Power your agent
The publisher's own command. Not a PlugMCP endpoint.
Host a copy with our keys and logs.
npx -y [email protected]Claude Code has no install link for a local command. Copy the command below and run it in a terminal.
claude mcp add codesift-mcp -- npx -y codesift-mcp@0.26.5Run in a terminal.
{ "mcpServers": { "codesift-mcp": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}claude_desktop_config.json
Remote URL or a command on your machine? How the two installs differ
Run on PlugMCP
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
LaunchFrom the publisher
CodeSift indexes your codebase with tree-sitter AST parsing and gives AI agents 150 MCP tools (55 core + 95 discoverable) via CLI or MCP server. It uses 61-95% fewer tokens than raw grep/Read workflows on typical code navigation tasks.
Works with: Claude Code, Cursor, Codex, Gemini CLI, Zed, Aider, Continue — any MCP client.
MCP server for code intelligence — 146 tools for symbol search, call graph, semantic search, route tracing, community detection, LSP bridge, secret detection, conversation search, and Hono framework intelligence
Bulletproof one-liner (clears stale cache, installs latest, auto-configures all platforms):
npm cache clean --force && npm i -g codesift-mcp@latest
npm cache clean --force clears stale registry metadata that can cause ETARGET errors. The postinstall script then runs codesift setup all automatically.
Restart your AI client (close + reopen) so the new MCP server is picked up. New terminal sessions in your IDE work fine — no need to quit the IDE itself.
Windows: close every MCP client before upgrading (Claude Code, Codex, Cursor, …). A running
CodeSift server holds native .node files open (onnxruntime-node, @huggingface/transformers),
Windows will not let npm replace an open file, and the upgrade fails with EBUSY / EPERM.
To configure individual platforms manually:
codesift setup claude # Claude Code — config + rules + hooks + CLAUDE.md
codesift setup codex # Codex CLI — config + AGENTS.md rules
codesift setup cursor # Cursor IDE — config + .cursor/rules
codesift setup gemini # Gemini CLI — config + GEMINI.md rules
codesift setup antigravity # Google Antigravity — config only
codesift setup all # All platforms at once
Verify installed version:
codesift --version
What setup installs (all by default):
Additionally, every MCP client receives ~800 tokens of compact guidance automatically via the MCP instructions field — zero setup needed.
npm update -g codesift-mcp
codesift setup all # Updates rules files to latest version
codesift setup all --force # Force-update even if you modified rules
setup writes the absolute codesift-mcp bin path when available. This avoids
per-session npx cache drift and stale dist/server.js paths. Re-run setup
after updating to refresh rules files and repair old MCP config entries.
# Index a project
codesift index /path/to/project
# Search for a function
codesift symbols local/my-project "createUser" --kind function --include-source
# Semantic search (requires embedding provider)
codesift retrieve local/my-project \
--queries '[{"type":"semantic","query":"how does caching work?"}]'
# Build the project wiki — agents read it on every new session
codesift wiki-generate
Wiki tip:
setup --hooks(on by default) wires a SessionStart hook that injects a project overview into every new agent session, plus a PostToolUse hook that auto-refreshes it. Both are silent no-ops until you runcodesift wiki-generateonce in the repo — skip it and the wiki never reaches your agent. This is the #1 reason wiki adoption stays at zero.
772 real tasks from usage.jsonl — exact query sequences agents used across 33+ repos. Native (grep/find/read) vs CodeSift.
Output goes to .codesift/wiki/ in the repo root. Includes markdown pages with [[wikilinks]], backlinks, community summaries, and a self-contained codesift-lens.html with D3 chord diagram and force-directed graph.
When running as an MCP server, CodeSift exposes 51 core tools directly. The remaining 95 niche tools are discoverable via discover_tools and describe_tools, or via plan_turn which routes a natural-language task to the best-fit tools and auto-reveals any hidden ones.
Search past Claude Code conversation history — the decisions, rationale, and debugging sessions that shaped your code.
