Infigraph is a code intelligence engine that indexes a codebase into a persistent knowledge graph from its abstract syntax trees, so an agent can answer structural questions without re-reading files. Instead of retracing imports on every query, it resolves questions such as which functions call a given symbol, or what the blast radius of a change is, against a graph that was built once and is kept fresh by a file watcher that starts automatically after indexing.
It is written in Rust and runs entirely on the local machine: no API keys, no network calls, and no dependency on a language model for analysis. Parsing covers 62 languages through Tree-sitter, with ANTLR grammar plugins for custom or internal domain-specific languages: a .g4 file and a plugin.toml add a grammar without recompiling. Compiler-grade SCIP indexers are downloaded automatically for TypeScript, Python, Java, Go, Rust, C#, Ruby, and Scala, with an lsp-to-scip bridge covering more languages.
The graph is queried with Cypher, including WITH, OPTIONAL MATCH, and variable-length paths, and search combines BM25 with Model2Vec embeddings so a query like "retry logic" matches functions that are not named retry. An HNSW vector index serves approximate nearest-neighbor lookups at scale. Agents reach all of this through 82 MCP tools wired into 11 coding agents, and outputs are compressed to reduce token use, with budget-aware scaling, session deduplication, and per-tool safety caps.
Analysis passes go beyond call graphs: taint tracking from sources such as HTTP parameters to sinks such as SQL and exec, dependency scanning against the OSV vulnerability database, design-pattern detection, refactor analysis for complexity hotspots, coupling, near-duplicates, and dead code, HTTP route mapping across 22 frameworks, cross-language bridge detection, and config binding resolution for Spring profiles, Django settings, .NET appsettings, and Rails environments. A pull-request mode detects change type and scope and runs semantic diff, blast radius, affected tests, and security checks as configurable CI gates.
Deployment scales from a single repository to a team: a local index, a remote MCP server over HTTP, or a multi-repo mode backed by Neo4j and Postgres for 30 or more repositories, with a GitHub webhook that reindexes on merge. A built-in web UI provides a graph explorer, search, and route map, and graphs export to Neo4j Cypher, GraphML, or JSON.
Features
- 62 languages: Tree-sitter parsing plus drop-in ANTLR grammar plugins for custom DSLs, with no configuration
- Cypher on code: full graph queries over symbols, calls, imports, routes, and patterns
- Hybrid search: BM25 combined with Model2Vec embeddings and an HNSW vector index for similarity queries at scale
- Cross-file resolution: import-aware linking of call sites to the definitions they actually reach, with SCIP indexers for eight languages
- MCP integration: 82 tools exposed to 11 coding agents, with automatic first-query indexing
- Context compression: tool output reduction with budget-aware scaling, session deduplication, and per-tool safety caps
- Security analysis: intra- and inter-procedural taint tracking with sanitizer awareness, plus OSV dependency scanning
- Review and CI: change-type detection, semantic diff, blast radius, affected tests, complexity, dead code, and clone detection behind configurable gates
- Refactor insight: complexity hotspots, coupling, near-duplicate detection, and dead code ranked by impact and effort
- Document indexing: PDF, DOCX, PPTX, HTML, and Markdown, plus a breadth-first Confluence wiki crawler with incremental sync
- Session continuity: named sessions and a memory system that persists summaries, pending tasks, decisions, and touched files across agent runs
- Multi-repo and export: repo groups with cross-repo queries and HTTP contract extraction, plus Neo4j Cypher, GraphML, and JSON export
