Sonde MCP server
Local code graph for TypeScript, Python and Swift: who calls this, what breaks if I change it.
B77/100grade B
Adoption
Growing
4 stars50 downloads/wk
Reviews
Write oneNobody has reviewed Sonde yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Sonde tools (3)
write = sends, deletes, buys or postsRead from the package source without running it. The installed server may list more.
find_symbolsSeed retrieval over the indexed symbol graph: exact qualified name,
get_impact_radiusReverse-traverse calls, references, implementations, and inheritance
query_graphStructural traversal for callers, callees, imports, inheritance,
Public scan report
scanner v0.1.9 · 2026-09-20 · same rubric, same numbers if you re-run it
2 medium
- Code scan131 source files scanned15/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancelast push 20 days ago15/15
- Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Findings (2)
- mediumnpm install lifecycle script present
install.script - mediumnpm install lifecycle script present
install.scriptpackage.json: …", "typecheck": "tsc --noEmit", "postinstall": "node scripts/fetch-grammars.mjs", …
Overall 77/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON
Install directly
Runs npx -y @cheppulabs/sonde on your machine. Read the scan report first; the gateway never runs local packages.
claude mcp add sonde -- npx -y @cheppulabs/sonde
Sonde: common questions
- Is Sonde MCP server safe?
- Mostly: it is graded B (77/100). Read the Sonde safety report
- How do I install Sonde?
- It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
- Does Sonde need an API key?
- Not as far as the registry entry and our scan can tell: no credentials are declared or required.
- Is Sonde maintained?
- The last commit was 21 days ago (2026-08-31). The latest release is v0.4.4.