trace-mcp Code Graph MCP Server by Vysotskyi: Setup for Claude, Cursor and Other Apps

• Gives a map of your project

  Returns the frameworks and languages found, file counts, directory layout and entry points, as a first look at an unfamiliar repo.

  Try: “Show me the project map.”

  Read · get_project_map

• Finds symbols by name or text

  Searches the index for functions, classes and other symbols by name, kind or text, ranked by importance in the dependency graph.

  Try: “Search for the function that creates sessions.”

  Read · search

• Searches all indexed files for text

  Full-text search across the files in the index.

  Try: “Search for every mention of "retry_limit".”

  Read · search_text

• Shows one symbol with its source

  Looks up a function or class by ID or full name and returns its source code.

  Try: “Show me the source of UserService.create.”

  Read · get_symbol

• Lists a file's symbols without bodies

  Returns the signatures of everything in a file, which is cheaper than reading the whole file.

  Try: “Give me the outline of src/auth/session.ts.”

  Read · get_outline

• Finds every use of a symbol

  Returns the imports, calls and renders that refer to a symbol or file across the project.

  Try: “Where is parseConfig used?”

  Read · find_usages

• Shows who calls a function and what it calls

  Builds a two-way call graph around one symbol.

  Try: “Show the call graph for processOrder.”

  Read · get_call_graph

• Shows what breaks if you change something

  Reports what depends on a file or symbol, with a risk score, breaking-change checks and related past decisions.

  Try: “What breaks if I change app/Models/User.php?”

  Read · get_change_impact

• Gathers code to start a task

  Returns the execution paths, tests and entry points that matter for a task described in words.

  Try: “Get the context to fix the login bug.”

  Read · get_task_context

• Picks the best first step for a task

  Routes a new task to the code and past decisions most relevant to it.

  Try: “Plan my first moves for adding rate limiting.”

  Read · plan_turn

• Finds code for a topic

  Searches by keyword or topic and returns ranked snippets that fit a token budget.

  Try: “Find the code about invoice generation.”

  Read · get_feature_context

• Packs a symbol with its dependencies

  Returns a symbol source, the imports it needs and optional callers, sized to a token budget.

  Try: “Bundle PaymentService with its callers.”

  Read · get_context_bundle

• Gives a very short orientation

  Returns a compact summary of the project for the start of a session.

  Try: “Orient me on this repo.”

  Read · get_minimal_context

• Gives a short session start summary

  Returns a compact orientation, and with a resume scope carries over structure from earlier sessions.

  Try: “Wake me up on where we left off.”

  Read · get_wake_up

• Traces a web request through the code

  For a URL and method, follows route, middleware, controller and service (framework-dependent).

  Try: “Trace GET /users/:id through the code.”

  Read · get_request_flow

• Finds classes that implement an interface

  Lists the classes that implement or extend a given interface or base class.

  Try: “Which classes implement Repository?”

  Read · get_implementations

• Shows a class family tree

  Walks TypeScript classes and interfaces up to what they extend and down to what extends them.

  Try: “Show the type hierarchy of BaseController.”

  Read · get_type_hierarchy

• Finds tests covering a symbol

  Returns the test files and functions that cover a symbol or file.

  Try: “Which tests cover calculateTax?”

  Read · get_tests_for

• Finds symbols without tests

  Lists symbols that have no test coverage in the index.

  Try: “What is untested in the billing module?”

  Read · get_untested_symbols

• Finds unused code

  Detects symbols and exports that nothing uses.

  Try: “Find dead code in src/utils.”

  Read · get_dead_code

• Finds circular imports

  Finds cycles in the import graph.

  Try: “Are there any circular imports?”

  Read · get_circular_imports

• Reports code complexity

  Returns cyclomatic complexity, nesting depth and parameter counts for a file or the project.

  Try: “Which functions are the most complex?”

