Grasp — Code Architecture & Dependency Analysis

Grasp MCP Server

Expose Grasp's codebase analysis engine as MCP tools for Claude Code and other LLM agents.

Supports GitHub repositories and local directories. Analyzes dependency graphs, architecture layers, circular deps, security issues, design patterns, dead code, code metrics, git history, duplicate detection, cross-repo comparison, monorepo workspaces, runtime call graphs, database schema coupling, API surface maps, and migration planning.

*Force-directed dependency graph — the same data the MCP server exposes via grasp_analyze, grasp_dependents, graph_query, etc.*

Table of Contents

• Setup
• Configure in Claude Code
• Tools
• Example Usage
• GitHub Token
• GitLab Support
• CLI
• JetBrains Plugin
• Claude Code Slash Commands
• Privacy

---

Current version: 3.21.3 — 150 tools + 8 MCP Resources + 2 guided Prompts.

New in v3.21.0 — Multimodal Knowledge Graph: ingest any artifact (code, Markdown, PDF, Word .docx, Excel .xlsx, HTML, images via OCR, audio/video via local Whisper, YouTube) into a queryable semantic knowledge graph, then ask it in natural language. New tools: grasp_ingest, grasp_kg_ask, grasp_kg_trace, grasp_kg_explain, grasp_kg_stats, grasp_kg_export (Cypher/Neo4j/GraphML/JSON/Mermaid), grasp_llm_status. Pluggable LLM backends (Anthropic, OpenAI, Gemini, DeepSeek, Kimi, Azure, Bedrock, Ollama — local-first, cloud opt-in; extraction falls back to a deterministic local extractor with zero credentials). Optional MCP-over-HTTP transport for shared team access (GRASP_HTTP_MCP=1, optional API key). Three new AST languages (Bash, Elixir, Julia → 19 tree-sitter-backed). See ## Multimodal Knowledge Graph below.

v3.20.0 added: Full security scanning suite — grasp_vulnerabilities covers five threat vectors (OSV.dev dependency CVEs, NIST NVD container/runtime CVEs, local supply-chain integrity checks, Socket.dev behavioral analysis, and scheduled grasp_vuln_watch monitoring), plus skip_container / skip_socket / skip_integrity fast-scan flags.

v3.19.0 added: Team Dashboard visual parity with the Grasp app — teal brand sweep, Lucide SVG icon system, multi-provider auth (GitLab, GitHub Enterprise, Bitbucket, Azure DevOps, Gitea), mobile More menu, keyboard shortcut popover.

v3.18.0 added: 10 new MCP tools (grasp_hub_nodes, grasp_bridge_nodes, grasp_surprising_connections, grasp_knowledge_gaps, grasp_suggested_questions, grasp_minimal_context, grasp_traverse, grasp_semantic_search, grasp_apply_refactor, grasp_architecture_overview); 3 graph export formats (grasp_export_graphml, grasp_export_cypher, grasp_export_obsidian); TS-config path-alias and Jedi-style Python import resolvers; Claude Code slash commands; token-reduction eval harness (scripts/eval-token-reduction.mjs); localized READMEs (Hindi/Japanese/Korean/Simplified Chinese).

Recent additions *(see CHANGELOG.md for full history)*:

• v3.17.1 — per-directory lockfile scoping in the OSV scanner; test-fixture manifests skipped; CWS-token rotation script.
• v3.17.0 — OSV.dev SCA scanner (grasp_vulnerabilities + grasp vulns CLI); architecture drift detection (grasp_snapshot + grasp_diff_snapshots + grasp drift CLI); org-level dashboard (grasp_org_summary + grasp org CLI); test-coverage gap map; graph schema v3 (TestFile nodes, TESTS/COVERS edges).
• v3.16.0 — PR Impact GitHub Action; Brain context tools (grasp_diff_symbols, grasp_exec_flow, grasp_skillmd, grasp_hooks, grasp_mro, grasp_communities, grasp_contracts); confidence scoring; wiki generator; registry tools.
• v3.15.0 — Kuzu graph schema v2; cross-file type propagation; ORM tracker; grasp_detect_changes; 8 MCP Resources; 2 MCP Prompts; grasp setup one-command editor auto-config.

