trace-mcp

description

desc

desc

desc

desc

Fetch a user by ID

Create a new item

Echo a string back.

MCP tool registration

Get map of all services, their APIs, and inter-service dependencies. Auto-detects services from Docker Compose or treats each repo as a service. Use to understand microservice topology. For subproject-level graph use get_subproject_graph instead. Read-only. Returns JSON: { services: [{ name, endpoints, dependencies }], total }.

Analyze cross-service impact of changing an endpoint or event. Shows which services would be affected. Use before modifying a shared endpoint. For within-codebase impact use get_change_impact instead; for the full cross-repo blast radius use get_federation_impact. Read-only. Returns JSON: { service, affectedServices: [{ name, reason }], total }.

Get API contract (OpenAPI/gRPC/GraphQL) for a service. Parses spec files found in the service repo. Use to inspect a service

Get external service dependencies: which services this one calls (outgoing) and which call it (incoming). Use to understand a single service

Detect mismatches between API spec and implementation: endpoints in spec but not in code, or in code but not in spec. Use to verify API contract accuracy. For reading the contract itself use get_api_contract instead. Read-only. Returns JSON: { service, missingInCode, missingInSpec, total }.

Aggregates cross-repo impact into ONE call: if you change an endpoint, service, or symbol, this combines subproject client-call impact (which repos/files call it), cross-service edge impact (dependent services via HTTP/event edges), and contract drift (spec vs implementation) into a single blast-radius report — instead of manually chaining get_subproject_impact + get_cross_service_impact + get_contract_drift. Requires at least one of endpoint or service. Read-only. Returns JSON: { target, affected_clients, affected_services, contract_drift, risk_level, summary, total_affected }.

Show all subprojects and their cross-repo connections. A subproject is any working repository in your project ecosystem (microservices, frontends, backends, shared libraries, CLI tools, etc.). Displays repos, endpoints, client calls, and inter-repo dependency edges. Use to understand multi-repo topology. Register repos first with subproject_add_repo. Read-only. Returns JSON: { repos, endpoints, clientCalls, edges }.

Cross-repo impact analysis: find all client code across subprojects that would break if an endpoint changes. Resolves down to symbol level when per-repo indexes exist. Use before modifying a shared API endpoint; for the full cross-repo blast radius use get_federation_impact. Read-only. Returns JSON: { endpoint, affectedClients: [{ repo, file, line, callType }], total }.

Add a repository as a subproject of the current project. Pass `repo_path` for a local checkout, or `git_url` to shallow-clone a remote repo into .trace-mcp/subprojects/<owner>/<repo> first (idempotent — re-runs reuse the existing clone). A subproject is any working repository in your ecosystem: microservices, frontends, backends, shared libraries, CLI tools. Discovers services, parses API contracts (OpenAPI/gRPC/GraphQL), scans for HTTP client calls, and links them to known endpoints. Mutates the topology store; idempotent. Returns JSON: { added, services, contracts, clientCalls, cloned? }.

Re-scan all subprojects: re-discover services, re-parse contracts, re-scan client calls, and re-link everything. Mutates the topology store; idempotent. Use after code changes in subproject repos. Returns JSON: { synced, services, contracts, clientCalls }.

Cross-project topic tunnels: links between registered subprojects sharing canonical entities — manifest package names, top-level declared dependencies, and git contributors (bots filtered). Tunnel weight favors shared people/project names over common deps (noisy deps down-weighted). Use to discover hidden cross-repo coupling or seed cross-project search. Read-only. Returns JSON: { tunnels: [{ project_a, project_b, shared: [{ kind, canonical, display }], weight }], total }.

Find all client calls across subprojects that call a specific endpoint. Shows file, line, call type, and confidence. Use to find all consumers of an endpoint before modifying it. Read-only. Returns JSON: { endpoint, clients: [{ repo, file, line, callType, confidence }], total }.

Show version history for a service API contract with breaking change detection between versions. Compares request/response schemas across snapshots to flag removed fields, type changes, and renames. Use to review API evolution. For current spec-vs-code drift use get_contract_drift instead. Read-only. Returns JSON: { service, versions: [{ version, date, breakingChanges }] }.

