code-graph-rag

Open source alternative to Augment AI and Sourcegraph

5.3K stars
MIT
Active this week
Last commit 1 day ago

Last verified Oct 20, 2026

Build knowledge graphs from multi-language codebases using Tree-sitter parsing and query them with natural language for AI-powered code understanding.

Visit website GitHub5.3K

Read the full breakdownWho it is for, how it works, trade-offs, the quick start and the FAQ

who it's for

Who code-graph-rag is for#

Platform teams enforcing compliance traceability

Map code to regulatory requirements (SOX, HIPAA, PCI-DSS) by adding custom compliance edges to the graph. Query which functions handle PII, trace data lineage across services, and audit cost attribution at the code level. The open schema extends to model team ownership, security classifications, and domain-specific relationships without vendor approval.

Skip if:

Your compliance needs fit into existing static analysis tools with predefined rule sets. Code-Graph-RAG's value is custom relationship modeling; if you don't need bespoke edge types, simpler linters may suffice.

AI engineers building code-aware RAG pipelines

Embed the knowledge graph into AI workflows for precise code retrieval. Natural language queries return exact function names, file paths, and line numbers instead of approximate text matches. Surgical code edits integrate into AI-driven refactoring agents that need structural targeting, not regex.

Skip if:

Your RAG pipeline works over documentation or text-heavy content, not source code. If you're indexing Markdown docs or API specs, standard vector search over text is simpler than parsing code into a graph.

Security researchers tracking data flow across services

FLOWS_TO taint edges trace values from sources to sinks across 10 languages. Query "show all paths from this user input to database writes" as a graph traversal. Use this to map attack surface, audit sensitive data handlers, and identify unvalidated flows. Dead code detection walks call edges from entry points to surface unreachable functions.

Skip if:

You're auditing a single-language codebase with mature static analysis tooling. Code-Graph-RAG's strength is cross-language taint tracking in polyglot monorepos; single-language projects often have specialized analyzers that run faster.

Teams managing legacy monorepos with mixed languages

Navigate codebases where Python microservices call TypeScript frontends that invoke Rust libraries. The unified graph schema surfaces cross-language dependencies that grep and IDE navigation miss. Incremental updates keep the graph current as the codebase evolves, so queries stay grounded in the actual structure.

Skip if:

You're maintaining one or two single-language projects with clear module boundaries. Small, well-organized codebases often don't need graph-based navigation; IDE "find usages" and grep suffice.

the problem

The problem it solves#

Understanding large codebases is slow, manual, and error-prone. Grep and text search miss structural relationships like call chains, data flow paths, and cross-file dependencies. Static analysis tools produce fragmented results that require manual assembly, and commercial code intelligence platforms charge per-seat fees that scale poorly for large teams while locking your code graph into proprietary systems.

The hardest part is querying across languages in a monorepo. A Python service calls a TypeScript API, which invokes a Rust library, and tracing that chain manually requires opening three repos, parsing three syntaxes, and keeping the call stack in your head. Most tools treat each language in isolation, forcing you to stitch the results together by hand.

how code-graph-rag solves it

How it solves it#

Multi-language Tree-sitter parsing

Parses 14 languages (Python, TypeScript, JavaScript, Rust, Go, Java, C, C++, C#, PHP, Lua, Dart, Ruby, Scala) with a unified graph schema. Every language produces the same node types (functions, classes, modules, imports), so cross-language queries work without language-specific logic. Adding a new language requires a single ast-grep YAML pattern file.

Memgraph knowledge graph backend

Stores code structure as an interconnected graph where functions, classes, and modules are nodes, and calls, imports, and data-flow edges are relationships. Cypher queries traverse call chains, find dead code by walking reference edges from entry points, and trace taint paths from sources to sinks. The graph persists across runs, so incremental updates avoid re-parsing unchanged files.

Natural language query interface

Ask questions in plain English and get answers grounded in the graph. "What functions handle authentication?" translates to a Cypher query, retrieves matching nodes, and returns the file paths and line numbers. The AI layer converts intent to precise graph queries without requiring manual Cypher knowledge.

