Skip to content

Symvanta

by symvanta.com · remote · no sign-in to list tools · v1.1.0 · published by com.symvanta

Hosted code graph over MCP: exact callers, dependencies, and cross-repo blast radius for AI agents.

Changes · 16

27 tools: 16 change things and 11 only read.

Scanned Oct 21, 2026

6 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http code-graph https://mcp.symvanta.com/mcp

Findings

Matches of fixed checks, with the text they matched.

2 warn4 info
  • Warninit

    The server marks "init" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "init" says "init": a word for a change.

    What this check looks for
  • Warnbundle

    The server marks "bundle" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "run": a word for a change.

    What this check looks for
  • The description mentions "credential".

    Matched text

    description: "...currentRemoteSha is null when no GitHub credential is configured. Echoes the active ref pi..."

    What this check looks for
  • The description mentions "credential".

    Matched text

    description: "...solve its head, so this is a network or credential problem, not a repository one), with th..."

    What this check looks for
  • The description mentions "credential".

    Matched text

    description: "...exing job; response carries visibility, credential ("installation" | "pat" | null), indexi..."

    What this check looks for
  • The description mentions "credential".

    Matched text

    description: "...a workspace PAT exists as the fallback credential. Empty = connect the GitHub App on the..."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

27 tools

Changes things 16Claude Code: ask
  • add_repositoryAttach a GitHub repository to a project (owner + repo_name; clone URL derived; projectId defaults to the bound / default project).1 finding

    Why it is in this group

    • The name "add_repository" says "add": a word for a change.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...exing job; response carries visibility, credential ("installation" | "pat" | null), indexi..."

      What this check looks for
    Description, as the server wrote it
    Attach a GitHub repository to a project (owner + repo_name; clone URL derived; projectId defaults to the bound / default project). Public repos need nothing else. Private repos need installation_id from list_installations (a GitHub App installation that covers the repo) or a workspace PAT saved on the dashboard; without either the attach is refused (private_repository_needs_credential) instead of failing on the queued clone. Idempotent. First attach dispatches an indexing job; response carries visibility, credential ("installation" | "pat" | null), indexing_status ("queued" | "already_indexed") and indexing_job_id to poll. Needs mcp:admin.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • adrArchitecture decision records: the WHY behind code, anchored to a symbol/file/project.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Architecture decision records: the WHY behind code, anchored to a symbol/file/project. Survive reindexes; find_node attaches a node's decisions. Ops: - record: needs title+decision. Anchor with repository+symbolPath or +filePath; omit both for project-wide. Optional context, consequences, status. - list: records for a project, filter by repository/symbolPath/filePath/status. - update: needs id; status:"superseded"+supersededById, or "deprecated".

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • ask_codebaseSynthesis Q&A for behavior/architecture questions: answer + citations in one call.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Synthesis Q&A for behavior/architecture questions: answer + citations in one call. HEAVY (~2-4 s, ~3-5 k tokens): prefer context, find_node, or locate when they suffice. scope:"repo" (default) = ONE repo; scope:"all" = cross-repo (repositoryIds narrows, omit spans all; rejects repository). If sufficient_to_answer=true, answer without further tool calls. commitSha pins a revision.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • bundleRun up to 10 independent tool calls in parallel in one round-trip.1 finding

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "bundle" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "run": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Run up to 10 independent tool calls in parallel in one round-trip. Calls share the bundle-level project/repository scope unless a call sets its own args.repository, which scopes that call alone. Supported: locate (args.mode text|symbol|semantic|file|config, not codebase), relate (kind:callers only), find_node, list_file_symbols, find_http_route. Returns results in input order; unsupported tool names return {error}.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • contextFirst-touch task orientation.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    First-touch task orientation. Pass a natural-language task; returns the top 5 relevant files with their symbols and best-matching snippets in one call (~1-1.5k tokens, ~500 ms, no LLM). Replaces chaining locate (text) + locate (semantic) + list_file_symbols. Known symbol: find_node/locate. Synthesized explanation: ask_codebase.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • create_projectCreate a project in the workspace (name; slug derived and made unique).No findings

    Why it is in this group

    • The name "create_project" says "create": a word for a change.
    Description, as the server wrote it
    Create a project in the workspace (name; slug derived and made unique). Needs mcp:admin; plan project caps apply (plan_limit_exceeded). Then attach repositories with add_repository { projectId, owner, repo_name } and bind the session with ref op:"use_project" (or init with the checkout's repository once attached).

