Trace MCP

Detect drift between AI agent config files (CLAUDE.md, AGENTS.md, .cursorrules) and the live tool/skill/command surface: dead path references, references to non-existent MCP tools, references to missing skills/commands, oversized sections. Convenience alias for `audit_config { drift_only: true }`. Read-only. Returns JSON: { issues: [{ file, line, category, issue, severity, fix? }], files_scanned, total_tokens, summary }.

Check if a function/class name already exists before creating it. Pass `name` when planning new code, or `symbol_id` to check an existing symbol against others (excluded from its own results). `exclude_symbol_id` suppresses known matches. Score ≥0.7 means high likelihood of duplication — review before proceeding. Read-only. Returns JSON: { duplicates: [{ symbol_id, name, file, score }], hasDuplication }.

Edit-safety preflight: before modifying a symbol or file, get one verdict for "is this safe to edit and what must I preserve". Fuses signature impact, cyclomatic complexity, and test coverage into a verdict tier (safe_to_edit / untested / complexity_risk / signature_impact) with ranked blockers and a recommended action. See `depth` to escalate to a continuous risk score or the full impact report instead. Read-only. Returns JSON: { verdict, recommended_action, blockers: [{ signal, severity, detail }], confidence, signals }.

Pin and re-check a 16-string canary against the active embedding provider. Catches silent provider model swaps (OpenAI/Voyage/etc.) that quietly degrade hybrid retrieval. First call (or with capture=true) saves the baseline; subsequent calls report max cosine distance vs baseline. Read-only or write-only (capture). Returns JSON: { status, message, max_distance?, mean_distance?, per_string? }.

Run configurable quality gate checks (complexity, coupling, circular imports, dead exports, tech debt, security, antipatterns, code smells). Designed for CI / pre-commit verification. Read-only. With no gates configured, returns `NO_GATES_CONFIGURED` with a `_warnings` advisory — never a misleading `PASS`. Pass `use_default_gates: true` for a conservative built-in ruleset. Returns JSON: { gates, summary: { result: "PASS"|"FAIL"|"WARNING"|"NO_GATES_CONFIGURED", ... }, _warnings?, _defaults_used? }.

Pre-rename collision detection: checks the symbol's own file and all importing files for existing symbols with the target name. Use before apply_rename to verify safety. Read-only (does not modify files). Returns JSON: { safe, conflicts: [{ symbol_id, name, file }] }.

Compare two branches at symbol level: what was added, modified, removed. Resolves merge-base automatically, groups by category/file/risk, includes blast radius and risk assessment. Requires git. For a quick list of changed symbols without risk analysis use get_changed_symbols instead. Read-only. Returns JSON: { branch, base, mergeBase, changes: [{ symbol_id, category, risk }], summary }.

LLM-driven semantic dedup of the decision store. For each decision in scope, finds top-K similar candidates (FTS + title-trigram) and asks the LLM to merge / replace / invalidate where appropriate. Mutating; respects dry_run (default true). Requires an active AI provider. Returns: { evaluated, verdicts: [{subject_id, verdict, affected_ids}], applied_count, dry_run }.

Remove a saved corpus (manifest + packed body). Returns JSON: { deleted: bool, name }.

Detect performance & design antipatterns: N+1 queries, missing eager loading, unbounded queries, event listener leaks, circular ORM association cycles, missing FK indexes, memory leaks, god classes (>=25 methods or >=500 LOC), long methods (>=60 LOC), long parameter lists (>=6), deep nesting (>=5). ORM-scoped signals need an active ORM plugin; size/complexity detectors run on every symbol. For import cycles use get_circular_imports; for TODOs/debug artifacts use scan_code_smells; for security use scan_security. Read-only. Returns JSON: { findings: [{ category, severity, file, line, message, su…

Find Type-2 AST clones: functions/methods with identical structure after normalizing identifiers and literals (tree-sitter parse + AST subtree hash). Unlike check_duplication (name/signature similarity), this finds structurally identical bodies — prime DRY-refactor candidates. Supports TypeScript, JavaScript, Python, Ruby, Go, Java, Rust, PHP, C, C++, C#, Swift, Kotlin, Scala, Elixir. Read-only. Returns JSON: { groups: [{ hash, size, loc, symbols: [{ symbol_id, name, file, line_start, line_end }] }], total_groups, total_duplicated_symbols, files_scanned, symbols_scanned }.

Run Leiden community detection on the file dependency graph. Identifies tightly-coupled file clusters (modules). Mutates the community index (stores results); idempotent. Deterministic — same `seed` produces identical assignments across runs. Use before get_communities or get_community. Returns JSON: { communities: [{ id, files, size }], modularity, seed }.

Detect architectural drift: cross-module co-change anomalies (files in different modules that always change together) and shotgun surgery patterns (commits touching 3+ modules). Requires git. Use to identify hidden coupling across modules. For file-pair co-changes use get_co_changes instead. Read-only. Returns JSON: { anomalies, shotgunSurgery, total }.

Cross-project topic tunnels: links between registered subprojects sharing canonical entities — manifest package names, top-level declared dependencies, and git contributors (bots filtered). Tunnel weight favors shared people/project names over common deps (noisy deps down-weighted). Use to discover hidden cross-repo coupling or seed cross-project search. Read-only. Returns JSON: { tunnels: [{ project_a, project_b, shared: [{ kind, canonical, display }], weight }], total }.

Compare two named graph snapshots and report deltas in counts, communities, and top in-degree files. Use to track graph evolution over time without git as the axis (e.g. before/after a refactor, week-over-week health). Read-only. Returns JSON: { base, head, files, symbols, symbols_by_kind, edges_by_type, exported_symbols, communities, top_files }.

Scan ~/.claude/projects for projects Claude Code has touched on this machine, decode each directory name back to its absolute path, and report which ones still exist plus session-file count and last activity. With add_as_subprojects=true, every existing project is registered as a subproject in one call — useful for spinning up multi-repo intelligence after a fresh clone. Reads local filesystem; with add_as_subprojects=true also mutates topology store. Returns JSON: { projects: [{ path, sessions, lastActivity }], total }.

List Hermes Agent (NousResearch) sessions visible on this machine. Scans $HERMES_HOME (default ~/.hermes) for state.db plus any profiles/<name>/state.db. Hermes conversations are GLOBAL — results are NOT filtered by the current project. Read-only. Returns JSON: { enabled, sessions: [{ sessionId, sourcePath, profile, lastActivity, sizeBytes }], total }.

Precompute and cache symbol embeddings for semantic / hybrid search. Also computed lazily on first semantic query — call this once after a fresh index to avoid that latency spike. Requires an AI provider (ollama/openai) enabled in config. force=true recomputes all embeddings. Mutates the vector store; idempotent. Returns JSON: { status, indexed_this_run, total_embedded, coverage_pct, duration_ms }. Failed batches return status "error" with a diagnostic and failed_batches count, never a silent 0-coverage "completed".

