A single binary replaces file-by-file code exploration with sub-ms graph queries

A persistent knowledge graph of your codebase, queryable in under a millisecond, built from a single native binary that requires no language runtime, no Docker, no API key. That is the core proposition of codebase-memory-mcp, and the README is unusually specific about what it actually delivers.

The indexing pipeline uses vendored tree-sitter grammars for 161 languages compiled directly into the binary, then layers what the project calls Hybrid LSP on top: a lightweight C implementation of type-resolution algorithms structurally compatible with tsserver, pyright, gopls, Roslyn, and rust-analyzer. The distinction matters. Tree-sitter gives you syntax; Hybrid LSP gives you the information needed to know that user.profile.display_name() resolves to Profile.display_name three modules away. Without that second pass, call graphs across package boundaries are guesswork. With it, CALLS edges reflect what an IDE's Go-to-Definition would actually find.

The token efficiency claim is the most striking number in the README: five structural queries consumed roughly 3,400 tokens compared to roughly 412,000 tokens via file-by-file grep exploration. The preprint behind the project, evaluated across 31 real-world repositories, reports 83% answer quality, ten times fewer tokens, and about twice as few tool calls versus file-by-file exploration. Those figures are self-reported benchmarks, not independent audits, but the mechanism is sound: a graph query that returns a call chain in one round trip genuinely replaces dozens of grep-and-read cycles.

The Linux kernel benchmark — full index in 3 minutes, producing millions of nodes and edges — is the headline performance claim, run on Apple M3 Pro hardware. Django indexes in roughly 6 seconds. The RAM-first pipeline (LZ4 compression, in-memory SQLite, single dump at end) explains the speed; memory is released after indexing completes.

The session coordination daemon is architecturally interesting and worth understanding before deploying. A single per-account daemon owns background watchers, shared indexing jobs, and the optional graph UI. All active processes must run the exact same version and binary build; a conflicting process fails before doing any work. Updates require stopping the daemon first. This is a deliberate design for correctness, not an oversight, but it means multi-agent setups need careful version discipline.

The 45 supported client surfaces — Claude Code, Cursor, VS Code Copilot, Zed, Windsurf, and dozens more — are configured by the installer with documented, narrowly scoped permissions. The README is explicit about what it withholds: no experimental flags, no YOLO modes, no third-party instruction trust. Hooks are fail-open and context-only; they inject graph symbols as additional context but never block or replace tool calls.

The team-shared graph artifact feature is practical: commit a single compressed snapshot to the repo and teammates skip the full reindex on clone, with incremental indexing filling in their local diff. A .gitattributes entry with merge=ours is auto-created to prevent binary merge conflicts.

The security posture is thorough for a tool that reads your codebase and writes to agent configuration files. SLSA Level 3 provenance, Sigstore keyless signatures, CodeQL SAST blocking the release pipeline, and VirusTotal scans of every release candidate are all documented with verifiable links.