Skills/npm/code-graph

code-graph@0.193.0

CAUTION· startup only

Publisher claims: "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher sdsrs · publishing for 248 daysInstalls 12,816Last detonated 32 h ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
no credential variables read in the code
Where it talks to
no vendor host named in the codeAlso claude.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it under the guard. Startup only; authenticated tool behavior not tested. The code names no credential variable; the guard pins the network to what the honeypot saw and logs every call.

$vet-skills run --net declared -- npx -y @sdsrs/code-graph

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-13 and scored it 66/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Auto-update or dynamic fetch configuration; Auto-update or dynamic fetch configuration; Privileged sudo command. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 20 s · 2 scenarios
t+CategoryObserved action
0.0sprocessno install scripts in bundle
20sfilesystemread ~/.cache/code-graph/binary-path outside project
20sprocessexec /app/apps/web/node_modules/.bin/npm
20sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/npm
20sprocessexec /app/node_modules/.bin/npm
20sprocessexec /pnpm/npm
20sprocessexec /usr/local/sbin/npm
20sprocessexec /usr/local/bin/npm
20sprocessexec /app/apps/web/node_modules/.bin/which
20sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/which
20sprocessexec /app/node_modules/.bin/which
20sprocessexec /pnpm/which
20sprocessexec /usr/local/sbin/which
20sprocessexec /usr/local/bin/which
20sprocessexec /usr/sbin/which
20sprocessexec /usr/bin/which
20sclaimedstartup only: exited (0) before answering · To install: npm install -g @sdsrs/code-graph To build from source: cargo install code-graph-mcp --features embed-model
20sprocessscript backend runs setup only
20sprocessno install scripts to re-run

