code-graph-rag

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

Development happens fully in the open on GitHub: every commit, feature branch, and pull request is public, and changes are reviewed via PRs before merging to main. Releases are tags cut from this continuous public history, with many interim commits between releases. https://github.com/vitali87/code-graph-rag/commits/main

Repository on GitHub, which uses git. git is distributed.

Every release has a unique version identifier. The version in pyproject.toml is bumped automatically on each merge to main, and PyPI plus GitHub releases each correspond to exactly one version. https://pypi.org/project/code-graph-rag/#history

Versions follow the SemVer MAJOR.MINOR.PATCH format (currently 0.0.x with an automated patch bump per change).
https://github.com/vitali87/code-graph-rag/blob/main/pyproject.toml

Every version is identified in git with a vX.Y.Z tag, created automatically by the version-bump workflow.
https://github.com/vitali87/code-graph-rag/tags

Non-trivial release notes file in repository: https://github.com/vitali87/code-graph-rag/blob/main/NEWS.md.

The project's one publicly known vulnerability (GHSA-vvr2-h2jp-838m, path traversal / arbitrary file read in the MCP read_file tool, High severity) was identified in the release notes of the fixing release v0.0.345, which names the advisory ID, severity, and affected component, and advises upgrading. https://github.com/vitali87/code-graph-rag/releases/tag/v0.0.345 and
https://github.com/vitali87/code-graph-rag/security/advisories/GHSA-vvr2-h2jp-838m

Bug reports are submitted via GitHub issues: https://github.com/vitali87/code-graph-rag/issues. CONTRIBUTING.md describes the process and issue labels.

The maintainer acknowledges and responds to the large majority of bug reports; recent months show issues being triaged, linked to fixing PRs, and closed promptly: https://github.com/vitali87/code-graph-rag/issues?q=is%3Aissue+is%3Aclosed

The majority of enhancement requests receive responses; many are implemented (e.g. new language support requests) and the rest get maintainer replies: https://github.com/vitali87/code-graph-rag/issues?q=is%3Aissue+label%3Aenhancement

Of 93 enhancement requests active in the last 12 months, 92 received a response (maintainer comments and/or resolution); many were implemented, such as new language support and MCP features.
https://github.com/vitali87/code-graph-rag/issues?q=is%3Aissue+label%3Aenhancement

All bug reports, enhancement requests, and their responses are permanently archived and searchable in the public GitHub issue and PR history: https://github.com/vitali87/code-graph-rag/issues?q=is%3Aissue

The vulnerability reporting process is published in the security policy, which directs reporters to GitHub private vulnerability reporting and explicitly forbids public-channel disclosure: https://github.com/vitali87/code-graph-rag/blob/main/.github/SECURITY.md

Private reporting is supported and documented: SECURITY.md instructs reporters to use GitHub's private vulnerability reporting via the Security tab, keeping details confidential until a fix ships. This channel was used successfully for GHSA-vvr2-h2jp-838m. https://github.com/vitali87/code-graph-rag/blob/main/.github/SECURITY.md

The one vulnerability report received in the last 6 months (GHSA-vvr2-h2jp-838m, MCP read_file path traversal) was acknowledged, fixed, and published as an advisory with a patched release on the same day it was reported (2026-07-14).
https://github.com/vitali87/code-graph-rag/security/advisories/GHSA-vvr2-h2jp-838m

Non-trivial build file in repository: https://github.com/vitali87/code-graph-rag/blob/main/Makefile.

Non-trivial build file in repository: https://github.com/vitali87/code-graph-rag/blob/main/Makefile.

