label": "Outputs", "value": "graphify-out/graph.json with `schema_version` and `graphify_version`, GRAPH_REPORT.md with hub nodes, communities and suggested questions, and graph.html. Exports to a Markdown wiki, Obsidian, GraphML, SVG, a Mermaid call-flow page and Cypher for Neo4j or FalkorDB" }, { "label": "Inputs", "value": "About 40 programming languages by the README's count, parsed with tree-sitter, plus SQL, Terraform, package manifests and YAML. Markdown, PDFs, Office files and images go through the semantic pass; audio and video are transcribed locally with faster-whisper" }, { "label": "Model step", "value": "Optional. In the `/graphify` skill, docs and images are read by the assistant's own model. Headless `extract` uses Gemini, Kimi (Moonshot AI, China), Anthropic, OpenAI, DeepSeek, Azure OpenAI, Bedrock, Ollama, the `claude` CLI or a custom OpenAI-compatible provider, chosen by `--backend`, `GRAPHIFY_BACKEND` or the first key found" }, { "label": "Agent configuration", "value": "`graphify install` copies the skill to ~/.claude/skills/graphify/ and adds a registration block to ~/.claude/CLAUDE.md. Per-platform commands write CLAUDE.md plus .claude/settings.json PreToolUse hooks, GEMINI.md plus a .gemini/settings.json BeforeTool hook, AGENTS.md plus a no-op .codex/hooks.json entry, or .cursor/rules/graphify.mdc. `graphify uninstall` removes them" }, { "label": "Install targets", "value": "The README names 24, among them Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot CLI, VS Code Copilot Chat, OpenCode, Kilo Code, Aider, Amp, Kiro, Devin CLI, Google Antigravity, Trae, Hermes, Pi and the cross-framework Agent Skills folders" }, { "label": "Git integration", "value": "`graphify hook install` adds post-commit, post-checkout, post-merge and post-rewrite rebuilds of the code graph and a union merge driver for graph.json. The docs recommend committing graphify-out/ so a team shares one graph" }, { "label": "MCP server", "value": "Ten tools, `query_graph`, `get_node`, `get_neighbors`, `get_community`, `god_nodes`, `graph_stats`, `shortest_path`, `list_prs`, `get_pr_impact` and `triage_prs`, each with an optional `project_path`, plus six resources. HTTP at `http://127.0.0.1:8080/mcp` by default, with an optional key" }, { "label": "Pull request review", "value": "`graphify prs` and the three PR tools read open pull requests through the owner's `gh` login and map their changes onto graph communities. `graphify prs --triage` sends PR titles, authors and status to a model backend; the MCP tool returns the data only" }, { "label": "Graphify Cloud", "value": "A separate hosted product from the same company, with an OAuth MCP server at https://api.graphify.com/mcp listed in the official MCP registry, PR reviews and formal verification. Not graded in this listing" }, { "label": "Advisories", "value": "GHSA-pcc4-rvhr-2pr8 (moderate), published 19 October 2026, affecting 0.7.2 to 0.9.69 and fixed in 0.9.70 of 27 September 2026" }, { "label": "Releases", "value": "0.9.95 on 23 October 2026, 0.9.94 on 22 October and 0.9.93 on 20 October. 263 PyPI versions since 0.1.1 on 4 April 2026" } ], "provenance": { "legalEntity": "Graphify Labs", "domain": "graphify.com", "domainRegistered": "2007-07-23", "endpointOnVendorDomain": null, "terms": "https://graphify.com/terms", "privacy": "https://graphify.com/privacy", "statusPage": "", "changelog": "https://github.com/Graphify-Labs/graphify/blob/v8/CHANGELOG.md", "securityTxt": "valid", "checked": "2026-10-26", "notes": [ "The terms and privacy policy name Graphify Labs, with no corporate suffix found, and the terms are governed by Delaware law. Y Combinator's directory lists Graphify Labs in San Francisco.", "The terms of 3 October 2026 cover the hosted service and say the open-source core is governed by its own licence, so the Apache 2.0 licence stands in for terms for this listing.", "graphify.com/.well-known/security.txt names founders@graphifylabs.ai and expires on 1 July 2027. SECURITY.md asks for reports through GitHub private vulnerability reporting.", "RDAP gives a registration date of 23 July 2007 for graphify.com, last changed on 8 July 2026, three months after the first release.", "There is no hosted endpoint for this listing. The MCP server and CLI run on the owner's host; Graphify Cloud's endpoint at api.graphify.com is a separate product.", "graphify.com says graphify.net, graphiffy.com and app.graphify.net are not operated by Graphify Labs." ], "score": 88, "checks": [ { "check": "Legal entity named", "value": "Graphify Labs", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "graphify.com, registered 2007-07-23 (19 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "no hosted endpoint", "points": 0, "max": 0, "state": "na" }, { "check": "Terms of service", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "Privacy policy", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/graphify.json" }, "verify": { "accepts": "a