{"id":"c2a6c388-a3f7-4141-819c-b18f773f5e80","slug":"crg","kind":"mcp","name":"crg","summary":"Knowledge graph for token-efficient code reviews -- semantic search and call-graph resolution across your codebase.","owner":"n24q02m","repoUrl":"https://github.com/n24q02m/crg","license":"Apache-2.0","licenseTier":"permissive","trust":"community","stars":76,"match":null,"fewStars":false,"format":"mcp","createdAt":"2026-03-20T11:11:32.000Z","addedAt":"2026-10-14T03:45:12.150Z","logoUrl":"https://avatars.githubusercontent.com/u/135627235?v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["developer-tools","memory-knowledge","cloud-infra"],"tags":["antigravity","claude-code","code-review","codex","copilot","gemini-cli","knowledge-graph","tree-sitter"],"runtime":"python","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-15T02:52:40.392Z","sample":false,"url":"https://conduits.dev/tools/crg","language":"Python","transports":["stdio"],"install":{"pypi":"better-code-review-graph"},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"# Better Code Review Graph\n\n> **Renamed (2026-09-13):** repo is now `crg` — CLI-first (`crg` command). PyPI package stays `better-code-review-graph`; MCP server is a secondary surface.\n\nmcp-name: io.github.n24q02m/crg\n\n**Knowledge graph for token-efficient code reviews -- semantic search and call-graph resolution across your codebase.**\n\n\n[](https://mcp.n24q02m.com/get-started/modes-overview/)\n[](https://github.com/n24q02m/crg/actions/workflows/ci.yml)\n[](https://codecov.io/gh/n24q02m/crg)\n[](https://pypi.org/project/better-code-review-graph/)\n[](LICENSE)\n\n\n[](#)\n[](#)\n[](https://github.com/python-semantic-release/python-semantic-release)\n[](https://developer.mend.io/)\n\n\n\n Sister projects from n24q02m (click to expand)
\n\n| Project | Tagline | Tag |\n|---|---|---|\n| [agent-chat-plugin](https://github.com/n24q02m/agent-chat-plugin) | Peer AI agents chat in a shared folder — no human relay, no orchestrator, wor... | Tooling |\n| [crg](https://github.com/n24q02m/crg) | Knowledge graph for token-efficient code reviews -- semantic search and call-... | MCP |\n| [better-drive](https://github.com/n24q02m/better-drive) | 2-way Google Drive sync with .driveignore filter — rclone engine, Windows tray | Tooling |\n| [better-email-mcp](https://github.com/n24q02m/better-email-mcp) | IMAP/SMTP email for AI agents -- read, send, organize folders, and manage att... | MCP |\n| [better-godot-mcp](https://github.com/n24q02m/better-godot-mcp) | Composite MCP server for Godot Engine -- 17 composite tools for AI-assisted g... | MCP |\n| [better-notion-mcp](https://github.com/n24q02m/better-notion-mcp) | Markdown-first Notion for AI agents -- pages, databases, blocks, and comments... | MCP |\n| [better-semantic-release](https://github.com/n24q02m/better-semantic-release) | Drop-in python-semantic-release fork with built-in release-safety guards (orp... | Tooling |\n| [better-telegram-mcp](https://github.com/n24q02m/better-telegram-mcp) | Telegram for AI agents -- messages, chats, media, and contacts across both bo... | MCP |\n| [better-workspace-mcp](https://github.com/n24q02m/better-workspace-mcp) | Google Workspace MCP server (Docs/Drive/Calendar/Gmail/Sheets/Slides/Tasks/Ch... | MCP |\n| [claude-plugins](https://github.com/n24q02m/claude-plugins) | Claude Code plugin marketplace for the n24q02m MCP servers -- install web sea... | Marketplace |\n| [imagine-mcp](https://github.com/n24q02m/imagine-mcp) | Image and video understanding + generation for AI agents -- across Gemini, Op... | MCP |\n| [jules-task-archiver](https://github.com/n24q02m/jules-task-archiver) | Chrome Extension for bulk operations on Jules tasks via batchexecute API -- a... | Tooling |\n| [mcp-core](https://github.com/n24q02m/mcp-core) | Shared foundation