Skip to content
plugmcp
DirectorySkillsCategoriesBlog
EN/δΈ­ζ–‡
Sign inSign up
Home/Servers/Arbor

Arbor

I
by io.github.Anandb71

The Graph-Native Intelligence Layer for Code.

Power your agent

Add this server

Install from the publisher. Not a PlugMCP endpoint.

No packaged release in the registry yet. Follow the repository README.

Provider
Step-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Related MCP

View more
  • FirecrawlπŸ”₯ Official Firecrawl MCP Server - Adds powerful web scraping and search to Cursor, Claude and any other LLM clients.
  • N
    NotionToken-auth Notion MCP: pages, databases, blocks, comments, files. Runs headless in CI and agents.
  • Context7Context7 Platform -- Up-to-date code documentation for LLMs and AI code editors

Related skills

View all
  • arborApplies Arbor Hypothesis Tree Refinement to research artifacts with repeatable evaluators, including model training, agent harnesses, data synthesis and benchmark optimization. Uses persistent hypothe
  • arboretoInfers candidate gene regulatory networks from bulk or single-cell expression data using AertsLab Arboreto GRNBoost2 and GENIE3. Use for transcription factor-target association ranking, compatible Das

The Graph-Native Intelligence Layer for Code.

v3.0.5 Β· Tests in TypeScript and JavaScript count: calls inside describe/it/test callbacks now belong to the test, so arbor callers, diff and check see Jest, Vitest and Mocha tests. MCP tool output uses project-relative paths. Release notes


Why Arbor

Most AI coding tools treat code as text. Arbor builds a semantic dependency graph β€” functions, classes, and modules as nodes; calls, imports, and inheritance as edges β€” then answers execution-aware questions with deterministic precision:

QuestionArbor answer
If I change this symbol, what breaks?Blast radius with depth, confidence, and risk level
Who calls this β€” directly and transitively?Caller/callee traversal on the call graph
What's the shortest path between A and B?A* path through real dependencies
Is this PR too risky to merge?CI gate on blast-radius thresholds

No keyword guessing. No embedding hallucinations. One graph, every interface.

Where the graph is unsure, it says so β€” edges carry a confidence, and ambiguous resolutions are labelled rather than hidden. An honest unknown beats a confident wrong answer.


What's new in v3.0.5

A fix release: tests written in TypeScript and JavaScript now count.

FixWhat was wrong
Jest, Vitest and Mocha tests are callersCalls inside describe/it/test callbacks belonged to no symbol, so arbor callers missed every test and diff/check reported that nothing tested a change. Each test and hook is now a function named after it, such as it: accepts two, that owns the calls in its callback. On the repro in #235, arbor callers decide went from 2 callers to 4.
Project-relative MCP pathsTool output could include absolute paths from your machine. Every file path is now relative to the project, and the namespaced io.modelcontextprotocol/protocolVersion request key is read first.

Cached graphs rebuild once on first use (extract-4). See the 3.0.4 release notes for the previous release.

A fix release. Every item below was a wrong answer, not a missing feature, and each ships with a regression test.

FixWhat was wrong
Rust calls resolvecrate::jobs::enqueue(), Type::new(), self.helper() and calls inside assert!/format! produced no edge, so heavily used Rust functions reported no callers. Paths now resolve through the module tree, and macro arguments are read as code.
Per-symbol arbor diffEvery symbol in a touched file counted as changed, so adding a function to a busy file reported that file's whole blast radius. New symbols now carry none; only modified ones do. Tests that call the change are listed as worth running, not counted as impact.
--base and --stagedarbor diff, check and summary saw only uncommitted edits unless ARBOR_DIFF_BASE was set. --base origin/main compares against the merge base, which is what a pull request shows; --staged checks just what is staged.
Languages stay apartA TypeScript enqueue could be reported as a caller of a Rust enqueue. Resolution stays within a language family, and callers/callees list each same-named definition separately.
No stale graphsAfter a branch switch, answers came from the old branch's graph when no remaining file was newer than it. The graph now records the commit it was built from and refreshes when HEAD moves.
Inheritance edgesclass Middle(Base) produced no edge, so changing a base class showed zero blast radius. extends/implements edges are emitted and inherited methods stay reachable.
Call cycles rank as oneA closed ring of functions filled the top of every centrality ranking. Cycles are condensed before PageRank.
HTTP bridge hardeningarbor bridge --http accepted cross-origin and DNS-rebinding requests. It now checks Origin/Host and requires JSON bodies.
Quieter bridgeThe bridge re-indexed ignored build directories in a busy loop.