AI-powered architecture analysis — layers, patterns, and data flow

Explain a symbol in detail using AI — purpose, behavior, relationships, usage patterns

Export decisions to JSONL or Markdown. Read-only; no schema mutations. Use for audit, sharing with external tooling, or pre-LLM digestion. JSONL emits one decision per line with `tags` parsed from the on-disk JSON column into a real array. Markdown groups by type (and by service when multi-service). Hard-capped at 5000 rows per call as a cost guard. Returns JSON: { format, content, count, scope }.

Export the dependency graph in formats external tools understand. Supports GraphML (Gephi/yEd/NetworkX), Cypher (Neo4j import script), and Obsidian (markdown vault with [[wikilinks]]). Use to crunch the graph in tools that already exist — Cypher queries, betweenness-centrality in NetworkX, vault navigation. For interactive HTML use visualize_graph; for Mermaid/DOT diagrams use get_dependency_diagram. Read-only. Returns JSON: { format, content, node_count, edge_count }.

Export security context for MCP server analysis. Generates enrichment JSON for skill-scan: tool registrations with annotations, transitive call graphs classified by security category (file_read, file_write, network_outbound, env_read, shell_exec, crypto, serialization), sensitive data flows, and per-file capability maps. Use to analyze MCP server security before installation. Read-only. Returns JSON: { tool_registrations, sensitive_flows, capability_map, warnings }.

Extract a line range out of an enclosing function into a new named helper (AST-aware, TypeScript/JavaScript). Computes the parameter list via free-variable analysis and a return value from bindings used after the slice. The helper is inserted after the enclosing function; the slice becomes a call. Dry-run by default — preview, then re-call with dry_run=false to apply. Returns JSON: { success, edits, extracted_params, return_value, confidence, files_modified }.

Find semantically similar symbols using vector search + optional AI reranking

Find all references to a symbol or file (imports, calls, renders, dispatches). Use instead of Grep for symbol usages — semantic, not text matches. For raw text use search_text; for a bidirectional call graph use get_call_graph. Weakly-grounded `text_matched` edges into a name-colliding target are dropped by default (phantom god-node filter); `include_ambiguous_text_matched: true` keeps them. Read-only. Returns JSON: { references: [{ edge_type, resolution_tier, file, symbol }], total, truncated?, ambiguous_filtered? } — page caps at 50, `total` counts all.

Generate project documentation from the code graph — architecture, API surface, data models, components, dependencies. For checking an existing document instead, use verify_docs. Returns JSON: { format, sections, outputPath }.

Single-call narrative health snapshot: god files (PageRank), architectural bridges (edge bottlenecks), risk hotspots (complexity × churn), edge resolution-tier breakdown, and gap counts (dead exports, untested, cycles). Aggregates already-computed metrics into ~2K tokens of Markdown plus a structured payload. Use at the start of a session to orient yourself instead of chaining get_pagerank + get_risk_hotspots + get_edge_bottlenecks + self_audit. Read-only. Returns JSON: { generated_at, totals, resolution_tiers, god_files, bridges, hotspots, gaps, markdown }.

Generate a Software Bill of Materials (SBOM) from package manifests and lockfiles. Supports npm, Composer, pip, Go, Cargo, Bundler, Maven. Outputs CycloneDX, SPDX, or plain JSON. Includes license compliance warnings for copyleft licenses. Use for supply chain audits or compliance reports. Returns JSON/CycloneDX/SPDX: { components: [{ name, version, license, type }], warnings }.

Get API contract (OpenAPI/gRPC/GraphQL) for a service. Parses spec files found in the service repo. Use to inspect a service's public API. For detecting spec-vs-code mismatches use get_contract_drift instead. Read-only. Returns JSON: { service, contract_type, endpoints, schemas }.

List all exported symbols (public API) of a file or matching files. Use to understand what a module exposes. For finding unused exports use get_dead_code with mode: exports_only. Read-only. Returns JSON: { files: [{ path, exports: [{ name, kind, signature }] }] }.

Surface non-code knowledge from the index: DB schemas (migrations, ORM models), API specs (routes, OpenAPI endpoints), infrastructure (docker-compose services, K8s resources), CI pipelines (jobs, stages), and config (env vars). All data from the existing index — no extra I/O. Use to discover infrastructure and config artifacts without reading files. Read-only. Returns JSON: { artifacts: [{ category, kind, name, file }], total }.

Build a bidirectional call graph centered on a symbol (who calls it + what it calls). Each branch keeps its direction: depth 2 = callers of callers, callees of callees. Use to understand control flow through a function. For flat list of all references use find_usages instead. Read-only. Returns JSON: { root: { symbol_id, name, calls: [...], called_by: [...] } }.

Full change impact report: risk score + mitigations, breaking change detection, enriched dependents (complexity, coverage, exports), module groups, affected tests, co-change hidden couplings. Pass symbol_ids to scope to changed symbols. Use before modifying code. For a quick risk score alone use assess_change_risk; for who-calls-what use get_call_graph. compact pages results; bundle recalls. Read-only. Returns JSON: { risk, dependents, affectedTests, breakingChanges, totalAffected }.

Map a git diff to affected symbols (functions, classes, methods), for PR review. If "since" is omitted, auto-detects main/master as the base. Requires git. For full branch comparison with risk assessment use compare_branches instead. Read-only. Returns JSON: { changes: [{ symbol_id, name, kind, file, changeType }], total }. Set `output_format: "toon"` for lossless, cheaper tabular encoding.

Find circular dependency chains in the import graph (Kosaraju SCC algorithm). Considers only import-typed edges (esm_imports / imports / py_imports / py_reexports); call, reference, member_of, and test_covers edges are NOT walked. Test files (paths matching tests/**, **/*.test.*, **/*.spec.*, **/__tests__/**) are excluded by default to suppress spurious test↔source cycles — pass include_tests: true to opt in. Use to detect and break dependency cycles. Read-only. Returns JSON: { total_cycles, cycles: [{ files, length }] }.

Return the member decisions of a cluster, plus the cluster header. Use after get_decision_clusters to drill into a specific topic. Read-only. Returns JSON: { cluster, decisions }.

Find files that frequently change together in git history (temporal coupling). Requires git. Use to discover hidden dependencies between files. For cross-module co-change anomalies use detect_drift instead. Read-only. Returns JSON: { file, coChanges: [{ file, confidence, count }] }.

Git-based code ownership: who contributed most to specific files (git shortlog). Requires git. Use to identify who to ask about specific files. For symbol-level ownership use get_symbol_owners instead. Read-only. Returns JSON: [{ file, owners: [{ author, commits, percentage }] }].

Get previously detected communities (file clusters). Run detect_communities first. Read-only. Returns JSON: { communities: [{ id, files, size }], total }.

Get details for a specific community: files, inter-community dependencies. Read-only. Use after detect_communities to drill into a specific cluster. Returns JSON: { id, files, interCommunityDeps }.

Get complexity metrics (cyclomatic, max nesting, param count) for symbols in a file or across the project. Use to identify complex code before refactoring. For historical trends use get_complexity_trend instead. Read-only. Returns JSON: { symbols: [{ symbol_id, name, kind, file, line, cyclomatic, max_nesting, param_count }], total }. Set `output_format: "toon"` for lossless, cheaper tabular encoding.