# Index conversations for current project (auto-detected from cwd)
# Also runs automatically at startup via auto-discovery
index_conversations()
# Index a specific project's conversations
index_conversations(project_path="/Users/me/.claude/projects/-Users-me-DEV-my-project")
# Search past conversations
search_conversations(query="auth middleware bug", limit=5)
# Find conversations that discussed a specific code symbol
find_conversations_for_symbol(symbol_name="processPayment", repo="local/my-project")
# In codebase_retrieval batch queries
codebase_retrieval(repo, queries=[
{"type": "semantic", "query": "how does auth work"},
{"type": "conversation", "query": "why we chose Redis over Postgres cache"}
])
Features:
[image]Detect hardcoded secrets (API keys, JWT tokens, passwords, connection strings) in your indexed codebase. Uses ~1,100 detection rules from TruffleHog via @sanity-labs/secret-scan, with CodeSift's tree-sitter AST for false-positive reduction.
# Scan entire repo for secrets
scan_secrets(repo="local/my-project")
# Filter by severity
scan_secrets(repo="local/my-project", severity="critical")
# Only high-confidence findings, including test files
scan_secrets(repo="local/my-project", min_confidence="high", exclude_tests=false)
# Scope to specific directory
scan_secrets(repo="local/my-project", file_pattern="src/config/**")
Features:
lowsk-p***hijk, raw values never in cache or logs// codesift:allow-secret to suppress a finding.env, .yaml, .toml, .json, .ini, .properties scannedindex_file responses when secrets detectedGenerate browsable wiki pages and an interactive HTML dashboard from your codebase's topology — zero manual writing.
# Generate wiki for current repo
codesift wiki-generate
# Scope to a directory
codesift wiki-generate --focus src/tools
# Check wiki integrity
codesift wiki-lint .codesift/wiki
What it generates (in .codesift/wiki/):
[[wikilinks]] and auto-generated backlinks*.summary.md files (~400 tokens) for AI agent context injectionLens HTML dashboard (codesift-lens.html):
AI agent integration:
handlePrecheckRead — when an agent reads a file, it automatically receives the file's community wiki summary as contextMCP tool:
generate_wiki(repo, focus?, output_dir?, include_lens?)
Full PHP code intelligence with first-on-market Yii2 framework awareness. No other general-purpose MCP tool provides static Yii2 intelligence.
Symbol extraction (tree-sitter-based):
TestCase subclass = test_suite, test* methods = test_case, setUp/tearDown = test_hookYii2 framework awareness:
trace_route("site/index") resolves to SiteController::actionIndex() (incl. module nesting)analyze_project detects Yii2 via composer.json and extracts: controllers, models, modules, widgets, behaviors, components, assets, config fileschecks= parameter)composer.json is detected at CWD — no need to call discover_tools/describe_tools firstLaravel support:
Route::get('/path', [Controller::class, 'method']) pattern matching# Trace a Yii2 route
trace_route(repo, path="site/about")
# Analyze ActiveRecord models (via php_project_audit)
php_project_audit(repo, checks=["activerecord"], model_name="User")
# PHP security scan (8 parallel checks)
php_security_scan(repo)
# Resolve PSR-4 namespace to file
resolve_php_namespace(repo, class_name="App\\Models\\User")
LSP bridge: Intelephense configured for go-to-definition, find-references, type-info, and rename across PHP files.
Deep Next.js static analysis — 3 core tools covering routing, rendering, security, SEO, and architecture:
framework_audit — one-call meta-audit: runs route map + metadata + server actions + boundary + data flow + middleware + component classification checks. Returns composite score with prioritized findings. Use checks= parameter to run individual checks (e.g., checks=["server-actions"], checks=["boundary"], checks=["link-integrity"], checks=["data-flow"], checks=["middleware"], checks=["components"], checks=["api-contract"])nextjs_route_map — maps all App Router and Pages Router routes with rendering strategy (SSG/SSR/ISR/PPR), dynamic params, route groups, parallel routes, and intercepting routesnextjs_metadata_audit — detects missing/incomplete metadata exports, OpenGraph gaps, missing robots/sitemap, and SEO anti-patterns across all routesAuto-load: Next.js tools are automatically enabled when next is detected in package.json — no manual discovery needed.