AST-based surgical code editing

Replace code blocks by function name with exact AST targeting, not regex. The tool shows a visual diff preview before writing changes, so you approve edits before they touch the filesystem. Combined with the graph query layer, you can find and patch every function matching a structural pattern across the entire codebase.

MCP server integration

Runs as an MCP server with 15 tools for indexing, querying, editing, and searching. Claude Code and other MCP clients can query the graph, retrieve source code, and perform surgical replacements directly from the IDE. Setup: `claude mcp add code-graph-rag` after installing the tool.

Data-flow taint tracking

FLOWS_TO edges trace values from sources through assignments, function calls, and returns to I/O sinks. Supported in Python, JavaScript, TypeScript, Go, Java, Rust, C++, C, C#, and Lua. Security researchers use this to map blast radius, track PII handlers, and audit compliance requirements by walking provenance as graph reachability.

strengths · trade-offs

Strengths and trade-offs#

Strengths

MIT license with full self-hostingThe self-hosted tier is MIT licensed, so you can run it on your infrastructure, modify the graph schema, and use it commercially without restrictions. Unlike Sourcegraph (proprietary, per-seat billing) or GitHub Copilot (API-only, no graph export), you pay once for the server and own the pipeline.
Unified schema across 14 languagesEvery language produces the same graph node types (Function, Class, Module, Import edges), so cross-language queries work without language-specific Cypher. A monorepo mixing Python, TypeScript, and Rust gets one coherent graph, not three isolated trees. Other multi-language tools emit different schemas per language, forcing you to write separate queries for each.
Incremental graph updatesThe `cgr start --update-graph` command re-parses only changed files, leaving the rest of the graph intact. Large monorepos avoid full re-indexing on every run. The shared Memgraph instance holds multiple projects simultaneously, so adding one repo does not wipe the others.
Structural search and replace with ast-grepMatch and rewrite code by AST pattern, not text or regex. Find every function with a specific parameter type, or replace all instances of a deprecated API call across the codebase. The MCP tool `structural_replace` shows a dry-run diff before writing changes, so you approve transformations before they touch files.

Trade-offs

-Docker and Memgraph required for self-hostingThe graph backend runs in a Memgraph Docker container, and the semantic search tier needs Qdrant. A minimal deployment requires Docker installed and at least 2GB RAM for the database. Lightweight VPS instances under 1GB will hit resource limits on large codebases. Cloud deployment or a dedicated small server resolves this, but it is not a zero-dependency install.
-AI provider API key needed for Cypher generationNatural language queries translate to Cypher via an LLM (Google Gemini, DeepSeek, or OpenAI). You need an API key for the chosen provider. The tool does not bundle a local model, so air-gapped environments require manual Cypher queries or a self-hosted LLM endpoint.
-Graph indexing time scales with codebase sizeInitial indexing parses every source file and writes the graph. A 100k-line monorepo takes several minutes; a million-line codebase can take 30+ minutes. Incremental updates mitigate this after the first run, but cold-start indexing for very large repos is not instant.

versus alternatives

code-graph-rag vs alternatives#

Code-Graph-RAG vs Sourcegraph

Both provide code intelligence for large codebases, but Code-Graph-RAG is MIT licensed with full self-hosting while Sourcegraph is proprietary with per-seat pricing.

Feature	Code-Graph-RAG	Sourcegraph
License	MIT	Proprietary
Self-hosting	Yes, Docker-based	Limited (free tier capped)
Graph backend	Memgraph (open)	Proprietary index
Multi-language	14 languages, unified schema	40+ languages
Natural language queries	Yes, via LLM	Search syntax only
Pricing	Free self-hosted	$99+/user/month

Code-Graph-RAG wins when you need data ownership, custom graph schema extensions (compliance edges, team ownership), and structural queries beyond text search. The unified schema across 14 languages enables cross-language dependency queries. The open Memgraph backend lets you write custom Cypher queries and integrate the graph into external workflows.

