npm JavaScript analyzed 1.6.11 deep scan unknown

gitnexus

v1.6.11
npm

Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.

maintainer
abhigyanpatwari
licence
PolyForm-Noncommercial-1.0.0
first seen
2026-05-22
last seen
2026-09-12
releases · 30d
118
short id

gitnexus is an MCP server distributed on npm, maintained by abhigyanpatwari, tracked here since May 2026. It has shipped 892 releases (currently 1.6.11) and exposes 17 tools. Tools include api_impact, check, context, cypher, detect_changes, explain, and 11 more. Its composite risk grade is B — an inferred review prompt computed from observed signals, not a verdict.

what we found

Reading the source raised 2 review prompts — dangerous code and exfiltration combo — each a pattern worth a human look rather than a finding of fault.

Its 17 tools appear to reach filesystem, network and database, inferred from tool names, descriptions and input schemas rather than from observed behaviour.

full security breakdown →
tools 17
  • api_impact Pre-change impact report for an API route handler
  • check Read-only structural checks against the indexed graph
  • context 360-degree symbol view — categorized refs, process participation
  • cypher Raw Cypher graph queries
  • detect_changes Git-diff impact — maps changed lines to affected processes
  • explain Explain persisted taint findings (source→sink flows, --pdg indexes)
  • group_list List configured repository groups
  • group_sync Rebuild a group's Contract Registry and cross-repo links
  • impact Blast radius analysis with depth grouping and confidence
  • list_repos Discover all indexed repositories (paginated — limit/offset)
  • pdg_query Query control/data dependence at statement level (--pdg indexes)
  • query Process-grouped hybrid search (BM25 + semantic + RRF)
  • rename Multi-file coordinated rename with graph + text search
  • route_map API route map — which components fetch which endpoints, and handlers
  • shape_check Validate API response shapes against consumers' property accesses
  • tool_map MCP/RPC tool definitions — where they're defined and handled
  • trace Shortest directed path between two symbols (call + class-member edges)
release cadence · 90d 393 releases
06-15 00:00 07-29 00:00 now
recent releases last 10
version date src
1.6.12-rc.38 2026-09-12 npm
1.6.12-rc.37 2026-09-12 npm
1.6.12-rc.36 2026-09-11 npm
1.6.12-rc.35 2026-09-11 npm
1.6.12-rc.34 2026-09-11 npm
1.6.12-rc.33 2026-09-11 npm
1.6.12-rc.32 2026-09-11 npm
1.6.12-rc.31 2026-09-11 npm
1.6.12-rc.30 2026-09-11 npm
1.6.12-rc.29 2026-09-10 npm

view all →