Scan ~/.claude/projects for projects Claude Code has touched on this machine, decode each directory name back to its absolute path, and report which ones still exist plus session-file count and last activity. With add_as_subprojects=true, every existing project is registered as a subproject in one call — useful for spinning up multi-repo intelligence after a fresh clone. Reads local filesystem; with add_as_subprojects=true also mutates topology store. Returns JSON: { projects: [{ path, sessions, lastActivity }], total }.

Git-based code ownership: who contributed most to specific files (git shortlog). Requires git. Use to identify who to ask about specific files. For symbol-level ownership use get_symbol_owners instead. Read-only. Returns JSON: [{ file, owners: [{ author, commits, percentage }] }].

Open interactive HTML visualization of the subproject topology: services as nodes, API calls as edges, health/risk indicators per service. Node size = endpoint count, color = health (green/yellow/red). Writes an HTML file to disk. Use for visual architecture review. Returns JSON: { outputPath, services, edges }.

Runtime profile for a symbol or route: call count, latency percentiles (p50/p95/p99), error rate, calls per hour. Requires OTLP trace ingestion. Read-only, queries external runtime data. Use for performance analysis of specific endpoints. Returns JSON: { symbol_id, callCount, latency: { p50, p95, p99 }, errorRate, callsPerHour }.

Actual call graph from runtime traces (vs static analysis). Shows observed call paths with call counts and latency. Requires OTLP trace ingestion. Read-only, queries external runtime data. For static call graph use get_call_graph instead. Returns JSON: { root, calls: [{ symbol, count, latency }] }.

Per-route analytics: request count, error rate, latency, caller services. Requires OTLP trace ingestion. Read-only, queries external runtime data. Use to understand endpoint performance and traffic. Returns JSON: { uri, method, requestCount, errorRate, latency, callerServices }.

Which external services (databases, caches, APIs, queues) does this code actually call at runtime. Based on OTLP traces. Read-only, queries external runtime data. Use to discover actual runtime dependencies vs static analysis. Returns JSON: { dependencies: [{ type, name, callCount }] }.

List Hermes Agent (NousResearch) sessions visible on this machine. Scans $HERMES_HOME (default ~/.hermes) for state.db plus any profiles/<name>/state.db. Hermes conversations are GLOBAL — results are NOT filtered by the current project. Read-only. Returns JSON: { enabled, sessions: [{ sessionId, sourcePath, profile, lastActivity, sizeBytes }], total }.

Map a business question to domain taxonomy → returns domain ownership and relevance scores (no source code). Use when you need to know WHICH DOMAIN owns specific functionality. For actual source code use get_feature_context instead. Read-only. Returns JSON: { symbols: [{ symbol_id, domain, relevance }] }.

Get hierarchical map of business domains with key symbols per domain. Auto-builds domain taxonomy on first call using heuristic classification. Use to understand business domain boundaries. For specific domain code use get_domain_context instead. Read-only. Returns JSON: { domains: [{ name, children, symbols }] }.

Get all code related to a specific business domain. Supports

Show which business domains depend on which. Based on edges between symbols in different domains. Use to understand domain coupling. Read-only. Returns JSON: { dependencies: [{ from, to, edgeCount }] }.

Trace how named symbols relate in the dependency graph → returns subgraph + Mermaid diagram. Input is NATURAL LANGUAGE only — NOT SQL. Must contain symbol/class names (e.g.

Walk the dependency graph from a starting symbol or file using BFS/DFS, with a hard token budget on the response. Use when you want a structured

Intra-function dataflow analysis: track how each parameter flows through the function body — into which calls, where it gets mutated, and what is returned. Phase 1: single function scope. Use to understand data transformations within a function. For security-focused data flow use taint_analysis instead. Read-only. Returns JSON: { symbol_id, params: [{ name, flows: [{ target, mutated }] }], returnPaths }.