The patterns command searches for common code quality issues across your codebase:
Custom regex is also supported: codesift patterns local/project "Promise<.*any>".
find_perf_hotspots)A separate tool scans for performance-specific issues with balanced-brace loop body extraction (not just regex):
# Scan all patterns
find_perf_hotspots(repo)
# Only N+1 and unbounded queries
find_perf_hotspots(repo, patterns="n-plus-one,unbounded-query")
# Scope to API directory
find_perf_hotspots(repo, file_pattern="src/api")
CodeSift runs as an MCP server, exposing 146 tools to AI agents (55 core + 95 discoverable). The fastest setup method is codesift setup <platform> which handles everything automatically. Manual configuration is also supported:
Add this to ~/.codex/config.toml:
[mcp_servers.codesift]
command = "/Users/you/.npm-global/bin/codesift-mcp"
args = []
tool_timeout_sec = 120
default_tools_approval_mode = "approve"
You can also add it manually or via the Codex CLI:
codex mcp add codesift -- /Users/you/.npm-global/bin/codesift-mcp
Add this to ~/.claude/settings.json:
{
"mcpServers": {
"codesift": {
"command": "/Users/you/.npm-global/bin/codesift-mcp",
"args": []
}
}
}
With semantic search (OpenAI embeddings), add the env var manually:
{
"mcpServers": {
"codesift": {
"command": "/Users/you/.npm-global/bin/codesift-mcp",
"args": [],
"env": {
"CODESIFT_OPENAI_API_KEY": "sk-..."
}
}
}
}
Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"codesift": {
"command": "/Users/you/.npm-global/bin/codesift-mcp",
"args": []
}
}
}
Add this to ~/.cursor/mcp.json, or to .cursor/mcp.json in your project:
{
"mcpServers": {
"codesift": {
"command": "/Users/you/.npm-global/bin/codesift-mcp",
"args": []
}
}
}
Add this to ~/.gemini/settings.json, or to .gemini/settings.json in your project:
{
"mcpServers": {
"codesift": {
"command": "/Users/you/.npm-global/bin/codesift-mcp",
"args": []
}
}
}
You can also use the Gemini CLI:
gemini mcp add codesift -s user /Users/you/.npm-global/bin/codesift-mcp
Add this to ~/.gemini/antigravity/mcp_config.json:
{
"mcpServers": {
"codesift": {
"command": "/Users/you/.npm-global/bin/codesift-mcp",
"args": []
}
}
}
codesift setup all
This configures Codex, Claude Code, Cursor, Gemini CLI, and Antigravity in one command. Safe to run multiple times — skips platforms that are already configured.
Semantic search uses embeddings to answer concept queries like "how does authentication work?" that keyword search misses.
Zero config — semantic search works out of the box. CodeSift defaults to local on-device embeddings (nomic-ai/nomic-embed-text-v1.5 via @huggingface/transformers v3, INT8 ONNX, ~140MB downloaded on first use, cached after). No API key, no internet after first run, no data leaves your machine. The provider applies the model's task-aware prefixes (search_document: / search_query:) automatically, so retrieval quality matches remote providers.
To opt into a remote provider for higher quality, set one of these:
To disable local embeddings entirely (BM25-only), set CODESIFT_DISABLE_LOCAL_EMBEDDINGS=true. To pin a different local model, set CODESIFT_LOCAL_MODEL=<owner>/<model> (e.g. Xenova/bge-small-en-v1.5).