  Read · get_complexity_report

• Measures how tangled files are

  Returns incoming and outgoing dependencies and an instability score per file.

  Try: “Which files are most tightly coupled?”

  Read · get_coupling

• Ranks the most important files

  Ranks files by how central they are in the import graph.

  Try: “Which files matter most in this repo?”

  Read · get_pagerank

• Finds risky, busy files

  Lists files that are both complex and changed often in git history.

  Try: “Show the risk hotspots.”

  Read · get_risk_hotspots

• Shows how often files change

  Returns commit counts, authors and a volatility rating per file from git history.

  Try: “Which files change the most?”

  Read · get_git_churn

• Shows who owns a file

  Uses git history to show who contributed most to files.

  Try: “Who owns src/payments?”

  Read · get_code_owners

• Maps a git diff to symbols

  Turns a diff into the functions, classes and methods it touches, for pull request review.

  Try: “Which symbols does this branch change?”

  Read · get_changed_symbols

• Compares two branches by symbol

  Reports which symbols were added, changed or removed between two branches.

  Try: “Compare main and feature/auth by symbol.”

  Read · compare_branches

• Predicts how risky an edit is

  Rates a planned change from low to critical, with contributing factors and ways to reduce the risk.

  Try: “How risky is changing the Order model?”

  Read · assess_change_risk

• Checks if an edit is safe

  Gives one verdict on whether a symbol or file is safe to edit and what must be kept.

  Try: “Is it safe to edit AuthMiddleware?”

  Read · check_edit_safe

• Checks if a name already exists

  Looks for an existing function or class with a name before you create a new one.

  Try: “Does a formatDate helper already exist?”

  Read · check_duplication

• Checks a rename for clashes

  Looks for existing symbols with the target name in the file and its importers before a rename.

  Try: “Check renaming getUser to fetchUser.”

  Read · check_rename

• Checks layer rules

  Finds forbidden imports between layers you have defined.

  Try: “Does the UI layer import from the database layer?”

  Read · check_architecture

• Runs quality gate checks

  Runs configured checks on complexity, coupling, cycles, dead exports, tech debt and security.

  Try: “Run the quality gates.”

  Read · check_quality_gates

• Scans for common vulnerabilities

  Scans project files for OWASP Top 10 issues such as injection, XSS, hardcoded secrets and weak crypto.

  Try: “Scan this project for security issues.”

  Read · scan_security

• Tracks untrusted data to risky calls

  Follows data from sources like request parameters to dangerous sinks like SQL queries and exec calls.

  Try: “Trace user input to any SQL queries.”

  Read · taint_analysis

• Lists your dependencies

  Builds a software bill of materials from package manifests and lockfiles.

  Try: “Generate an SBOM for this project.”

  Read · generate_sbom

• Runs the type checker and maps errors

  Runs tsc, mypy or pyright in your project and ties each error to the function it sits in.

  Try: “Run the type checker and list the errors by symbol.”

  Runs code · get_diagnostics

• Previews a refactor

  Shows what a rename, move, extract or signature change would do, without applying it.

  Try: “Preview moving UserService to a new file.”

  Read · plan_refactoring

• Renames a symbol everywhere

  Renames a symbol at its definition and in every file that uses it. It edits your source files.

  Try: “Rename getUser to fetchUser across the project.”

  Write · apply_rename

• Moves a symbol or file

  Moves a symbol to another file, or moves or renames a file, and updates import paths. It edits your source files.

  Try: “Move the Logger class to src/lib/logger.ts.”

  Write · apply_move

• Finds and replaces across files

  Runs a structural (AST) or regex find and replace over many files. It edits your source files.

  Try: “Replace all uses of oldApi() with newApi().”

  Write · apply_codemod

• Changes a function signature

  Adds, removes, renames or reorders parameters and updates every call site. It edits your source files.

  Try: “Add a timeout parameter to fetchData and update callers.”