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • estimate_scopePre-flight estimate before graph traversal: coarse count of files a task likely touches and whether it spans layers (common/browser/node/electron-main/...) or repositories.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Pre-flight estimate before graph traversal: coarse count of files a task likely touches and whether it spans layers (common/browser/node/electron-main/...) or repositories. Decides single-file edit vs consulting the graph. Heuristic, from symbol-name + text matches.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • historyIndexed commit history.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Indexed commit history. Ops: - commits: recent commits (metadata + file list); <=200/call, default 50. With a clone prefer git log. - commit: one commit by sha with its diff summary (added/modified/deleted/renamed); null if outside the indexed window. - recently_changed: files ranked by change frequency in the indexed window ("what's hot").

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • index_healthPer-project index health.1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...solve its head, so this is a network or credential problem, not a repository one), with th..."

      What this check looks for
    Description, as the server wrote it
    Per-project index health. pendingLibraryVersions: cross-repo specifiers still indexing (an empty result may mean "not indexed yet", not "not in code"); call when a query is surprisingly empty. A row with status "skipped" is never going to arrive (a dev or optional dependency, which the catalog does not index) and status "failed" means discovery found no source, so only "indexing" is worth waiting on. architecture: per-repo Louvain module count + modularity Q (low Q = tangled), plus circular-dependency and mutually-recursive-symbol counts (inspect via map view:"architecture"). versionDrift: joined cross-repo SCIP edges whose consumer-pinned package version differs from the sibling's current version (package, pinned vs current, edge count). externalsCoverage: per-repo count of external references joined onto a sibling definition vs left as materialized stubs. unindexableRepositories: repos whose last index produced no graph and left a status (no_default_branch = the remote has no resolvable default branch, e.g. an empty repo; awaiting_upload = an upload-provider repo with no zip yet; remote_head_unresolvable = the remote could not be reached to resolve its head, so this is a network or credential problem, not a repository one), with the worker's log line as indexStatusDetail; explains a silently-empty repo. degradedRepositories: repos that DID index but lost a derived artifact (community_detection_skipped = Louvain clustering did not run, so map view:"architecture" has no modules; raise COMMUNITY_EDGE_CEILING or set COMMUNITY_DETECTION=true, then reindex). Both carry a human-readable reason.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • initCall first, with repository:"owner/name" (your checkout's GitHub remote).1 finding

