Graphify – Turn Any Codebase into a Queryable Knowledge Graph
Turn code, docs, SQL schemas, and PDFs into a queryable knowledge graph with /graphify in your AI coding assistant – no vector store needed.
Evidence shows: Security policy details threat model including URL validation, path traversal protection, XSS sanitization, prompt injection mitigation, reflecting least privilege. Installation and operation require explicit user commands like `graphify install`, and no network calls by default. Data flow transparency: code parsed locally, docs/media via user-configured API keys, README clearly states. Sensitive data handling: does not store credentials or API keys, but relies on user-configured API keys, storage method not specified. Dependency security: CI includes bandit and pip-audit but non-blocking (continue-on-error), no audit results provided. External effects: no network listener by default, but `ingest` subcommand fetches URLs, requires explicit user input. Rollback: provides `graphify uninstall`, but no data rollback or recovery mechanism. Source attribution: README and pyproject clearly identify repo and package name, but publisher unverified. Deductions: incomplete rollback, non-blocking security scans.
Evidence shows: README, SECURITY.md, pyproject.toml, and CI config are consistent in functionality descriptions, no contradictions. Dependencies explicitly listed in pyproject, CI uses uv.lock for reproducible installs. Failure messages: SECURITY.md and code comments provide error handling, e.g., corrupted graph.json recovery message. Deductions: no actual runtime tests, but static evidence sufficient.
Evidence shows: README details target audience (AI coding assistant users) and multiple use cases (code, docs, PDFs, etc.). Capability boundaries clear: code parsed locally, docs/media require API keys, supported file types and optional extras listed. Trigger precision: `/graphify` command and `graphify install` clear, with platform-specific install commands. Environment fit: supports multiple OS and Python versions, installation instructions provided. Deductions: no actual runtime verification, but static evidence sufficient.
Evidence shows: README structure clear, includes installation, usage, platform support, file types, security sections. Installation notes detailed, including multiple methods and common issues. Naming stability: package name `graphifyy` and command `graphify` clear, README warns other `graphify*` packages not affiliated. Examples and FAQ: README includes usage examples and FAQ. Known limitations: SECURITY.md and README mention security model and limitations. License: Apache-2.0, LICENSE file complete. Versioning: pyproject version 0.9.37, but no CHANGELOG. Maintenance responsibility: README and SECURITY.md provide contact and vulnerability reporting. Deductions: missing CHANGELOG.
Evidence shows: Outputs include graph.html, GRAPH_REPORT.md, and graph.json, directly usable. Marginal value: maps codebase to knowledge graph, provides query, path, explain functions, unique value over traditional grep. Cost-benefit: code parsing local and free, docs/media require API keys but free options available. Deductions: no actual runtime verification, but static evidence sufficient.
Evidence shows: README benchmarks link to BENCHMARKS.md but no specific data provided. Security claims detailed in SECURITY.md but no test evidence. Fact-inference separation: README clearly distinguishes EXTRACTED and INFERRED edges, but no verification method. Deductions: benchmark data not in provided files, cannot verify.
- Publisher identity unverified, exercise caution.
- Dependency security scans non-blocking, potential unpatched vulnerabilities.
- Rollback mechanism incomplete, only uninstall command, no data recovery.
- Benchmark data not in provided files, performance claims unverifiable.
What does this agent do, and when should you use it?
Graphify is a local-first code analysis tool that integrates with AI coding assistants like Claude Code, Cursor, Codex, and Gemini CLI. It uses tree-sitter to deterministically parse code into an AST and build a knowledge graph without any LLM calls, resolving cross-file relationships like `calls`, `imports`, `inherits`, and `mixes_in` across 40+ languages. For docs, PDFs, images, and videos, it uses your assistant's model or a configured API key for semantic extraction. Every edge is tagged `EXTRACTED` or `INFERRED` with confidence, so you know what was read vs. inferred. The output includes `graph.html` for interactive visualization, `GRAPH_REPORT.md` with highlights, and `graph.json` for querying. It offers `query`, `path`, and `explain` commands, and can serve the graph via MCP for structured access.
Graphify runs via the /graphify command on a directory and produces graphify-out/ with three files: graph.html, GRAPH_REPORT.md, and graph.json. It parses code with tree-sitter, extracting cross-file edges such as calls, imports, inherits, and mixes_in. Users can query with graphify query "<question>", find shortest paths with graphify path "A" "B", and explain nodes with graphify explain "Symbol". It registers as a skill via graphify install for platforms like Claude Code, Gemini CLI, and more. It also supports graphify export callflow-html for architecture diagrams, graphify hook install to auto-rebuild on git commit, and graphify add <URL> to fetch papers or videos into the graph.
- A developer joining a large codebase can use the interactive graph to quickly see key concepts and how modules connect.
- During debugging or code review, trace dependencies between functions or services using
graphify path. - Teams can commit
graphify-out/to git so everyone has an up-to-date map from the start. - CI pipelines can run
graphify extractheadlessly to keep the graph fresh without IDE involvement. - For projects with docs and PDFs, semantic extraction maps non-code assets into the same graph.
- Architects can identify hot spots via god nodes and communities to plan refactors.
What are this agent's strengths and limitations?
- Local deterministic AST parsing with no LLM calls for code, ensuring privacy and offline capability.
- Every edge has a confidence label distinguishing explicit extractions from inferred relationships.
- Multi-platform integration (20+ assistants) with an MCP server for structured tool access.
- No vector store – a real graph you can traverse, with community detection and path queries.
- Docs, PDFs, and images require LLM calls, needing API keys or an IDE session.
- For huge codebases, graph files can become large (512 MiB cap) and the HTML might be heavy in browsers.
- There is a learning curve for CLI commands and configuration options.
- Installation may hit PATH issues on some systems, requiring extra setup like
uv tool update-shell.
How do you install or deploy this agent?
Install with uv tool install graphifyy or pipx install graphifyy, then run graphify install to register the skill. Requires Python 3.10+, uv or pipx. Optional extras: uv tool install "graphifyy[pdf]", "graphifyy[office]", "graphifyy[video]", etc.
How do you use this agent?
In your AI assistant, type /graphify . to generate the graph. Then query with graphify query "<question>", graphify path "A" "B", or graphify explain "Symbol". For headless extraction, set an API key and run graphify extract ./docs --backend claude. You can also serve the graph via MCP: python -m graphify.serve graphify-out/graph.json.
How does this agent compare with similar options?
Graphify outperforms mem0 and supermemory on the LOCOMO benchmark in recall@10 (0.497 vs 0.048 and 0.149) but QA accuracy is slightly lower than supermemory (45.3% vs 49.7%). Compared to RAG systems, it avoids vector storage and instead builds a traversable graph.
FAQ
How does Graphify handle code privacy?
Do I need an API key?
How is Graphify different from RAG?
How do I make my assistant always use the graph?
graphify claude install or the equivalent for your platform, which writes config files like CLAUDE.md or AGENTS.md and installs hooks to prefer graph queries.