for building MCP servers -- Streamable HTTP transport, OAut... | MCP |\n| [mnemo-mcp](https://github.com/n24q02m/mnemo-mcp) | Persistent AI memory with hybrid search and embedded sync. Open, free, unlimi... | MCP |\n| [fastretrieval](https://github.com/n24q02m/fastretrieval) | Fast multi-model retrieval runtime for ONNX and GGUF embeddings, reranking, and model contracts | Library |\n| [skret](https://github.com/n24q02m/skret) | Secrets without the server. | CLI |\n| [tacet](https://github.com/n24q02m/tacet) | A self-distilling neuro-symbolic cascade that amortises LLM cost across knowl... | Tooling |\n| [web-core](https://github.com/n24q02m/web-core) | Shared web infrastructure package for search, scraping, HTTP security, and st... | Library |\n| [wet-mcp](https://github.com/n24q02m/wet-mcp) | Open-source MCP server for AI agents: web search, content extraction, and lib... | MCP |\n\n \n\n\n\n\n ![\"crg](\"https://glama.ai/mcp/servers/n24q02m/crg/badge\")
\n\n\nAn MCP server that parses your codebase with [Tree-sitter](https://tree-sitter.github.io/tree-sitter/), builds a structural graph of functions/classes/imports, and gives Claude (or any MCP client) precise context so it reads only what matters instead of the whole tree. Semantic search runs through the local ONNX model registry from [fastretrieval](https://github.com/n24q02m/fastretrieval) by default (zero config, no API key), with an optional cloud embedding chain. Fork of [code-review-graph](https://github.com/tirth8205/code-review-graph) with fixed multi-word search, qualified call resolution, dual-mode embeddings, output pagination, and production CI/CD.\n\n## v2.0 migration (BREAKING)\n\nv2.0 adds temporal columns (`valid_from_sha` / `valid_to_sha` on every node + edge) and an opt-in security scanner. The schema migration is auto-applied on first `GraphStore` open, and a backup of the pre-2.0 DB is saved to `.pre-2.0.bak` so you can roll back. See [BREAKING_CHANGES.md](BREAKING_CHANGES.md) for the full schema-change list, behavior changes, environment requirements, and the downgrade procedure (`CRG_DOWNGRADE_TO_1_X=1 uv run crg`).\n\n## Table of contents\n\n- [v2.0 migration (BREAKING)](#v20-migration-breaking)\n- [Install](#install)\n- [Usage](#usage)\n- [Smithery](#smithery)\n- [Configuration](#configuration)\n- [Tools](#tools)\n- [CLI](#cli)\n- [Features](#features)\n- [Comparison](#comparison)\n- [Security](#security)\n- [Build from source](#build-from-source)\n- [Trust model](#trust-model)\n- [Migration & changelog](#migration--changelog)\n- [Documentation](#documentation)\n- [License](#license)\n\n## Install\n\nFor OMP and other local coding harnesses, the primary surface is the package CLI\nplus the bundled `skills/` workflows. The skills invoke the CLI directly and do\nnot require an MCP server mapping.\n\n```bash\n# Run without a persistent install (short `crg` script; PyPI package name stays\n# better-code-review-graph, so `uvx` needs the explicit --from form)\nuvx --python 3.13 --from better-code-review-graph crg graph build --full-rebuild \\\n --repo-root /path/to/repo\nuvx --python 3.13 --from better-code-review-graph crg graph stats \\\n --repo-root /path/to/repo\n\n# Or install the console scripts (installs both `crg` and the legacy long name)\npip install better-code-review-graph\ncrg query search --search-query \"authentication\" \\\n --repo-root /path/to/repo\n```\n\nThe optional Semgrep engine for deeper security scans is a separate extra:\n\n```bash\npip install 'better-code-review-graph[security]'\n```\n\nMCP stdio remains a secondary protocol adapter for clients that require it:\n\n```json\n{\n \"mcpServers\": {\n \"crg\": {\n \"command\": \"uvx\",\n \"args\": [\"--python\", \"3.13\", \"better-code-review-graph\"],\n \"env\": { \"MCP_TRANSPORT\": \"stdio\" }\n }\n }\n}\n```\n\nInstall matrix (stdio unless noted; the CLI-first usage above stays the primary surface):\n\n| Client | Install |\n|---|---|\n| Claude Code (plugin) | `/plugin marketplace add n24q02m/claude-plugins` then `/plugin install better-code-review-graph@n24q02m-plugins` |\n| Claude Code (stdio) | `claude mcp add crg -- uvx --python 3.13 better-code-review-graph` |\n| Codex | register stdio command `uvx --python 3.13 better-code-review-graph` under `mcp_servers` in `~/.codex/config.toml` |\n| Gemini CLI | add the `mcpServers` JSON above to `~/.gemini/settings.json` |\n| Cursor / Windsurf | add the `mcpServers` JSON above via the client's MCP settings (`mcp.json`) |\n| Any client (HTTP self-host) | point the client at `https:///mcp` (`MCP_TRANSPORT=http`) -- self-host only, no hosted endpoint |\n\n**Install with an AI agent** -- paste this to your AI coding agent:\n\n> Install MCP server `crg` following the steps at\n> https://raw.githubusercontent.com/n24q02m/claude-plugins/main/plugins/better-code-review-graph/setup-with-agent.md\n\nFull CLI usage is in [CLI](#cli). Optional per-client MCP setup is at\n**[mcp.n24q02m.com/servers/better-code-review-graph/setup/](https://mcp.n24q02m.com/servers/better-code-review-graph/setup/)**.\n\n## Usage\n\nTwo ways to run the server, plus the surfaces to consume it.\n\n### Dev: uv, no auth (loopback only)\n\n```bash\n# instance config lives at $CRG_CONFIG_DIR or ~/.crg (same schema as hull's\n# config.toml); a default no-auth template is fine for local dev\nuv run better-code-review-graph server start\n# -> http://127.0.0.1:8000/mcp (no-auth is refused on any off-loopback bind)\n```\n\n### Always-on: docker (token auth)\n\n```bash\ncp docker-config/config.example.toml docker-config/config.toml\n# mint a token + hash (hull CLI ships with crg's dependency tree):\n# TOKEN=$(python -c \"import secrets; print(secrets.token_urlsafe(32))\")\n# hull token hash \"$TOKEN\" # paste output into token_hash in config.toml\ndocker compose up -d\n```\n\nThe compose file builds the Dockerfile's `http` target (image `crg:http`),\npublishes the container on host loopback only\n(`127.0.0.1:${CRG_PORT:-8772}:8080`), and mounts\n`./docker-config/config.toml` read-only at the container's config dir\n(`CRG_CONFIG_DIR=/data/config`); graph state persists in the `crg-data`\nnamed volume. All state stays on your machine.\n\n### Consuming: CLI or MCP\n\nCLI (local graphs, no server needed):\n\n```bash\ncrg graph build --full-rebuild --repo-root /path/to/repo\ncrg query search --search-query \"authentication\" --repo-root /path/to/repo\n```\n\nMCP over HTTP (remote/always-on): point any MCP client at\n`http://127.0.0.1:8772/mcp` with `Authorization: Bearer `:\n\n```json\n{\n \"mcpServers\": {\n \"better-code-review-graph\": {\n \"url\": \"http://127.0.0.1:8772/mcp\",\n \"headers\": { \"Authorization\": \"Bearer \" }\n }\n }\n}\n```\n\n### Per-task model configuration\n\nEach task (embed / rerank / chat / jev_score) resolves its own OpenAI-spec\nprovider cell from `[models.]` in the instance config: an independent\n`base_url` + `api_key` + `model`. Cloud or local is purely a config choice —\npoint `base_url` at OpenRouter, a vendor, or your own local gateway\n(e.g. `http://host.docker.internal:11434/v1`). API keys are host-only\nmaterial: keep them in `config.toml` (gitignored under `docker-config/`) or\nsupply via `HULL__API_KEY` env; they are never end-user supplied.\n\n## Local-first boundary\n\nCRG is local-first for coding workflows:\n\n- **CLI and bundled Skills are the primary surfaces** for graph build/query,\n impact analysis, review context, security scans, and repository onboarding.\n- **MCP stdio is the secondary protocol adapter** over the same local domain\n services; it does not maintain a separate graph implementation.