    Why it is in this group

    • The name "init" says "init": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "init" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "init" says "init": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Call first, with repository:"owner/name" (your checkout's GitHub remote). Binds the session to the project holding that repository and returns it as the active project with its repositories, index health, and a `usage` field (decision matrix + routing). workspace.attached=false means the checkout is NOT indexed: nothing in the answer describes it; attach it (add_repository, create_project) or work without the graph, do not route through the projects listed. Without repository: the pinned project (ref op:"use_project") or the workspace default.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • libraryLibrary catalog lookups.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Library catalog lookups. Ops: - packages: list indexed npm packages (specifier, ecosystem, owner/name, indexed-at, sha). Tenant-scoped, no projectId. - version: one package's resolved version for a project (sha, version, dep type, indexed-at, status indexed|indexing|failed|not_found). "indexing" means a job for that revision is in flight, so retrying later converges; "failed" carries a reason and does not change on its own.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • mapToken-efficient repo (or subtree) skeleton: directory tree with each file's classes (methods in parens), functions, and HTTP endpoints, from the graph.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Token-efficient repo (or subtree) skeleton: directory tree with each file's classes (methods in parens), functions, and HTTP endpoints, from the graph. Orient before drilling in. Scope with "path", cap with "maxDepth", density:"full" adds properties. view:"architecture" instead returns a module map (Louvain clusters with hubs, paths and cross-module coupling), plus namedModules/totalModules: a module NAME comes from a generated summary and is provisional, its id (the member-set hash in the header) is the stable key, so pin modules by id and re-read names rather than caching them.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • refSession-scoped branch / working-tree overlay / project binding.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Session-scoped branch / working-tree overlay / project binding. Ops: - use: pin a repository's reads to a branch (latest indexed revision). Branch must be tracked+indexed (open a PR, or add on the dashboard); else "indexing_in_progress". commitSha overrides. - clear: remove the pin, revert to default. - index_working_tree: overlay UNCOMMITTED edits (changedFiles path+content, optional deletedPaths/baseSha) on a short-lived synthetic revision pinned here; find_node/locate/relate reflect them, source and locate mode:semantic do NOT. Cap 100 files/256KB. - use_project: bind this session to projectId (from init.otherProjects / list_projects / create_project) so calls without projectId resolve there. init with repository:"owner/name" sets the same binding from the checkout's remote. - clear_project: drop the binding, back to the workspace default project.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • reindex_repositoryDispatch a reindex job for an already-attached repository (repositoryId from list_repositories / add_repository).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Dispatch a reindex job for an already-attached repository (repositoryId from list_repositories / add_repository). Optional commit_sha pin. force:true re-applies the current parser even when unchanged at HEAD: it bypasses the per-file hash-skip AND re-runs the SCIP indexer subprocesses (no same-sha .scip cache serve), so a parser fix inside a SCIP runner, an external-moniker re-pin, or a toolchain upgrade takes effect without a version bump.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • relateGraph relationship traversal via one kind (real edges, not text).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Graph relationship traversal via one kind (real edges, not text). Kinds (1-10 symbols; heritage/chain one): - callers: direct callers. granularity:'file' (default) one row/file, 'site' one row/caller. - dependencies: outgoing calls/imports. - blast_radius: upstream impact walk (every caller, importer and referencer up to 3 hops, no per-hop sampling) + co-change siblings; risk {level,signals}. includeCrossRepo defaults ON here (off for others). blastRadiusTotalCount is the number of distinct symbols that 3-hop walk reached, not the row count: the blastRadius array is capped by expansionLimit. blastRadiusTruncated:true means the rows are a sample of that total; blastRadiusTotalAtLeast:true means the count stopped at its 10000 bound, so quote it as "N+". The walk stops at 3 hops, so it can miss impact further away; it never overcounts. Never report the number of listed rows as the impact size. - implementers: classes implementing interfaces via heritage edges. - heritage: full hierarchy (ancestors+descendants) of ONE type. maxDepth caps it. - chain: call-chain paths for a node (nodeId OR selectors[0]); chain params tune the walk. - path: shortest connection between selectors[0] (from) and selectors[1] (to). Direction-agnostic hop-labeled path; found:false when none within 6 hops. minimal:true = {id,name,filePath,startLine}-only (~50% cheaper) on callers/dependencies/blast_radius/implementers; granularity on callers/blast_radius. Rows may carry confidence (tiers in init usage); a cross-repo callers/dependencies row joined by a SCIP moniker also carries package (the package name that bridged the repos). 0 results: call locate (mode:text), not Grep; reason:"no_edges_indexed" = no edges.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • sourceRaw file/git access at the indexed commit, for cloud agents with no clone; with a clone prefer your own Read/Grep/git.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Raw file/git access at the indexed commit, for cloud agents with no clone; with a clone prefer your own Read/Grep/git. Ops: - read: content of filePath, whole file or slice startLine..endLine. ifHash (a prior read's hash) returns {unchanged:true}, no content. compact:true strips blank/comment-only lines. - list: files+subdirs at path. grep: ripgrep pattern (glob/pathPrefix). tree: layout from path. stat: size/lines/language/binary for filePath. blame: authorship for filePath. diff: fromSha..toSha. Keys: {op:"read",filePath:"src/a.ts"}, {op:"grep",pattern:"foo"}, {op:"list",path:"src"}. filePath is the file, path the directory. Gated by the Source Access add-on; else source_access_required.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 11Claude Code: allow
  • diff_impactImpact of a diff between two indexed revisions of one repo (base..head): changed files + symbols, union blast radius (layers + cross-repo fallout), affected endpoints, test suites,…No findings