Capture the current graph shape (file/symbol counts, edges by type, top in-degree files, communities, exported symbols) under a named label. Use as a checkpoint before/after a refactor; later compare with diff_graph_snapshots. Mutates a single graph_snapshots row; idempotent (re-stamps if name exists). Returns JSON: { id, name, captured_at, summary }.

List previously captured graph snapshots, most recent first. Each entry includes its summary so you can inspect counts without diffing. Read-only. Returns JSON: { snapshots: [{ id, name, captured_at, summary }], total }.

Compare two named graph snapshots and report deltas in counts, communities, and top in-degree files. Use to track graph evolution over time without git as the axis (e.g. before/after a refactor, week-over-week health). Read-only. Returns JSON: { base, head, files, symbols, symbols_by_kind, edges_by_type, exported_symbols, communities, top_files }.

Graph-evolution timeline: samples evenly-spaced historical commits (via git log) and reports file-count + commit churn per period, with a short narrative diff marker. Symbol/edge counts reflect the current HEAD only, not reconstructed per historical commit. For point-in-time named checkpoints use snapshot_graph + diff_graph_snapshots instead. Requires git. Read-only. Returns JSON: { since_days, granularity, periods: [{ period, commit, date, file_count, commits_in_period, files_changed, insertions, deletions, narrative }], current: { files, symbols, edges_by_type }, _tier, _methodology }.

Export the dependency graph in formats external tools understand. Supports GraphML (Gephi/yEd/NetworkX), Cypher (Neo4j import script), and Obsidian (markdown vault with [[wikilinks]]). Use to crunch the graph in tools that already exist — Cypher queries, betweenness-centrality in NetworkX, vault navigation. For interactive HTML use visualize_graph; for Mermaid/DOT diagrams use get_dependency_diagram. Read-only. Returns JSON: { format, content, node_count, edge_count }.

Open interactive HTML graph in browser showing file/symbol dependencies. Supports force/hierarchical/radial layouts, community coloring. Use granularity=symbol to see individual functions/classes/methods as nodes instead of files. Writes an HTML file to disk. For static Mermaid/DOT output use get_dependency_diagram instead. Returns JSON: { outputPath, nodes, edges }.

Render dependency diagram for a file/directory path as Mermaid or DOT. Input: a path like

Full-text search across all indexed files. Supports regex, glob file patterns, language filter. Use for finding strings, comments, TODOs, config values, error messages — anything not captured as a symbol. For symbol search (functions, classes) use search instead. Read-only. Returns JSON: { files: [{ file, language, hits: [{ line, column, match, context }] }], total_matches } — hits grouped per file, so a long path is paid once. Pass `grouping:

Heuristic bug-risk triage: ranks files by git churn, fix-commit ratio, complexity, coupling, PageRank, and author count — a prioritization heuristic, NOT a validated predictor (calibration notes in the response

Detect architectural drift: cross-module co-change anomalies (files in different modules that always change together) and shotgun surgery patterns (commits touching 3+ modules). Requires git. Use to identify hidden coupling across modules. For file-pair co-changes use get_co_changes instead. Read-only. Returns JSON: { anomalies, shotgunSurgery, total }.

Per-module tech debt score (A–F grade) combining: complexity, coupling instability, test coverage gaps, and git churn. Includes actionable recommendations. Use for architecture review and prioritizing cleanup. Read-only. Returns JSON: { modules: [{ module, grade, score, factors, recommendations }] }.

Before modifying a file or symbol, predict risk level (low/medium/high/critical) with contributing factors and recommended mitigations. Combines blast radius, complexity, git churn, test coverage, and coupling. Use as a quick risk check. For full impact report with affected tests and dependents use get_change_impact instead. Read-only. Returns JSON: { risk, level, factors: [{ name, value }], mitigations }.

Time-series health metrics for a file or module: bug score, complexity, coupling, churn over time. Populated by predict_bugs runs. Use to track if a module is improving or degrading. Read-only. Returns JSON: { dataPoints: [{ date, bugScore, complexity, coupling, churn }] }.