# Pure semantic search
codesift retrieve local/my-project \
--queries '[{"type":"semantic","query":"error handling and retry logic","top_k":10}]'
# Hybrid search (semantic + BM25 text, RRF-merged)
codesift retrieve local/my-project \
--queries '[{"type":"hybrid","query":"caching strategy","top_k":10}]'
Semantic and hybrid queries exclude test files by default to maximize token efficiency. To include test files, set "exclude_tests": false in the sub-query or pass --exclude-tests=false on the CLI.
All configuration is via environment variables.
Each repo's index is a SQLite database (~/.codesift/<hash>.index.db) with normalized
files and symbols tables, using Node's built-in node:sqlite in WAL mode. There is no
native dependency to compile — npx codesift-mcp cannot fail on a build step.
Why it matters: the index used to be one JSON document per repo, so re-indexing a single
edited file re-parsed and re-serialised the whole thing (262 MB on our largest repo). The
codesift postindex-file hook runs as a fresh process per edit, so it could never amortise
that cost.
Measured on a 4,000-file / 32,000-symbol index:
The two regressions are deliberate: rebuilding symbol objects from rows costs more than one
large JSON.parse, and both affected operations are rare. Everything frequent gets cheaper.
Migration is automatic. An existing <hash>.index.json is imported on first access. The
JSON file is never deleted, so it stays available as a rollback target.
Backends. CODESIFT_INDEX_BACKEND=json pins the legacy format; =sqlite demands the new
one and fails loudly if unavailable; unset auto-detects. node:sqlite requires Node >=
22.5 — on older runtimes CodeSift transparently keeps using JSON, so the supported Node
floor stays at 20.
Storage faults are not "no index". A locked, corrupt, or permission-denied store raises a
distinct error instead of reading as an unindexed repo — otherwise tools answer "no results"
with full confidence over a database that is merely busy, and the obvious next step (rebuild)
is the wrong one. index_status reports it as unreadable: {code, message}; SQLITE_BUSY is
worth a retry, SQLITE_CORRUPT needs index_folder. A missing, empty, or malformed index is
still ordinary absence.
Design rationale and rejected alternatives: docs/adr/ADR-003-index-storage-format.md.
CodeSift sends anonymous, aggregate usage stats so the tool can be improved based on how it's actually used. It is opt-out and sends only the fields below — never your queries, file paths, repo/file/symbol names, code, hostname, username, or IP.
Exactly what is sent (allowlist): a random per-install id (not derived from your machine); bucketed environment (OS, arch, RAM bucket, cores, Node & CodeSift version, repo-size bucket, top-3 file extensions); and per-tool-per-day aggregates (call count, latency p50/p95/max, error rate, empty-result rate, cache-hit rate) plus response-hint emission counts.
If zuvo is also installed, anonymous per-skill rollups are included as well: which skill ran, its friction category, whether the audit/adversarial gates produced a verdict or were skipped, and median effort — as daily medians and counts, never sums, so total workload does not leak. A retro line's four identifying fields (project, branch, commit sha, free-text note) are never read at all — they are omitted from the field map rather than read and scrubbed, so anonymity survives a format change instead of depending on one. The key is absent entirely when no zuvo is installed, so "absent" and "ran but produced nothing" stay distinguishable. With no zuvo on the machine, nothing in this paragraph applies.
The allowlist is enforced in code — see src/storage/telemetry/sanitizer.ts — and the first-run notice is held to it by a test that fails if the payload can emit a dimension the notice does not name.
See the exact payload that would be sent from your machine:
codesift telemetry show
Opt out (any one of):
export CODESIFT_TELEMETRY=off # or the DO_NOT_TRACK=1 standard
codesift telemetry off # persists in ~/.codesift/config.json
full is opt-in only (sends full local usage entries incl. queries/paths — intended for your own fleet). Push only happens when CODESIFT_TELEMETRY_URL is configured.
Indexing -- Tree-sitter WASM grammars parse source files into ASTs. Symbol extraction produces functions, classes, methods, types, constants, etc. with signatures, docstrings, and source code. Filesystem mtime is stored per file for incremental skip on reindex.