The project is built entirely with FLOSS tools: uv (build and packaging), Python, and PyInstaller for binaries. No proprietary tooling is required. https://github.com/vitali87/code-graph-rag/blob/main/pyproject.toml

The project uses pytest (FLOSS) with a suite of several thousand tests. How to run it is documented in CONTRIBUTING.md and executed in CI via GitHub Actions on every push and pull request. https://github.com/vitali87/code-graph-rag/blob/main/CONTRIBUTING.md and https://github.com/vitali87/code-graph-rag/blob/main/.github/workflows/ci.yml

The suite runs the standard Python way: uv run pytest (or plain pytest). Documented in CONTRIBUTING.md.
https://github.com/vitali87/code-graph-rag/blob/main/CONTRIBUTING.md

Code coverage is around 95 percent, tracked continuously on Codecov, with several thousand tests covering parsers for all supported languages, graph construction, CLI, and MCP endpoints. https://app.codecov.io/gh/vitali87/code-graph-rag

GitHub Actions runs the full test suite on every push and pull request across Linux, macOS, and Windows, plus CodeQL and SonarCloud analysis. https://github.com/vitali87/code-graph-rag/actions

The project mandates test-first development: CONTRIBUTING.md and the checked-in coding standard require a failing test before any bug fix or behavioural change, and pull requests without tests are not merged. https://github.com/vitali87/code-graph-rag/blob/main/CONTRIBUTING.md

CONTRIBUTING.md documents the requirement that changes include tests (failing test first for fixes and behavioural changes) as part of the pull request instructions. https://github.com/vitali87/code-graph-rag/blob/main/CONTRIBUTING.md

ruff (lint and format), the ty type checker, and bandit run via pre-commit and CI; SonarCloud and CodeQL add further static warning analysis on every push. https://github.com/vitali87/code-graph-rag/blob/main/.pre-commit-config.yaml

Warnings are hard gates: CI fails on any ruff or type-check finding, and the SonarCloud quality gate on new code is enforced and currently passing with zero open issues. https://sonarcloud.io/project/overview?id=vitali87_code-graph-rag

Warnings are hard gates: CI fails on any ruff or type-check finding, and the SonarCloud quality gate on new code is enforced and currently passing with zero open issues. https://sonarcloud.io/project/overview?id=vitali87_code-graph-rag

Linting is maximally strict in practice: ruff runs with an extensive rule selection plus bandit security checks, the ty type checker enforces strict typing, and all of them block commits via pre-commit and block merges via CI.
https://github.com/vitali87/code-graph-rag/blob/main/pyproject.toml

The primary developer (sole maintainer) is familiar with secure design principles and applies them in the project: fail-safe defaults (MCP server binds to loopback by default and refuses non-loopback binds without an auth token), complete mediation (resolved-path containment checks on all file access endpoints), least privilege (CI workflows use minimal read-only tokens), and limited attack surface (private vulnerability reporting, CodeQL, and dependency scanning).
Example: https://github.com/vitali87/code-graph-rag/security/advisories/GHSA-vvr2-h2jp-838m was fixed same-day with a path-containment mediation fix.

The primary developer knows the common vulnerability classes for this kind of software (path traversal, injection, unauthenticated network exposure, SSRF, insecure deserialisation) and their mitigations, demonstrated in the codebase: path traversal countered by resolved-path containment checks (GHSA-vvr2-h2jp-838m fix), missing authentication countered by loopback-default binding plus mandatory bearer token for network exposure of the MCP server, and Cypher/query construction uses parameterised queries. CodeQL, SonarCloud security rules, and bandit run continuously to catch regressions.

Only publicly published, expert-reviewed algorithms: SHA-256 via Python's hashlib for embedding-cache keys (codebase_rag/embedder.py) and path digests (codebase_rag/utils/path_utils.py); MD5 appears only with usedforsecurity=False for non-security file fingerprints (codebase_rag/graph_updater.py, codebase_rag/parser_fingerprint.py). TLS for LLM API calls comes from the underlying FLOSS HTTP stack (pydantic-ai/httpx on CPython's OpenSSL-backed ssl). Release binaries are signed with Sigstore cosign (.github/workflows/build-binaries.yml). https://github.com/vitali87/code-graph-rag/blob/main/codebase_rag/embedder.py

The project implements no cryptographic primitives of its own; it only calls software designed for the purpose: CPython's hashlib and secrets modules (constant-time bearer-token comparison via secrets.compare_digest in codebase_rag/mcp/server.py), TLS via the standard OpenSSL-backed stack, and Sigstore cosign for artifact signing.
https://github.com/vitali87/code-graph-rag/blob/main/codebase_rag/mcp/server.py