File complexity over git history: cyclomatic complexity at past commits. Shows if a file is getting more or less complex. Requires git. Use to track whether a file is improving or degrading. For current snapshot use get_complexity_report; for symbol-level trends use get_symbol_complexity_trend. Read-only. Returns JSON: { file, snapshots: [{ commit, date, complexity }] }.

Build a component render tree starting from a given .vue file. Use to visualize parent-child component hierarchy. Read-only. Returns JSON: { root, children: [{ component, props, slots, depth }], totalComponents }.

Get a symbol's source code + its import dependencies + optional callers, packed within a token budget. Supports batch queries with shared-import deduplication. Use instead of chaining get_symbol calls. For a single symbol without imports, use get_symbol — lighter. Read-only. Returns JSON: { primary: [{ symbol_id, file, source }], imports: [{ file, source }], token_usage }.

Detect mismatches between API spec and implementation: endpoints in spec but not in code, or in code but not in spec. Use to verify API contract accuracy. For reading the contract itself use get_api_contract instead. Read-only. Returns JSON: { service, missingInCode, missingInSpec, total }.

Show version history for a service API contract with breaking change detection between versions. Compares request/response schemas across snapshots to flag removed fields, type changes, and renames. Use to review API evolution. For current spec-vs-code drift use get_contract_drift instead. Read-only. Returns JSON: { service, versions: [{ version, date, breakingChanges }] }.

Build a Control Flow Graph (CFG) for a function/method: if/else branches, loops, try/catch, returns, throws. Shows logical paths through the code. Outputs Mermaid diagram, ASCII, or JSON. Use to understand branching logic before modifying complex functions. For call-level graph (who calls whom) use get_call_graph instead. Read-only. Returns Mermaid/ASCII/JSON: { nodes, edges, entryPoint, exitPoints }.

Coupling analysis: afferent (Ca), efferent (Ce), instability index per file. Shows which modules are stable vs unstable. Use to identify fragile or overly-depended-on modules. For coupling changes over time use get_coupling_trend instead. Read-only. Returns JSON: [{ file, ca, ce, instability, assessment }]. Set `output_format: "toon"` for lossless, cheaper tabular encoding.

File coupling over git history: Ca/Ce/instability at past commits. Shows if a module is stabilizing or destabilizing. Requires git. Use to track module stability over time. For current coupling snapshot use get_coupling instead. Read-only. Returns JSON: { file, snapshots: [{ commit, date, ca, ce, instability }] }.

Show which business domains depend on which. Based on edges between symbols in different domains. Use to understand domain coupling. Read-only. Returns JSON: { dependencies: [{ from, to, edgeCount }] }.

Analyze cross-service impact of changing an endpoint or event. Shows which services would be affected. Use before modifying a shared endpoint. For within-codebase impact use get_change_impact instead; for the full cross-repo blast radius use get_federation_impact. Read-only. Returns JSON: { service, affectedServices: [{ name, reason }], total }.

Show which workspaces are affected by changes in a given workspace. Lists all cross-workspace edges, affected symbols, and the public API surface consumed by other workspaces. Use before modifying shared code in a monorepo. Read-only. Returns JSON: { workspace, public_api, consumed_by, depends_on, cross_workspace_edges }.

Intra-function dataflow analysis: track how each parameter flows through the function body — into which calls, where it gets mutated, and what is returned. Phase 1: single function scope. Use to understand data transformations within a function. For security-focused data flow use taint_analysis instead. Read-only. Returns JSON: { symbol_id, params: [{ name, flows: [{ target, mutated }] }], returnPaths }.

Dead code detection. Modes: "multi-signal" (default) combines import graph, call graph, and barrel-export analysis with confidence scores; "reachability" runs forward BFS from auto-detected entry points — stricter when entry points are enumerable; "exports_only" is the fast export-keyword-only scan. Pass entry_points for custom roots. To remove detected code use remove_dead_code. Read-only. Returns JSON: { dead_symbols: [{ symbol_id, name, file, confidence, signals }], total }.

Fetch a single decision by id, including its full `content`. Companion to query_decisions `index_only: true` (progressive disclosure): list cheaply with index_only, then pull full content on demand for the ids you care about. Read-only. Returns JSON: { decision: { id, title, content, type, tags, ... } } or { error } when not found.

List decision clusters with optional full-text filter. Each row carries a short noun-phrase title, 1-3 sentence summary, member count, and a preview of member decision titles. Use to navigate the decision store by topic instead of chronologically. Read-only. Returns JSON: { clusters, total }.

Overview of the decision knowledge graph: total decisions, active/invalidated counts, breakdown by type and source. Shows how much institutional knowledge is captured. Read-only. Returns JSON: { total, active, invalidated, by_type, by_source, sessions_mined }.

Chronological timeline of decisions for a project, symbol, or file. Shows when decisions were made and invalidated — like git log but for architectural decisions. Read-only. Use to review decision history. Returns JSON: { timeline: [{ id, title, type, created_at, valid_until }], count }.

Render dependency diagram for a file/directory path as Mermaid or DOT. Input: a path like "src/tools/" — not a question. Trims to max_nodes most important nodes. Read-only. For interactive HTML visualization use visualize_graph instead. Returns JSON: { format, diagram, nodes, edges }.

Trace NestJS dependency injection tree (what a service injects + who injects it). Use to understand DI wiring for a specific provider. For module-level graph use get_module_graph instead. Read-only. Returns JSON: { service, injects: [{ name, kind }], injected_by: [{ name, kind }] }.

Execute type-checker (tsc, mypy, pyright) and map errors to enclosing AST symbols. Read-only.

Get all code related to a specific business domain. Supports "parent/child" notation (e.g. "payments/refunds"). Use to explore code within a domain boundary. For the full domain taxonomy use get_domain_map instead. Read-only. Returns JSON: { domain, symbols: [{ symbol_id, name, file, source }], relatedDomains }.

Get hierarchical map of business domains with key symbols per domain. Auto-builds domain taxonomy on first call using heuristic classification. Use to understand business domain boundaries. For specific domain code use get_domain_context instead. Read-only. Returns JSON: { domains: [{ name, children, symbols }] }.

Find architectural bottleneck edges in the import graph: edges on many shortest paths (betweenness), edges whose removal would disconnect the graph (bridges), and single-point-of-failure nodes (articulation points). bottleneckScore = betweenness × (1 + coChangeWeight). Use to prioritize decoupling work. For general importance use get_pagerank instead. Read-only. Returns JSON: { edges: [{ sourceFile, targetFile, betweenness, coChangeWeight, bottleneckScore, isBridge }], articulationPoints: [...], stats }.

Per-route analytics: request count, error rate, latency, caller services. Requires OTLP trace ingestion. Read-only, queries external runtime data. Use to understand endpoint performance and traffic. Returns JSON: { uri, method, requestCount, errorRate, latency, callerServices }.

