github Python re-analysis due

n24q02m/crg

github

Knowledge graph for token-efficient code reviews -- semantic search and call-graph resolution across your codebase.

maintainer
n24q02m
licence
Apache-2.0
first seen
2026-09-13
last seen
2026-09-15
releases · 30d
27
short id

n24q02m/crg is an MCP server distributed on github, maintained by n24q02m, tracked here since September 2026. It has shipped 110 releases and exposes 25 tools. Tools include build, cache_clear, diff, embed, export, impact, and 19 more. Its composite risk grade is B — an inferred review prompt computed from observed signals, not a verdict.

what we found

Reading the source raised 2 review prompts — dangerous code and exfiltration combo — each a pattern worth a human look rather than a finding of fault.

Its 25 tools appear to reach filesystem, network, secrets and database, inferred from tool names, descriptions and input schemas rather than from observed behaviour.

full security breakdown →
tools 20 of 25
  • build Full or incremental graph build. Set full_rebuild=true to re-parse all files; pass roots to federate extra repo directories into one graph.
  • cache_clear Remove all computed embeddings.
  • diff Nodes added/removed/modified between two commit SHAs (from_sha, to_sha).
  • embed Compute vector embeddings for semantic search. Dual-mode: local ONNX or cloud chain.
  • export Export the graph as graphml / json-ld / dot / cypher. Inline or to output_path.
  • impact Blast radius of changed files. Auto-detects from git diff. Paginated with max_results.
  • large_functions Find functions/classes exceeding a line-count threshold.
  • query Predefined patterns: callers_of, callees_of, imports_of, importers_of, children_of, tests_for, inheritors_of, file_summary.
  • renamed_in_diff Symbols whose callsite line shifted versus a base ref.
  • report Re-emit cached findings as JSON (format='json') or SARIF v2.1.0 (format='sarif').
  • rule_list List available rules for an engine.
  • scan Run a security scan (engine='heuristic' default = 5 regex rules, or 'semgrep'). Findings persist on nodes.security_tags.
  • search Search code entities by name/keyword or semantic similarity.
  • set Update a runtime setting (key=log_level).
  • setup_complete Re-resolve credentials from environment variables.
  • setup_reset Clear credentials and reset state.
  • setup_skip Set local mode (skip relay permanently, use ONNX only).
  • setup_start Start relay setup to configure API keys via browser (HTTP mode).
  • setup_status Show current credential state, providers configured, and setup URL.
  • spot_check Random callsite snippets from the last callers_of/callees_of/inheritors_of/importers_of result.
All 25 tools →
release cadence · 90d 48 releases
06-18 00:00 08-01 00:00 now
recent releases last 10
version date src
v3.26.10 2026-09-14 github
v3.26.9 2026-09-14 github
v3.26.8 2026-09-14 github
v3.26.7 2026-09-14 github
v3.26.6 2026-09-14 github
v3.26.5 2026-09-14 github
v3.26.4 2026-09-14 github
v3.26.3 2026-09-13 github
v3.26.2 2026-09-13 github
v3.26.1 2026-09-13 github

view all →