\n- Graph state stays in `/.crg/graph.db` unless an explicit\n multi-user/self-host configuration selects another data directory.\n- PyPI, CI, security scanning, GitHub releases, and eligible stable MCP Registry\n publication remain active. Historical public OCI tags are retained, but new\n public Docker Hub/GHCR images are no longer published.\n- CRG has no hosted Cloudflare runtime in the target topology.\n\n## Smithery\n\nThe repo ships a [`smithery.yaml`](smithery.yaml) so the server can be built and\nrun through [Smithery](https://smithery.ai). It deploys over **stdio** and needs\nno startup configuration -- the config schema is empty, and any optional cloud\nembedding/summary keys are supplied at runtime through the server's own config\nflow (see [Configuration](#configuration) below). The launch command is the same\n`uvx` invocation as a local install:\n\n```yaml\nstartCommand:\n type: stdio\n commandFunction: |-\n (config) => ({ command: 'uvx', args: ['--python', '3.13', 'crg'] })\n```\n\n## Configuration\n\nEverything works **out of the box with zero configuration** -- semantic search\nuses the local ONNX registry from [fastretrieval](https://github.com/n24q02m/fastretrieval)\n(`Qwen3-Embedding-0.6B` is the current built-in reference entry, ~570 MB\ndownloaded on first `graph embed`). This reference entry is not a Qwen-only\nboundary: any built-in registry ID or valid non-Qwen artifact manifest follows\nthe same resolver. All environment variables below are optional and only needed\nfor cloud embeddings, LLM summaries, or an explicit BYO local artifact.\n\n### Model selection\n\nEmbeddings select the first `provider/model` entry in `EMBEDDING_MODELS`; later\nentries are retained as configuration but are not runtime fallbacks. The summary\nmodel comes from the `model` field of the `[models.chat]` cell (an unconfigured\ncell disables summaries). Transport always comes from the per-task\n`[models.]` cell (OpenRouter pre-wired default) — model-name prefixes\nonly select wire details, never keys.\n\n| Variable | Purpose | Empty (default) |\n|---|---|---|\n| `EMBEDDING_MODELS` | Cloud embedding selection; the first entry is active | Local fastretrieval registry |\n| `[models.chat]` cell `model` | Completion model selection for `graph(action=\"summarize\")` | Summaries disabled |\n\nCohere `embed-v4.0` requests and stores **1024 dimensions**; other backends retain\n768-dimensional storage. CRG never slices, pads, or silently accepts a different\nprovider width. The embedding row's model and byte width must match before reuse.\nRun `graph(action=\"embed\")` after changing models or upgrading an old 768-wide\nCohere index. Searches reject incompatible widths before a provider call; graph\nnodes are retained and re-embedding replaces only stale vectors.\n\n### Provider API keys\n\nThe key lives in the per-task cell's `api_key` (host-only; see the table below).\nKeys alone never select models: an empty embedding chain stays local, and an empty summary\nchain stays disabled. A configured cloud error does not fall back to local or\nanother provider. Summarizers require a chat-completion model.\n\n| Task | Config cell | Notes |\n|---|---|---|\n| Embedding | `[models.embed]` in the instance config (`base_url` + `api_key` + `model`), or `HULL_EMBED_API_KEY` env | Plain OpenAI-spec HTTP through hull-core; OpenRouter pre-wired default. `EMBEDDING_MODELS` picks the model name(s) — keys never select a model. Model prefixes (`cohere/…`, `jina_ai/…`, `gemini/…`) select wire details only (e.g. Cohere `input_type`); there are no per-vendor API keys. Cohere embed-4.0 direct is the documented opt-in exception (spec 2026-09-26 §9). |\n| Summarizer | `[models.chat]` cell (or `HULL_CHAT_API_KEY`) | Requires a chat-completion model; OpenRouter default. |\n\nVendor-specific key env vars (`JINA_AI_API_KEY`, `GEMINI_API_KEY`,\n`OPENAI_API_KEY`, `GOOGLE_VERTEX_EXPRESS_API_KEY`, …) are **not read** by\ncrg; the removed per-vendor dispatch lived in the pre-de-host stack.