List environment variable keys from .env files with inferred value types/formats. Never exposes actual values — only keys, types, and formats (url/email/ip/path/uuid/json/base64/csv/dsn/etc). Safe for secrets. Pass `redacted: true` with `file` for a line-by-line redacted view of one file (keys + type hints, no values, preserves order/comments). Returns JSON grouped by file: { [file]: [{ key, type, format, comment }] }.

Get event/signal/task dispatch graph (Laravel events, Django signals, NestJS events, Celery tasks, Socket.io events). Use to understand event-driven architecture and trace event producers/consumers. Read-only. Returns JSON: { events: [{ name, dispatchers, listeners, file }] }.

Search code by keyword/topic → returns ranked source snippets within a token budget. Use when you need to READ actual code for a concept or feature. For structured task context with tests and entry points use get_task_context instead; for symbol metadata without source use search. Read-only. Returns JSON (default) or Markdown: { items: [{ symbol_id, name, file, source, score }], token_usage } | { content: "...markdown..." }. Supports `output_format: "toon"`. Capped by `memory.recall.timeoutMs` (default 5000ms); on timeout returns `{ items: [], token_usage, degraded: true }`.

Aggregates cross-repo impact into ONE call: if you change an endpoint, service, or symbol, this combines subproject client-call impact (which repos/files call it), cross-service edge impact (dependent services via HTTP/event edges), and contract drift (spec vs implementation) into a single blast-radius report — instead of manually chaining get_subproject_impact + get_cross_service_impact + get_contract_drift. Requires at least one of endpoint or service. Read-only. Returns JSON: { target, affected_clients, affected_services, contract_drift, risk_level, summary, total_affected }.

Aggregates get_complexity_trend, get_coupling_trend, and get_git_churn into one per-file time series: complexity, coupling, and a lightweight risk_score per historical snapshot, plus a whole-window churn summary. Answers "is this file getting healthier or worse" in one call. For cross-file bug-risk ranking use predict_bugs instead. Requires git. Read-only. Returns JSON: { file, current, historical: [{ date, commit, max_cyclomatic, avg_cyclomatic, ca, ce, instability, risk_score }], churn, trend }.

Per-file git churn: commits, unique authors, frequency, volatility assessment. Requires git. Use to identify frequently-changed files. For combined churn+complexity hotspots use get_risk_hotspots instead. Read-only. Returns JSON: { results: [{ file, commits, authors, frequency, volatility }], total }. Set `output_format: "toon"` for lossless, cheaper tabular encoding.

Graph-evolution timeline: samples evenly-spaced historical commits (via git log) and reports file-count + commit churn per period, with a short narrative diff marker. Symbol/edge counts reflect the current HEAD only, not reconstructed per historical commit. For point-in-time named checkpoints use snapshot_graph + diff_graph_snapshots instead. Requires git. Read-only. Returns JSON: { since_days, granularity, periods: [{ period, commit, date, file_count, commits_in_period, files_changed, insertions, deletions, narrative }], current: { files, symbols, edges_by_type }, _tier, _methodology }.

Time-series health metrics for a file or module: bug score, complexity, coupling, churn over time. Populated by predict_bugs runs. Use to track if a module is improving or degrading. Read-only. Returns JSON: { dataPoints: [{ date, bugScore, complexity, coupling, churn }] }.

Find all classes that implement or extend a given interface or base class. Use when you know the interface name. For full hierarchy tree (ancestors + descendants) use get_type_hierarchy instead. Read-only. Returns JSON: { implementations: [{ symbol_id, name, kind, file, line }], total }.

Show file-level dependency graph: what a file imports and what imports it (requires reindex for ESM edge resolution). Use to understand module dependencies for a specific file. For project-wide coupling analysis use get_coupling; for visual diagram use get_dependency_diagram. Read-only. Returns JSON: { file, imports: [{ path }], importedBy: [{ path }] }.

Get index status, statistics, health, and pipeline progress (indexing, summarization, embedding). Includes the session projectRoot; when the index is empty, next_steps names the empty root and points at list_projects + call_project_tool for other registered projects. Read-only, no side effects. Use to verify the index is ready before running queries. Returns JSON: { status, stats, projectRoot, next_steps?, config, warnings, pipelineProgress, embedding }.

Get full context for a Livewire component: properties, actions, events, view, child components. Use to understand a specific Livewire component before modifying it. Read-only. Returns JSON: { component, properties, actions, events, view, children }.

Trace middleware chain for a route URL (Express/NestJS/FastAPI/Flask). Use when you only need the middleware stack, not the full request flow. For full route→controller→service flow use get_request_flow instead. Read-only. Returns JSON: { url, middlewares: [{ name, file, order }] }.

Single-call orientation context (~150 tokens). Returns project shape, top 3 risk hotspots, top 3 PageRank-central files, top 3 communities, and 3-5 task-routed next-tool suggestions. Use at session start instead of chaining get_project_map + get_pagerank + get_risk_hotspots + get_communities. The optional `task` argument biases the suggestions toward review / refactor / debug / add_feature / understand. Read-only. Returns JSON: { project, health, communities, next_steps }.

Get full model context: relationships, schema, and metadata (Eloquent/Mongoose/Sequelize/SQLAlchemy/Prisma/TypeORM/Drizzle). Use to understand a specific ORM model. For raw table schema without ORM context use get_schema instead. Read-only. Returns JSON: { model, table, relationships: [{ type, related, foreignKey }], fields, metadata }.

Build NestJS module dependency graph (module -> imports -> controllers -> providers -> exports). Use to understand NestJS module structure and DI wiring. For provider-level DI tree use get_di_tree instead. Read-only. Returns JSON: { module, imports, controllers, providers, exports, edges }.

Build React Native navigation tree from screens, navigators, and deep links. Use to understand app navigation structure. For details on a specific screen use get_screen_context instead. Read-only. Returns JSON: { navigators, screens, deepLinks, edges }.

Get full context for a Laravel Nova resource: model, fields, actions, filters, lenses, metrics. Use to understand a Nova admin resource before modifying it. Read-only. Returns JSON: { resource, model, fields, actions, filters, lenses, metrics }.

Get all symbols for a file (signatures only, no bodies) — cheaper than Read for understanding a file before editing. Follow up with get_symbol to read one symbol's source. `nested: true` expands large top-level symbols (default ≥100 LOC) into inner declarations, each carrying `parentId` + `depth` (max 3). Accepts project-relative or absolute file paths. For files in other registered projects, use call_project_tool. Read-only. Returns JSON: { path, language, symbols: [{ symbolId, name, kind, signature, lineStart, lineEnd, parentId?, depth? }] }. Supports `output_format: "toon"`.

Cross-repo package dependency analysis: find which registered projects depend on a package, or what packages a project publishes. Scans package.json/composer.json/pyproject.toml across all repos in the registry. Use for cross-project dependency mapping. For impact of upgrading a specific package use plan_batch_change instead. Read-only. Returns JSON: { dependents, dependencies, package }.

