Is Code-Graph-RAG safe to use?

Code-Graph-RAG has an HVTrust score of 68.3/100 (Grade B), ranked #164 of 1283 tracked AI agent projects. This score reflects verifiable supply-chain integrity, transparency, maintenance, and adoption signals.

What is the trust score for Code-Graph-RAG?

Code-Graph-RAG scores 68.3/100 on HVTracker's evidence-weighted HVTrust scale. It has 3.9k GitHub stars and is categorized under Memory & Knowledge.

Code-Graph-RAG

vitali87/code-graph-rag

The ultimate RAG for your monorepo. Query, understand, and edit multi-language codebases with the power of AI and knowle

Memory & Knowledge Python Grade B Listed MIT

68.3/100

Rank #164 of 1283

Compare Code-Graph-RAG

How does it stack up against its Memory & Knowledge neighbours?

Pick any agent to compare →

Promising trust profile, but some evidence still deserves review.

Open compare tool Suggest correction

Listing state

Listed

Evidence coverage

Grade C · 2/5 signals

Last push

2026-08-11 · 1d ago

Recent change

New

Is Code-Graph-RAG safe? Code-Graph-RAG scores 68.3/100 (Grade B), ranked #164 of 1283 tracked open-source AI agent projects, on evidence coverage C (2 of 5 independent signal types). The public evidence: no package-provenance attestation found; OSSF Scorecard rates its supply-chain practices 8.5/10; 26% of recent commits are signed; last pushed 2026-08-11. Every point is earned from checkable signals — never paid placement. How scoring works →

Ranked neighbours in Memory & Knowledge

#18 Vellum Assistant — 68.6 (B) → #19 Khoj — 68.5 (B) → #21 agentmemory — 66.9 (B) → #22 Zvec — 64.5 (C) →

Quick Trust Read

What Would Improve It

Publish package provenance or release attestations for stronger supply-chain evidence.

Recent Changes

2026-08-10

Newly Listed

First tracked at rank #166

Maintainer Checklist

Publish provenance Add package provenance or release attestations so users can verify where shipped artifacts came from.

Increase signed commits Raise the share of verified-signed commits to make maintainer identity and release history easier to trust.

Compare with another agent Get email alerts for Code-Graph-RAG View Memory & Knowledge Report missing data

84.3

Activity sub-score · out of 100

#20

In Memory & Knowledge

How to read this: HVTrust (0–100) weighs supply-chain signals (provenance, OSSF Scorecard, signed commits, open license) alongside real-world adoption. Grade B reflects the trust score band: A ≥ 80, B ≥ 65, C ≥ 50, D < 50. Evidence coverage C is separate — it grades how many independent signal types back the score (2 of 5), so a high score on thin evidence stays visible. Full methodology →

Rank Trend

2026-08-11 2026-08-12

Activity & Reach

Stars

3.9k

Forks

566

Last Push

2026-08-11

yesterday

Commits (4 wk)

1984

Downloads (7d)

—

HN mentions (30d)

—

Open Issues

Rank Change

was #164

Analysis

HVTrust Dimensions vs Memory & Knowledge

68.3 / 100 · 100.0% confidence

Code-Graph-RAG Memory & Knowledge average (42 agents)