\n\n### Advanced\n\n| Variable | Purpose |\n|---|---|\n| `EMBEDDING_MODELS` | Comma-separated embedding model chain; the first entry is the cloud model (host-owned; keys never select a model). Legacy `EMBEDDING_MODEL` is honored with a deprecation warning until the next release. |\n| `DISABLE_LOCAL_EMBED` | Skip the local ONNX download; embedding is unavailable unless a cloud chain is configured |\n| `LOCAL_RERANK_MODEL` | Fastretrieval `TextCrossEncoder` model ID for bounded semantic reranking | Blank (disabled) |\n| `LOCAL_EMBEDDING_DIM` | Required dimension for an external model ID without a manifest | `0` |\n| `LOCAL_EMBEDDING_MODEL_FILE` | ONNX file path inside a manifest-backed artifact directory | `onnx/model.onnx` |\n| `LOCAL_EMBEDDING_POOLING` | Explicit pooling for an external ID without a manifest: `CLS`, `MEAN`, `LAST_TOKEN`, or `DISABLED` | `MEAN` |\n| `LOCAL_EMBEDDING_NORMALIZE` | Explicit L2 normalization for an external ID without a manifest | `true` |\n| `CRG_DATA_DIR` | Override the per-user data directory (default `~/.crg`) used for per-user graphs and credentials in HTTP multi-user mode |\n| `EMBEDDING_BACKEND` / `EMBEDDING_MODEL` | **Deprecated** singular vars, honored one release with a warning -- migrate to `EMBEDDING_MODELS`. The pre-de-host summary-model and base-URL env vars are no longer read; model + transport live in the `[models.*]` cells |\n\nWhen `LOCAL_RERANK_MODEL` is configured, semantic vector search retrieves a\nbounded candidate pool of `min(max(limit * 4, limit), 100)` rows, applies the\nexisting `kind`, `repo`, and live-row filters, then reranks that pool and returns\nat most `limit` rows. The response uses `search_mode=\"semantic_reranked\"` and\nadds `rerank_score` while preserving `similarity_score`. Blank keeps the\nexisting `limit * 2` vector path and `search_mode=\"semantic\"`. Configured\nreranker failures return an explicit error; CRG does not silently fall back to\nvector or keyword results. Keyword searches, including `as_of` snapshots, do\nnot invoke the reranker.\n\n### Example -- cloud embeddings + summaries\n\n`~/.crg/config.toml` (write by hand, or start from `hull config init` which\npre-wires OpenRouter defaults):\n\n```toml\n[models.embed]\nbase_url = \"https://openrouter.ai/api/v1\"\napi_key = \"sk-or-...\"\nmodel = \"cohere/embed-v4.0\"\n\n[models.chat]\nbase_url = \"https://openrouter.ai/api/v1\"\napi_key = \"sk-or-...\"\nmodel = \"minimax/minimax-m3:free\"\n```\n\nEquivalent env surface for the MCP server entry (keys override the cells;\nmodel names still come from `EMBEDDING_MODELS` / the `model` field):\n\n```json\n{\n \"mcpServers\": {\n \"crg\": {\n \"command\": \"uvx\",\n \"args\": [\"--python\", \"3.13\", \"better-code-review-graph\"],\n \"env\": {\n \"MCP_TRANSPORT\": \"stdio\",\n \"EMBEDDING_MODELS\": \"cohere/embed-v4.0\",\n \"HULL_EMBED_API_KEY\": \"sk-or-...\",\n \"HULL_CHAT_API_KEY\": \"sk-or-...\"\n }\n }\n }\n}\n```\n\nCohere embedding is paid. Authorize a bounded budget before a live index/query;\nthe Minimax-free completion choice does not make embeddings free. Model-name\nprefixes (`cohere/…`, `openrouter/…`) select wire details only — transport and\ncredentials come from the `[models.*]` cells, which the host owns.\n\nCRG currently has **no cloud rerank call**: `LOCAL_RERANK_MODEL` is its only\nreranking path. Setting `RERANK_MODELS` or `RERANK_API_BASE` does not enable one.\n\n## Tools\n\nSix tools, each grouping related actions to keep the tool surface small.