Also new: arbor receipt. After each coding-agent turn it explains, in plain English, what changed and what was touched that you didn't ask for, with arbor receipt undo to put a turn back.

Cached graphs from 3.0.0 are rebuilt automatically on first use.

One fix, measured.

Symbol resolution consults the importing file. When a bare name matched definitions in several modules, resolve_ref fell through to SameDir and attached the edge to whichever definition sat in the caller's own directory β€” not a dropped edge, a confidently misrouted one, stamped at 0.55 confidence.

GraphBuilder already kept a per-file import map, but only apply_import_validation read it, and that scores an edge after one has been chosen. It never saw the references going to the wrong node. Consulting it between the same-file and same-directory checks keeps a local definition shadowing an import, while letting a written import beat mere adjacency. Resolution::ViaImport scores 0.93, above SameDir's 0.55.

Measured

A fixture of 260 modules across 10 layers, each layer defining the same 26 function names. Ground truth is derived from the generator's own edge list, so the expected answer is exact rather than estimated.

True downstreamv2.6.0v3.0.0
1790163
1780161
1610133
14322133
12222119
362261
162246

Previously flat at about 22 regardless of the real answer. Now it tracks. Risk on the largest hub moves from LOW to CRITICAL.

Total edge count barely moves (1335 β†’ 1334). That is the signature of misrouting rather than loss: the edges were always there, pointing at the wrong nodes.

Breaking

  • Resolution gains a ViaImport variant β€” an exhaustive match will not compile
  • Edges land on different nodes, so cached graphs, stored node ids, and centrality baselines from 2.6.0 will differ

Call cycles are condensed before PageRank. Each strongly connected component is ranked once and that mass is shared across its members, so a closed ring does not fill the top of the ranking and a cycle that calls out keeps its members together. The number CentralityScores reports is still the v2.6.0 percentile, i / (n - 1).

Known and still open

Written down rather than left to be discovered:

  • Small targets now over-report (36 β†’ 61, 16 β†’ 46). Safer direction than silence, but not yet correct.
  • Dynamic and reflective imports (importlib, __import__, import(), eval(require(...))) are unresolvable by construction and are documented as expected misses in the fixture rather than counted as defects.

Correctness, not speed. Each of these was silently wrong before.

FixWhy it mattered
Colliding symbols are keptSymbolTable used HashMap::insert, so a second handler, new, or process replaced the first. The loser had zero callers and was invisible to blast radius.
Resolution is deterministicSame-directory locality was decided by iterating a HashMap. Rust seeds RandomState per process, so the same binary on the same input could build different edges between runs. Now asserted across eight fresh processes.
Edges carry confidenceA proven same-file call and a same-directory guess were identical evidence. Each edge now scores [0,1] by how it resolved.
Exported TS symbols indexed onceexport_statement recursed into its children, then the generic loop recursed again β€” every exported symbol became two vertices sharing one node id. 133 phantom nodes on a 149-file app, 25% of the graph.
Method calls on untyped receivers resolveobj.method() was dropped outright, leaving the graph nearly edgeless on TS/JS β€” and an empty graph reports a blast radius of zero, which reads as "safe" rather than "unknown".
Centrality is a percentile rankScores were divided by the graph maximum, so the top node was 1.0 by construction and a 0.6 threshold meant nothing consistent between repos. Adding one hub rescaled every other node.
Resolution is O(1), not O(refs Γ— nodes Γ— files)Unresolvable references β€” stdlib and third-party calls, most call sites in real code β€” paid the worst case. Suffixes are now indexed.

New capability β€” concept search. Substring matching cannot find get_authenticated from login; they share no substring. Identifiers are now tokenized and expanded through curated concept clusters, and docstrings, signatures, and paths are indexed alongside names. Deterministic, offline, no model. Available on the library as ArborGraph::search_ranked (arbor query remains literal-substring for now).

New capability β€” hunk-level impact. changed_node_ids_for_ranges keeps only symbols whose lines actually changed, instead of every symbol in a touched file.

Measured on identical node sets, after the duplicate-extraction fix:

CodebaseBeforeAfter
TypeScript (149 files)172 edges196 (+14%)
Rust (arbor-graph)116 edges167 (+44%)

Graph caches from earlier versions are invalidated β€” centrality now means something different, so a stale cache would be read wrong.