Safety / Integrity50% OSSF Scorecard · 30% provenance · 20% signed commits

11.9 / 25

1.8 above avg 10.1

Identity / Provenance60% listing status · 40% build provenance

10.8 / 18

1.4 below avg 12.2

Transparency50% declared license · 50% OSSF Scorecard

15.7 / 17

3.2 above avg 12.5

Maintenance60% last-push freshness · 40% commit activity

19.9 / 20

2.2 above avg 17.7

AdoptionLog-scaled stars · package downloads

8.6 / 20

5.0 below avg 13.6

Activity Inputs

84.3 / 100

StarsRepository reach

21.5 / 30

FreshnessLast push recency

24.9 / 25

ActivityRecent commits

25 / 25

CommunityFork signal

12.8 / 20

Supply Chain Trust

Package Provenance

None

No package attestations found

OSSF Scorecard

8.5 / 10

OpenSSF Scorecard · scanned Aug 10, 2026

Signed Commits

26%

of last 100 commits verified

Maintained 10

Dependency-Update-Tool 10

Security-Policy 10

Code-Review 0

Dangerous-Workflow 10

Token-Permissions 10

Binary-Artifacts 10

Pinned-Dependencies 9

License 10

Vulnerabilities 10

CII-Best-Practices 5

Signed-Releases 8

Fuzzing 10

SAST 10

Packaging 10

Branch-Protection 3

CI-Tests 10

Contributors 10

Is Code-Graph-RAG safe?

Code-Graph-RAG has a mixed signal profile. Some trust indicators are present, others are missing. Whether it is safe for your use case depends on which gaps matter to you — review the breakdown below before adopting in production.

Does Code-Graph-RAG publish package provenance?

No published build provenance is currently detected for Code-Graph-RAG. This is common for open-source projects but means consumers cannot independently verify that the package on the registry matches the GitHub source.

Does Code-Graph-RAG have an OpenSSF Scorecard?

Code-Graph-RAG has an OpenSSF Scorecard score of 8.5/10. The Scorecard checks for branch protection, signed releases, dependency updates, fuzzing, code review, and other supply-chain hygiene items. See the full check breakdown on this page.

Is Code-Graph-RAG actively maintained?

Actively maintained. The repository was pushed to within the last 1 day(s).

What license does Code-Graph-RAG use?

Code-Graph-RAG ships under MIT. A declared, OSI-approved license is one of the transparency signals HVTrust scores.

Are Code-Graph-RAG's commits signed?

26% of the last 100 commits to Code-Graph-RAG are verified-signed (GPG, SSH, S/MIME, or GitHub's signing flow). Signed commits help confirm that code was authored by who the commit claims.

Not a safety endorsement. HVTracker describes what public signals show, not whether a project is safe for your use case. Run your own security review before adopting in production.

AI agent surface

MCP, providers, tool surface

Scored in HVTrust

These runtime-trust fields — detected from public repo docs and manifests — contribute a bounded adjustment to this project's HVTrust score alongside supply-chain evidence. The exact values each field can add or subtract are documented in the methodology → Compare this surface across every listed agent in the capability matrix →

MCP Server Support

high confidence

Implemented

Code-Graph-RAG appears to expose MCP server capabilities.

Detailed evidence is not shown in the public view.

External Service Dependencies

high confidence

1 detected

Public provider/service dependencies detected.

Qdrant

Credential signal: No explicit API-key/config marker detected.

Tool / Plugin Surface

high confidence

Declared

Declared plugin/integration surface detected.

database

Detailed evidence is not shown in the public view.

Package Provenance Drift

N/A

No package source configured

Detailed evidence is not shown in the public view.

MCP signal live
External deps live
Tool / plugin surface live
Package provenance drift live

Maintain Code-Graph-RAG?

For maintainers

HVTrust scores Code-Graph-RAG from public signals only — we never contact maintainers first. If a signal is wrong, stale, or missing (provenance you publish, a Scorecard you run, signed releases), tell us and we'll review it. Corrections are public and tracked on GitHub.

Submit a correction → Add the trust badge

Reputation Timeline

Signal history

2026-08-10

Newly Listed

First tracked at rank #166

GitHub →

Embed Badge Badge guide for maintainers →

For maintainers

Markdown:
            [![HVTrust](https://hvtracker.net/badge/code-graph-rag.svg)](https://hvtracker.net/agents/code-graph-rag)
            
HTML:
            <a href="https://hvtracker.net/agents/code-graph-rag"><img src="https://hvtracker.net/badge/code-graph-rag.svg" alt="HVTrust"></a>

Other agents in Memory & Knowledge

Data sources
GitHub REST API (repo, commits, stars, forks, license) · OpenSSF Scorecard CLI
Each agent's signals refresh once daily across 6 staggered batches. Methodology v4.3 · Raw JSON