page on graphify.com or one of its subdomains, or the README of github.com/Graphify-Labs/graphify", "badgeUrl": "https://www.anchorterminal.com/badges/graphify.svg", "body": { "slug": "graphify", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/graphify", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/graphify\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/graphify.svg\" alt=\"Graphify on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Graphify on Anchor Terminal](https://www.anchorterminal.com/badges/graphify.svg)](https://www.anchorterminal.com/tools/graphify)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/graphify\"\u003eGraphify on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/graphify", "json": "https://www.anchorterminal.com/tools/graphify.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/graphify.md", "mcp": "https://www.anchorterminal.com/mcp", "pricing": "https://www.anchorterminal.com/tools/graphify#pricing", "reviews": "https://www.anchorterminal.com/tools/graphify#reviews", "slim": "https://www.anchorterminal.com/tools/graphify.min.md" }, "markdown": "## Overview\n\n**Grade B · 69/100 · rank #217 of 1211 · #4 in Code \u0026 developer platforms · not agent-ready · confidence medium**\n\n\n## Assessment\n\nGraphify parses code locally with tree-sitter, ships near-daily releases with a dated changelog, and keeps its ten MCP tools read-only and compact. The optional model step picks a cloud provider from whichever API key is set, and community naming can fall back to the `claude` CLI, so `GRAPHIFY_BACKEND=none` is needed to keep everything on the machine.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | Graphify Labs (https://graphify.com) |\n| Kind | MCP server |\n| Category | Code \u0026 developer platforms (https://www.anchorterminal.com/categories/code) |\n| Transport | stdio, Streamable HTTP |\n| Auth | None · No account with Graphify Labs. The stdio MCP server and the CLI need no credentials. The optional Streamable HTTP server binds 127.0.0.1 by default and requires a key only when `GRAPHIFY_API_KEY` or `--api-key` is set, sent as `Authorization: Bearer \u003ckey\u003e` or `X-API-Key`. The optional model step uses the owner's own provider key, a local Ollama or an authenticated `claude` CLI. The PR tools use the owner's `gh` login (https://docs.graphify.com/mcp/shared-http.md). |\n| Pricing | Free (Free · OSS) · Free under the Apache 2.0 licence, with nothing to buy to run the package. The owner pays any model provider used for the semantic pass, or nothing with Ollama or a code-only graph. Graphify Cloud is a separate hosted product with a Free plan, Pro at $15 a month and Teams from $29 a seat a month, not graded here (https://docs.graphify.com/pricing/overview.md, checked 2026-10-26). |\n| x402 | No · A local package with nothing to buy. No x402, MPP or L402 in the README, the docs or the source at 0.9.95 (checked 2026-10-26). |\n| Licence | Apache-2.0 since 0.9.25 of 22 July 2026. Contributions made before then remain available under MIT, with the original text kept in LICENSE-MIT and referenced from NOTICE |\n| Tools exposed | 10 |\n| Packages | pypi: `graphifyy` |\n| Source | https://github.com/Graphify-Labs/graphify |\n| Docs | https://docs.graphify.com |\n| llms.txt | https://docs.graphify.com/llms.txt |\n| Last release | 2026-10-23 |\n| Where it runs | The owner's machine. PyPI package `graphifyy` for Python 3.10 or newer, installed with uv or pipx, with optional extras for MCP, PDFs, Office files, video, Leiden clustering, Neo4j, FalkorDB and each model provider. A Dockerfile ships in the repository for the HTTP MCP server |\n| Surfaces | The `/graphify` skill typed in an assistant chat, the `graphify` CLI (`query`, `path`, `explain`, `affected`, `update`, `extract`, `prs`), the `graphify-mcp` server over stdio or Streamable HTTP, git hooks and a `watch` mode |\n| Outputs | graphify-out/graph.json with `schema_version` and `graphify_version`, GRAPH_REPORT.md with hub nodes, communities and suggested questions, and graph.html. Exports to a Markdown wiki, Obsidian, GraphML, SVG, a Mermaid call-flow page and Cypher for Neo4j or FalkorDB |\n| Inputs | About 40 programming languages by the README's count, parsed with tree-sitter, plus SQL, Terraform, package manifests and YAML. Markdown, PDFs, Office files and images go through the semantic pass; audio and video are transcribed locally with faster-whisper |\n| Model step | Optional. In the `/graphify` skill, docs and images are read by the assistant's own model. Headless `extract` uses Gemini, Kimi (Moonshot AI, China), Anthropic, OpenAI, DeepSeek, Azure OpenAI, Bedrock, Ollama, the `claude` CLI or a custom OpenAI-compatible provider, chosen by `--backend`, `GRAPHIFY_BACKEND` or the first key found |\n| Agent configuration | `graphify install` copies the skill to ~/.claude/skills/graphify/ and adds a registration block to ~/.claude/CLAUDE.md. Per-platform commands write CLAUDE.md plus .claude/settings.json PreToolUse hooks, GEMINI.md plus a .gemini/settings.json BeforeTool hook, AGENTS.md plus a no-op .codex/hooks.json entry, or .cursor/rules/graphify.mdc. `graphify uninstall` removes them |\n| Install targets | The README names 24, among them Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot CLI, VS Code Copilot Chat, OpenCode, Kilo Code, Aider, Amp, Kiro, Devin CLI, Google Antigravity, Trae, Hermes, Pi and the cross-framework Agent Skills folders |\n| Git integration | `graphify hook install` adds post-commit, post-checkout, post-merge and post-rewrite rebuilds of the code graph and a union merge driver for graph.json. The docs recommend committing graphify-out/ so a team shares one graph |\n| MCP server | Ten tools, `query_graph`, `get_node`, `get_neighbors`, `get_community`, `god_nodes`, `graph_stats`, `shortest_path`, `list_prs`, `get_pr_impact` and `triage_prs`, each with an optional `project_path`, plus six resources. HTTP at `http://127.0.0.1:8080/mcp` by default, with an optional key |\n| Pull request review | `graphify prs` and the three PR tools read open pull requests through the owner's `gh` login and map their changes onto graph communities. `graphify prs --triage` sends PR titles, authors and status to a model backend; the MCP tool returns the data only |\n| Graphify Cloud | A separate hosted product from the same company, with an OAuth MCP server at https://api.graphify.com/mcp listed in the official MCP registry, PR reviews and formal verification. Not graded in this listing |\n| Advisories | GHSA-pcc4-rvhr-2pr8 (moderate), published 19 October 2026, affecting 0.7.2 to 0.9.69 and fixed in 0.9.70 of 27 September 2026 |\n| Releases | 0.9.95 on 23 October 2026, 0.9.94 on 22 October and 0.9.93 on 20 October. 263 PyPI versions since 0.1.1 on 4 April 2026 |\n| Capabilities | code.repo, memory.graph, code.git, diagram.architecture |\n| Tags | open-source, local, self-hosted, free, no-card, python, apache-2.0, mcp, cli, stdio, coding-agent, agent-skills, hooks, knowledge-graph, llms-txt, no-telemetry, docker, pre-1.0 |\n| JSON | https://www.anchorterminal.com/api/v1/tools/graphify.json |\n\n## Score breakdown (methodology v0.6, October 2026 research run)\n\nAssessed 2026-10-26 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 58 | 11.6 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 77 | 12.5 |\n| Agent ergonomics | 13% | 16.2 | 77 | 12.5 |\n| Security \u0026 auth | 14% | 17.5 | 66 | 11.6 |\n| Payments \u0026 pricing | 10% | 12.5 | 60 | 7.5 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 81 | 7.1 |\n| Transparency \u0026 trust (editorial 78, provenance 88) | 7% | 8.8 | 83 | 7.3 |\n| Negative events | up to −15 | up to −15 | 2026-10-19. GHSA-pcc4-rvhr-2pr8 (moderate). In 0.7.2 to 0.9.69 the Fortran extractor's `cpp` step followed absolute and traversing `#include` lines in an untrusted `.F` file, reading host files into graph.json, the report and the model context on the default offline path. Fixed in 0.9.70 of 27 September 2026, with a Security line in the changelog the same day and the advisory published three weeks later. Fixed and documented, so -1. https://api.osv.dev/v1/vulns/GHSA-pcc4-rvhr-2pr8 | -1 |\n| **Total** | | | | **69 → B** |\n\n### Why each score\n\n- Reliability 58 (checked 2026-10-26): Read with the local-software lines, since the owner runs it. `graphifyy` installs from PyPI with uv or pipx, with `requires-python \u003e=3.10` stated (20). The CI workflow runs pytest on Python 3.10, 3.12, 3.13 and 3.14, an end-to-end `graphify install`, the Pi guard tests and generated-skill checks on every push and pull request to v8, over 458 test files. Whether the latest runs pass couldn't be read, because GitHub's web pages weren't reachable (15 of 25). Open issues weren't read. The changelog fixes many extraction regressions each release, each credited to a reporter and a pull request, which reads as handled rather than left open (15 of 25). CHANGELOG.md marks breaking changes, such as full-path node IDs in 0.9.0 and Java `inherits` edges in 0.8.18, and announces AST cache bumps, but on 0.x they ship in ordinary releases with no Breaking section (8 of 15). Version 0.9.95 (0).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 77 (checked 2026-10-26): MCP reading. All ten tools carry typed JSON Schema inputs in serve.py, though `get_node` and `get_neighbors` mark no field required and no tool has an output schema (20 of 25). llms.txt at docs.graphify.com, a Markdown copy of every page, llms-full.txt, and an MCP tool reference generated from serve.py (10). Descriptions say what each tool does in one sentence; the three PR tools also say when to call them, the graph tools don't say when not to (10 of 20). Types, defaults and a `bfs`/`dfs` enum, but `depth` is limited to 1 to 6 in text and code rather than in the schema, and `relation_filter` is a free string (10 of 15). Worked examples in the README and docs, documented exit codes 0, 3 and 4, refusals that list candidate nodes, and a troubleshooting page (12 of 15). A dated CHANGELOG.md with 238 entries, a docs changelog, and `schema_version` in graph.json (15).