File importance ranking via PageRank on the import graph. Shows most central/important files. Use to identify architecturally critical files. For combined health metrics use get_project_health instead. By default markdown files (.md/.mdx/.markdown/.qmd) are excluded — their cross-link patterns dominate the graph and bury real code. Pass `include_markdown: true` to keep them. Read-only. Returns JSON: [{ file, score }]. Set `output_format: "toon"` for lossless, cheaper tabular encoding.

List registered indexer plugins and edge types. Read-only. Returns JSON: { language_plugins, framework_plugins, edge_type_categories, active_frameworks }; include_edge_types adds full catalog.

Structural health: coupling instability, dependency cycles, PageRank rankings, refactor candidates. Use for architecture review as a single aggregated report. For individual metrics use get_coupling, get_circular_imports, or get_pagerank separately. Read-only. Returns JSON: { coupling, cycles, pagerank, refactorCandidates, hotspots }.

Get project overview: detected frameworks, languages, file counts, structure. Read-only, no side effects. Call with summary_only=true at session start to orient yourself before diving into code. Use instead of manual ls/find. Returns JSON: { frameworks, languages, fileCount, symbolCount, structure }.

Find functions with high complexity called from many files — candidates for extraction to shared modules. Use during architecture review to identify hotspots worth refactoring. Read-only. Returns JSON: [{ symbol_id, name, file, cyclomatic, callerCount }]. Set `output_format: "toon"` for lossless, cheaper tabular encoding.

Find symbols related via co-location (same file), shared importers, and name similarity. Use when exploring a symbol to discover sibling code. For call-graph relationships use get_call_graph instead; for all usages use find_usages. Read-only. Returns JSON: { related: [{ symbol_id, name, kind, file, relation_type, score }] }.

Trace request flow for a URL+method: route → middleware → controller → service (Laravel/Express/NestJS/Fastify/Hono/tRPC/FastAPI/Flask/DRF). Use to understand how a request is handled end-to-end. For middleware-only analysis use get_middleware_chain instead. Read-only. Returns JSON: { route, steps: [{ type, symbol_id, name, file }] }.

Code hotspots: files with both high complexity AND high git churn (Adam Tornhill methodology). Score = complexity × log(1 + commits). Heuristic triage, not validated (calibration notes in _methodology). Requires git. For per-file bug-risk triage use predict_bugs instead. Read-only. Returns JSON: { hotspots: [{ file, score, max_cyclomatic, commits, assessment, confidence_level }], total }. Supports `output_format: "toon"`.

Actual call graph from runtime traces (vs static analysis). Shows observed call paths with call counts and latency. Requires OTLP trace ingestion. Read-only, queries external runtime data. For static call graph use get_call_graph instead. Returns JSON: { root, calls: [{ symbol, count, latency }] }.

Which external services (databases, caches, APIs, queues) does this code actually call at runtime. Based on OTLP traces. Read-only, queries external runtime data. Use to discover actual runtime dependencies vs static analysis. Returns JSON: { dependencies: [{ type, name, callCount }] }.

Runtime profile for a symbol or route: call count, latency percentiles (p50/p95/p99), error rate, calls per hour. Requires OTLP trace ingestion. Read-only, queries external runtime data. Use for performance analysis of specific endpoints. Returns JSON: { symbol_id, callCount, latency: { p50, p95, p99 }, errorRate, callsPerHour }.

Get database schema reconstructed from migrations or ORM model definitions. Use to understand table structure. For ORM-level context with relationships use get_model_context instead. Read-only. Returns JSON: { tables: [{ name, columns: [{ name, type, nullable, default }], indexes }] }.

Get full context for a React Native screen: navigator, navigation edges, deep link, platform variants, native modules. Use to understand a specific screen before modifying it. For the full navigation tree use get_navigation_graph instead. Read-only. Returns JSON: { screen, navigator, deepLink, platformVariants, nativeModules, navigationEdges }.

Get external service dependencies: which services this one calls (outgoing) and which call it (incoming). Use to understand a single service's dependency profile. For full topology use get_service_map instead. Read-only. Returns JSON: { service, outgoing, incoming }.

Get map of all services, their APIs, and inter-service dependencies. Auto-detects services from Docker Compose or treats each repo as a service. Use to understand microservice topology. For subproject-level graph use get_subproject_graph instead. Read-only. Returns JSON: { services: [{ name, endpoints, dependencies }], total }.

Session history: all tool calls made, files read, zero-result searches, and duplicate queries. Use to avoid repeating work. For a compact snapshot use get_session_snapshot instead. Read-only. Returns JSON: { calls, filesRead, zeroResults, duplicates }.

Compact session snapshot (~200 tokens) for context recovery after compaction. Returns focus files (by read count), edited files, key searches, and dead ends. Also used by the PreCompact hook to preserve session orientation automatically. Read-only. For full journal use get_session_journal; for cross-session context use get_wake_up with scope: "resume". Returns JSON: { focusFiles, editedFiles, keySearches, deadEnds }.

What every session pays before your first message, what it costs, and what went unused: source decomposition, cache-rebuild prices, and removals proven unused — never merely big. `textCompression` finds text the block says twice, as a delete-only diff. Read-only, local. Returns JSON: { startupTokens, sources, cost, cacheBreakers, mcpServers, instructionFiles, recommendations, textCompression, observationWindow }.

List all Zustand stores and Redux Toolkit slices with their state fields, actions/reducers, and dispatch sites. Use to understand state management architecture. Read-only. Returns JSON: { stores: [{ type, name, handler, metadata }], dispatches, totalStores, totalDispatches }.

Find all client calls across subprojects that call a specific endpoint. Shows file, line, call type, and confidence. Use to find all consumers of an endpoint before modifying it. Read-only. Returns JSON: { endpoint, clients: [{ repo, file, line, callType, confidence }], total }.

Show all subprojects and their cross-repo connections. A subproject is any working repository in your project ecosystem (microservices, frontends, backends, shared libraries, CLI tools, etc.). Displays repos, endpoints, client calls, and inter-repo dependency edges. Use to understand multi-repo topology. Register repos first with subproject_add_repo. Read-only. Returns JSON: { repos, endpoints, clientCalls, edges }.

Cross-repo impact analysis: find all client code across subprojects that would break if an endpoint changes. Resolves down to symbol level when per-repo indexes exist. Use before modifying a shared API endpoint; for the full cross-repo blast radius use get_federation_impact. Read-only. Returns JSON: { endpoint, affectedClients: [{ repo, file, line, callType }], total }.

Auto-generated, prioritized review questions derived from the analyses we already cache (untested framework entry points, circular imports, ast-clone clusters, dead-export drift, untested-but-exported symbols). Use during PR review to surface "what should I be looking at?" without manually chaining six tools. Each question carries a severity (high/medium/low) and the follow-up tool to drill in. Read-only. Returns JSON: { questions: [{ id, severity, question, reason, follow_up }], total, generated_at }.

Rank cross-module file edges by how unexpected they look (deep folder distance + popular target + few edges = high surprise). Surfaces hidden coupling that shotgun-changes through unrelated modules. Requires detect_communities to have been run first. Read-only. Returns JSON: { edges: [{ sourceFile, targetFile, surpriseScore, ... }], totalCommunities }.

