Loading ToolBench
Code intelligence MCP server for Claude Code & Codex CLI — AST call graph analysis and hybrid semantic search (Dense + Sparse + RRF + Cross-Encoder Reranker) across 7 languages.
CodeXray demonstrates strong naming conventions (verb_noun pattern: codexray_search, codexray_find, codexray_explore, codexray_callers, codexray_callees, codexray_status) and comprehensive descriptions with explicit TRIGGER guidance for LLM selection. All 6 tools have detailed descriptions (194-350 chars, within baseline 34-392 range). Input schemas are present and properly typed with JSON Schema. However, output schemas are completely undocumented, no response structure is defined for any tool, forcing LLMs to guess what fields to expect. Parameter descriptions are strong but lack explicit constraints (e.g., no min/max for 'limit' parameter, no enum for result types). Error handling and recovery guidance are absent from tool definitions.
Find ALL functions CALLED BY this symbol: its internal dependencies. Use to understand what a function relies on — databases, APIs, utilities, helpers. AST-level tracing, accurate even with same-named symbols in different scopes.
Find ALL functions that CALL this symbol. REQUIRED before modifying or deleting any function — shows every downstream consumer and the full blast radius. AST-level tracing (not text matching), so it won't miss indirect references or confuse same-named symbols in different scopes.
DEFAULT first step for "how does X work?" / "explain the architecture" questions. Combines search + call graph: returns the key functions for a concept, with each function's callers and callees. Gives you a ready-made map of the relevant code paths. USE THIS when the user asks to EXPLORE, EXPLAIN, UNDERSTAND, or INVESTIGATE how something works in the codebase. It is always the right tool for architecture questions.
Find code symbols by NAME. Use INSTEAD of Glob or Bash find when you know the function/class/method name you're looking for. Returns AST-verified DEFINITIONS (not text matches) with file paths and line numbers. TRIGGERS: - "find the login handler" - "where is UserService defined" - "look for processPayment function"
Your FIRST choice for understanding or exploring code. Use INSTEAD of Grep/Glob when finding code by what it DOES (not literal text). Understands synonyms: "auth" matches "login", "authenticate", "verify credentials". Returns function/class definitions with signatures, file paths, and line numbers — no follow-up reads needed. TRIGGERS (use BEFORE Grep/Glob): - "how does X work" / "explain Y" - "find where Z happens" - Any code exploration or investigation task
Output schemas completely undocumented. No response structure defined for any tool, LLMs cannot plan downstream calls or extract required fields (e.g., file paths, line numbers, function signatures mentioned in descriptions but not in response schema).
No error handling or recovery guidance in tool definitions. Descriptions lack 'what to do if this fails', e.g., if codexray_search returns no results, should the LLM retry with a different query, fall back to grep, or ask the user?
Parameter constraints missing. 'limit' parameter lacks min/max bounds (baseline: 1 - 100 or 1 - 50). No validation guidance for 'query' or 'symbol' parameters, what happens if query is empty, too long, or contains special characters?
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 57 | <=2025-11-25 | v2 |
Check index freshness — number of indexed functions, files, last update timestamp. Use to verify the index is ready before relying on search or call-graph results.
codexray_status has minimal description (70 chars) and empty input schema properties object, no explanation of what fields are returned or when to call it relative to other tools.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). All tools are read-only but this is not declared in the schema, forcing LLMs to infer safety from descriptions alone.