| FMRS | 63 / 100 · C | 76 / 100 · B |
|---|
| Reliability | 10 / 20 | 13 / 20 |
|---|
| Security and permissions | 11 / 20 | 14 / 20 |
|---|
| Maintenance | 14 / 20 | 18 / 20 |
|---|
| Documentation | 15 / 20 | 17 / 20 |
|---|
| Setup experience | 13 / 20 | 14 / 20 |
|---|
| Best for | - AI coding-agent users who need local code-structure analysis
- Development teams seeking to reduce file-by-file search and context-token usage
- Projects requiring cross-file, cross-package, or cross-repository relationship queries
| - Teams that want an AI assistant to directly operate on GitHub repos and collaboration workflows
- Users already in the GitHub Copilot ecosystem who want a zero-deployment remote option
|
|---|
| Not for | - Users who require a built-in LLM or natural-language-to-graph-query translation
- Environments where the server must not read local source code
- Scenarios that require only a remote cloud service instead of a local stdio process
| - Scenarios where you don't want the assistant to have write access to repos (enable only read-only toolsets)
- Environments with strict network isolation for private repos that can't reach the official remote endpoint
|
|---|
| Required permissions | - Read access to local repositories and related configuration files being indexed
- Write access to ~/.cache/codebase-memory-mcp/ for persistent indexes and logs
- The installer may write agent configuration, instructions, skills, and lifecycle hooks
- The optional UI may serve a local interface at localhost:9749
| - A personal access token (PAT) or OAuth App token; effective scope depends on the token's own permissions
- Enabling toolsets like actions/issues/pull_requests grants write access — request tokens on a least-privilege basis
|
|---|
| Risks and side effects | - Indexing and searching process local source code, so its scope and cache location should be reviewed
- The installer modifies agent configuration, skills, instructions, or hooks
- Uninstall and project deletion can remove associated configuration or graph data; deletion requires confirmation
- Although the source describes signatures, checksums, and antivirus scanning, users should still audit binaries before execution
| - Write toolsets (creating/merging PRs, triggering workflows) can cause accidental changes if the token is overscoped — try a read-only toolset first
- In hosted mode, credentials travel via the Authorization header — make sure the client-to-api.githubcopilot.com connection is trusted
|
|---|
| Supported clients | Claude Code, Codex, Gemini CLI, Zed, OpenCode, Cursor, Windsurf, Aider, KiloCode, VS Code, GitHub Copilot CLI, OpenHands, Cline, Qwen Code, Factory Droid, Goose, Mistral Vibe, Qoder CLI, Kimi Code CLI, Rovo Dev CLI | Claude Desktop, Claude Code, VS Code, Cursor, Windsurf, JetBrains IDEs, Zed, Amp |
|---|
| Tools | 14 | 15 |
|---|