Code-Graph-RAG
The ultimate RAG for your monorepo. Query, understand, and edit multi-language codebases with the power of AI and knowledge graphs
Is Code-Graph-RAG safe? Promising trust profile, but some evidence still deserves review.
Compare Code-Graph-RAG
How does it stack up against its Memory & Knowledge neighbours?
Pick any agent to compare →In detail: Code-Graph-RAG scores 71.4/100 (Grade B), ranked #304 of 1325 tracked open-source AI agent projects, on evidence coverage C (2 of 5 independent signal types). The public evidence: no package-provenance attestation found; OSSF Scorecard rates its supply-chain practices 8.7/10; 65% of recent commits are signed; last pushed 2026-09-26. Every point is earned from checkable signals — never paid placement. How scoring works →
How Code-Graph-RAG compares in Memory & Knowledge
- #19 RAGFlow 72.0 +0.6
- #20 Tidb 71.5 +0.1
- #21 Code-Graph-RAG 71.4 this agent
- #22 txtai 70.9 −0.5
- #23 Vellum Assistant 69.6 −1.8
Bars show each HVTrust score; the tick marks Code-Graph-RAG’s 71.4.
Where the 71.4 comes from
HVTrust dimensions vs the Memory & Knowledge average
71.4 / 100 · 100.0% confidenceCode-Graph-RAG Memory & Knowledge average (44 agents)
Quick Trust Read
How to read this: HVTrust (0–100) weighs supply-chain signals (provenance, OSSF Scorecard, signed commits, open license) alongside real-world adoption. Grade B reflects the trust score band: A ≥ 80, B ≥ 65, C ≥ 50, D < 50. Evidence coverage C is separate — it grades how many independent signal types back the score (2 of 5), so a high score on thin evidence stays visible. Full methodology →
Rank Trend
Activity & Reach
Analysis
Activity Inputs
85.5 / 100Supply Chain Trust
Common questions about Code-Graph-RAG
Does Code-Graph-RAG publish package provenance?
Does Code-Graph-RAG have an OpenSSF Scorecard?
Is Code-Graph-RAG actively maintained?
What license does Code-Graph-RAG use?
Are Code-Graph-RAG's commits signed?
Not a safety endorsement. HVTracker describes what public signals show, not whether a project is safe for your use case. Run your own security review before adopting in production.
AI agent surface
MCP, providers, tool surface
These runtime-trust fields — detected from public repo docs and manifests — contribute a bounded adjustment to this project's HVTrust score alongside supply-chain evidence. The exact values each field can add or subtract are documented in the methodology → Compare this surface across every listed agent in the capability matrix →
- database
- MCP signal live
- External deps live
- Tool / plugin surface live
- Package provenance drift live
Detected changes to Code-Graph-RAG's runtime surface and supply-chain posture, from daily public-signal snapshots. A change here means our detectors see something different — a genuinely changed capability, or better evidence of an existing one.
Maintain Code-Graph-RAG?
For maintainers
HVTrust scores Code-Graph-RAG from public signals only — we never contact maintainers first. If a signal is wrong, stale, or missing (provenance you publish, a Scorecard you run, signed releases), tell us and we'll review it. Corrections are public and tracked on GitHub.
Reputation Timeline
Signal history
Embed Badge Badge guide for maintainers →
For maintainers
[](https://hvtracker.net/agents/code-graph-rag)
<a href="https://hvtracker.net/agents/code-graph-rag"><img src="https://hvtracker.net/badge/code-graph-rag.svg" alt="HVTrust"></a>
Other agents in Memory & Knowledge
GitHub REST API (repo, commits, stars, forks, license) · OpenSSF Scorecard CLI
Each agent's signals refresh once daily across 6 staggered batches. Methodology v4.3 · Raw JSON