    Why it is in this group

    • The name "diff_impact" says "diff": a word for reading.
    Description, as the server wrote it
    Impact of a diff between two indexed revisions of one repo (base..head): changed files + symbols, union blast radius (layers + cross-repo fallout), affected endpoints, test suites, and co-change reminders. Replaces per-symbol relate (kind:blast_radius) loops before merging. Defaults: head = session's effective revision, base = previous indexed. For UNCOMMITTED edits, run ref (op:"index_working_tree"), then call with no shas.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • find_http_routeResolve an HTTP route by path + optional method to endpoint + handler (filePath + line bounds).No findings

    Why it is in this group

    • The name "find_http_route" says "find": a word for reading.
    Description, as the server wrote it
    Resolve an HTTP route by path + optional method to endpoint + handler (filePath + line bounds). Use instead of grep/locate for URL paths: follows framework router metadata (Express, Fastify, Hono, Laravel, FastAPI, etc.) and resolves dynamic segments, prefix groups, and middleware-mounted routers text search misses.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • find_nodeResolve 1-10 symbols to filePath + line bounds + signature.No findings

    Why it is in this group

    • The name "find_node" says "find": a word for reading.
    Description, as the server wrote it
    Resolve 1-10 symbols to filePath + line bounds + signature. selectors: array keyed by symbol (bare name) / symbolPath / filePath / nodeId; a flat query/name/single field also works. includeSource=true adds the excerpt, includeSummaries=true AI summaries. A node from a SCIP-indexed package also carries scip_package_name (and scip_package_version / scip_manager when known). For a class/interface/struct/protocol it carries a compact heritage field (<=5 ancestors, <=20 descendants, omitted when empty); includeHeritage:false skips it, includeCrossRepo:true walks cross-repo heritage. {resolved:false, candidates} = no confident match.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • freshnessReturns lastIndexedSha, lastIndexedAt, and the current remote HEAD sha for a repository: detect index drift from remote.1 finding

    Why it is in this group

    • The description's first verb is "return": a word for reading.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...currentRemoteSha is null when no GitHub credential is configured. Echoes the active ref pi..."

      What this check looks for
    Description, as the server wrote it
    Returns lastIndexedSha, lastIndexedAt, and the current remote HEAD sha for a repository: detect index drift from remote. Reports what Symvanta knows, not local git. currentRemoteSha is null when no GitHub credential is configured. Echoes the active ref pin (pinnedBranch, pinnedSha).

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_file_symbolsList symbols in one file (name + kind + line bounds).No findings

    Why it is in this group

    • The name "list_file_symbols" says "list": a word for reading.
    Description, as the server wrote it
    List symbols in one file (name + kind + line bounds). Step 1 of the two-step read: get line bounds, then pass startLine/endLine to source (op:read) for that slice only (~4-15x fewer tokens). For one symbol + signature, use find_node {symbol, filePath}.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_installationsGitHub App installations connected to this workspace and the repositories each can reach (private included).1 finding

    Why it is in this group

    • The name "list_installations" says "list": a word for reading.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...a workspace PAT exists as the fallback credential. Empty = connect the GitHub App on the..."

