Loading ToolBench
Code Graph MCP Server - provides tools for semantic code analysis, graph traversal, and code discovery using CodeGPT's deep code graph API
The server defines 4 code-graph exploration tools with explicit schemas and descriptions. Tool naming follows verb-noun convention (list-, get-, find-, nodes-) but descriptions are lengthy and not optimized for LLM token efficiency. All tools have documented parameters with types and descriptions, but several critical quality issues exist: (1) output schemas are not documented, responses are wrapped in generic 'content' arrays; (2) error handling is minimal, returning raw errors without recovery guidance; (3) parameter descriptions include example values that LLMs may reuse literally; (4) no pagination support despite tools that may return large result sets; (5) security: API keys passed via environment variables but also accepted as command-line args, risking shell history leakage.
Explore the immediate relationships of a functionality within the code graph from the repository. This reveals first-level connections including: parent functionalities that reference this node, child functionalities that this node directly calls or uses, declaration/definition relationships, and usage patterns. Essential for understanding code dependencies and architecture. The repository is represented as a connected graph where each node (function, class, file, etc.) has relationships with other nodes.
Get the complete code implementation of a specific functionality (class, function, method, etc.) from the repository graph. This is the primary tool for code retrieval and should be prioritized over other tools. The repository is represented as a graph where each node contains code, documentation, and relationships to other nodes. Use this when you need to examine the actual implementation of any code entity.
List all available repository graphs that you have access to. Returns basic information about each graph including the graph ID, repository name with branch, and description. Use this tool when you need to discover available graphs.
Search for code functionalities across the repository graph using semantic similarity based on natural language queries. This tool finds relevant functions, classes, methods, and other code entities that match the conceptual meaning of your query, even if they don't contain the exact keywords. Perfect for discovering related functionality, finding similar implementations, or exploring unfamiliar codebases. The search operates on the semantic understanding of code purpose and behavior.
Output schemas are not documented. All tools wrap responses in generic { content: [{ type: 'text', text: ... }] } without declaring what the returned text contains (structure, fields, format). LLMs cannot plan downstream calls or extract structured data without knowing what fields are present.
Parameter descriptions contain example values that LLMs reuse literally. E.g., 'getUserById', 'UserService.authenticate', 'user authentication and login'. This violates the pattern rule: 'Do not put example values in descriptions. Use parameter constraints (enums, patterns) instead.'
Error handling returns raw error messages without actionable recovery guidance. E.g., 'catch (error) { return { content: [{ type: "text", text: `${error}` }] }'. LLMs receive no information about whether the error is retryable, what to do next, or which alternative tools to try.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | C | 60 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 0 | - | v1 |
No pagination or result-limiting declared. The nodes-semantic-search tool may return hundreds or thousands of matches without a cap, risking context window exhaustion. Tools should accept limit/page parameters and document max result counts.
Description length exceeds 200-char LLM-optimized baseline for 3 of 4 tools (get-code: 314, find-direct-connections: 315, nodes-semantic-search: 285). Verbose descriptions waste tokens and bury key selection criteria. Baseline from 549 production tools: average 194 chars, p90=392, but optimal for agent selection is 50-200.
Security: API key can be passed as command-line argument (process.argv.slice(2).find(arg => arg.startsWith('sk-'))). Secrets in CLI args leak into shell history, process listings, and logs. Enforce environment-variable-only injection.
Tool composition: graphId and repository parameters are conditionally required depending on server configuration (single-repo, multi-repo, or graph-id-only modes), but this logic is not declared in parameter descriptions. LLMs cannot predict which parameters are needed without explicit documentation.