Static findings

HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/auto-update.js:790 · Auto-update or dynamic fetch configuration — agent may load new code at runtime* Auto-update writes the plugin cache + installed_plugins.json directly andFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/auto-update.js:216 · Auto-update or dynamic fetch configuration — agent may load new code at runtime// The updater's main trigger is `launchBackgroundAutoUpdate` in session-init.js:Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionclaude-plugin/scripts/lifecycle.js:929 · File type combined with upload action — agent may exfiltrate local data files// hooks from cache/<mp>/<plugin>/<ver>/hooks/hooks.json. PreToolUse, PostToolUse,Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Privileged sudo commandclaude-plugin/scripts/find-binary.js:163 · Privileged sudo command — agent may execute with elevated privileges// 3. Common no-sudo user prefixFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandclaude-plugin/scripts/lifecycle.js:71 · File permission modification command — agent changes file ownership/permissions// unparseable case and left the unreadable one behind — a `chmod 000`Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/doctor.js:985 · Auto-update or dynamic fetch configuration — agent may load new code at runtime* Why a just-run `auto-update.js check` can have done nothing, in the updater'sFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/session-init.js:183 · Auto-update or dynamic fetch configuration — agent may load new code at runtime// auto-update installs a newer version, those old scripts would seeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandclaude-plugin/scripts/mcp-launcher.js:205 · File permission modification command — agent changes file ownership/permissions` chmod +x "${binary}"\n`Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/doctor.js:824 · Auto-update or dynamic fetch configuration — agent may load new code at runtime// `auto-update.js check` has NO non-zero exit path: dev mode, the opt-out,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageclaude-plugin/scripts/find-binary.js:635 · npx invocation of non-well-known package — may execute untrusted code// --- npx cache (very last resort — may be outdated) ---Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandclaude-plugin/scripts/auto-update.js:735 · File permission modification command — agent changes file ownership/permissions// chmod BEFORE reading the version. readBinaryVersion executes the binaryFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandclaude-plugin/scripts/lifecycle.js:350 · File permission modification command — agent changes file ownership/permissions// umask can only have cleared bits the original had, so chmod is what makesFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packageclaude-plugin/scripts/find-binary.js:639 · npx invocation of non-well-known package — may execute untrusted code// Same hoisted-or-nested question as the global prefix — an npx tree isFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandclaude-plugin/scripts/lifecycle.js:485 · File permission modification command — agent changes file ownership/permissions// durable backup — one `chmod 000` (a stray sudo, a restrictive umask) and theFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/auto-update.js:1438 · Auto-update or dynamic fetch configuration — agent may load new code at runtime`[code-graph] Auto-update to v${latest.version} suspended after ${attempts} failed attempts on this machine. ` +Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/lifecycle.js:2346 · Auto-update or dynamic fetch configuration — agent may load new code at runtime// auto-update. Deferring this one edge to call time is the only thing thatFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/doctor.js:997 · Auto-update or dynamic fetch configuration — agent may load new code at runtimereturn `auto-update is SUSPENDED after ${state.updateAttempts} failed attempts on v${state.latestVersion} `Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageclaude-plugin/scripts/find-binary.js:646 · npx invocation of non-well-known package — may execute untrusted code} catch { /* no npx cache */ }Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/find-binary.js:58 · Auto-update or dynamic fetch configuration — agent may load new code at runtime* `auto-update.clearCache()`) is exactly when the chain is longest and everyFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/tmp-dir.js:112 · Auto-update or dynamic fetch configuration — agent may load new code at runtime// `update-*` staging dirs from an interrupted auto-update are the onlyFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandclaude-plugin/scripts/mcp-launcher.js:208 · File permission modification command — agent changes file ownership/permissionsprocess.stderr.write(`Fix: chmod +x "${binary}"\n`);Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandclaude-plugin/scripts/doctor.js:1203 · File permission modification command — agent changes file ownership/permissionsconsole.log(`\n \u2705 Fixed permissions: chmod +x ${binary}`);Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandclaude-plugin/scripts/pre-read-guide.js:242 · Process kill command — agent can terminate processes// the former is the healthy-hook-answers-nothing case NEW-08 traded a killFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/cache-paths.js:28 · Auto-update or dynamic fetch configuration — agent may load new code at runtime/** Auto-update bookkeeping: available version, attempt counters, last error. */Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/doctor.js:991 · Auto-update or dynamic fetch configuration — agent may load new code at runtimefunction autoUpdateNoOpReason(state = readUpdateState(), env = process.env) {Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandclaude-plugin/scripts/cache-paths.js:110 · Process kill command — agent can terminate processes// kill switch this design's TTL exists to prevent, in bounded form, and it isFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/find-binary.js:277 · Auto-update or dynamic fetch configuration — agent may load new code at runtime// an auto-update, on the hook path (JS-23 / pre-ship review 2026-09-07).Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/doctor.js:763 · Auto-update or dynamic fetch configuration — agent may load new code at runtime* was gone — re-opening the 41 MB auto-update race the tombstone closes, sinceFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/lifecycle.js:2174 · Auto-update or dynamic fetch configuration — agent may load new code at runtime// `launchBackgroundAutoUpdate`. SessionStart is still the racing surface,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/lifecycle.js:2241 · Auto-update or dynamic fetch configuration — agent may load new code at runtime…kups, MAX_CORRUPT_BACKUPS, // auto-update.js repoints installed_plugins.json and owes the same preserve-then-proceed route migrateOldPluginIds, …Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/proc-opts.js:12 · Auto-update or dynamic fetch configuration — agent may load new code at runtime* (issue #40); the auto-update treadmill fixed alongside it made that perFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandclaude-plugin/scripts/doctor.js:1276 · File permission modification command — agent changes file ownership/permissions// skipped. Without this arm a chmod on ~/.claude was diagnosed asFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/find-binary.js:497 · Auto-update or dynamic fetch configuration — agent may load new code at runtime* Why: candidates below the auto-update cache had no version check at all, soFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageclaude-plugin/scripts/lifecycle.js:826 · npx invocation of non-well-known package — may execute untrusted codelines.push(' `npx -y @sdsrs/code-graph unadopt` in the project:');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandclaude-plugin/scripts/pre-grep-guide.js:2379 · Process kill command — agent can terminate processes// within 60 s still lands in the cooldown `observe` branch above. A killFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packageclaude-plugin/scripts/find-binary.js:373 · npx invocation of non-well-known package — may execute untrusted code* cargo install → PATH → npx cacheFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/session-init.js:582 · Auto-update or dynamic fetch configuration — agent may load new code at runtime// self-heals through the background auto-update (decision D5).Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/session-init.js:799 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeautoUpdateLaunched, indexFreshness, mapInjected, binaryCheck, consistencyIssues,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandclaude-plugin/scripts/cache-paths.js:68 · Process kill command — agent can terminate processes* binary. The TTL is what keeps this from becoming a permanent kill switch —Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packageclaude-plugin/scripts/adopt.js:754 · npx invocation of non-well-known package — may execute untrusted code// .claude/ detail 文件）。/plugin install 本身已构成知情同意；npm / npx / 裸 checkoutFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionclaude-plugin/scripts/doctor.js:541 · File type combined with upload action — agent may exfiltrate local data files// silently ignores plugin-cache hooks.json for PreToolUse/PostToolUse/Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionclaude-plugin/scripts/lifecycle.js:320 · File type combined with upload action — agent may exfiltrate local data files// settings.json the user had put at 0600 came back 0644 on the firstFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsclaude-plugin/scripts/session-init.js:125 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv: { ...env, CODE_GRAPH_AUTO_UPDATE_SILENT: '1' },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/auto-update.js:821 · Auto-update or dynamic fetch configuration — agent may load new code at runtime`Auto-update skipped: missing required tools: ${missingTools.join(', ')}. Install them to enable auto-updates.`)}`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationclaude-plugin/scripts/auto-update.js:1314 · Auto-update or dynamic fetch configuration — agent may load new code at runtime// bypasses auto-update.js, so re-sync state.installedVersion every call.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Instructs the agent to modify its persistent memory or instruction filesclaude-plugin/scripts/session-init.js:57 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file// hook used to write there — "CLAUDE.md was modified", "hooks look dark",Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction filesclaude-plugin/scripts/adopt.js:1021 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file' Refusing rather than guessing: both verbs write to your CLAUDE.md.\n');Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packageclaude-plugin/templates/code-graph-snapshot.yml:44 · npx invocation of non-well-known package — may execute untrusted codenpx -y -p @sdsrs/[email protected] code-graph-mcp snapshot create --out "code-graph-snapshot-${GITHUB_SHA:0:7}.db.zst"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Instructs the agent to modify its persistent memory or instruction filesclaude-plugin/scripts/adopt.js:39 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file// `followLink` is opt-in, and ONLY the CLAUDE.md read-modify-write passes it.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File permission modification commandclaude-plugin/scripts/session-init.js:473 · File permission modification command — agent changes file ownership/permissions`Fix: chmod +x "${binary}"` +Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packageclaude-plugin/templates/code-graph-snapshot.yml:13 · npx invocation of non-well-known package — may execute untrusted code# name belongs to an unrelated publisher on npm, and `npx -y` would install andFix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Instructs the agent to modify its persistent memory or instruction filesclaude-plugin/scripts/cli-entry.js:18 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file* they write `<cwd>/CLAUDE.md`, `<cwd>/.claude/` and `~/.cache/code-graph`, andFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packageclaude-plugin/templates/code-graph-snapshot.yml:12 · npx invocation of non-well-known package — may execute untrusted code# inside it). Do NOT shorten this to `npx -y code-graph-mcp` — that unscopedFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionclaude-plugin/templates/code-graph-snapshot.yml:40 · File type combined with upload action — agent may exfiltrate local data files# its checksum beside it as `<name>.db.zst.blake3`. Upload both: installFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Instructs the agent to modify its persistent memory or instruction filesclaude-plugin/scripts/adopt.js:970 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction fileelse lines.push('[code-graph] CLAUDE.md block already up-to-date — no write');Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction filesclaude-plugin/scripts/adopt.js:941 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file'Edit CLAUDE.md manually to opt in.';Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01

Cost to the agent

Instructions loaded
≈560 tok
2 files · 49 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @sdsrs/code-graph@0.193.0 as of 30 h ago. This is the package itself, not its dependencies.

What would make this Verified

14 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim sdsrs: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  3. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  4. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim sdsrsPropose a patch to the maintainer