Sourcegraph is better when you need IDE integrations across 40+ languages, a polished search UI with no setup, and enterprise support. Its batch change system is more mature. If your team values zero infrastructure management and can afford per-seat pricing, the managed service removes the Docker layer.

Code-Graph-RAG vs GitHub Copilot Workspace

Feature	Code-Graph-RAG	Copilot Workspace
License	MIT	Proprietary
Self-hosting	Yes	No
Graph backend	Memgraph	Proprietary index
Pricing	Free self-hosted	$10-20/user/month
Data-flow tracing	Yes (10 languages)	Limited

Code-Graph-RAG wins for self-hosting (compliance, air-gapped, cost control). The Memgraph backend exposes the full code graph for custom queries. Data-flow taint tracking with FLOWS_TO edges enables security audits that Copilot does not surface.

Copilot Workspace is better if your team uses GitHub, values zero setup, and needs AI-assisted PR generation in the web UI. Its GitHub Issues integration is tighter than Code-Graph-RAG's external MCP workflow.

install · quick start

Quick start#

bash

Self-hosting requires Docker, cmake, and ripgrep installed.

```bash
# Install with uv (recommended)
uv tool install "code-graph-rag[treesitter-full,semantic]"

# Or with pipx
pipx install "code-graph-rag[treesitter-full,semantic]"

# Start the Memgraph + Qdrant stack
cgr daemon up

# Index a repository
cgr start --repo-path /path/to/repo --update-graph

# Add as MCP server in Claude Code
claude mcp add code-graph-rag --transport stdio \
  --env TARGET_REPO_PATH="$(pwd)" \
  --env CYPHER_PROVIDER=google \
  --env CYPHER_MODEL=gemini-2.5-flash \
  --env CYPHER_API_KEY=your-api-key \
  cgr mcp-server
```

tech stack · detected from GitHub

What it's built on#

Languages: PythonRust

frequently asked

FAQ#

Is Code-Graph-RAG free to use?

Yes. The self-hosted version is MIT licensed and free to run on your infrastructure. You pay for the server (Docker, Memgraph, Qdrant), the AI provider API key for natural language queries, and nothing else. There is no per-seat pricing, no usage caps, and no vendor fees.

Can I use Code-Graph-RAG without an AI API key?

Yes, but you lose the natural language query layer. You can index the codebase, build the graph, and write manual Cypher queries directly against Memgraph. The surgical editing, structural search, and dead code detection features work without an LLM. For teams with air-gapped environments, manual Cypher or a self-hosted LLM endpoint are the two paths.

How does Code-Graph-RAG compare to Sourcegraph?

Code-Graph-RAG is MIT licensed and self-hosted with no per-seat fees. Sourcegraph is proprietary with per-user pricing that scales poorly for large teams. Code-Graph-RAG stores the graph in Memgraph, which you control; Sourcegraph locks your code intelligence data into their platform. Sourcegraph has stronger IDE integrations and a mature search UI; Code-Graph-RAG offers deeper graph-based structural queries and custom relationship modeling.

What languages does Code-Graph-RAG support?

Python, TypeScript, TSX, JavaScript, Rust, Go, Java, C, C++, C#, PHP, Lua, and Dart are fully supported. Scala is in development, and Ruby has structural support (modules, functions, classes, imports). Data-flow taint tracking works in Python, JavaScript, TypeScript, Go, Java, Rust, C++, C, C#, and Lua. Adding a new language requires a single ast-grep YAML pattern file that defines the AST extraction rules.

Can Code-Graph-RAG handle very large monorepos?

Yes, but initial indexing time scales with codebase size. A 100k-line repo indexes in minutes; a million-line repo takes 30+ minutes on the first run. Incremental updates (cgr start --update-graph) re-parse only changed files, so subsequent runs are much faster. The graph persists in Memgraph, and queries run in milliseconds regardless of codebase size once indexed.

also worth a look

Similar open-source tools#

Understand-Anything

Alternative toSourcegraph

Interactive knowledge graphs for codebases

87,219 GitHub stars
Licence MIT

Vllm

Alternative toTogether AI

High-throughput LLM inference server with OpenAI-compatible API

94,441 GitHub stars
Licence Apache-2.0

WeKnora

Alternative toGlean

Self-hosted knowledge base with RAG search, AI agent, and wiki

34,874 GitHub stars
Licence MIT

Chat2DB

Alternative toDataGrip

AI text-to-SQL client for 40+ databases; local-first, self-hosted

28,327 GitHub stars
Licence Apache-2.0 with additional commercial restrictions (LicenseRef-Chat2DB)

Duckle

Alternative toFivetran

Self-hosted ETL on DuckDB with 385 connectors and no per-row billing.