ChangeMeasured
PageRank rewrite β€” flat call-graph adjacency replaces per-iteration traversal149.8ms β†’ 6.6ms on a 10k-node graph (23x), verified side-by-side vs the old implementation
Parallel indexing β€” parse fans out across all cores, deterministic assemblyArbor: 253ms β†’ 95ms Β· tokio (178k LOC): 2.7s β†’ 1.6s
Warm-start centrality β€” watcher recomputes seed from previous scoresConverges in ~2 rounds after a one-file patch instead of the full 20-iteration budget
Convergence early-exitIteration stops at 1e-9 max delta β€” the budget is a ceiling, not a sentence

Think a number is wrong? cargo bench -p arbor-graph and prove it: BENCHMARKS.md.

FeatureWhat it does
MCP 2026-07-28Stateless server/discover, response caching (ttlMs/cacheScope), dual-version fallback for 2025-03-26 clients
Tasks extensiontasks/get Β· tasks/update Β· tasks/cancel β€” cold-start indexing returns task handles, not errors
MCP AppsInteractive blast-radius graph (ui://arbor/blast-radius) and architecture map (ui://arbor/architecture-map) inside agent hosts
HTTP transportarbor bridge --http --port 3333 β€” stateless MCP behind load balancers
Real get_blast_radiusGit-diff-aware impact analysis via shared arbor-graph::compute_blast_radius
Paginationoffset / limit / hasMore on search_symbols and get_map
BenchmarksCriterion suite + CI regression gate β€” see BENCHMARKS.md

Quickstart

# Install (crates.io can lag the latest release: see docs/INSTALL.md)
cargo install arbor-graph-cli

# Index your project (one command)
cd your-project && arbor setup

# Explore before you edit
arbor map . --exclude-test          # ranked project skeleton (~1k tokens)
arbor refactor parse_file           # blast radius of changing a symbol
arbor diff                          # impact of uncommitted git changes
arbor diff --base origin/main       # impact of this branch, as its PR shows it

# Wire up your AI agent
claude mcp add --transport stdio --scope project arbor -- arbor bridge

After every turn: arbor hook claude makes Claude Code show a receipt of what it changed, what it touched that you didn't ask for, and what to test. Receipts β†’

Agent workflow: call get_map first β†’ search_symbols / get_file_graph to locate code β†’ Read only the target file. Full MCP guide β†’


For AI agents (MCP)

Arbor ships a production MCP server via arbor bridge. Stdio is the default; HTTP is opt-in for remote/enterprise.

# Stdio (Claude, Cursor, VS Code)
arbor bridge

# HTTP (MCP 2026-07-28)
arbor bridge --http --port 3333

Cursor / VS Code

{
  "mcpServers": {
    "arbor": {
      "type": "stdio",
      "command": "arbor",
      "args": ["bridge"]
    }
  }
}

Templates: templates/mcp/ Β· Setup scripts: scripts/setup-mcp.sh Β· scripts/setup-mcp.ps1

16 MCP tools

TierToolsUse when
Orientationget_mapFirst call β€” token-budgeted project skeleton ranked by PageRank
Surgicallist_entry_points Β· get_callers Β· get_callees Β· search_symbols Β· get_file_graph Β· get_node_detailNavigate to a specific symbol or file
Broadget_logic_path Β· analyze_impact Β· find_path Β· get_knowledge_pathTrace dependencies, blast radius, paths
Agent-nativeget_blast_radius Β· explain_symbol Β· audit_security Β· get_architecture_overview Β· batch_queryPR impact, onboarding, security audit, bulk lookup

Every tool returns { ok, tool, data, meta: { suggested_next_tool, suggested_next_args } } so agents chain calls without re-prompting.

Registry: io.github.Anandb71/arbor Β· Official API lookup Β· Glama listing


CLI reference

CommandDescription
arbor setupOne-shot init + index
arbor mapRanked, token-budgeted project skeleton
arbor query <term>Fuzzy symbol search (supports | OR)
arbor callers / callees <sym>One-hop graph traversal. Same-named symbols are listed per definition; narrow with jobs::enqueue, Type.method or src/jobs.rs:enqueue
arbor entry-pointsHTTP handlers, main, jobs, webhooks
arbor file-graph <path>Symbols + edges in one file
arbor inspect <sym>Full symbol detail
arbor path <a> <b>Shortest call-graph path
arbor refactor <sym>Blast radius before refactoring
arbor diffGit-change impact report, per symbol: new symbols carry no blast radius. --base <ref> compares against the merge base (what a PR shows), --staged only staged changes
arbor checkCI safety gate (--max-blast-radius N, --base <ref>)
arbor summaryAuto-generate PR description (--base <ref>)
arbor agent reviewAutonomous PR architecture review
arbor agent onboardCodebase onboarding guide
arbor agent guardReal-time architectural safety gate
arbor bridgeMCP server (add --http for HTTP transport)
arbor watchLive re-index on file changes
arbor receipt list / show / undoPlain-English receipts of what each agent turn changed, and undo for a turn (guide)
arbor hook claudeWire Arbor into Claude Code: directives, receipts after every turn
arbor guiNative desktop UI