Verticals shipped before v3.15: aerospace/safety-critical (requirement traceability, MISRA, DO-178C, ECSS-E-ST-40C, Ada/SPARK), AI research (safety-constraint tracing, eval coverage, ML pipeline DAG, Jupyter notebooks), enterprise (SBOM CycloneDX/SPDX, DORA, AI-powered ADR, PII trace, separation of duties, finance latency / model risk), OS/kernel (subsystem boundaries, ABI stability, Kconfig, IRQ graph, patch series impact), open source (good-first-issues, fork divergence, OpenSSF scorecard, deps.dev), and a hosted SaaS API (saas/).

Verify Provenance

Every release is signed. Verify before installing:

npm package (SLSA provenance):

npm install -g @sigstore/verify  # one-time

sigstore verify npm grasp-mcp-server@3.21.1

Docker image (Cosign keyless signature):

cosign verify \

--certificate-identity-regexp="https://github.com/ashfordeOU/grasp/.github/workflows/publish.yml" \ --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \ ghcr.io/ashfordeou/grasp:latest

Signatures are stored transparently in the Sigstore Rekor public ledger.

---

Multimodal Knowledge Graph

Beyond code analysis, Grasp can ingest any artifact into a queryable semantic knowledge graph and answer natural-language questions grounded with citations.

// Ingest a folder of docs, a PDF, or a URL (incl. YouTube)

grasp_ingest { "source": "./docs" } grasp_ingest { "source": "/papers/spec.pdf" } grasp_ingest { "source": "https://youtu.be/…" } // local Whisper transcription

// Ask it grasp_kg_ask { "question": "How does auth flow through the billing service?" } grasp_kg_trace { "from": "Auth", "to": "Postgres" } // shortest relationship path grasp_kg_explain { "name": "Billing Service" } // neighbourhood + sources grasp_kg_stats {} // counts + god-nodes grasp_kg_export { "format": "cypher", "out_path": "kg.cypher" } // Neo4j/FalkorDB

Local-first, cloud opt-in. Code parsing stays deterministic (tree-sitter AST). Semantic entity/relationship extraction uses whichever LLM you configure and auto-detects a local Ollama before any cloud key; with no LLM at all it falls back to a deterministic extractor so everything still works offline. Every edge is tagged EXTRACTED (stated in the source) vs INFERRED (derived), with a source locator.

Select explicitly with GRASP_LLM_PROVIDER + GRASP_LLM_MODEL, or per-call via the provider/model/api_key tool args. Run grasp_llm_status to see what's available.

Optional parsers (installed on demand, keeping the core install lean): npm i pdf-parse mammoth xlsx tesseract.js youtube-transcript. Audio/video transcription additionally needs ffmpeg on PATH.

Shared team access (MCP over HTTP)

GRASP_HTTP_MCP=1 GRASP_HTTP_API_KEY=… grasp-mcp   # serves Streamable HTTP on :7333/mcp

Point any MCP client at http://host:7333/mcp (send the key as Authorization: Bearer … or x-api-key). /health returns liveness. Grasp's tools are stateless, so one endpoint serves a team's agents.

Where it lives

The multimodal pipeline is MCP-server-side (Node) and does not run in the browser app — see the source layout under mcp/src/:

• ingest/* — artifact parsers (PDF, Word .docx, Excel .xlsx, HTML, image OCR, audio/video, URL, YouTube; heavy parsers lazy-loaded on demand)
• llm/provider.ts — pluggable multi-provider LLM layer (local-first Ollama auto-detect → cloud key → deterministic fallback)
• semantic/* — SQLite knowledge-graph store, hybrid BM25 + vector retrieval, BFS path-tracing, hub/god-node detection
• tree-sitter/* — deterministic AST parsing across 19 languages

---

Setup

cd mcp

npm install npm run build

Configure in Claude Code

Add to ~/.claude/claude_mcp_settings.json:

{

"mcpServers": { "grasp": { "command": "node", "args": ["/absolute/path/to/grasp/mcp/dist/index.js"] } } }

Or install globally via npm:

{

"mcpServers": { "grasp": { "command": "npx", "args": ["grasp-mcp-server"] } } }

Tools

Core Analysis

History & Comparison

Code Quality

Ecosystem Integration

Runtime & Infrastructure Intelligence

| grasp_db_coupling | ORM/SQL-to-table coupling map — god tables, hig