Audited 2026-10-20 · Sources: GitHub repo metadata + README, license files, docs/, tests/, plus our own fleet's graphify-out/ run artifacts (557 files parsed). Tabletop + prior-run evidence — nothing new executed this pass.
The card
| Repo | Graphify-Labs/graphify |
| Stars | 130.3k (GitHub, audit date) — 2,463 commits, v8, 707 issues / 860 PRs |
| License | Apache-2.0 + MIT dual |
| Provenance | Graphify-Labs org, real docs site, ARCHITECTURE.md + AGENTS.md + pre-commit config + tests/ in-tree — built like a library, not a stunt repo |
| What it is | Deterministic local AST parsing (tree-sitter) that turns a codebase — plus docs, SQL schemas, configs, PDFs — into a queryable knowledge graph. Ships as a /graphify skill for Claude Code, Cursor, Codex, and Gemini CLI. No vector store, no embeddings, no LLM in the loop. |
| Install surface | Skill directory + a Python toolchain; output lands in a graphify-out/ dir beside your repo. Reads source, writes graph artifacts — nothing leaves the machine. |
What problem it solves
Agent code-search today mostly means embeddings into a vector store — an LLM in the loop, a cloud index, fuzzy recall. Graphify builds the map deterministically: every edge in the graph traces to a parser rule, so agents query structure (who calls this, what depends on it) instead of guessing from semantic similarity.
Our gate findings
| Gate | Finding |
|---|---|
| Upstream identity | Verified — consistent org branding, active release line (v8), real docs, contribution hygiene (pre-commit, tests, ARCHITECTURE.md) |
| License | Apache-2.0 + MIT dual — clean for commercial and internal use. |
| Determinism claim | Empirically verified in our own fleet. The verifiedantiagingclinics repo carries a graphify-out/ run — its cost.json shows total_input_tokens: 0, total_output_tokens: 0 across 557 files, and manifest.json holds per-file AST/semantic hashes. "No LLM, no vector store" isn't marketing — the run ledger proves it. |
| Data boundary | Strong. Local parse, local artifacts, no external calls in the pipeline we observed. Your code never leaves the box — the property that matters for client-repo work. |
| Blast radius | Low — it reads your tree and writes beside it. The one thing to watch: artifacts in graphify-out/ can carry paths and identifiers from private repos; gitignore or encrypt per your repo policy. |
| Maturity signals | 707 open issues against 860 PRs is an unusual ratio — either high triage volume or noisy inbound. Star velocity (~130k in a young window) mirrors the current agent-tooling spike more than long-term adoption; judge it on v8 stability, not the badge. |
| Fit | It answers structural questions brilliantly (dependency edges, blast radius, coverage). It is not semantic memory — you still need judgment for "why does this exist." |
Verdict: GO. Apache/MIT, deterministic by design, zero-token runs verified in our own output, and the cleanest data boundary on this trending list. The rare case where we audited a tool we already trusted and found the trust documented.
Best for
Teams pointing agents at real codebases — especially multi-repo or client-owned ones — who need structural answers without shipping source to a vector API. If your agents grep blind today, this is the upgrade path.