  Write · change_signature

• Extracts code into a helper

  Moves a line range out of a function into a new named helper, for TypeScript and JavaScript. It edits your source files.

  Try: “Extract lines 40 to 60 into a helper called validateInput.”

  Write · extract_function

• Removes an unused symbol

  Deletes a symbol that nothing uses from its file.

  Try: “Remove the unused legacyParser function.”

  Delete · remove_dead_code

• Rebuilds the index

  Re-indexes the whole project or one folder.

  Try: “Reindex the src folder.”

  Write · reindex

• Precomputes search embeddings

  Builds and caches symbol embeddings for semantic search.

  Try: “Embed the repo for semantic search.”

  Write · embed_repo

• Repairs the local index

  Applies a targeted repair to the local SQLite index.

  Try: “Repair the index.”

  Write · repair_index

• Checks the index for damage

  Runs a read-only structural check of the local SQLite index.

  Try: “Verify the index.”

  Read · verify_index

• Shows index status

  Returns file, symbol and edge counts, errors and indexing progress.

  Try: “How healthy is the index?”

  Read · get_index_health

• Lists registered projects

  Lists the projects registered with trace-mcp on this machine.

  Try: “Which projects are registered?”

  Read · list_projects

• Runs a tool on another project

  Relays a trace-mcp call to a different registered project than the current one.

  Try: “Run get_project_map on my api project.”

  Runs code · call_project_tool

• Runs several tools in one request

  Executes many trace-mcp tools in a single call.

  Try: “Run the project map and index health together.”

  Runs code · batch

• Saves a decision to memory

  Writes a decision or convention into the decision store and links it to code.

  Try: “Remember that we chose PostgreSQL for JSONB support.”

  Write · remember_decision

• Records a decision by hand

  Manually records an architectural decision, tech choice or convention.

  Try: “Record a decision to use Zod for validation.”

  Write · add_decision

• Searches saved decisions

  Queries the decision store, which links decisions to symbols and files.

  Try: “Why did we pick this auth approach?”

  Read · query_decisions

• Shows one decision

  Fetches a single decision with its full content.

  Try: “Show decision 12.”

  Read · get_decision

• Marks a decision as outdated

  Marks a decision as no longer valid.

  Try: “Invalidate the decision about Redis.”

  Write · invalidate_decision

• Exports decisions

  Exports decisions to JSONL or Markdown.

  Try: “Export my decisions to Markdown.”

  Files · export_decisions

• Extracts decisions from past sessions

  Reads Claude Code and Claw Code session logs and pulls out decisions, tech choices and bug causes by pattern matching.

  Try: “Mine my past sessions for decisions.”

  Write · mine_sessions

• Indexes past conversations for search

  Indexes conversation content from Claude Code and Claw Code sessions so it can be searched later.

  Try: “Index my past sessions.”

  Write · index_sessions

• Searches past conversations

  Searches across past session conversations that were indexed.

  Try: “What did we discuss about GraphQL last month?”

  Read · search_sessions

• Finds Claude Code projects on this machine

  Scans ~/.claude/projects for projects Claude Code has touched and decodes their paths. It sits behind an opt-in config flag.

  Try: “Which projects has Claude Code touched?”

  Files · discover_claude_sessions

• Shows what each session costs up front

  Breaks down what every session loads before your first message and what went unused.

  Try: “What does my session setup cost me?”

  Read · get_startup_context_audit

• Applies startup cleanup advice

  Applies or previews a recommendation: disable an unused MCP server, move an unused skill aside, or delete duplicated instruction lines.

  Try: “Preview the startup recommendations.”

  Delete · apply_startup_recommendations

• Undoes a startup cleanup

  Restores files and moved skills byte for byte after an apply call.

  Try: “Roll back the last startup cleanup.”

  Write · rollback_startup_recommendations

• Audits agent config files

  Scans CLAUDE.md, AGENTS.md and .cursorrules for stale references, dead paths and token bloat.

