# socraticode SocratiCode — MCP server for local codebase indexing, semantic search, and code dependency graphs. All private, all local via Docker. - **Type:** MCP server - **Trust:** 60/100 (B), scored on the package rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 1.13.3 - **Author:** Giancarlo Erra - **License:** AGPL-3.0-only - **npm:** socraticode - **Source:** https://github.com/giancarloerra/socraticode - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 60/100 (B), scored on the package rubric - Publisher verified: no - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 1 day ## Security scan - **Status:** clean - **Scanned:** 2026-09-11T09:37:25.818Z - **Version scanned:** 1.13.3 - **CVEs:** none found by OSV at scan time ## Tools 25 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `codebase_index` — Start indexing a codebase in the background. Returns immediately. Call codebase_status to poll progress until 100%. Do NOT search until indexing is complete. If - `codebase_update` — Incrementally update an existing codebase index. Only re-indexes changed files. Runs synchronously. Use it to refresh a manual/off snapshot, or whenever an imme - `codebase_remove` — Remove a project's codebase index entirely from the vector database. Safely stops the file watcher, cancels any in-progress indexing/update (with drain), and wa - `codebase_stop` — Gracefully stop an in-progress indexing operation. The current batch will finish and checkpoint, preserving all progress. Re-run codebase_index to resume from w - `codebase_watch` — Start/stop watching a project directory for file changes and automatically update the index. When starting, first runs an incremental update to catch up, then w - `codebase_search` — Semantic search across an indexed codebase. Only use after codebase_index is complete (check codebase_status first). Returns relevant code chunks matching a nat - `codebase_status` — Check index status: chunk count, indexing progress (%), last completed operation, file watcher state. Call after codebase_index to poll until 100% complete. - `codebase_graph_build` — Build a dependency graph of the codebase using static analysis (ast-grep). Maps import/require/export relationships between files. Runs in the background — call - `codebase_graph_query` — Query the code dependency graph for a specific file. Returns what the file imports and what files depend on it. - `codebase_graph_stats` — Get statistics about the code dependency graph: total files, edges, most connected files, orphan files, circular dependencies. - `codebase_graph_circular` — Find circular dependencies in the codebase. - `codebase_graph_visualize` - `codebase_graph_remove` — Remove a project's persisted code graph. Waits for any in-flight graph build to finish first. The graph can be rebuilt with codebase_graph_build or will be rebu - `codebase_graph_status` — Check the status of the code dependency graph: build progress (if building), node/edge count, when it was last built, whether it's cached in memory. Use this to - `codebase_impact` — Impact Analysis — return the BLAST RADIUS for a file or symbol. Lists every file (and, where helpful, function) that could break if you change the target. Polym - `codebase_flow` — Trace the EXECUTION FLOW forward from an entry point — what does this code call into? With NO args, returns a ranked list of auto-detected entry points (orphans - `codebase_symbol` — 360° view of a symbol: definition, kind, callers, callees, confidence levels. Use to understand a function or class before changing it. - `codebase_symbols` — List symbols in a file, or search by name across the project. Use to discover what exists before drilling into a single symbol with codebase_symbol. - `codebase_context` — List all context artifacts defined in .socraticodecontextartifacts.json — database schemas, API specs, infra configs, architecture docs, etc. Shows each artifac - `codebase_context_search` — Semantic search across context artifacts (database schemas, API specs, infra configs, etc.) defined in .socraticodecontextartifacts.json. Auto-indexes on first - `codebase_context_index` — Index or re-index all context artifacts defined in .socraticodecontextartifacts.json. Chunks and embeds artifact content into the vector database for semantic s - `codebase_context_remove` — Remove all indexed context artifacts for a project from the vector database. Blocked while indexing is in progress — use codebase_stop or wait for the operation - `codebase_health` — Check the health of all infrastructure: Docker, Qdrant container, Ollama, and embedding model. Use this to diagnose setup issues. - `codebase_list_projects` — List all projects that have been indexed (have collections in Qdrant). - `codebase_about` — Display information about SocratiCode — what it is, its tools and how to use it. Use this to get a quick overview of the MCP tools and their purpose. ## Install **Verdict: review** — Installable, but 1 thing to check first: No publisher has proved control of this listing; it is indexed, not vouched for. **Cautions** (coverage gaps and advisories — never blocking) - No publisher has proved control of this listing; it is indexed, not vouched for. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"socraticode\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"socraticode\"\n ],\n \"env\": {\n \"OPENAI_API_KEY\": \"\",\n \"GOOGLE_API_KEY\": \"\",\n \"OLLAMA_API_KEY\": \"\",\n \"LMSTUDIO_API_KEY\": \"\",\n \"LITELLM_API_KEY\": \"\",\n \"QDRANT_API_KEY\": \"\"\n }\n }\n }\n}" ``` **Credentials it will ask for** (names only — Forge never holds a value): - `OPENAI_API_KEY` — OpenAI API Key (optional) - `GOOGLE_API_KEY` — Google API Key (optional) - `OLLAMA_API_KEY` — Ollama API Key (optional) - `LMSTUDIO_API_KEY` — Lmstudio API Key (optional) - `LITELLM_API_KEY` — Litellm API Key (optional) - `QDRANT_API_KEY` — Qdrant API Key (optional) Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one. - This entry needs 6 credentials (0 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset. ## Blast radius Extensive blast radius — deletes data; holds an api key. - Floor 57, ceiling 57 (tier: extensive) - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/socraticode - Install plan: https://forgeregistry.com/api/v1/packages/socraticode/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/socraticode - HTML page: https://forgeregistry.com/registry/socraticode - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.