\n- Agent ergonomics 77 (checked 2026-10-26): MCP reading. Ten compact tools, about 7,900 characters of tool-definition source in serve.py (25). `token_budget` on `query_graph`, `get_neighbors` and `get_community` (default 2,000), `depth` capped at 6, `max_hops`, `top_n`, `relation_filter` and `context_filter`, and `--budget` on the CLI. No cursor paging (17 of 20). Exit codes for answer, ambiguous name and no match, ambiguous names refused with candidates instead of guessed, and a clear message when graph.json is missing or corrupt. MCP errors come back as text (15 of 20). Every tool reads, so calls are safe to repeat, but none carries readOnlyHint or destructiveHint (10 of 20). `graphify install` and `/graphify .` build a first graph, `graph_stats` is the documented first call, and code needs no key. Python only, though the CLI works from any language (10 of 15).\n- Security \u0026 auth 66 (checked 2026-10-26): Local-software reading, as for vibe-trading. 30 for what leaves the machine by default, 20 for approvals and least privilege, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Code parsing is local and no telemetry code was found. The HTTP server binds 127.0.0.1 with a Host allow-list and a constant-time key check, but only warns when bound to 0.0.0.0 without a key, and turns DNS-rebinding protection off for a wildcard bind. Headless `extract` sends docs to whichever provider's key is in the environment, with a printed notice, and community naming falls back to `claude -p` when no key is set (21). No MCP tool writes, and `uninstall --purge` refuses to delete the project or home folder. The Claude hooks inject a MANDATORY instruction before every Bash, Grep, Read and Glob call once a graph exists, the default install edits the user-wide ~/.claude/CLAUDE.md, and git hooks rebuild on every commit and checkout. Settings files get a `.graphify-bak` copy (14). The semantic pass wraps each file in a hash-stamped `untrusted_source` block, defangs chat-template tokens, sanitises labels in MCP output and redacts credential-shaped text, and SECURITY.md says this lowers injection rather than stopping it (11). An opt-in query log, a stderr line naming the backend and the variable that chose it, and a local cost.json (8). SECURITY.md with private reporting and a threat table, a valid security.txt, one published advisory with a fix, PyPI trusted publishing, and bandit and pip-audit in CI set not to fail the build. The SOC 2 engagement covers the hosted product only and has no report yet. No bug bounty (12).\n- Payments \u0026 pricing 60 (checked 2026-10-26): Read with the self-hosted rule. No payment protocol (0). The package is free under Apache 2.0, needs no account or card, and builds a code graph with no key, so 20, 20 and 20 on the last three lines. Graphify Cloud, a separate hosted product with public plan prices, is not scored here.\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 81 (checked 2026-10-26): 0.9.95 was published on 23 October 2026, three days before this check (30). 67 PyPI versions in the 90 days to 26 October, 0.9.29 to 0.9.95 (20). The 0.9.95 entry credits 21 community pull requests and the changelog names reporters on most fixes, with issue numbers past #4700. Issue threads and reply times weren't read, a judgement call (18 of 25). The official MCP registry holds `io.github.Graphify-Labs/graphify`, but that entry is Graphify Cloud's hosted server; the local `graphify-mcp` isn't listed. Published on PyPI (5 of 15). A frozen uv.lock in CI on four Python versions, dependency floors raised for named CVEs (starlette 1.3.1), and trusted publishing. No Dependabot configuration, and the audit jobs don't block (7 of 10).\n- Transparency \u0026 trust 83 (checked 2026-10-26): The editorial half. Apache 2.0, with the MIT portion before 0.9.25 kept in LICENSE-MIT (30). The README's privacy section says what stays local, which env vars send docs to which provider, that Kimi routes to China and how to turn backends off, and the docs agree. The README still says every query is logged by default while the code and configuration docs say logging is off by default, and graphify.com's security page says the core makes no network calls of its own, which the `claude` CLI fallback for community names stretches (20 of 30). The changelog dates breaking changes and removals, SECURITY.md supports the latest 0.9.x only, and graph.json carries a schema version. No deprecation policy or notice period (8 of 20). No telemetry, stated in the README and on the security page, and none found in the source (20).