MCP.Market

Sonde MCP server

by anishmoncivarghese·io.github.anishmoncivarghese/sonde·v0.4.4·4 stars

Local code graph for TypeScript, Python and Swift: who calls this, what breaks if I change it.

B77/100grade B
What users say
No reviews yet
Be the first
Safety scan
B77/100

full report

Adoption
Growing

4 stars106 downloads/wk

Reviews

Write one

Nobody has reviewed Sonde yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Sonde tools (3)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • find_symbols

    Seed retrieval over the indexed symbol graph: exact qualified name,

  • get_impact_radius

    Reverse-traverse calls, references, implementations, and inheritance

  • query_graph

    Structural traversal for callers, callees, imports, inheritance,

Public scan report

scanner v0.1.10 · 2026-10-29 · same rubric, same numbers if you re-run it

2 medium
  • Code scan131 source files scanned15/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 24 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Findings (2)

  • mediumnpm install lifecycle script presentinstall.script
  • mediumnpm install lifecycle script presentinstall.script
    package.json: …", "typecheck": "tsc --noEmit", "postinstall": "node scripts/fetch-grammars.mjs", …
Overall 77/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Sonde compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
77/100
higher than 50% of 48,243 servers
Tools
3
the typical server has 7
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
4
more than 82% of 28,706 servers
Downloads a week
106
more than 64% of 12,306 servers with a package

What its tools let an agent do: 3 read

Install Sonde in Claude Code, Cursor or VS Code

Runs npx -y @cheppulabs/sonde on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add sonde -- npx -y @cheppulabs/sonde
Add to Cursor

What the publisher says

From the Sonde repository's README, as published. We do not edit it. Read it on GitHub

Sonde

A local code-context engine for AI coding agents. Sonde indexes a TypeScript, Python, or Swift repository into a symbol-level graph in SQLite and exposes three MCP tools — findsymbols, querygraph, and getimpactradius — so an agent can answer who calls this, what breaks if I change it, and which tests relate to it in one call instead of a search loop.

What the benchmark actually shows

The honest claim is not "finds what grep cannot". A competent agentic search loop finds the same structural evidence — we measured it, on a real 19,409-line repository, and it scored 1.000 recall on every task.

The claim is the same answers for a fraction of the cost, inside a budget:

Sonde matches the baseline's answers on every structural task while using ~3× less context, 8× fewer calls, and ~147× less wall-clock time — and it never exceeds the caller's token budget, because the packer truncates to it by construction. That is the trade being offered.

Where it loses. Behavioural queries with no shared vocabulary — "where is the retry backoff decided?" — score 0.00. Local semantic retrieval was built and measured and does not fix it (see the design doc §2.2); the capability is therefore not claimed. If your questions are mostly of that shape, an agentic search loop is the better tool today.

Numbers are reproducible: npm run bench:fixture && npm run bench:large. Full results in BENCHMARK-LARGE.md and BENCHMARK.md.

Install and run

npm install -g @cheppulabs/sonde
cd your-project
sonde init

sonde init indexes the repository and registers sonde as an MCP server in this project's .mcp.json, asking before it writes anything (skip the prompt with sonde init --yes). It never touches an .mcp.json it can't safely merge into — an existing sonde entry that differs from what init would write is left alone and reported, not overwritten.

For Python repositories, use sonde init --resolve; the default tree-sitter tier did not pass the project's placement gate for structural queries.

Equivalent by hand, if you'd rather see every step:

sonde index .
# then add to .mcp.json:
# { "mcpServers": { "sonde": { "command": "sonde", "args": ["mcp", "serve", "."] } } }

No account or hosted service is required.

Architecture documentation

sonde doc writes an ARCHITECTURE.md describing the repository's modules, how they depend on each other, and what each one exposes — generated from the graph, so it reports what the code actually does rather than what someone remembered.

sonde doc            # write ARCHITECTURE.md
sonde doc --stdout   # print it instead
sonde doc --check    # fail if it is out of date (for CI)
sonde doc --module src/store   # symbol-level detail, never committed

It is meant to be committed and regenerated, not hand-edited. Regeneration is byte-identical when nothing changed, so it does not churn your diffs; when two branches both regenerate it, resolve the conflict by running sonde doc again rather than merging by hand. It refuses to overwrite an ARCHITECTURE.md it did not generate.

Three things it deliberately does not do:

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Sonde: common questions

Is Sonde MCP server safe?
Mostly: it is graded B (77/100). Read the Sonde safety report
How do I install Sonde?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Sonde need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Sonde maintained?
The last commit was 31 days ago (2026-10-05). The latest release is v0.4.4.
How does Sonde compare with other MCP servers?
safety score 77/100 (higher than 50% of 48,243 servers); tools 3 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.