Arbor: a code graph for agents and an MCP server
Arbor
Builds a call and dependency graph from code and tells an agent who calls a function and what breaks after an edit
- 162 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- Arbor reads all project code and writes a graph to an index folder; the Claude Code hook changes agent settings
- The install script runs through curl and bash, so read it beforehand
Install
- Works in
Manual install
cargo install arbor-graph-cli && arbor setupInstall and index the project; then connect the server.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Arbor reads all project code and writes a graph to an index folder; the Claude Code hook changes agent settings
- The install script runs through curl and bash, so read it beforehand
This is third-party code. Review the repository files before installing.
What it does
Arbor parses a project and builds a semantic graph: functions, classes and modules become nodes, and calls, imports and inheritance become edges. From it an agent gets deterministic answers instead of text-based guesses: who calls a symbol directly and transitively, the path between two points, and how large the blast radius of an edit is with depth, confidence and danger level. Edges carry a confidence score, and ambiguous links are labelled rather than hidden. The server starts with `arbor bridge` over stdio, with an HTTP mode for remote setups. It has 17 tools: `get_map` (a project skeleton ranked by PageRank, called first), symbol and caller search, `get_blast_radius`, `explain_symbol`, `audit_security`, `batch_query` and `find_api_usages`. The same graph is reachable from the CLI: `arbor map`, `arbor refactor`, `arbor diff`. A separate `arbor retirements` command finds OpenAI, Anthropic and Google SDK calls in Python code that use retired models. `arbor hook claude` gives Claude Code a receipt after every turn: what changed, what was touched unasked and what to test.
Who it is for. Developers on large codebases where it is costly for an agent to reread files, and teams that check the impact of changes before merging.
Good fit when
- You are changing a function and want to see what depends on it first
- An agent does not know the project: it needs a code map of about a thousand tokens instead of reading dozens of files
- CI needs blast-radius thresholds to block overly dangerous pull requests
- Before old models are retired you need to find SDK calls that will stop working
Not a fit when
- You need semantic search over text and documentation: the graph is built from code structure and uses no embeddings
- The project uses a language with fallback parsing (Kotlin, Swift, Ruby, PHP, Shell): links there are less reliable
- You need a security check like a real scanner: audit_security gives a pointer but does not replace one
Example request
Show the blast radius if I change parse_file: who calls this function and which tests to run.MCP
- Transport
- stdio, http
- Authentication
- not required
Limitations
Full parsers exist for Rust, TypeScript and JavaScript, Python, Go, Java, C and C++, C# and Dart, with fallback parsing for the rest. After an upgrade a saved graph is rebuilt once. The install script runs through curl and bash, and crates.io may lag the release, so the README lists pinned installs.
`arbor setup` indexes the project, `arbor hook claude` changes Claude Code settings, and `~/.arbor` holds the global config. The retirements data was checked against providers on 28 October 2026 and ages along with their pages. Part of the analysis is limited by visibility: a call to a function in another file counts only if the calling file can see it.
How to disable. Remove the arbor entry from the client config (`claude mcp remove arbor`), take out the Claude Code hook and, if you like, the program itself with the ~/.arbor folder.
FAQ
How does Arbor differ from embedding search?
Arbor builds a graph from calls, imports and inheritance, so answers about callers and the blast radius are deterministic. Embeddings find similar text but do not know who calls whom.
How do I connect Arbor to Claude Code?
After install and `arbor setup`, run `claude mcp add --transport stdio --scope project arbor -- arbor bridge`. Agents are advised to call `get_map` first, then search symbols and read only the target file.
Can Arbor be used as a CI check?
Yes. The README describes a CI gate on blast-radius thresholds, and action.yml sits in the repository root. `arbor diff --base origin/main` shows the branch impact the way the pull request will see it.
Which languages does Arbor parse?
Full parsers cover Rust, TypeScript and JavaScript, Python, Go, Java, C and C++, C# and Dart. Kotlin, Swift, Ruby, PHP and Shell get a simpler fallback parser. Caller search keeps languages apart: a TypeScript function is never reported as a caller of a same-named Rust one.
What does arbor retirements do?
It finds direct OpenAI, Anthropic and Google SDK calls in Python code that use retired or soon-to-be-retired models and says what to change. The README gives 14 January 2027 as the shutdown date for dated gpt-4o and gpt-4.1 snapshots.
Discussion
No questions or reviews yet.
Related
MCP serversA local MCP server with call graphs and symbol search: the agent sees code structure and what an edit affects in advance.
A local code graph with version history: an MCP server that tells the agent who calls a function and what an edit breaks
A CLI and MCP server that build a code graph with Tree-sitter so an agent reads only needed functions in review, saving tokens
CodeGraph (Rust)
codegraph-rust
A Rust code graph for agents: four MCP tools show what an edit will touch, how the architecture fits together and where the fragile spots are
Code graph and project memory in one Rust program: the agent gets excerpts with file and line citations
DevLens analyzes a repo once and serves agents ranked files, call flow and change impact over MCP, no file-by-file reading
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Arbor: a code graph for agents and an MCP server (this card) | no | not required | 162 | |
| code-review-graph | no | not required | 32,733 | a code graph for reviewing changes |
| gograph | no | not required | 231 | a dependency graph for Go projects |
README in short
The README opens with the promise of "code context for people and agents", then explains the graph, shows a short start, the list of 17 MCP tools, CLI modes and installs for Linux, macOS, Windows, npx and Docker. Release 3.1.1 and supported languages are covered separately.