safishamsi/graphify agent mcp skill
code navigation
Graphify maps your entire project—code, docs, PDFs, images, and video—into a knowledge graph that you can query instead of searching through files. Code is parsed locally using tree-sitter AST with no LLM involvement; semantic analysis of non-code content uses your AI assistant's model or a configured API. Every graph connection is tagged as either explicitly extracted from source or inferred through resolution.
Query your codebase by concept, relationship, or path instead of grepping through files Visualize your project structure as an interactive knowledge graph with detected communities and key concepts Trace connections between any two concepts to understand how they relate across your entire project Explore cross-file relationships like calls, imports, inheritance, and mixins automatically resolved across ~40 languages Run locally on code (no external calls) or configure API keys to include semantic analysis of documentation and media 5 HIGH✓ 17 MEDIUM 6 LOW
✓ CRITICAL/HIGH reflect AI-verified findings (false positives excluded) · MEDIUM/LOW/INFO are unverified scanner output
AI-verified (CRITICAL/HIGH): 1 confirmed (20%) 4 likely real (80%) 1 false positive — excluded from CRITICAL/HIGH count above
Findings by checker · 4 high-signal, 1 mostly false-positive (hidden by default)
CHK-029 2 findings 2 likely
0% FP CHK-083 1 finding 1 likely
0% FP CHK-099 1 finding 1 likely
0% FP CHK-144 1 finding 1 confirmed
0% FP ▼ Show 1 checker that are mostly false positives (1 findings) 28 findings click to expand
CHK-083 Potential path traversal — user-controlled path in file operation: graphify/hooks.py
graphify/hooks.py
AI: likely real possible ▼
CHK-029 Dynamic MCP server instantiation in skill
tools/skillgen/expected/graphify__skill.md
AI: likely real likely ▼
CHK-099 Potential IDOR — 'doc_id' accessed without ownership check
graphify/google_workspace.py
AI: likely real possible ▼
CHK-144 'filesystem' invoked via npx with no version pin — rug pull risk
tests/fixtures/sample.mcp.json
AI: confirmed possible ▼
CHK-029 Dynamic MCP server instantiation in skill
graphify/skill.md
AI: likely real likely ▼
CHK-125a shutil.rmtree() — recursive directory deletion — no scope constraint in graphify/cache.py
graphify/cache.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in graphify/llm.py
graphify/llm.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in graphify/export.py
graphify/export.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in graphify/cli.py
graphify/cli.py
possible ▼
CHK-125a shutil.rmtree() — recursive directory deletion — no scope constraint in graphify/install.py
graphify/install.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in graphify/_minhash.py
graphify/_minhash.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in graphify/prs.py
graphify/prs.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in graphify/google_workspace.py
graphify/google_workspace.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in graphify/extract.py
graphify/extract.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in graphify/__main__.py
graphify/__main__.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in skillgen/gen.py
tools/skillgen/gen.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in extractors/fortran.py
graphify/extractors/fortran.py
possible ▼
CHK-102 Direct SQL execution — may bypass ORM-level access controls
graphify/pg_introspect.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in CHANGELOG.md
CHANGELOG.md
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in README.md
README.md
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in SECURITY.md
SECURITY.md
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in graphify/hooks.py
graphify/hooks.py
possible ▼
CHK-032 Agent 'hooks' has no explicit 'cannot do' boundary
graphify/skills/agents/references/hooks.md
possible ▼
CHK-043 Database Connection URI (Postgres) detected in README.md [doc context — likely format example, verify manually]
README.md
possible ▼
CHK-125c urllib.request — unconstrained HTTP — no scope constraint in graphify/security.py
graphify/security.py
possible ▼
CHK-032 Agent 'AGENTS' has no explicit 'cannot do' boundary
AGENTS.md
possible ▼
CHK-032 Agent 'github-and-merge' has no explicit 'cannot do' boundary
graphify/skills/agents/references/github-and-merge.md
possible ▼
CHK-043 Database Connection URI (Postgres) detected in CHANGELOG.md [doc context — likely format example, verify manually]
CHANGELOG.md
possible ▼
▼ Show 1 false positive (3% of this view) Last scanned: Jul 11, 2026
More servers
google-gemini/gemini-cli 85
An open-source AI agent that brings the power of Gemini directly into your terminal.
106k★
skypilot-org/skypilot 85
obra/superpowers 85
Foundational skill pack by Jesse Vincent now in anthropics/claude-plugins-official. Includes ffuf web-fuzzing/pentest skill. Partial analysis done — full hook and plugin inspection pending. tier=T2
191k★
Significant-Gravitas/AutoGPT 85
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.
186k★
nanocoai/nanoclaw 85
A lightweight alternative to OpenClaw that runs in containers for security. Connects to WhatsApp, Telegram, Slack, Discord, Gmail and other messaging apps,, has memory, scheduled jobs, and runs directly on Anthropic's Agents SDK
30k★
google-gemini/gemini-cli 85
An open-source AI agent that brings the power of Gemini directly into your terminal.
106k★
Scan your entire org's MCP deployment
2,500+ repos pre-scored. 22% carry CRITICAL findings.