BM25F search -- Symbols are tokenized (camelCase/snake_case splitting) and indexed with field-weighted BM25 scoring. Name matches rank 5x higher than body matches. Symbols in frequently-imported files get a log-scaled centrality bonus as tiebreaker.
Semantic search (optional) -- Source code is chunked and embedded via the configured provider. Queries are embedded at search time and ranked by cosine similarity. Multi-sub-query decomposition with Reciprocal Rank Fusion (RRF, k=60).
Hybrid search -- Combines semantic embedding similarity with BM25 text matches via RRF, getting the best of both keyword and concept search.
File watcher -- chokidar watches indexed folders for changes. Modified files are re-parsed and the index is updated incrementally.
Response guards -- Multiple layers prevent token waste: progressive cascade (>15K tok → compact, >25K → counts, >30K → truncate), response dedup cache (30s), in-flight request coalescing, H1-H9 sequential hints, and source truncation.
Agent onboarding -- MCP instructions field sends ~800 tokens of guidance (tool discovery, hints, ALWAYS/NEVER rules) to every client automatically. codesift setup installs full rules files per platform + Claude Code hooks for enforcement.
LSP bridge (optional) -- When a language server is installed (typescript-language-server, pylsp, gopls, rust-analyzer, kotlin-language-server, solargraph, intelephense), CodeSift uses it for type-safe find_references, precise go_to_definition, get_type_info via hover, and cross-file rename_symbol. Falls back to tree-sitter/grep when LSP is unavailable. Lazy start + 5 min idle kill — zero overhead when not used.
File pattern parameters (file_pattern) support full glob syntax via picomatch:
*.ts — match by extension at any depth*.{ts,tsx} — brace expansionsrc/**/*.service.ts — directory globbing[!.]*.ts — character classesservice — plain substring match (no glob chars)CodeSift auto-loads 6 React tools when a React project is detected (package.json with react + .tsx/.jsx files). Zero config.
react_quickstart
One call returns: component/hook counts, stack (state mgmt, routing, UI lib, form lib, build tool), critical pattern violations, top hooks used, and suggested next queries. Replaces 5+ manual exploration calls.
analyze_renders("MyComponent") # re-render risk for a specific component
trace_component_tree("App") # JSX composition hierarchy
analyze_hooks(component_name="Foo") # hook inventory + Rule of Hooks check
trace_call_chain("useAuth", filter_react_hooks=true) # hook dependency graph, stdlib filtered
find_references("UserContext") # where this context is consumed
analyze_context_graph # all createContext → Provider → useContext flows
review_diff # 10-check composite (React patterns auto-skipped on non-.tsx diffs)
changed_symbols(since="HEAD~3") # what changed structurally
search_patterns("hook-in-condition") # Rule of Hooks violations in changed files
impact_analysis(since="HEAD~3") # blast radius of your changes
audit_scan REACT gate + audit_compiler_readiness)audit_scan # includes REACT gate: hook-in-condition, useEffect-async,
# dangerously-set-html, index-as-key, nested-component-def
audit_compiler_readiness # React Compiler (v1.0) adoption score — flags bailout
# patterns before migration, counts redundant memo to remove
Set CI to fail on: any dangerously-set-html, any Rule of Hooks violation, any useEffect-missing-cleanup in new code.
TypeScript, JavaScript (JSX/TSX), Python, Go, Rust, Kotlin, Java, Ruby, PHP, Markdown, CSS, Prisma, Astro.