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (24 items): https://www.anchorterminal.com/fixes/graphify.md (JSON https://www.anchorterminal.com/fixes/graphify.json)\n\n### What we couldn't check\n\n- Category. code, because the main job is reading a repository's structure for a coding agent, beside sourcegraph-mcp and rea. agent-memory was the alternative, since the graph persists between sessions and Graphicle sits there, but Graphify keeps no record of decisions or past sessions beyond an opt-in Q\u0026A memory folder. Judgement call.\n- Kind is `mcp`, as for rea and Graphicle, though the installed skill and CLI are the surfaces most assistants use. Graded with the local-software Reliability lines, the MCP lines for Schema and Ergonomics, the local-software reading of Security and the self-hosted Payments rule.\n- firstReleased is 4 April 2026, the date of 0.1.1, the earliest version on PyPI. CHANGELOG.md has a 0.1.0 entry dated 3 April 2026 that PyPI doesn't list.\n- unchecked: github.com/robots.txt. The shell's proxy answered the request with an API error and WebFetch's permission request timed out, so no GitHub web page was fetched and the repository was read from a `git clone --depth 1` instead.\n- unchecked: the GitHub star count, CI run results, issue and pull request threads and the GitHub release pages. The lead's 135K matches the 135.4k in graphify.com's header on 26 October 2026 (135.3k on the terms page minutes later). YC's profile says 116K+ and its launch post 108K+. All three are the vendor's figures and none is used as popularity.\n- unchecked: PyPI download counts. PyPI's robots.txt disallows `/pypi/*/json`. The YC profile's 6.5M+ downloads is the vendor's claim.\n- The lead's about 40 languages matches the README's own count and the extension table in detect.py. graphify.com's security page says 36 bundled grammars. The lead's 20 and more assistants matches the README's table of 24 install targets.\n- Benchmark figures in the README and BENCHMARKS.md (LOCOMO recall@10 of 0.497 against mem0 and supermemory, 82 per cent key-fact coverage), Graphify Cloud's 80 per cent token saving and the YC post's first to cross 100K stars mid-batch are Graphify Labs' claims, not checked and not deducted.\n- The privacy policy says Graphify Labs maintains a SOC 2 Type II programme, while the security page says the engagement has started with no report. Both concern the hosted product. Recorded, not deducted.\n- Deduction of 1 for GHSA-pcc4-rvhr-2pr8, fixed in 0.9.70 and disclosed in the changelog the day of the fix, weighed below vibe-trading's critical advisories. Judgement call.\n- The claude CLI fallback for community names and the auto-detection of a backend from ambient keys are recorded as weaknesses, not deductions, because both print a notice and are documented in the code and the README's privacy section. Judgement call.\n- Graphify Cloud (app.graphify.com and the OAuth MCP server at api.graphify.com/mcp) is a separate hosted product and wasn't graded. It could take its own listing.\n- Graphicle. Its listing says its code-graph engine is a Rust port of Graphify. A grep of data/tools/graphicle.json for that line also printed part of its transparency note, which wasn't used.\n- Our own products. Graphify doesn't do LocalGhost's job (a personal AI server over the owner's own data) or letme's (choosing tools from our grades). Graded the normal way.\n- Nothing was installed or run. Tool counts, defaults and behaviour come from reading the source at 0.9.95.\n\n### Sources\n\n- git clone of v8 at 92741d1 (23 October 2026), the source read for every code fact: \u003chttps://github.com/Graphify-Labs/graphify\u003e (seen 2026-10-26)\n- README (install, privacy section, platforms, extras): \u003chttps://github.com/Graphify-Labs/graphify/blob/v8/README.md\u003e (seen 2026-10-26)\n- CHANGELOG.md (238 dated entries, relicensing in 0.9.25, Fortran fix in 0.9.70): \u003chttps://github.com/Graphify-Labs/graphify/blob/v8/CHANGELOG.md\u003e (seen 2026-10-26)\n- SECURITY.md (supported versions, reporting, threat table): \u003chttps://github.com/Graphify-Labs/graphify/blob/v8/SECURITY.md\u003e (seen 2026-10-26)\n- LICENSE, LICENSE-MIT and NOTICE: \u003chttps://github.com/Graphify-Labs/graphify/blob/v8/NOTICE\u003e (seen 2026-10-26)\n- pyproject.toml (package name, version, extras, entry points): \u003chttps://github.com/Graphify-Labs/graphify/blob/v8/pyproject.toml\u003e (seen 2026-10-26)\n- MCP server source (ten tools, HTTP key check, Host allow-list): \u003chttps://github.com/Graphify-Labs/graphify/blob/v8/graphify/serve.py\u003e (seen 2026-10-26)\n- model backends, auto-detection order and the claude CLI labelling fallback: \u003chttps://github.com/Graphify-Labs/graphify/blob/v8/graphify/llm.py\u003e (seen 2026-10-26)\n- assistant installers (CLAUDE.md, settings.json hooks, GEMINI.md, AGENTS.md, Cursor rule): \u003chttps://github.com/Graphify-Labs/graphify/blob/v8/graphify/install.py\u003e (seen 2026-10-26)\n- hook-guard nudge and