Code Review Graph builds a structural map of a codebase so an AI coding assistant can review a change by reading only the files it affects, instead of re-reading large parts of the project. It serves that context over MCP (30 tools plus 5 workflow prompts) and through a CLI.
The repository is parsed with Tree-sitter into a graph of nodes (functions, classes, imports) and edges (calls, inheritance, test coverage), stored in a single local SQLite file. When a file changes, the graph traces callers, dependents, and tests to produce a blast radius and the smallest review set. Editor hooks, a git pre-commit hook, and watch mode keep it current by re-parsing only files whose content hash changed.
An installer detects AI coding tools and writes an MCP entry, hooks, and skills for each, covering Codex, Claude Code, Cursor, Windsurf, Zed, Continue, OpenCode, Antigravity, Gemini CLI, Qwen, Qoder, Kiro, GitHub Copilot, and Hermes Agent. The same analysis also runs as a GitHub Action that posts a risk-scored review comment on each pull request, built and queried on the CI runner.
Parsing covers more than 30 languages, including Python, JavaScript and TypeScript, Go, Rust, Java, C and C++, C#, Ruby, Kotlin, Swift, PHP, Solidity, SQL, Terraform, and Jupyter or Databricks notebooks, with framework-aware edges for Laravel and Spring. Other languages can be added through a TOML mapping to a bundled Tree-sitter grammar.
Measured token use per question, whole-corpus baseline against a graph query (6 repositories, captured 2026-08-02). The median reduction is about 63x, and the whole-corpus figure is an upper bound that an agent using grep would not pay:
| Repo | Corpus tokens | Avg graph tokens | Reduction |
|---|---|---|---|
| fastapi | 948,793 | 2,653 | 357.6x |
| flask | 143,594 | 2,196 | 65.4x |
| gin | 166,868 | 2,766 | 60.3x |
| httpx | 142,356 | 2,661 | 53.5x |
| express | 136,052 | 3,936 | 34.6x |
Impact analysis averages 0.69 F1 against ground truth derived from the same graph edges, so its recall of 1.0 is a circular upper bound. Documented limitations include graph context that can exceed a plain file read for trivial single-file edits, keyword search ranking that needs work, and flow detection that is strongest for Python and PHP.
Features
- Blast-radius analysis: traces the functions, classes, files, and tests likely affected by a change
- Risk-scored reviews: maps a diff to affected functions, execution flows, and test gaps
- Incremental updates: re-parses only changed files and their dependents, triggered by hooks, a pre-commit hook, or watch mode
- Semantic search: optional vector embeddings via sentence-transformers, Google Gemini, MiniMax, Voyage AI, or any OpenAI-compatible endpoint, combined with full-text search
- Graph analysis: Leiden community detection, hub and bridge detection, surprise scoring for unexpected coupling, and knowledge-gap reports
- Architecture overview: community-based architecture map with coupling warnings and execution flows sorted by criticality
- Refactoring support: rename preview, framework-aware dead code detection, and community-driven suggestions
- GitHub Action: sticky risk-scored pull request comments with an optional fail-on-risk merge gate
- Exports and visualization: GraphML, Neo4j Cypher, Obsidian vault, JSON, and SVG exports, plus an interactive D3.js graph view and a generated Markdown wiki
- Multi-repo: a registry for searching across several repositories and a daemon that watches them
- Agent skills: explore-codebase, review-changes, debug-issue, and refactor-safely workflows
- Context savings estimates: review and impact responses report estimated tokens saved