      What this check looks for
    Description, as the server wrote it
    GitHub App installations connected to this workspace and the repositories each can reach (private included). Use before add_repository for a private repository: pass the installation's id as installation_id. pat_configured says whether a workspace PAT exists as the fallback credential. Empty = connect the GitHub App on the dashboard (Project > Repositories). An installation whose GitHub call failed carries error and an empty list.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_projectsList all projects with indexing summaries.No findings

    Why it is in this group

    • The name "list_projects" says "list": a word for reading.
    Description, as the server wrote it
    List all projects with indexing summaries. Find a project by name or check which exist.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_repositoriesList repositories in a project.No findings

    Why it is in this group

    • The name "list_repositories" says "list": a word for reading.
    Description, as the server wrote it
    List repositories in a project. Find repository names to scope a query to one repo.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_tests_forTest suites and cases whose suite name matches a symbol name (case-insensitive substring).No findings

    Why it is in this group

    • The name "list_tests_for" says "list": a word for reading.
    Description, as the server wrote it
    Test suites and cases whose suite name matches a symbol name (case-insensitive substring). Call before adding tests to see existing coverage and mirror its shape.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • locateSearch/lookup.No findings

    Why it is in this group

    • The description's first verb is "search": a word for reading.
    Description, as the server wrote it
    Search/lookup. Pick a mode, or omit with a bare query to AUTO-ROUTE (text, then semantic on empty; response carries answered_by). Modes: - text (replaces grep): literal identifier/string, one row/occurrence. queries:[...] (<=10 terms) searches several in one call (and implies this mode when mode is omitted). pathsOnly:true = "filePath:lineNumber" only (~5x cheaper). maxPerFile caps rows/file (default 5). Empty carries did_you_mean; do NOT retry reworded, use semantic. - symbol: symbols by name/symbolPath in one repo. kind filters node kind, layer one layer. Tests last unless includeTests:true. - semantic: vector search for symbols similar to a natural-language query (names unknown). - file: fuzzy filename search (basename); filenames only. - config (replaces grep for env/config keys): key/env-var usages with nearest-symbol context; queries:[...] batches several keys. - codebase: cross-repo candidate scan; narrow with repositoryIds.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • quick_lookupFast substring lookup of symbol DEFINITIONS by name: rows {name, kind, filePath, startLine, repositoryName} (displayName only when distinct from name), no ranking, no semantic.No findings

    Why it is in this group

    • The name "quick_lookup" says "lookup": a word for reading.
    Description, as the server wrote it
    Fast substring lookup of symbol DEFINITIONS by name: rows {name, kind, filePath, startLine, repositoryName} (displayName only when distinct from name), no ranking, no semantic. Cheaper alternative to locate (mode:symbol) for latency-sensitive pre-fetch (grep-augment hook); interactive search should prefer locate/find_node. Reads the latest indexed revision, no ref pin.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http code-graph https://mcp.symvanta.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__code-graph__locate",
      "mcp__code-graph__diff_impact",
      "mcp__code-graph__list_projects",
      "mcp__code-graph__list_repositories",
      "mcp__code-graph__list_file_symbols",
      "mcp__code-graph__list_tests_for",
      "mcp__code-graph__quick_lookup",
      "mcp__code-graph__freshness",
      "mcp__code-graph__find_http_route",
      "mcp__code-graph__find_node",
      "mcp__code-graph__list_installations"
    ],
    "ask": [
      "mcp__code-graph__init",
      "mcp__code-graph__relate",
      "mcp__code-graph__source",
      "mcp__code-graph__history",
      "mcp__code-graph__library",
      "mcp__code-graph__ref",
      "mcp__code-graph__adr",
      "mcp__code-graph__estimate_scope",
      "mcp__code-graph__map",
      "mcp__code-graph__index_health",
      "mcp__code-graph__ask_codebase",
      "mcp__code-graph__add_repository",
      "mcp__code-graph__create_project",
      "mcp__code-graph__reindex_repository",
      "mcp__code-graph__context",
      "mcp__code-graph__bundle"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as code-graph. Review it before you use it.