All query commands support --json. map additionally supports --tokens N, --focus "pattern", --focus-changed.


Visual tour


Installation

# macOS / Linux: prebuilt binary from the latest GitHub release
curl -fsSL https://raw.githubusercontent.com/Anandb71/arbor/main/scripts/install.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/Anandb71/arbor/main/scripts/install.ps1 | iex

# Scoop (Windows)
scoop install https://raw.githubusercontent.com/Anandb71/arbor/main/packaging/scoop/arbor.json

# Rust / Cargo (crates.io can lag the latest release)
cargo install arbor-graph-cli

# npm wrapper (cross-platform)
npx @anandb71/arbor-cli

# Docker
docker pull ghcr.io/anandb71/arbor:latest

Pinned installs: docs/INSTALL.md


Language support

Production parsers: Rust Β· TypeScript / JavaScript Β· Python Β· Go Β· Java Β· C / C++ Β· C# Β· Dart

Fallback parsers: Kotlin Β· Swift Β· Ruby Β· PHP Β· Shell

Adding languages β†’


CI & pull requests

arbor diff --markdown
arbor check --max-blast-radius 30 --markdown
arbor summary

GitHub Action (pre-built binary, ~5s vs ~3–5min compile):

name: Arbor Check
on: [pull_request]

jobs:
  arbor:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: Anandb71/[email protected]
        with:
          command: check . --max-blast-radius 30 --markdown
          comment-on-pr: true
          github-token: ${{ secrets.GITHUB_TOKEN }}

Architecture

arbor-core (Tree-sitter parsing)
    └── arbor-graph (petgraph + PageRank + impact analysis)
            β”œβ”€β”€ arbor-cli      β€” CLI + MCP bridge
            β”œβ”€β”€ arbor-mcp      β€” MCP protocol server
            β”œβ”€β”€ arbor-server   β€” WebSocket JSON-RPC
            β”œβ”€β”€ arbor-watcher  β€” incremental file watcher
            └── arbor-gui      β€” desktop UI

Docs: Quickstart Β· Architecture Β· Graph schema Β· MCP integration Β· Receipts Β· Benchmarks Β· Roadmap Β· Philosophy

Release channels: GitHub Releases Β· crates.io Β· GHCR Β· npm Β· VS Code / Open VSX Β· Scoop β€” Releasing guide


Philosophy

  1. Consumer first β€” beautiful, intuitive, instantly useful
  2. Accessibility second β€” works across ecosystems, runs anywhere
  3. Affordability next β€” minimal overhead, from laptops to monoliths

Arbor is local-first: no mandatory data exfiltration, offline-capable, open source. Security policy β†’


Contributing

cargo build --workspace
cargo test --workspace
cargo clippy --workspace --all-targets --all-features

CONTRIBUTING.md Β· Good first issues Β· Code of conduct


Contributors


License

MIT β€” see LICENSE.

How do I install Arbor?
Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.
Does Arbor need an API key?
No required environment variable is listed on this record.
What transport does Arbor use?
Arbor runs locally over stdio.
When was Arbor last checked?
Last checked 2026-10-16. The Graph-Native Intelligence Layer for Code.

No tool list yet. Remote servers get one after the first health check.

plugmcp

Plug any tool into any agent. MCP servers for people who do not write servers. Gateway for volume, n8n for apps.

  • github.com/TODO
  • x.com/TODO
  • linkedin.com/company/TODO

PlugMCP, 2026

Product
  • Browse
  • Install
  • Host your own
  • Voice mode
  • Browser
Directory
  • All MCP servers
  • Agent skills
  • Categories
  • New
  • Voice
  • Submit a server
Developers
  • Docs
  • Blog
  • What is MCP
  • What is WebMCP
  • Status
Company
  • About
  • Contact
  • Terms
  • Privacy
  • DPA