Aggregates get_complexity_trend, get_coupling_trend, and get_git_churn into one per-file time series: complexity, coupling, and a lightweight risk_score per historical snapshot, plus a whole-window churn summary. Answers

List all detected monorepo workspaces with file counts, symbol counts, and languages. Returns dependency graph between workspaces showing cross-workspace imports. Use for monorepo structure overview. For impact of changes on other workspaces use get_cross_workspace_impact instead. Read-only. Returns JSON: { workspaces: [{ name, files, symbols, languages }], dependencies }.

Show which workspaces are affected by changes in a given workspace. Lists all cross-workspace edges, affected symbols, and the public API surface consumed by other workspaces. Use before modifying shared code in a monorepo. Read-only. Returns JSON: { workspace, public_api, consumed_by, depends_on, cross_workspace_edges }.

Mine Claude Code / Claw Code session logs for architectural decisions, tech choices, bug root causes, and preferences. Strategies:

Manually record an architectural decision, tech choice, preference, or convention. Links to code symbols/files and optionally to a specific subproject for code-aware memory. Decisions have temporal validity — they can be invalidated later when they become outdated. Mutates the decision store (creates a new record). For automated extraction from session logs use mine_sessions instead. Returns JSON: { added: { id, title, type } }.

Check architectural layer rules: detect forbidden imports between layers (e.g. domain importing infrastructure). Supports auto-detected presets (clean-architecture, hexagonal) or custom layers. Use to enforce architectural boundaries. Read-only. Returns JSON: { violations: [{ from, to, rule, file, line }], total, preset }.

Live agent write into the decision knowledge graph. Confidence-scores the input and routes it through the memoir review queue: high-confidence rows enter the active graph immediately, mid-confidence rows queue for human approval, low-confidence rows are dropped without persistence. Per-session dedup + rate-limit. Use during a session to capture decisions in real time. For manual high-confidence writes use add_decision; for post-hoc extraction from session logs use mine_sessions. Returns JSON: { id, review_status, confidence, deduplicated? }.

Query the decision knowledge graph. Filter by type, subproject, code symbol, file path, tag, or time — answers

Fetch a single decision by id, including its full `content`. Companion to query_decisions `index_only: true` (progressive disclosure): list cheaply with index_only, then pull full content on demand for the ids you care about. Read-only. Returns JSON: { decision: { id, title, content, type, tags, ... } } or { error } when not found.

Export decisions to JSONL or Markdown. Read-only; no schema mutations. Use for audit, sharing with external tooling, or pre-LLM digestion. JSONL emits one decision per line with `tags` parsed from the on-disk JSON column into a real array. Markdown groups by type (and by service when multi-service). Hard-capped at 5000 rows per call as a cost guard. Returns JSON: { format, content, count, scope }.

Mark a decision as no longer valid. The decision remains in the knowledge graph for historical queries but is excluded from active queries. Use when a decision is superseded or reversed. Mutates the decision store; idempotent. Returns JSON: { invalidated: { id, title, valid_until } }.

Approve a decision currently in the memoir-style review queue (review_status=

Reject a decision currently in the memoir-style review queue (review_status=

Decision memory, not retrieval ranking (that is `tune_weights`): re-fit decision confidence weights from accumulated review feedback (approve/reject events). Requires >= min_events reviews and at least one of each label. Mutating: when dry_run=false and the fit succeeds, persists to ~/.trace-mcp/confidence_weights.json and resets the in-memory weight cache so subsequent remember_decision calls use the new weights. Returns: { ok, reason, events_used, weights?, before?, loss_before?, loss_after?, applied }.

Chronological timeline of decisions for a project, symbol, or file. Shows when decisions were made and invalidated — like git log but for architectural decisions. Read-only. Use to review decision history. Returns JSON: { timeline: [{ id, title, type, created_at, valid_until }], count }.

Overview of the decision knowledge graph: total decisions, active/invalidated counts, breakdown by type and source. Shows how much institutional knowledge is captured. Read-only. Returns JSON: { total, active, invalidated, by_type, by_source, sessions_mined }.