\n\n### `graph` -- Graph lifecycle\n\nActions: `build` | `update` | `stats` | `embed` | `export` | `summarize`\n\n| Action | Description |\n|:-------|:------------|\n| `build` | Full or incremental graph build. Set `full_rebuild=true` to re-parse all files; pass `roots` to federate extra repo directories into one graph. |\n| `update` | Alias for `build` with `full_rebuild=false` (incremental). |\n| `stats` | Graph size, languages, node/edge breakdown, embedding count. |\n| `embed` | Compute vector embeddings for semantic search. Dual-mode: local ONNX or cloud chain. |\n| `export` | Export the graph as `graphml` / `json-ld` / `dot` / `cypher`. Inline or to `output_path`. |\n| `summarize` | LLM-generated one-paragraph docstrings for `Function` nodes (via the `[models.chat]` cell; no-op when no model is configured). Calls bounded by `max_nodes`. |\n\n### `query` -- Graph queries\n\nActions: `query` | `search` | `impact` | `large_functions` | `spot_check` | `renamed_in_diff` | `diff`\n\n| Action | Description |\n|:-------|:------------|\n| `query` | Predefined patterns: `callers_of`, `callees_of`, `imports_of`, `importers_of`, `children_of`, `tests_for`, `inheritors_of`, `file_summary`. |\n| `search` | Search code entities by name/keyword or semantic similarity. |\n| `impact` | Blast radius of changed files. Auto-detects from git diff. Paginated with `max_results`. |\n| `large_functions` | Find functions/classes exceeding a line-count threshold. |\n| `spot_check` | Random callsite snippets from the last `callers_of`/`callees_of`/`inheritors_of`/`importers_of` result. |\n| `renamed_in_diff` | Symbols whose callsite line shifted versus a base ref. |\n| `diff` | Nodes added/removed/modified between two commit SHAs (`from_sha`, `to_sha`). |\n\nMost read actions accept `as_of=` for temporal (point-in-time) snapshots\nand `repo=` to scope a federated multi-repo graph.\n\n### `review` -- Code review context\n\nActions: `context` (default) | `delta`\n\nToken-optimized review context with structural summary, impacted nodes, source\nsnippets, and review guidance. `context` auto-detects changed files from the\ngit diff; `delta` (with `from_sha`/`to_sha`, optional `show_line_shifts`)\nsurfaces refactor moves between two commits.\n\n### `config` -- Server configuration and credential setup\n\nActions: `status` | `set` | `cache_clear` | `setup_status` | `setup_start` | `setup_skip` | `setup_reset` | `setup_complete`\n\n| Action | Description |\n|:-------|:------------|\n| `status` | Server info: version, graph path, node/edge counts, embedding backend, embeddings count. |\n| `set` | Update a runtime setting (`key=log_level`). |\n| `cache_clear` | Remove all computed embeddings. |\n| `setup_status` | Show current credential state and which model cells have keys. |\n| `setup_start` | Explain where the host configures API keys (host-owned model cells). |\n| `setup_skip` | Set local mode (local ONNX embedding, no cloud cells). |\n| `setup_reset` | Reset state to local; host config re-resolves on next call. |\n| `setup_complete` | Re-resolve credential state from host config. |\n\n### `security` -- Security scanning\n\nActions: `scan` | `report` | `suppress` | `rule_list`\n\n| Action | Description |\n|:-------|:------------|\n| `scan` | Run a security scan (`engine='heuristic'` default = 5 regex rules, or `'semgrep'`). Findings persist on `nodes.security_tags`. |\n| `report` | Re-emit cached findings as JSON (`format='json'`) or SARIF v2.1.0 (`format='sarif'`). |\n| `suppress` | Suppress a finding by `rule_id` (or `remove=true` to un-suppress). |\n| `rule_list` | List available rules for an engine. |\n\nThe `semgrep` engine requires the `[security]` extra and runs Semgrep's\n`p/auto` registry pack plus a 3-rule curated overlay.\n\n### `help` -- Full documentation\n\nTopics: `graph` | `query` | `review` | `config` | `security` | `recipes`\n\nReturns complete documentation for each tool. Use when the compressed\ndescriptions above are insufficient.