strict-mode deny payloads: \u003chttps://github.com/Graphify-Labs/graphify/blob/v8/graphify/cli.py\u003e (seen 2026-10-26)\n- git hooks and graph.json merge driver: \u003chttps://github.com/Graphify-Labs/graphify/blob/v8/graphify/hooks.py\u003e (seen 2026-10-26)\n- query log (off by default): \u003chttps://github.com/Graphify-Labs/graphify/blob/v8/graphify/querylog.py\u003e (seen 2026-10-26)\n- PR commands and the triage backend: \u003chttps://github.com/Graphify-Labs/graphify/blob/v8/graphify/prs.py\u003e (seen 2026-10-26)\n- CI and trusted-publishing workflows: \u003chttps://github.com/Graphify-Labs/graphify/blob/v8/.github/workflows/ci.yml\u003e (seen 2026-10-26)\n- PyPI project page and release history (263 versions, trusted publishing): \u003chttps://pypi.org/project/graphifyy/\u003e (seen 2026-10-26)\n- PyPI robots.txt: \u003chttps://pypi.org/robots.txt\u003e (seen 2026-10-26)\n- OSV query for graphifyy and the record for GHSA-pcc4-rvhr-2pr8: \u003chttps://api.osv.dev/v1/vulns/GHSA-pcc4-rvhr-2pr8\u003e (seen 2026-10-26)\n- docs llms.txt and robots.txt: \u003chttps://docs.graphify.com/llms.txt\u003e (seen 2026-10-26)\n- docs, MCP setup: \u003chttps://docs.graphify.com/mcp/overview.md\u003e (seen 2026-10-26)\n- docs, HTTP server options and key: \u003chttps://docs.graphify.com/mcp/shared-http.md\u003e (seen 2026-10-26)\n- docs, MCP tool reference: \u003chttps://docs.graphify.com/reference/mcp-tools.md\u003e (seen 2026-10-26)\n- docs, configuration (backends, query log off by default): \u003chttps://docs.graphify.com/reference/configuration.md\u003e (seen 2026-10-26)\n- docs, edge confidence labels: \u003chttps://docs.graphify.com/concepts/provenance.md\u003e (seen 2026-10-26)\n- docs, plans and pricing (Cloud; open-source CLI free and separate): \u003chttps://docs.graphify.com/pricing/overview.md\u003e (seen 2026-10-26)\n- docs, Claude Code integration: \u003chttps://docs.graphify.com/integrations/claude-code.md\u003e (seen 2026-10-26)\n- graphify.com robots.txt, home page and sitemap: \u003chttps://graphify.com/robots.txt\u003e (seen 2026-10-26)\n- graphify.com terms of service (3 October 2026): \u003chttps://graphify.com/terms\u003e (seen 2026-10-26)\n- graphify.com privacy policy (October 2026): \u003chttps://graphify.com/privacy\u003e (seen 2026-10-26)\n- graphify.com subprocessors (hosted service): \u003chttps://graphify.com/subprocessors\u003e (seen 2026-10-26)\n- graphify.com security page (SOC 2 engagement started, no report): \u003chttps://graphify.com/security\u003e (seen 2026-10-26)\n- graphify.com official-site page (graphify.net not affiliated): \u003chttps://graphify.com/graphify-net-vs-graphify-com\u003e (seen 2026-10-26)\n- security.txt: \u003chttps://graphify.com/.well-known/security.txt\u003e (seen 2026-10-26)\n- Y Combinator company page (Summer 2026, active) and its robots.txt: \u003chttps://www.ycombinator.com/companies/graphify-labs\u003e (seen 2026-10-26)\n- official MCP registry search (only the hosted Cloud server is listed): \u003chttps://registry.modelcontextprotocol.io/v0/servers?search=graphify\u003e (seen 2026-10-26)\n- RDAP for graphify.com: \u003chttps://rdap.org/domain/graphify.com\u003e (seen 2026-10-26)\n\n## Score history\n\nEvery move of a score since the listing was graded, newest first, with its cause. A score can't move without an entry here. JSON: https://www.anchorterminal.com/api/v1/tools/graphify/history.json\n\n- 2026-10-26: graded 69 B (methodology 0.6)\n\n## Who's behind it (provenance 88/100, checked 2026-10-26)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | Graphify Labs | 20/20 |\n| Domain age | graphify.com, registered 2007-07-23 (19 years) | 15/15 |\n| Endpoint on the vendor's domain | no hosted endpoint | n/a |\n| Terms of service | published | 10/10 |\n| Privacy policy | published | 10/10 |\n| Status page | not found | 0/10 |\n| Changelog | published | 10/10 |\n| security.txt | valid | 10/10 |\n\nThe terms and privacy policy name Graphify Labs, with no corporate suffix found, and the terms are governed by Delaware law. Y Combinator's directory lists Graphify Labs in San Francisco.\n\nThe terms of 3 October 2026 cover the hosted service and say the open-source core is governed by its own licence, so the Apache 2.0 licence stands in for terms for this listing.\n\ngraphify.com/.well-known/security.txt names founders@graphifylabs.ai and expires on 1 July 2027. SECURITY.md asks for reports through GitHub private vulnerability reporting.\n\nRDAP gives a registration date of 23 July 2007 for graphify.com, last changed on 8 July 2026, three months after the first release.\n\nThere is no hosted endpoint for this listing. The MCP server and CLI run on the owner's host; Graphify Cloud's endpoint at api.graphify.com is a separate product.\n\ngraphify.com says graphify.net, graphiffy.com and app.graphify.net are not operated by Graphify Labs.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://graphify.com/terms), not read yet.