Look up a symbol by symbol_id or FQN and return its source code. Use instead of Read when you need one specific function/class/method — returns only the symbol, not the whole file. For multiple symbols at once, prefer get_context_bundle. Read-only. Returns JSON: { symbol_id, name, kind, fqn, signature, file, line_start, line_end, source }.

Single symbol complexity over git history: cyclomatic, nesting, params, lines at past commits. Requires git. Use to track a specific function's complexity evolution. For file-level trends use get_complexity_trend instead. Read-only. Returns JSON: { symbol_id, snapshots: [{ commit, date, cyclomatic, nesting, params, lines }] }.

Git blame-based symbol ownership: who wrote which lines of a specific symbol. Requires git. Use for fine-grained ownership of a specific function/class. For file-level ownership use get_code_owners instead. Read-only. Returns JSON: { symbol_id, owners: [{ author, lines, percentage }] }.

All-in-one context for starting a dev task: execution paths, tests, entry points, adapted by task type. Use as your FIRST call when beginning any new task — replaces manual chaining of search → get_symbol → Read. For narrower feature-code lookup use get_feature_context instead. Read-only. Returns JSON (default) or Markdown.

Per-module tech debt score (A–F grade) combining: complexity, coupling instability, test coverage gaps, and git churn. Includes actionable recommendations. Use for architecture review and prioritizing cleanup. Read-only. Returns JSON: { modules: [{ module, grade, score, factors, recommendations }] }.

Find test files/functions covering a given symbol or file. Understands test-to-source mapping, not just filename conventions. With symbol_id/fqn, narrows to tests that actually exercise it (direct_invocation, import_and_call, or text_match confidence tiers; default min_confidence is import_and_call). For project-wide coverage gaps use get_untested_symbols instead. Read-only. Returns JSON: { tests: [{ test_file, symbol_id, test_name, line, edge_type, confidence }], total, symbol_filtered?, fell_back_to_file_level? }.

Walk TypeScript class/interface hierarchy: ancestors (what it extends/implements) and descendants (what extends/implements it). Use to understand inheritance trees. For a flat list of implementations only use get_implementations instead. Read-only. Returns JSON: { name, ancestors: [...], descendants: [...] }.

Find symbols lacking test coverage. scope="all_symbols" (default) returns only "unreached" symbols (no test file imports the source) — the weaker "imported_not_called" tier is opt-in via `level`. `total_untested` counts the requested level only; `by_level` always carries both. Only source-code languages are considered unless include_non_code=true. scope="exports_only" is the fast export-keyword-only scan. Read-only. Returns JSON: { level, untested: [{ symbol_id, name, kind, file, level }], total_symbols, total_untested, by_level }. Supports `output_format: "toon"`.

Compact orientation context (~300 tokens) for session start. By default returns a {stable, dynamic} split: stable content (project identity, conventions, architecture) is provider-cacheable when injected into system_prompt; dynamic content (recent activity) goes into the user message to avoid busting the system-prompt cache. Pass cache_split: false for the legacy flat shape. See `scope` to fetch cross-session activity or the project memo instead. Hard-capped by `memory.recall.timeoutMs` (default 5000 ms); on timeout returns a degraded empty payload with `degraded: true` so the agent turn never…

List all detected monorepo workspaces with file counts, symbol counts, and languages. Returns dependency graph between workspaces showing cross-workspace imports. Use for monorepo structure overview. For impact of changes on other workspaces use get_cross_workspace_impact instead. Read-only. Returns JSON: { workspaces: [{ name, files, symbols, languages }], dependencies }.

Trace how named symbols relate in the dependency graph → returns subgraph + Mermaid diagram. Input is NATURAL LANGUAGE only — NOT SQL. Must contain symbol/class names (e.g. "How does AuthService reach Database?", "What depends on UserModel?", "trace the flow of LoginHandler"). SQL-shaped input (SELECT/FROM/WHERE/JOIN…) is rejected with VALIDATION_ERROR — there is no SQL endpoint for the index. Weakly-grounded anchors (single-word collisions with many symbols) are dropped via god-name filter. Use for ad-hoc graph exploration. For structured call graph use get_call_graph instead. Read-only. Retu…

Index conversation content from Claude Code / Claw Code sessions for cross-session search. Stores chunked messages in FTS5 — enables "what did we discuss about X?" queries across all past sessions. Skips already-indexed sessions unless force=true. Mutates the session index; idempotent. Use before search_sessions. Returns JSON: { indexed, sessions_processed, chunks_stored }.

Mark a decision as no longer valid. The decision remains in the knowledge graph for historical queries but is excluded from active queries. Use when a decision is superseded or reversed. Mutates the decision store; idempotent. Returns JSON: { invalidated: { id, title, valid_until } }.

List installed pre-indexed bundles for dependency libraries. Shows package name, version, symbol/edge counts, and size. Read-only. Returns JSON: { bundles: [{ name, version, symbols, edges, size }], total }.

List every corpus saved on disk with its manifest (scope, project_root, sizes, timestamps). Read-only. Use to discover what corpora are available to query.

List previously captured graph snapshots, most recent first. Each entry includes its summary so you can inspect counts without diffing. Read-only. Returns JSON: { snapshots: [{ id, name, captured_at, summary }], total }.

List all active ranking pins with weight, scope, target, expiry, and creator. Use to inspect what is currently boosted/demoted in PageRank-driven ranking. Read-only. Returns JSON: { pins: [{ scope, target_id, weight, expires_at, created_by, created_at }], total, cap }.

List projects registered with trace-mcp (~/.trace/registry.json) — the roots call_project_tool accepts. Use to query a project other than the one this session is attached to. Subprojects nested inside those roots are not valid targets, so they are opt-in via include_subprojects. Read-only. Returns JSON: { projects: [{ root, name, type, lastIndexed }], subprojects?: [{ name, repo_root, project_root }], total }.

Mine Claude Code / Claw Code session logs for architectural decisions, tech choices, bug root causes, and preferences. Strategies: "regex" (default, free, ~20-40% recall), "llm" (higher recall, costs tokens), "hybrid" (regex + LLM safety net). Skips already-mined sessions unless force=true. Mutates the decision store; idempotent. Returns JSON: { mined, decisions_extracted, sessions_processed, strategy?, llm_sessions?, llm_decisions_extracted? }.

Pack project context into a single document for external LLMs. Intelligent selection by graph importance, fits within token budget. Better than Repomix for focused context. Strategies: most_relevant (default — feature/PageRank ranked), core_first (PageRank always wins, surfaces architecturally central code), compact (signatures only — drops source bodies, lets outlines cover much more of the repo per token). Read-only. Use when sharing project context with external tools. Returns XML/Markdown/JSON with selected code within budget.

Boost (or demote) a symbol and/or file in PageRank-driven ranking by setting a multiplicative weight. Unifies pin_symbol/pin_file — pass symbol_id and/or file_path (at least one required; pass both to pin them together with the same weight). Capped at 50 active pins per project. Returns JSON: { ok, pins, errors? }.

