{"name":"in.koragraph/koragraph","slug":"koragraph","title":"Koragraph","description":"Local multi-repo code graph over MCP. Blast radius, call graphs, and memory anchored to code.","url":"https://mcp.market/server/koragraph","rating":null,"grade":"C","score":58,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":40,"stars":14,"forks":0,"downloads_week":153,"last_push_at":"2026-09-14T12:25:00.000Z","license":"NOASSERTION"},"uptime":null,"claimed":false,"transport":"npm","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/Koragraph/KoragraphMCP","website":"https://www.koragraph.in","version":"0.1.4","remotes":[],"packages":[{"registryType":"npm","registryBaseUrl":"https://registry.npmjs.org","identifier":"koragraphmcp","version":"0.1.4","transport":{"type":"stdio"},"packageArguments":[{"description":"Runs the MCP server over stdio. The same binary also exposes ingest, doctor and serve.","value":"mcp","type":"positional","valueHint":"subcommand"}]}],"tools":[],"scan":{"score":58,"grade":"C","scanned_at":"2026-09-20T11:38:00.410Z","report":{"scannerVersion":"0.1.9","scannedAt":"2026-09-20T11:38:00.374Z","components":{"code":{"score":3,"max":25,"notes":["181 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":12,"max":15,"notes":["local package, no credentials required"]},"maintenance":{"score":15,"max":15,"notes":["last push 6 days ago"]},"identity":{"score":8,"max":10,"notes":["registry namespace matches repository owner","website matches verified namespace"]}},"findings":[{"id":"install.script","severity":"medium","component":"code","title":"npm install lifecycle script present"},{"id":"install.script","severity":"medium","component":"code","title":"npm install lifecycle script present","evidence":"package.json: … \"node\": \">=22\" }, \"scripts\": { \"postinstall\": \"node scripts/postinstall.js || true\" …"},{"id":"exec.shell-concat","severity":"high","component":"code","title":"Shell command built from a string (injection risk)","evidence":"src/services/vcs/local-provider.js: …d */ function git(cmd, cwd) { return execSync(`git ${cmd}`, { cwd, stdio: ['pipe', 'p…"}],"inputs":{"packages":[{"registryType":"npm","identifier":"koragraphmcp","version":"0.1.4","found":true,"license":"BUSL-1.1","hasInstallScripts":true,"dependencyCount":11,"publishedAt":"2026-09-05T15:09:03.485Z","repositoryUrl":"git+https://github.com/Koragraph/KoragraphMCP.git","weeklyDownloads":153}],"repo":{"found":true,"owner":"Koragraph","repo":"KoragraphMCP","archived":false,"pushedAt":"2026-09-14T12:25:00Z","stars":14,"forks":0,"openIssues":0,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/324379785?v=4","ownerCreatedAt":"2026-09-03T07:25:54Z","license":"NOASSERTION"},"icon":{"url":"https://www.koragraph.in/icon.png?77e000cbd8b90257","source":"site","width":512,"height":512},"presence":{"stars":14,"forks":0,"downloadsWeek":153,"license":"NOASSERTION","lastPushAt":"2026-09-14T12:25:00.000Z","score":40}}}},"grade_history":[],"reviews":[]}