\n\n## CLI\n\nThe package installs two console scripts: **`crg`** (primary) and\n`crg` (legacy long name). Running either with **no\narguments** starts the MCP server over stdio; a leading positional argument\nroutes to a local CLI subcommand that calls the same domain services used by\nthe MCP adapter. Run them directly after `pip install`, or without a\npersistent install via `uvx --python 3.13 --from better-code-review-graph crg ...`.\n\n```bash\n# Start the MCP server over stdio (default -- no subcommand)\ncrg\n\n# Build, inspect, and embed the local graph\ncrg graph build\ncrg graph stats\ncrg graph embed\n\n# Query relationships and impact\ncrg query query \\\n --pattern callers_of --target \"path/to/module.py::function\"\ncrg query search --search-query \"authentication\"\ncrg query impact --changed-files src/app.py\n\n# Produce review context and run a local security scan\ncrg review context --base HEAD~1\ncrg security scan --engine heuristic\n```\n\n| Command | Description |\n|:--------|:------------|\n| `graph build` | Full or incremental graph build. `--full-rebuild` re-parses every file; `--base [` sets the incremental diff ref; `--repo-root ` overrides auto-detection. |\n| `graph embed` | Compute vector embeddings using local ONNX or the configured cloud chain. |\n| `graph stats` / `graph export` / `graph import` / `graph summarize` | Inspect, export/import a portable `crg` graph, or summarize functions. |\n| `query query` / `query search` | Run relationship patterns or keyword/semantic search. |\n| `query impact` / `query large_functions` | Analyze changed-file blast radius or find oversized nodes. |\n| `query spot_check` / `query renamed_in_diff` / `query diff` | Inspect callsites, line shifts, or commit-to-commit graph changes. |\n| `review context` / `review delta` | Generate review context or diff buckets for a code change. |\n| `security scan` / `security report` / `security suppress` / `security rule_list` | Run and manage heuristic/Semgrep security findings. |\n\nCLI subcommands print structured JSON and exit non-zero on an error.\n\n\n## Features\n\nWhat this fork fixes versus the upstream [code-review-graph](https://github.com/tirth8205/code-review-graph):\n\n| Feature | code-review-graph | crg |\n|:--------|:------------------|:-------------------------|\n| Multi-word search | Broken (literal substring) | AND-logic word splitting |\n| callers_of/callees_of | Empty results (bare name targets) | Qualified name resolution + bare fallback |\n| Embedding | sentence-transformers + torch (1.1 GB) | fastretrieval ONNX + cloud (200 MB), dual-mode |\n| Output size | Unbounded (500K+ chars) | Paginated (max_results, truncated flag) |\n| Tool design | 9 individual tools | 6 grouped tools: graph + query + review + config + security + help |\n| Plugin hooks | Invalid PostEdit/PostGit | Valid PostToolUse |\n\n## Comparison\n\nHow crg stacks up against direct competitors in each pillar:\n\n| Capability | crg | Greptile | Sourcegraph (Cody / MCP) | CodeGraph (colbymchenry) |\n|---|---|---|---|---|\n| Codebase knowledge graph | Yes (Tree-sitter, 14 langs, SQLite) | Yes (functions/classes/deps) | Yes (precise code indexing) | Yes (Tree-sitter, 20+ langs, SQLite) |\n| Persistent incremental updates | Yes (git-diff + file-hash re-parse) | ? | Yes (continuous indexing) | Yes (OS file-watcher debounced) |\n| Qualified call resolution (callers/callees) | Yes (same-file bare-call resolution + fallback) | ? | Yes (go-to-def / find-references) | Yes (callers / callees / impact) |\n| Semantic search / embeddings | Yes (fastretrieval local registry + cloud Jina/Gemini/OpenAI/Cohere) | ? | Yes (semantic + keyword + regex) | No (FTS5 full-text only) |\n| Token-optimized review context | Yes (`review` tool, git-diff