React/JSX/TSX has first-class support across 8 waves: component and hook SymbolKind values, JSX-aware call graph (all graph tools see <Component> usage as call edges), 43 React anti-patterns with engine-level comment/string preprocessing. Tier 8 (May 2026) added preprocess: "strip-comments-strings" declarative field on BUILTIN_PATTERNS entries — single-pass 7-state-machine source stripper at src/utils/source-stripper.ts strips comments, string/template/regex literals before regex match (closes the false-positive class where comment-embedded mentions spoofed detection). Tier 7 (May 2026) fixed 3 pre-existing CRITICAL bugs (useOptimistic lookahead trivial bypass, useEffect-setstate-loop array-arg false positive, react19-server-action-not-async missing arrow/default-export forms) and added cross-file findSuspenseAncestor + findLazyComponentsWithoutSuspense walkers reusing reverse JSX adjacency from Tier 5. Tier 6 (May 2026) — derived-state-reducer (useReducer sync action), derived-state-custom-setter (custom setter naming), stale-closure-toggle (setX(!X)), stale-closure-broken-functional (setX(prev => X+1) wrong reference), context-provider-value-via-variable (intermediate-var inline), context-provider-value-inline-destructured ({Provider} form), react-lazy-no-suspense-same-file (single-file heuristic), rsc-non-serializable-prop-deep (Map/Set/Class across RSC boundary), error-boundary-incomplete (partial lifecycle) + full severity migration on all 29 prior patterns; multiline hook-in-condition, bug-free nested-component-def, and Tier 5 (May 2026) patterns — derived-state (useState(props.X) + useEffect sync), stale-closure-setstate (setX(X+1) non-functional update), context-provider-value-inline (inline object/array forces consumer re-render), jsx-no-target-blank (tabnabbing security with postFilter validator), button-no-type (implicit submit foot-gun, lookahead-bounded for HTML only). trace_component_tree (BFS JSX composition tree), analyze_hooks (hook inventory + Rule of Hooks violation detection), analyze_renders (re-render risk + prop_chain_depth render-tree depth metric with explicit "NOT prop-drilling depth" disclaimer in suggestion text — semantic prop-flow tracking is Tier 6 scope), buildContextGraph (createContext → Provider → useContext consumer mapping), React complexity metrics, enriched get_context_bundle, filter_react_hooks option on trace_call_chain, audit_scan REACT gate, React-aware review_diff, generate_report React section, route entry point detection, shadcn/ui + Tailwind + form library detection, @/ alias resolution, RSC boundary detection, build tool detection (Vite, CRA, webpack, Parcel, esbuild, Rspack, Rsbuild, Turbopack), severity-aware react_quickstart bucketing into critical_issues / warnings / style_issues, and declarative postFilter field on BUILTIN_PATTERNS entries. Auto-loaded on React projects (package.json + .tsx files).
Astro has deep framework intelligence — the first and only static code intelligence for Astro in the MCP ecosystem. 4 dedicated tools: astro_analyze_islands (detect all client:*/server:defer directives, group by framework, track server islands), astro_hydration_audit (12 anti-pattern detectors AH01-AH12 with A/B/C/D scoring — catches client:load on Astro components, islands in loops, missing framework hints, below-fold eager hydration, and more), astro_route_map (file-based routing analysis with dynamic params, route conflicts, rendering mode per page, endpoint method detection), astro_config_analyze (tree-sitter AST walker for astro.config.mjs — extracts output mode, adapter, integrations, i18n, redirects with config_resolution honesty field). Also: 6 Astro anti-patterns in search_patterns, Astro-aware trace_route, analyze_project returns full astro_conventions, .astro extension normalization in import graph, framework detection for dead-code analysis, .mdx file indexing. Template parser (parseAstroTemplate) extracts islands, slots, component usages, and directives from HTML template section with balanced-brace tracking, conditional/loop detection, and landmark section awareness.