Analyze the impact of updating a package/dependency. Shows all affected files, import references, and generates a PR template with checklist. Use before upgrading a dependency to understand blast radius. Read-only (analysis only, does not modify files). Returns JSON: { package, affectedFiles, importReferences, prTemplate, checklist }.

Preview any refactoring (rename, move, extract, signature) without applying. Returns all edits as {old_text, new_text} pairs. Read-only (does not modify files). Use to review the blast radius before calling apply_rename, apply_move, change_signature, or extract_function. Returns JSON: { success, type, edits: [{ file, old_text, new_text }], filesAffected }.

Heuristic bug-risk triage: ranks files by git churn, fix-commit ratio, complexity, coupling, PageRank, and author count — a prioritization heuristic, NOT a validated predictor (calibration notes in the response's _methodology field). Cached 1h; refresh=true to recompute. Requires git. Use to prioritize where to look, not to certify a file as buggy. For complexity+churn only use get_risk_hotspots, for one file's trend over time get_file_health_timeline. Read-only. Returns JSON: { predictions: [{ file, score, risk, confidence_level, signals }], total }.

Map a business question to domain taxonomy → returns domain ownership and relevance scores (no source code). Use when you need to know WHICH DOMAIN owns specific functionality. For actual source code use get_feature_context instead. Read-only. Returns JSON: { symbols: [{ symbol_id, domain, relevance }] }.

Answer a natural-language question against a saved corpus. Loads the corpus body, primes the configured AI provider with it as system context, and returns the response. When mode="prompt-only" returns the assembled system+user prompt instead of calling the AI — useful for users without an AI provider configured, or for piping into another LLM. Returns JSON: { answer | prompt, corpus, tokens_used }.

Query the decision knowledge graph. Filter by type, subproject, code symbol, file path, tag, or time — answers "why was this architecture chosen?" with the actual decision record. Defaults to approved decisions; use include_pending or review_status for other tiers. Read-only. Returns JSON: { decisions: [{ id, title, type, content, tags, review_status, cluster_ids? }], clusters_summary?, total_results }. Supports `output_format: "toon"`.

Rebuild co-change index from git history. Mutates the co-change index; idempotent. Use after significant git history changes. Returns JSON: { status, pairs_stored, window_days }.

Synthesise (or refresh) the project memo — a 250-400 word LLM-written orientation digest over the decision store. Skips work when fewer than `memory.memo.regenerateEveryN` decisions have been added since the last memo unless `force=true`. Requires an active AI provider — structured error otherwise.

Notify trace-mcp that a file was edited. Reindexes the single file and invalidates search caches. Call after Edit/Write to keep index fresh — much lighter than full reindex. Also flags duplicate symbols — if `_duplication_warnings` appears, you may be recreating existing logic; review them. Each one is reported once per file, not on every edit; `check_duplication` re-asks. Mutates the index; idempotent. Returns JSON: { status, file, totalFiles, indexed, _duplication_warnings? }.

Trigger (re)indexing of the project or a subdirectory. Mutates the local index (SQLite). Use after major file changes; for single-file updates prefer register_edit instead. The optional `postprocess` flag controls how much work runs after raw symbol extraction: "full" (default) does everything; "minimal" skips LSP enrichment + env-var scan + git history snapshots (~30-50% faster on warm CI runs); "none" also skips edge resolution and gives you raw symbols only. Idempotent — safe to re-run. Returns JSON: { status, totalFiles, indexed, skipped, errors, durationMs, postprocess }.

Reject a decision currently in the memoir-style review queue (review_status="pending"). Sets review_status="rejected" so the row is hidden from default query_decisions results but kept for audit. Mutates the decision store; idempotent. Use approve_decision for the opposite. Returns JSON: { rejected: { id, title, review_status } }.

Live agent write into the decision knowledge graph. Confidence-scores the input and routes it through the memoir review queue: high-confidence rows enter the active graph immediately, mid-confidence rows queue for human approval, low-confidence rows are dropped without persistence. Per-session dedup + rate-limit. Use during a session to capture decisions in real time. For manual high-confidence writes use add_decision; for post-hoc extraction from session logs use mine_sessions. Returns JSON: { id, review_status, confidence, deduplicated? }.

Safely remove a dead symbol from its file. Verifies the symbol is actually dead (multi-signal detection or zero incoming edges) before removal. Warns about orphaned imports in other files. Dry-run by default — preview the plan, then re-call with dry_run: false to apply. Destructive when applied — deletes code from source files. Use get_dead_code first to identify candidates. Returns JSON: { success, removed: { symbol_id, file }, orphanedImports }.

Apply a targeted repair to the local SQLite index. Modes: drop-orphans (delete embedding rows whose symbol_id no longer exists), drop-vec (drop the entire vector store — search falls back to BM25; embed_repo rebuilds), rebuild-fts (drop and reload symbols_fts from the symbols table). Each mode runs in a transaction so a partial failure leaves the DB unchanged. DESTRUCTIVE — verify_index first to find out which mode is needed. Returns JSON: { mode, ok, detail, affected }.

AI-powered review of a file change — identify issues, risks, and suggestions

Undo one apply_startup_recommendations(dry_run:false) call byte-for-byte: restores files and moved skills. Defaults to the latest backup. Returns JSON: { backupId, restored, errors }.

Find deferred work and shortcuts: TODO/FIXME/HACK/XXX comments, empty functions & stubs, hardcoded values (IPs, URLs, credentials, magic numbers), and per-language debug artifacts (console.log, debugger, var_dump, pdb.set_trace, etc). Combines comment scanning, symbol body analysis, and false-positive filtering — surfaces more than grep alone. Use for code quality audits / pre-release checks. For performance antipatterns use detect_antipatterns; for security use scan_security. Read-only. Returns JSON: { findings: [{ category, priority, file, line, message }], total, summary }.

Scan project files for OWASP Top-10 vulnerabilities (SQLi, XSS, command injection, path traversal, hardcoded secrets, insecure crypto, open redirects, SSRF — reported with CWE IDs). Skips test files. Low-confidence findings are held back by default and counted in suppressed_low_confidence — pass include_low_confidence to see them. For data-flow analysis use taint_analysis. Read-only. Returns JSON: { findings: [{ rule, severity, cwe, file, line, message }], total, summary, suppressed_low_confidence }.

Search symbols by name, kind, or text. Use instead of Grep for functions, classes, methods, variables. For raw text/comment search use search_text; for references to a known symbol use find_usages. Read-only. Returns JSON: { items: [{ symbol_id, name, kind, fqn, signature, file, line, score }], total, search_mode } — mode-specific shape when mode!=single. Supports `output_format: "toon"`.

Search pre-indexed bundles for symbols from popular libraries (React, Express, etc.). Returns symbol definitions from dependency bundles — useful for go-to-definition into node_modules/vendor. Install bundles via CLI: `trace-mcp bundles export`. For project source code search use search instead. Read-only. Returns JSON: { results: [{ name, kind, signature, bundle }], bundles_searched }.