scoped) | Yes (PR review comments) | No (code-context assistant) | No (context layer, not review) |\n| Security scanning | Yes (Semgrep `p/auto` + 3-rule overlay, SARIF) | ? | ? | No |\n| Self-hostable | Yes (stdio default, machine-bound) | Yes (Docker / K8s / air-gapped) | Yes (self-hosted instance) | Yes (100% local, no API keys) |\n| Free / open source | Yes (Apache-2.0) | No (proprietary SaaS; free OSS tier) | No (Enterprise license, source private) | Yes (MIT) |\n\nSources: [Greptile](https://www.greptile.com/docs/introduction) · [Greptile pricing](https://www.greptile.com/pricing) · [Sourcegraph MCP](https://sourcegraph.com/mcp) · [CodeGraph](https://github.com/colbymchenry/codegraph). Cells marked `?` are capabilities the competitor does not publicly document, not confirmed absences.\n\n## Security\n\n- **Explicit selection** -- Cloud embedding errors are reported; the runtime does not silently switch models or fall back to local ONNX.\n- **Error handling** -- Tools return error strings with fix suggestions, never crash.\n- **Read-only mount** -- Docker mode mounts the repo as `:ro` (read-only).\n- **SSRF-guarded endpoints** -- Custom `[models.*]` cell `base_url` values are validated before any outbound call.\n\nTo report a vulnerability, see [SECURITY.md](SECURITY.md).\n\n## Build from source\n\n```bash\ngit clone https://github.com/n24q02m/crg\ncd crg\nuv sync --group dev\nuv run pytest\nuv run crg\n```\n\n**Requirements:** Python 3.13, [uv](https://docs.astral.sh/uv/).\n\n## Trust model\n\nThis plugin implements **TC-Local** (machine-bound, single trust principal). See the [mcp-core trust model](https://mcp.n24q02m.com/servers/mcp-core/trust-model/) for full classification.\n\n| Mode | Graph DB | Cloud credentials | Who can read your data? |\n|---|---|---|---|\n| stdio (default) | `/.crg/graph.db` (git-ignored) | `~/.crg/config.toml` (AES-GCM, machine-bound key) | Only your OS user |\n| HTTP self-host (multi-user) | Per-user `~/.crg/subs//graph.db` | Per-user `~/.crg/subs//config.json` | Only the authenticated user |\n\n## Migration & changelog\n\nGraph, security scan cache, and suppression state now use the package-owned\n`.crg/` directory. Run `graph(action=\"build\", full_rebuild=true)`\nonce after upgrading, followed by `graph(action=\"embed\")` if semantic search is\nneeded. The old `.better-code-review-graph/` state directory plus the ambiguous\n`.code-review-graph/` and `.code-review-graph.db` paths and their SQLite\nsidecars are left untouched, not migrated. Review and reapply any desired\nsuppression rules explicitly.\n\nThe v2.0 release added **temporal columns** (`valid_from_sha` / `valid_to_sha`\non every node and edge) plus an opt-in security scanner. The schema migration\nis auto-applied on first `GraphStore` open, and a backup of the pre-2.0 DB is\nwritten to `.pre-2.0.bak`. To downgrade and restore it:\n\n```sh\nCRG_DOWNGRADE_TO_1_X=1 uvx better-code-review-graph\n```\n\nFull schema-change list, behavior changes, and rollback procedure:\n[BREAKING_CHANGES.md](BREAKING_CHANGES.md). Release-by-release history:\n[CHANGELOG.md](CHANGELOG.md).\n\n## Documentation\n\nFull docs at\n**[mcp.n24q02m.com/servers/better-code-review-graph/setup/](https://mcp.n24q02m.com/servers/better-code-review-graph/setup/)**:\n\n- [Setup](https://mcp.n24q02m.com/servers/better-code-review-graph/setup/) -- install methods for Claude Code, Codex, Gemini CLI, Cursor, Windsurf, mcp.json\n- [Modes overview](https://mcp.n24q02m.com/get-started/modes-overview/) -- stdio / local-relay / remote-relay / remote-oauth\n- [Multi-user setup](https://mcp.n24q02m.com/get-started/multi-user/) -- per-JWT-sub credential model\n\nUse the `help` tool from any MCP client for inline per-tool reference.\n\n## License\n\nApache-2.0 -- See [LICENSE](LICENSE).\n"}]