1,517 GitHub stars
Licence Apache-2.0

Firebase Ios Sdk

Alternative toAWS Amplify

Open source Apple SDK for Firebase auth, data, push and crashes

6,974 GitHub stars
Licence Apache-2.0

by category

Open source tools in these categories#

463

4,904 GitHub stars
Licence Apache-2.0
#AI Agents

Inbox Zero

Alternative toSuperhuman

AI email assistant that drafts replies and clears your inbox

12,712 GitHub stars
Licence AGPL-3.0
#Email

Omnara

Alternative toClaude Managed Agents

Open-source agent deployment API. Self-host or use Omnara Cloud.

2,957 GitHub stars
Licence Apache-2.0
#AI Agents

Feature your project

The projects we add and every new guide. Free, unsubscribe any time.

Find open source alternatives to paid software

Code-Graph-RAG vs Sourcegraph

Both provide code intelligence for large codebases, but Code-Graph-RAG is MIT licensed with full self-hosting while Sourcegraph is proprietary with per-seat pricing.

Feature	Code-Graph-RAG	Sourcegraph
License	MIT	Proprietary
Self-hosting	Yes, Docker-based	Limited (free tier capped)
Graph backend	Memgraph (open)	Proprietary index
Multi-language	14 languages, unified schema	40+ languages
Natural language queries	Yes, via LLM	Search syntax only
Pricing	Free self-hosted	$99+/user/month

Code-Graph-RAG vs GitHub Copilot Workspace

Feature	Code-Graph-RAG	Copilot Workspace
License	MIT	Proprietary
Self-hosting	Yes	No
Graph backend	Memgraph	Proprietary index
Pricing	Free self-hosted	$10-20/user/month
Data-flow tracing	Yes (10 languages)	Limited

Who code-graph-rag is for#

Platform teams enforcing compliance traceability

Skip if:

AI engineers building code-aware RAG pipelines

Skip if:

Security researchers tracking data flow across services

Skip if:

Teams managing legacy monorepos with mixed languages

Skip if:

The problem it solves#

How it solves it#

Multi-language Tree-sitter parsing

Memgraph knowledge graph backend

Natural language query interface

AST-based surgical code editing

MCP server integration

Data-flow taint tracking

Strengths and trade-offs#

Strengths

Trade-offs

code-graph-rag vs alternatives#

Code-Graph-RAG vs Sourcegraph

Code-Graph-RAG vs GitHub Copilot Workspace

Quick start#

What it's built on#

FAQ#

Similar open-source tools#

Open source tools in these categories#

Developer Tools

AI & Machine Learning

Backend Development

Databases & Storage

Find open source alternatives to paid software

Who code-graph-rag is for#

Platform teams enforcing compliance traceability

Skip if:

AI engineers building code-aware RAG pipelines

Skip if:

Security researchers tracking data flow across services

Skip if:

Teams managing legacy monorepos with mixed languages

Skip if:

The problem it solves#

How it solves it#

Multi-language Tree-sitter parsing

Memgraph knowledge graph backend

Natural language query interface

AST-based surgical code editing

MCP server integration

Data-flow taint tracking

Strengths and trade-offs#

Strengths

Trade-offs

code-graph-rag vs alternatives#

Code-Graph-RAG vs Sourcegraph

Code-Graph-RAG vs GitHub Copilot Workspace

Quick start#

What it's built on#

FAQ#

Similar open-source tools#

Open source tools in these categories#

Developer Tools

AI & Machine Learning

Backend Development

Databases & Storage

Find open source alternatives to paid software