GraphKeeper

- Everygitandgraphifyinvocation uses an argv array passed directly to the OS (spawnSyncin TypeScript,subprocess.runwith a list in Python), never a shell string, so commit messages, file names, or repo paths can't be interpreted as shell syntax.
- .graphkeeper/output paths are checked against the resolved repo root before every write (symlinks included, viafs.realpathSync), so a maliciously crafted repo can't redirect GraphKeeper's writes outside.graphkeeper/.
- No telemetry, no network calls, no secrets. The only files GraphKeeper reads aregit logoutput and, optionally, graphify's owngraph.json; the only file it writes is.graphkeeper/graph.json.

Is GraphKeeper a general codebase knowledge-graph indexer?

Not on its own.graphkeeper buildminesgit logfor file-level co-change and writes those edges to.graphkeeper/graph.json. That file only becomes a symbol/call graph too if graphify is installed and gets merged in during the same build. Without graphify onPATH, the store holds co-change data only, andgraphkeeper query callssays so directly instead of returning an empty result.

What does GraphKeeper actually give an agent that grep or git log don't?

A pre-computed, queryable answer to "which files change together here," so an agent doesn't have to run its owngit log --name-onlyscan and tally the results by hand on every question.--jsonon every command makes that answer script-consumable rather than something a human has to read and re-type.

How do I install it, and does it work on Windows?

npm install -g graphkeeper-cli(Node.js 18+) orpip install graphkeeper-cli(Python 3.9+); both needgitonPATH. Neither package contains OS-specific branches or native bindings, and the PyPI listing is classifiedOperating System :: OS Independent, so it runs the same way on Windows, macOS, and Linux anywhere git and a supported Node or Python runtime are available.

How is this different from graphify, the tool it links to for enrichment?

They answer different questions. graphify extracts symbols, imports, and call graphs straight from source via tree-sitter, across 36 languages; GraphKeeper mines commit history for which files were historically edited together, a signal graphify has no reason to compute. GraphKeeper shells out to graphify's own localextractcommand when it's present and merges the result in, rather than reimplementing tree-sitter parsing from scratch. Neither replaces the other; see the Comparison table above for how GitNexus, Greptile, and Augment Code differ from both.

What actually breaks GraphKeeper, or gives an empty result?

Two real cases, both documented, neither a crash: a shallow git clone (GitHub Actions' defaultfetch-depth: 1) has no history to mine, sobuildreports0 commit(s) analyzedand writes an empty co-change graph; full history (fetch-depth: 0) is required. Separately,query callsonly returns results if the most recentbuildran with graphify onPATH; if it didn't, the command explains that plainly (graphify was not found on PATH...) instead of pretending the symbol doesn't exist.

Is it safe to run against a repo I don't fully trust?

Everygitandgraphifycall goes through an argv array straight to the OS (spawnSync/ Python'ssubprocess.runwith a list, never a shell string), so filenames or commit messages can't be interpreted as shell syntax. Every.graphkeeper/write is checked against the resolved repo root, symlinks included, before it happens. There are no network calls anywhere in the tool, so nothing about the repo you point it at leaves your machine.

Is the npm CLI just a wrapper around the Python one, or vice versa?

Neither. They're two independent, from-scratch implementations (src/for TypeScript,python/src/graphkeeper/for Python) that happen to agree on the same.graphkeeper/graph.jsonschema, the same subcommands, flags, and exit codes. A store built by one can be read by the other. The Python port's own test suite (ported from the TypeScript vitest suite) is 78 tests, run against a real subprocess CLI invocation, not a mock of the other language's output. Both suites pass in a clean install as of this writing: 78/78 on the TypeScript side (npm test), 78/78 on the Python side (pytest).

What license is this under, and can I use it commercially?

Issues and PRs welcome. To build the TypeScript package from source:

git clone https://github.com/RudrenduPaul/GraphKeeper.git cd GraphKeeper npm install npm run build npm test npm run lint npm run typecheck

Neo4j graph database server (schema + read/write-cypher) and separate graph database backed memory

Remote MCP for commodities research — knowledge graph, COT positioning, natural gas storage/weather, futures quotes, and private stories/journals. Requires Arc Research Starter + bearer token.

A task management system for LLM agents to manage projects, tasks, and knowledge using a Neo4j database for complex workflow automation.

Cross-language code graph extraction and visualization — symbols, call graphs, and cross-repo relationships across 34+ languages with incremental caching and federation support.

MCP server for live NFL and fantasy football data, powered by gamedai Scout: player grades, start/sit calls, and a grounded football knowledge graph.

Query a hybrid graph (Neo4j) and vector (Qdrant) database for powerful semantic and graph-based document retrieval.

A knowledge graph-driven persistent memory layer for coding agents and LLM workflows.

Connects to Neo4j graph databases with ability to use GDS functions ( when available), a read only mode , and set the sample size for schema detection