\n\n\n**Privacy policy** (https://graphify.com/privacy), not read yet.\n\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Strengths\n\n- Code graphs build offline with tree-sitter, with no embeddings and no model call, and no telemetry code was found in the source\n- Ten MCP tools with typed JSON Schema inputs, all of them reads, with token budgets on the larger ones\n- 67 PyPI releases in the 90 days to 26 October 2026, each with a dated CHANGELOG.md entry crediting the pull requests\n- Edges are labelled EXTRACTED, INFERRED or AMBIGUOUS, and ambiguous names are refused with candidates and exit code 3\n- Docs at docs.graphify.com with llms.txt and a Markdown copy of every page, plus a valid security.txt\n\n## Weaknesses\n\n- Headless extraction sends docs to whichever cloud provider's key is set, Gemini first and Kimi in China second, unless `GRAPHIFY_BACKEND` is set\n- Community naming falls back to the `claude` CLI when no key is set, which sends node names to Anthropic through the owner's plan\n- Version 0.9.95, with breaking changes such as node IDs in 0.9.0 shipped inside 0.x releases\n- One moderate advisory, a host-file read through the Fortran extractor in 0.7.2 to 0.9.69, fixed in 0.9.70\n- No readOnlyHint or destructiveHint annotations, and the local server isn't in the official MCP registry\n\n\n\n## Before you call it (notes for agents)\n\n1. Install `graphifyy` with two y's; other `graphify*` packages on PyPI are not the project's\n2. Set `GRAPHIFY_BACKEND=none` or use `--code-only` when no source or doc text may leave the machine\n3. Pass an absolute path to graph.json in the MCP config, and run `graph_stats` first to check the graph loaded\n4. Set `GRAPHIFY_API_KEY` before binding the HTTP server to 0.0.0.0; it only warns when no key is set\n5. Run 0.9.70 or later before indexing an untrusted repository, because earlier versions carry the Fortran file-read advisory\n\n## Connect\n\nInstall:\n\n```bash\nuv tool install \"graphifyy[mcp]\" # then: graphify install, and /graphify . in the assistant\n```\n\nClaude Code:\n\n```bash\nclaude mcp add --transport stdio graphify -- graphify-mcp /absolute/path/to/repo/graphify-out/graph.json\n```\n\nMCP client configuration:\n\n```json\n{\n \"mcpServers\": {\n \"graphify\": {\n \"args\": [\n \"/absolute/path/to/repo/graphify-out/graph.json\"\n ],\n \"command\": \"graphify-mcp\"\n }\n }\n}\n```\n\nHeadless / CI:\n\n```json\n{\n \"command\": \"graphify query \\\"$QUESTION\\\" --budget 2000\"\n}\n```\n\nThrough letme: https://letme.dev/graphify (letme picks it for code.git, the top-graded tool for the job, letme picks it for diagram.architecture, the top-graded tool for the job). letme answers with the pick and how to call it direct. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Sourcegraph MCP Server | C | 57.5 | 695 | code.repo, code.git | no | https://www.anchorterminal.com/tools/sourcegraph-mcp.md |\n| graft | D | 52.5 | 857 | code.git, code.repo | no | https://www.anchorterminal.com/tools/graft.md |\n| Zep | BB | 73.9 | 82 | memory.graph | no | https://www.anchorterminal.com/tools/zep.md |\n| GitHub MCP Server | BB | 70.3 | 172 | code.repo | no | https://www.anchorterminal.com/tools/github-mcp-server.md |\n| Graphicle | B | 69.8 | 185 | memory.graph | no | https://www.anchorterminal.com/tools/graphicle.md |\n| Glean | B | 69.8 | 187 | memory.graph | no | https://www.anchorterminal.com/tools/glean.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- Code is parsed locally with tree-sitter, with no embeddings, vector store or model call. `graphify update .` and `graphify extract --code-only` run offline; docs, PDFs and images need a semantic pass through the assistant's model or a configured backend (source: \u003chttps://github.com/Graphify-Labs/graphify/blob/v8/README.md\u003e)\n- Each edge carries a confidence label, EXTRACTED, INFERRED or AMBIGUOUS. AMBIGUOUS comes from the semantic pass, and INFERRED edges can also come from static name and import resolution with no model (source: \u003chttps://docs.graphify.com/concepts/provenance.md\u003e)\n- Headless `graphify extract` picks a backend from whichever key is set, in the order Gemini, Kimi, Claude, OpenAI, DeepSeek, Azure, Bedrock, then Ollama, and prints the variable that chose it. Kimi routes to Moonshot AI in China. `GRAPHIFY_BACKEND=none` turns every backend off (source: \u003chttps://github.com/Graphify-Labs/graphify/blob/v8/graphify/llm.py\u003e)\n- `graphify label`, and `graphify cluster-only` when no labels file exists, fall back to naming communities through the `claude` CLI when no key is set and the CLI is on PATH. The prompt carries up to 12 node names per community. The fallback is announced on stderr and `GRAPHIFY_BACKEND=none` stops it (source: \u003chttps://github.com/Graphify-Labs/graphify/blob/v8/graphify/llm.py\u003e)\n- `graphify claude install` writes a graphify section to ./CLAUDE.md and