  Try: “Audit my CLAUDE.md.”

  Read · audit_config

• Packs project context to disk

  Saves a slice of project context as a corpus on disk for later questions.

  Try: “Build a corpus of the billing module.”

  Write · build_corpus

• Deletes a saved corpus

  Removes a saved corpus and its packed body.

  Try: “Delete the billing corpus.”

  Delete · delete_corpus

• Packs context for another model

  Packs project context into one document for an external model.

  Try: “Pack the auth module for review.”

  Read · pack_context

• Opens a dependency graph in the browser

  Opens an interactive HTML graph of file and symbol dependencies.

  Try: “Show the dependency graph.”

  Files · visualize_graph

• Shows token savings this session

  Returns per-tool call counts and estimated tokens saved in this session.

  Try: “How many tokens did trace save me today?”

  Read · get_session_stats

• Used by the assistant behind the scenes

  Tells trace a file changed

  Lets trace-mcp know a file was edited so its index stays fresh.

  Try: “Register that src/app.ts changed.”

  Write · register_edit

• Loads more tools into the session

  Loads tools that the active preset left out.

  Try: “Load the refactoring tools.”

  Runs code · load_tools

• Shows the active tool set

  Shows the active preset, the other presets, and which tools are loaded or deferred.

  Try: “Which tool preset am I using?”

  Read · get_preset_info

• Shows tool speed stats

  Returns latency and error rates per tool.

  Try: “Which trace tools are slowest?”

  Read · analyze_perf

Watch out for

• It edits and deletes code in your project

  The apply tools rename, move and rewrite code across many files, and one removes unused symbols from their files. Another tool can disable unused MCP servers, move skills aside or delete duplicated instruction lines. Review the plan tool output and commit before you let it run. github.com

• Setup rewires your agent and your CLAUDE.md

  The init command edits your MCP client config, adds routing rules to ~/.claude/CLAUDE.md and installs a hook that blocks Read, Grep and Glob on source files in Claude Code. The Max tier, which is the default pick, also runs a third-party patcher on Claude Code. github.com

• Installing it globally runs install scripts

  The npm package runs three install scripts (a macOS native-module check, a desktop-app updater and a control-plane setup). On macOS they register a background launchd service on port 3741 and write files under ~/.trace. If an older desktop app is installed, the updater can replace it with a download from the project releases. The service setup skips temporary npx installs. TRACE_MCP_NO_POSTINSTALL=1 skips the service setup, TRACE_MCP_NO_AUTO_UPDATE=1 skips the app update and TRACE_MCP_NO_PREFLIGHT=1 skips the native check. github.com

• It sends one anonymous usage ping a day

  A Google Analytics ping carries a random install id, version, Node and OS, country from timezone, client and model name, counts of repos, tool calls and daemon starts, and machine class (CPU architecture, cores, RAM). It sends no code, paths or IP address. TRACE_MCP_TELEMETRY=off turns it off, and it is skipped when CI is set. github.com

• It tells your assistant to use it over its own tools

  The server instructions and tool descriptions steer agents to prefer trace tools over Read, Grep and Glob, and init adds the same rule to CLAUDE.md. The Max tier also ships behavior rules to every connected agent through the MCP instructions. Check that you want that behavior. github.com

• It can read your past Claude Code conversations

  The session tools scan ~/.claude/projects and index conversation text into the local store so it can be searched. Skip those tools if your chats hold private material. github.com

• It runs your type checker

  The diagnostics tool runs tsc, mypy or pyright inside your project. That runs whatever your project config points at. github.com

• The local daemon has no sign-in

  The optional HTTP daemon listens on 127.0.0.1:3741 with no authentication. A non-loopback host is refused unless you pass the allow-remote flag. github.com

• Secret files are left out of the index

  .env files, keys, certificates and similar files are not indexed. For .env only key names and value types are stored. github.com

Security advisories