Search across all past session conversations. Finds what was discussed, decided, or debugged in previous sessions. Full-text search with porter stemming — e.g., "why did we switch to GraphQL", "auth middleware bug", "database migration approach". Requires index_sessions to be run first. Read-only. Returns JSON: { results: [{ session_id, text, score }], total_results }.

Full-text search across all indexed files. Supports regex, glob file patterns, language filter. Use for finding strings, comments, TODOs, config values, error messages — anything not captured as a symbol. Skips .env files: secret values are never searched or returned, use get_env_vars for env keys. For symbol search (functions, classes) use search instead. Read-only. Returns JSON: { files: [{ file, language, hits: [{ line, column, match, context }] }], total_matches } — hits grouped per file, so a long path is paid once. Pass `grouping: "flat"` for the ungrouped matches[] shape.

Dead code & coverage audit: dead exports, untested public symbols, heritage debt. Use as a one-shot health check combining dead exports + untested symbols + heritage debt. For individual checks use get_dead_code or get_untested_symbols separately. Read-only. Returns JSON: { deadExports, untestedSymbols, heritageDebt, summary }.

Capture the current graph shape (file/symbol counts, edges by type, top in-degree files, communities, exported symbols) under a named label. Use as a checkpoint before/after a refactor; later compare with diff_graph_snapshots. Mutates a single graph_snapshots row; idempotent (re-stamps if name exists). Returns JSON: { id, name, captured_at, summary }.

Add a repository as a subproject of the current project. Pass `repo_path` for a local checkout, or `git_url` to shallow-clone a remote repo into .trace-mcp/subprojects/<owner>/<repo> first (idempotent — re-runs reuse the existing clone). A subproject is any working repository in your ecosystem: microservices, frontends, backends, shared libraries, CLI tools. Discovers services, parses API contracts (OpenAPI/gRPC/GraphQL), scans for HTTP client calls, and links them to known endpoints. Mutates the topology store; idempotent. Returns JSON: { added, services, contracts, clientCalls, cloned? }.

Re-scan all subprojects: re-discover services, re-parse contracts, re-scan client calls, and re-link everything. Mutates the topology store; idempotent. Use after code changes in subproject repos. Returns JSON: { synced, services, contracts, clientCalls }.

Onboarding helper: shows top imported files, most connected symbols (PageRank), language stats, and example tool calls. Call this first when exploring an unfamiliar project. For a structured project map use get_project_map instead. Read-only. Returns JSON: { topFiles, topSymbols, languageStats, exampleQueries }.

Suggest test cases for a symbol using AI

Track flow of untrusted data from sources (HTTP params, env vars, file reads) to dangerous sinks (SQL queries, exec, innerHTML, redirects). Framework-aware (Express, Laravel, Django, FastAPI, etc). Reports unsanitized flows with CWE IDs and fixes; prunes flows that provably terminate at a non-string value. Heuristic, regex-based — not a sound dataflow engine, treat as triage. For pattern-based OWASP scanning use scan_security instead. Read-only. Returns JSON: { flows: [{ source, sink, path, sanitized, cwe, suggestion }], total }.

Call a trace-mcp tool discovered with trace_tools. Supports the complete trace-mcp tool surface.

Check whether the bb environment repository is indexed and ready for queries.

Get a compact outline of symbols in a repository file.

Recall the compact project memo and durable decisions before a task.

Read the exact indexed definition of a symbol, using its symbol ID or fully qualified name.

Recall project decisions previously stored by trace-mcp.

Save an English-language project decision to shared memory with bb thread deduplication.

Search the indexed repository for symbols and relevant code with compact results.

Shortcut to record a failed approach or dead end into task state without a full patch.

Save a named state checkpoint snapshot for safe rollback if a future exploration path fails.

Retrieve current execution state for a task in compact markdown (~150 tokens) or full JSON.

Initialize structured execution state for a task (arXiv:2608.26263). Saves state to SQLite and returns compact initial state.

List recent agent execution task states and their status in storage.

Apply an RFC 7396 JSON Merge Patch to update state atomically. Validates schema and increments version. Returns compact status.

Rollback task execution state to a previously saved checkpoint snapshot by label or ID.

Discover additional trace-mcp tools by name or description without loading its entire catalog into context.

Walk the dependency graph from a starting symbol or file using BFS/DFS, with a hard token budget on the response. Use when you want a structured "what reaches this from N hops away?" answer without committing to the call-graph or impact-radius shape. Read-only. Returns JSON: { start, direction, nodes: [{ id, kind, name, depth, edge_type, in_degree }], total_visited, truncated_by_depth, truncated_by_nodes, truncated_by_budget }.

Decision memory, not retrieval ranking (that is `tune_weights`): re-fit decision confidence weights from accumulated review feedback (approve/reject events). Requires >= min_events reviews and at least one of each label. Mutating: when dry_run=false and the fit succeeds, persists to ~/.trace-mcp/confidence_weights.json and resets the in-memory weight cache so subsequent remember_decision calls use the new weights. Returns: { ok, reason, events_used, weights?, before?, loss_before?, loss_after?, applied }.

Retrieval fusion ranking for `search`, not decision memory (that is `tune_decision_weights`): read the persistent ranking ledger and learn per-repo signal-fusion weights, written to ~/.trace-mcp/tuning.jsonc. Requires telemetry.enabled in config. Read-only by default (dry_run=true unless explicitly disabled). Returns JSON: { applied, reason, weights?, before?, events_used? }.

Remove a ranking pin by target. Pass either symbol_id (for a pinned symbol) or file_path (for a pinned file). At least one is required. Returns JSON: { ok, deleted }.

Verify a markdown document against the code graph — the reverse of generate_docs, for catching doc drift after a rename. forward: backticked paths and identifiers that no longer resolve, each with its heading path. reverse: public symbols in a scope the document never mentions. Read-only. Returns JSON: { doc, forward: { checked, resolved, misses }, reverse: { unmentioned } }.

Read-only structural check of the local SQLite index: SQLite integrity_check, foreign-key violations, required-table presence, FTS5 integrity-check, embedding dimension consistency, orphan embedding detection, and missing-on-disk file check. Returns a check-by-check report with status (ok/warn/error) and a suggested repair mode for any non-ok finding. Never writes. Use as a preflight before reindex/embed_repo or when search is misbehaving. Returns JSON: { ok, status, checks: [{ name, status, detail, count?, suggested_repair? }] }.

Open interactive HTML graph in browser showing file/symbol dependencies. Supports force/hierarchical/radial layouts, community coloring. Use granularity=symbol to see individual functions/classes/methods as nodes instead of files. Writes an HTML file to disk. For static Mermaid/DOT output use get_dependency_diagram instead. Returns JSON: { outputPath, nodes, edges }.

Open interactive HTML visualization of the subproject topology: services as nodes, API calls as edges, health/risk indicators per service. Node size = endpoint count, color = health (green/yellow/red). Writes an HTML file to disk. Use for visual architecture review. Returns JSON: { outputPath, services, edges }.