Static and dynamic call tracing MCP server backed by a SQLite property graph of your codebase
MCPpedia last refreshed this data
io.github.nithin554/code-crawler is an MCP server that static and dynamic call tracing MCP server backed by a SQLite property graph of your codebase. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 91/100 on MCPpedia's security, maintenance and efficiency rubric.
Config is the same across clients - only the file and path differ.
{
"mcpServers": {
"code-crawler": {
"args": [
"-y",
"@nithin554/code-crawler",
"serve"
],
"command": "npx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Static and dynamic call tracing MCP server backed by a SQLite property graph of your codebase
This server supports HTTP transport. Be the first to test it - help the community know if it works.
Five weighted categories - click any category to see the underlying evidence.
No known CVEs.
Checked @nithin554/code-crawler against OSV.dev.
Click any tool to inspect its schema.
Be the first to review
Have you used this server?
Share your experience - it helps other developers decide.
Sign in to write a review.
Others in browser / data
Token-efficient database MCP server for PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, SQLite
Manage Supabase projects — databases, auth, storage, and edge functions
Open-source web scraper for AI agents with scrape, crawl, and map tools
Firecrawl, the context API for AI agents: search, scrape, interact with the web, plus paper search.
MCP Security Weekly
Get CVE alerts and security updates for io.github.nithin554/code-crawler and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
Static + dynamic call tracing MCP server backed by a persistent property graph of your codebase.
Code-Crawler indexes a project into a SQLite-backed property graph — files, packages, modules, classes, interfaces, methods, fields, imports, annotations/decorators, call edges, virtual dispatch, aspect advice, and the wiring frameworks add (entry points, routes, injected dependencies, reflective lookups) — then exposes that graph to LLM clients as MCP tools: find callers, trace call paths, explore neighborhoods, follow runtime dispatch, and search symbols across the whole codebase.
Supports Java, Python, TypeScript, and JavaScript projects, and can index all of them into the same graph.
📖 Documentation site: https://nithin554.github.io/code-crawler/
📘 Task-oriented guide: USAGE.md
🗺️ Roadmap: ROADMAP.md
┌─────────────────────── MCP (stdio) ───────────────────────┐
│ crawl_project search_symbols get_callers get_callees │
│ trace_path trace_execution find_aspects get_decorators│
│ find_implementations find_hotspots find_dead_code ... │
└───────────────┬──────────────────────────────┬───────────────┘
│ │
┌──────▼───────┐ ┌────────▼────────┐
│ crawler │ │ graph queries │
│ parse+resolve│ │ recursive CTEs │
└──────┬───────┘ └────────┬────────┘
│ │
┌──────▼──────────────────────────────▼──────┐
│ SQLite property graph (WAL) │
│ nodes (kind, fqn, props) + edges (kind) │
└─────────────────────────────────────────────┘
Plain-text grep can't answer questions like:
OrderRepository#create?"Main#main to Tracking#dispatch?"OrderService#place?"These need graph traversal. Code-Crawler builds the graph once (idempotently, file-by-file) and answers them with bounded recursive SQL queries.
tree-sitter-java), Python
(tree-sitter-python), TypeScript (tree-sitter-typescript, tree-sitter-tsx), and
JavaScript (tree-sitter-javascript) — all WASM, no native build step.
Language is detected per file, so a polyglot repo lands in a single graph.DYNAMIC_DISPATCH edges connect interface/base
calls to every override in the project, and ADVISES edges weave AspectJ/Spring AOP
advice into execution traces (before, after, around, after-returning,
after-throwing, named @Pointcut references, &&/||/! and execution, within,
@annotation, @within, target, this, args primitives).ServiceLoader, Python
getattr/importlib, and JS require/dynamic import() produce REFLECTS edges to
the resolved symbol when the target is statically determinable, or to a
__reflect__: marker when it is not.@Autowired, NestJS constructor
injection, FastAPI Depends) becomes INJECTS edges, and HTTP routes
(@GetMapping, `@