Kotlin support includes full tree-sitter parsing with a dedicated extractor for functions, classes (data/sealed/enum/abstract/annotation), interfaces, objects (singleton + companion), properties (val/var/const), type aliases, extension functions, suspend functions, generics, KDoc comments, and JUnit test detection (@Test, @BeforeEach, @AfterEach, @BeforeAll, @AfterAll). Route tracing supports Ktor DSL and Spring Boot Kotlin. Six Kotlin anti-patterns are built-in. | PHP/Yii2 support | src/parser/extractors/php.ts (+ PHPDoc @property/@method synthesis), src/tools/php-tools.ts (6 tools: resolve_php_namespace, trace_php_event, find_php_views, resolve_php_service, php_security_scan, php_project_audit), src/tools/project-tools.ts (Yii2Conventions), src/tools/route-tools.ts (findYii2Handlers, findLaravelHandlers), src/tools/pattern-tools.ts (8 PHP anti-patterns), src/tools/graph-tools.ts (PHP method call detection), src/utils/import-graph.ts (PHP require/include + PSR-4 cross-file edges via resolvePhpNamespace), src/utils/walk.ts (BACKUP_FILE_PATTERNS auto-exclusion), src/parser/parser-manager.ts (error recovery try/catch), src/lsp/lsp-servers.ts (Intelephense), scripts/download-wasm.ts ([email protected]) |
git clone https://github.com/greglas75/codesift.git
cd codesift-mcp
npm install
npm run download-wasm # Download tree-sitter WASM grammars
npm run build # TypeScript compilation
npm test # Run tests (Vitest, 2900+ tests)
npm run test:coverage # Coverage report
npm run lint # Type check (tsc --noEmit)
After making changes, follow these steps to publish to npm:
# 1. Ensure clean working tree
git status # No uncommitted changes
# 2. Build and verify
npm run build # Must succeed with 0 errors
npm test # Must pass (flaky ast-query tests may fail in full suite — OK if they pass individually)
# 3. Bump version (choose one)
npm version patch # 0.2.0 → 0.2.1 (bug fixes)
npm version minor # 0.2.0 → 0.3.0 (new features)
npm version major # 0.2.0 → 1.0.0 (breaking changes)
# This creates a git commit + tag automatically
# 4. Publish to npm
npm publish --ignore-scripts
# npm will open browser for WebAuthn/Keychain authentication
# Press Enter, confirm in browser, done
# 5. Push to GitHub (commit + tag)
git push && git push --tags
The files field in package.json controls what ships:
dist/ — compiled JavaScriptrules/ — platform-specific agent rules (codesift.md, codesift.mdc, codex.md, gemini.md)src/parser/languages/ — tree-sitter WASM grammarsREADME.md, LICENSEUsers update with:
npm update -g codesift-mcp # Update package
codesift setup all # Update rules files to latest version
codesift setup all rewrites old npx / dist/server.js MCP entries to the
current absolute codesift-mcp bin path.
npm run build — 0 TypeScript errorsnpm test — 2900+ tests passrules/codesift.md updated if hints or tools changedsrc/instructions.ts updated if rules changed (compact version)README.md updated if features addedCLAUDE.md updated if architecture changednpm versionBSL-1.1
Each editor session (Claude Code/Cursor/Codex window) can spawn its own
stdio codesift server process, and each loads per-repo embeddings into its own
RAM. On big repos (GB-scale embedding files) several windows can exhaust memory on
smaller machines. Controls:
# Prefer one shared daemon for many editor windows.
codesift serve
codesift setup all --http
# Clean up stale helper MCP processes left by closed sessions.
codesift cleanup-processes
codesift cleanup-processes --dry-run
Set these in the env block of your MCP client config (e.g.
mcpServers.codesift.env). The shared HTTP daemon (codesift serve) loads
embeddings once for all windows and avoids per-session duplication.
MCP server for code intelligence — 146 tools for symbol search, call graph, semantic search, route tracing, community detection, LSP bridge, secret detection, conversation search, and Hono framework i
{ "mcpServers": { "codesift-mcp": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}Overview
MCP server for code intelligence — 146 tools for symbol search, call graph, semantic search, route tracing, community detection, LSP bridge, secret detection, conversation search, and Hono framework intelligence
Tools
No tool list yet. Remote servers get one after the first health check.
FAQ
Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.
No required environment variable is listed on this record.
Codesift runs locally over stdio.
Last checked 2026-11-14. MCP server for code intelligence — 146 tools for symbol search, call graph, semantic search, route tracing, community detection, LSP bridge, secret detection, conversation search, and Hono framework intelligence