Is socraticode safe?

"command": "npx",

"command": "npx",

import { execFileSync } from "node:child_process";

import { execFileSync } from "node:child_process";

import { execFile } from "node:child_process";

import { execFile } from "node:child_process";

const { stdout } = await exec("git", args, {

import { execSync } from "node:child_process";

execSync(`taskkill /F /PID ${pid}`, { stdio: "ignore" });

const raw = fs.readFileSync(configPath, "utf-8");

const src = await fs.readFile(path.join(resolvedPath, relPath), "utf-8");

source = await fs.readFile(absolutePath, "utf-8");

const raw = await fs.readFile(configPath, "utf-8");

raw = await fs.readFile(resolved, "utf-8");

return await fs.readFile(path.resolve(root, relativePath), "utf-8");

fs.readFile(path.join(ASSETS_DIR, "cytoscape.min.js"), "utf-8"),

fs.readFile(path.join(ASSETS_DIR, "dagre.min.js"), "utf-8"),

fs.readFile(path.join(ASSETS_DIR, "cytoscape-dagre.js"), "utf-8"),

fs.readFile(path.join(ASSETS_DIR, "viewer-styles.css"), "utf-8"),

fs.readFile(path.join(ASSETS_DIR, "viewer-app.js"), "utf-8"),

fs.readFile(path.join(ASSETS_DIR, "viewer-template.html"), "utf-8"),

const content = fs.readFileSync(rootGitignore, "utf-8");

const content = fs.readFileSync(socraticodeignorePath, "utf-8");

const content = fs.readFileSync(gitignorePath, "utf-8");

const content = fs.readFileSync(filePath, "utf-8").trim();

await fs.writeFile(file, html, "utf-8");

fs.writeFileSync(filePath, `${process.pid}\n`, "utf-8");

fs.writeFileSync(filePath, `${process.pid}\n`, "utf-8");

* `init` is forwarded to fetch(), allowing callers to attach headers (e.g. an

const resp = await fetch(url, init);

const resp = await fetch("http://localhost:11434/api/tags", { signal: controller.signal });

*     hands to Node's built-in fetch. Node 26's built-in fetch (undici 8)

"mcpServers": {

{

"mcpServers": {

{

const server = new McpServer({

server.tool("codebase_index", "Start indexing a codebase in the background. Returns immediately. Call codebase_status to poll progress until 100%. Do NOT search until indexing is complete. If already indexing, returns current progress.", {

server.tool("codebase_update", "Incrementally update an existing codebase index. Only re-indexes changed files. Runs synchronously. Use it to refresh a manual/off snapshot, working-tree edits before the next Git transition in git mode, or w …

server.tool("codebase_remove", "Remove a project's codebase index entirely from the vector database. Safely stops the file watcher, cancels any in-progress indexing/update (with drain), and waits for any in-flight graph build before deletin …

server.tool("codebase_prune", "Inventory stored project identities and their resources. Report-only by default. Applying requires an exact identity, the confirmation token from a fresh inventory, and an acknowledgement that no other host is …

server.tool("codebase_stop", "Gracefully stop an in-progress indexing operation. The current batch will finish and checkpoint, preserving all progress. Re-run codebase_index to resume from where it left off.", {

server.tool("codebase_watch", "Start/stop watching a project directory for file changes and automatically update the index. When starting, first runs an incremental update to catch up, then watches for changes. SOCRATICODE_WATCHER=manual al …

server.tool("codebase_search", "Semantic search across an indexed codebase. Only use after codebase_index is complete (check codebase_status first). Returns relevant code chunks matching a natural language query.", {

server.tool("codebase_status", "Check index status: chunk count, indexing progress (%), last completed operation, file watcher state. Call after codebase_index to poll until 100% complete.", {

server.tool("codebase_graph_build", "Build a dependency graph of the codebase using static analysis (ast-grep). Maps import/require/export relationships between files. Runs in the background — call codebase_graph_status to poll progress unt …

server.tool("codebase_graph_query", "Query the code dependency graph for a specific file. Returns what the file imports and what files depend on it.", {

server.tool("codebase_graph_stats", "Get statistics about the code dependency graph: total files, edges, most connected files, orphan files, circular dependencies.", {

server.tool("codebase_graph_circular", "Find circular dependencies in the codebase.", {

server.tool("codebase_graph_visualize", [

server.tool("codebase_graph_remove", "Remove a project's persisted code graph. Waits for any in-flight graph build to finish first. The graph can be rebuilt with codebase_graph_build or will be rebuilt automatically on the next codebase_ind …

server.tool("codebase_graph_status", "Check the status of the code dependency graph: build progress (if building), node/edge count, when it was last built, whether it's cached in memory. Use this to poll progress after calling codebase_grap …

server.tool("codebase_impact", "Impact Analysis — return the BLAST RADIUS for a file or symbol. Lists every file (and, where helpful, function) that could break if you change the target. Polymorphic on target: a path-like string ('src/foo.t …

server.tool("codebase_flow", "Trace the EXECUTION FLOW forward from an entry point — what does this code call into? With NO args, returns a ranked list of auto-detected entry points (orphans with outgoing calls, conventional names like main …

server.tool("codebase_symbol", "360° view of a symbol: definition, kind, callers, callees, confidence levels. Use to understand a function or class before changing it.", {

server.tool("codebase_symbols", "List symbols in a file, or search by name across the project. Use to discover what exists before drilling into a single symbol with codebase_symbol.", {

server.tool("codebase_context", "List all context artifacts defined in .socraticodecontextartifacts.json — database schemas, API specs, infra configs, architecture docs, etc. Shows each artifact's name, description, path, and index status. …