All cryptography-dependent functionality relies exclusively on FLOSS implementations: CPython's hashlib/secrets/ssl (OpenSSL), the pydantic-ai HTTP stack, and Sigstore cosign. No proprietary cryptographic components. https://github.com/vitali87/code-graph-rag/blob/main/pyproject.toml

No default security mechanism depends on a broken algorithm. MD5 appears only for non-security file-change fingerprints and is explicitly flagged usedforsecurity=False (codebase_rag/graph_updater.py, codebase_rag/parser_fingerprint.py); security-relevant hashing uses SHA-256 and token comparison uses constant-time secrets.compare_digest. https://github.com/vitali87/code-graph-rag/blob/main/codebase_rag/graph_updater.py

No default security mechanism uses algorithms with known serious weaknesses: no SHA-1, no CBC-mode SSH, no RC4. Security-relevant hashing is SHA-256; transport security is TLS as provided by the platform's OpenSSL-backed stack.

Distribution channels use HTTPS exclusively. [osps_br_03_02]

No cryptographic hash is retrieved over plain http anywhere in the delivery chain. Distribution is via PyPI and GitHub Releases over HTTPS, and release binaries additionally carry Sigstore cosign signature bundles plus SLSA build provenance.
https://github.com/vitali87/code-graph-rag/blob/main/.github/workflows/build-binaries.yml

There are no unpatched medium-or-higher vulnerabilities. The only published vulnerability, GHSA-vvr2-h2jp-838m (path traversal in the MCP read_file endpoint, High), was patched and released the same day it was reported (2026-07-14).
https://github.com/vitali87/code-graph-rag/security/advisories/GHSA-vvr2-h2jp-838m

The project fixes critical vulnerabilities rapidly. The only high-severity vulnerability reported to date, GHSA-vvr2-h2jp-838m (path traversal in the MCP read_file endpoint), was patched and released the same day it was reported (2026-07-14).
https://github.com/vitali87/code-graph-rag/security/advisories/GHSA-vvr2-h2jp-838m

No valid private credentials are stored in the repository. All secrets (PyPI publishing, Codecov, SonarCloud) live in GitHub Actions secrets. GitHub secret scanning with push protection is enabled on the repository, and CodeQL plus SonarCloud scan every push.

Multiple FLOSS static analysis tools run on every change: CodeQL (python, csharp, actions), SonarCloud, ruff lint, the ty type checker, and bandit in pre-commit. https://github.com/vitali87/code-graph-rag/blob/main/.github/workflows/codeql.yml and https://github.com/vitali87/code-graph-rag/blob/main/.pre-commit-config.yaml

CodeQL and SonarCloud both apply security rule sets that look for common vulnerabilities (injection, path traversal, insecure deserialisation), and bandit scans for common Python security issues on every commit via pre-commit.

Medium and higher severity findings are fixed promptly. The SonarCloud quality gate on new code is enforced on every PR, and CodeQL alerts are triaged and fixed; the high-severity path traversal found in the MCP server was fixed the same day (GHSA-vvr2-h2jp-838m).

Static analysis runs on every commit: CodeQL, SonarCloud, ruff, and ty run in GitHub Actions on every push and pull request, and pre-commit runs ruff and bandit locally before each commit.

The project has an atheris fuzz harness (codebase_rag/tests/fuzz_test_parsers.py, installed via the "fuzz" extra) that varies inputs to the language detection layer, and an automated test suite of over 5,900 tests executed on every push and pull request across Linux, macOS, and Windows with roughly 95 percent coverage reported to Codecov.
https://github.com/vitali87/code-graph-rag/blob/main/codebase_rag/tests/fuzz_test_parsers.py

The software produced by the project is written in Python and C#, both memory-safe languages. Memory-unsafe code appears only in third-party dependencies (tree-sitter grammars, database clients), not in software produced by this project.

The test suite runs with assertions enabled: pytest executes plain Python assert statements (never stripped, since tests do not run under python -O), and the codebase itself contains runtime validation raising explicit errors at trust boundaries.

Dynamic analysis (the fuzz harness and the full test suite on every commit) has not surfaced any medium or higher severity vulnerabilities to date. Any that were found would follow the same process as the one reported vulnerability, GHSA-vvr2-h2jp-838m, which was fixed and released the same day it was confirmed.