two PreToolUse hooks to .claude/settings.json (Bash|Grep and Read|Glob, 10-second timeout), keeping a `.graphify-bak` copy. When a graph exists the hooks add a MANDATORY instruction to run `graphify query` first; `--strict` denies the first raw read in each session (source: \u003chttps://github.com/Graphify-Labs/graphify/blob/v8/graphify/install.py\u003e)\n- `graphify hook install` adds post-commit, post-checkout, post-merge and post-rewrite blocks that rebuild the code-only graph in a detached process, and registers a union merge driver for graph.json in the local git config and .gitattributes. The rebuild makes no model call (source: \u003chttps://github.com/Graphify-Labs/graphify/blob/v8/graphify/hooks.py\u003e)\n- One GitHub advisory, GHSA-pcc4-rvhr-2pr8 (moderate), published 19 October 2026. The Fortran extractor's `cpp` step let an untrusted `.F` file read host files into the graph in 0.7.2 to 0.9.69. Fixed in 0.9.70 of 27 September 2026 (source: \u003chttps://api.osv.dev/v1/query, package graphifyy\u003e)\n- No telemetry code was found in the source at 0.9.95. Outbound calls are the chosen model backend, URLs the owner passes to `graphify add`, and `gh` for the PR commands. The local query log is off by default, though the README still describes it as on (source: \u003chttps://github.com/Graphify-Labs/graphify/blob/v8/graphify/querylog.py\u003e)\n- PyPI lists 263 versions of `graphifyy`, from 0.1.1 on 4 April 2026 to 0.9.95 on 23 October 2026, published through trusted publishing. The README warns that other `graphify*` packages on PyPI are not affiliated (source: \u003chttps://pypi.org/project/graphifyy/\u003e)\n- Y Combinator's directory lists Graphify Labs in Summer 2026, active, in San Francisco, with Safi Shamsi as founder. Star counts of 108K, 116K and 135.4k appear on the YC launch post, the YC profile and graphify.com's header; GitHub's own page wasn't read (source: \u003chttps://www.ycombinator.com/companies/graphify-labs\u003e)\n- Graphicle, listed as graphicle, is a separate product from KarLex AI whose code-graph engine is a Rust port of Graphify. Graphify does neither LocalGhost's job nor letme's\n\n- #4 of 13 in Best code, repository and documentation tools for AI agents: https://www.anchorterminal.com/best/code/index.md\n- All 22 code comparisons: https://www.anchorterminal.com/compare/code/index.md\n\n## Compare\n\n- [Azure DevOps MCP Server vs Graphify](https://www.anchorterminal.com/compare/azure-devops-mcp-vs-graphify.md): B 66.3 vs B 69\n- [GitHub MCP Server vs Graphify](https://www.anchorterminal.com/compare/github-mcp-server-vs-graphify.md): BB 70.3 vs B 69\n- [Graphify vs Sourcegraph MCP Server](https://www.anchorterminal.com/compare/graphify-vs-sourcegraph-mcp.md): B 69 vs C 57.5\n- [Git (MCP reference server) vs Graphify](https://www.anchorterminal.com/compare/git-reference-server-vs-graphify.md): D 51.9 vs B 69\n- [graft vs Graphify](https://www.anchorterminal.com/compare/graft-vs-graphify.md): D 52.5 vs B 69\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on graphify.com or one of its subdomains, or the README of github.com/Graphify-Labs/graphify. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"graphify\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/graphify\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/graphify.svg\" alt=\"Graphify on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Graphify on Anchor Terminal](https://www.anchorterminal.com/badges/graphify.svg)](https://www.anchorterminal.com/tools/graphify)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/graphify\"\u003eGraphify on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Graphify is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/graphify-dark.png\n- Light: https://www.anchorterminal.com/assets/share/graphify-light.png\n- Create a video and download its frames: https://www.anchorterminal.com/assets/listing-video/index.html?listing=graphify\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-26", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.6", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Code \u0026 developer platforms", "url": "https://www.anchorterminal.com/categories/code" }, { "name": "Graphify", "url": "" } ], "description": "Graphify is an open-source Python tool from Graphify Labs that turns a repository, plus its docs and media, into a knowledge graph a coding agent queries through a CLI, an installed assistant skill or a local ten-tool MCP server.", "facts": [ "rank #217 of 1211", "None auth", "0 desk reviews" ], "h1": "Graphify", "image": "https://www.anchorterminal.com/assets/og/tools-graphify.png", "path": "/tools/graphify", "published": "2026-10-01", "section": "tools", "title": "Graphify review (2026): pricing, alternatives and grade B", "toc": null, "updated": "2026-10-26", "url": "https://www.anchorterminal.com/tools/graphify" }, "tokens": { "markdown": 8800, "slim": 1930 }, "version": 1 }