Sonde MCP server
io.github.anishmoncivarghese/sonde·v0.4.4·4 starsLocal code graph for TypeScript, Python and Swift: who calls this, what breaks if I change it.
4 stars106 downloads/wk
Reviews
Write oneNobody has reviewed Sonde yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Sonde tools (3)
write = sends, deletes, buys or postsRead from the package source without running it. The installed server may list more.
find_symbolsSeed retrieval over the indexed symbol graph: exact qualified name,
get_impact_radiusReverse-traverse calls, references, implementations, and inheritance
query_graphStructural traversal for callers, callees, imports, inheritance,
Public scan report
scanner v0.1.10 · 2026-10-29 · same rubric, same numbers if you re-run it
- Code scan131 source files scanned15/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancelast push 24 days ago15/15
- Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Findings (2)
- mediumnpm install lifecycle script present
install.script - mediumnpm install lifecycle script present
install.scriptpackage.json: …", "typecheck": "tsc --noEmit", "postinstall": "node scripts/fetch-grammars.mjs", …
How Sonde compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 77/100
- higher than 50% of 48,243 servers
- Tools
- 3
- the typical server has 7
- Tools that change things
- 0%
- typical: 0%. Fewer write tools means less an agent can break
- GitHub stars
- 4
- more than 82% of 28,706 servers
- Downloads a week
- 106
- more than 64% of 12,306 servers with a package
What its tools let an agent do: 3 read
Install Sonde in Claude Code, Cursor or VS Code
Runs npx -y @cheppulabs/sonde on your machine. Read the scan report first; the gateway never runs local packages.
claude mcp add sonde -- npx -y @cheppulabs/sonde
What the publisher says
From the Sonde repository's README, as published. We do not edit it. Read it on GitHub
Sonde
A local code-context engine for AI coding agents. Sonde indexes a TypeScript, Python, or Swift repository into a symbol-level graph in SQLite and exposes three MCP tools — findsymbols, querygraph, and getimpactradius — so an agent can answer who calls this, what breaks if I change it, and which tests relate to it in one call instead of a search loop.
What the benchmark actually shows
The honest claim is not "finds what grep cannot". A competent agentic search loop finds the same structural evidence — we measured it, on a real 19,409-line repository, and it scored 1.000 recall on every task.
The claim is the same answers for a fraction of the cost, inside a budget:
Sonde matches the baseline's answers on every structural task while using ~3× less context, 8× fewer calls, and ~147× less wall-clock time — and it never exceeds the caller's token budget, because the packer truncates to it by construction. That is the trade being offered.
Where it loses. Behavioural queries with no shared vocabulary — "where is the retry backoff decided?" — score 0.00. Local semantic retrieval was built and measured and does not fix it (see the design doc §2.2); the capability is therefore not claimed. If your questions are mostly of that shape, an agentic search loop is the better tool today.
Numbers are reproducible: npm run bench:fixture && npm run bench:large. Full results in BENCHMARK-LARGE.md and BENCHMARK.md.
Install and run
npm install -g @cheppulabs/sonde
cd your-project
sonde initsonde init indexes the repository and registers sonde as an MCP server in this project's .mcp.json, asking before it writes anything (skip the prompt with sonde init --yes). It never touches an .mcp.json it can't safely merge into — an existing sonde entry that differs from what init would write is left alone and reported, not overwritten.
For Python repositories, use sonde init --resolve; the default tree-sitter tier did not pass the project's placement gate for structural queries.
Equivalent by hand, if you'd rather see every step:
sonde index .
# then add to .mcp.json:
# { "mcpServers": { "sonde": { "command": "sonde", "args": ["mcp", "serve", "."] } } }No account or hosted service is required.
Architecture documentation
sonde doc writes an ARCHITECTURE.md describing the repository's modules, how they depend on each other, and what each one exposes — generated from the graph, so it reports what the code actually does rather than what someone remembered.
sonde doc # write ARCHITECTURE.md
sonde doc --stdout # print it instead
sonde doc --check # fail if it is out of date (for CI)
sonde doc --module src/store # symbol-level detail, never committedIt is meant to be committed and regenerated, not hand-edited. Regeneration is byte-identical when nothing changed, so it does not churn your diffs; when two branches both regenerate it, resolve the conflict by running sonde doc again rather than merging by hand. It refuses to overwrite an ARCHITECTURE.md it did not generate.
Three things it deliberately does not do:
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Sonde: common questions
- Is Sonde MCP server safe?
- Mostly: it is graded B (77/100). Read the Sonde safety report
- How do I install Sonde?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does Sonde need an API key?
- Not as far as the registry entry and our scan can tell: no credentials are declared or required.
- Is Sonde maintained?
- The last commit was 31 days ago (2026-10-05). The latest release is v0.4.4.
- How does Sonde compare with other MCP servers?
- safety score 77/100 (higher than 50% of 48,243 servers); tools 3 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.