Recompute the L2 thematic cluster overlay over the decision store using the configured LLM. Stable cluster ids: a fresh cluster whose title matches an existing one (trigram Jaccard >=0.8) updates the existing row in place. Mutates the cluster store; idempotent. Requires an active AI provider — returns a structured error otherwise. Returns JSON: { created, updated, removed, total_after, clusters, strategy_used }.

LLM-driven semantic dedup of the decision store. For each decision in scope, finds top-K similar candidates (FTS + title-trigram) and asks the LLM to merge / replace / invalidate where appropriate. Mutating; respects dry_run (default true). Requires an active AI provider. Returns: { evaluated, verdicts: [{subject_id, verdict, affected_ids}], applied_count, dry_run }.

List decision clusters with optional full-text filter. Each row carries a short noun-phrase title, 1-3 sentence summary, member count, and a preview of member decision titles. Use to navigate the decision store by topic instead of chronologically. Read-only. Returns JSON: { clusters, total }.

Return the member decisions of a cluster, plus the cluster header. Use after get_decision_clusters to drill into a specific topic. Read-only. Returns JSON: { cluster, decisions }.

Synthesise (or refresh) the project memo — a 250-400 word LLM-written orientation digest over the decision store. Skips work when fewer than `memory.memo.regenerateEveryN` decisions have been added since the last memo unless `force=true`. Requires an active AI provider — structured error otherwise.

Index conversation content from Claude Code / Claw Code sessions for cross-session search. Stores chunked messages in FTS5 — enables

Search across all past session conversations. Finds what was discussed, decided, or debugged in previous sessions. Full-text search with porter stemming — e.g.,

Compact orientation context (~300 tokens) for session start. By default returns a {stable, dynamic} split: stable content (project identity, conventions, architecture) is provider-cacheable when injected into system_prompt; dynamic content (recent activity) goes into the user message to avoid busting the system-prompt cache. Pass cache_split: false for the legacy flat shape. See `scope` to fetch cross-session activity or the project memo instead. Hard-capped by `memory.recall.timeoutMs` (default 5000 ms); on timeout returns a degraded empty payload with `degraded: true` so the agent turn never blocks on slow IO.

Find all classes that implement or extend a given interface or base class. Use when you know the interface name. For full hierarchy tree (ancestors + descendants) use get_type_hierarchy instead. Read-only. Returns JSON: { implementations: [{ symbol_id, name, kind, file, line }], total }.

List all exported symbols (public API) of a file or matching files. Use to understand what a module exposes. For finding unused exports use get_dead_code with mode: exports_only. Read-only. Returns JSON: { files: [{ path, exports: [{ name, kind, signature }] }] }.

List registered indexer plugins and edge types. Read-only. Returns JSON: { language_plugins, framework_plugins, edge_type_categories, active_frameworks }; include_edge_types adds full catalog.

Walk TypeScript class/interface hierarchy: ancestors (what it extends/implements) and descendants (what extends/implements it). Use to understand inheritance trees. For a flat list of implementations only use get_implementations instead. Read-only. Returns JSON: { name, ancestors: [...], descendants: [...] }.

Show file-level dependency graph: what a file imports and what imports it (requires reindex for ESM edge resolution). Use to understand module dependencies for a specific file. For project-wide coupling analysis use get_coupling; for visual diagram use get_dependency_diagram. Read-only. Returns JSON: { file, imports: [{ path }], importedBy: [{ path }] }.

Find symbols lacking test coverage. scope=

Dead code & coverage audit: dead exports, untested public symbols, heritage debt. Use as a one-shot health check combining dead exports + untested symbols + heritage debt. For individual checks use get_dead_code or get_untested_symbols separately. Read-only. Returns JSON: { deadExports, untestedSymbols, heritageDebt, summary }.

Single-call narrative health snapshot: god files (PageRank), architectural bridges (edge bottlenecks), risk hotspots (complexity × churn), edge resolution-tier breakdown, and gap counts (dead exports, untested, cycles). Aggregates already-computed metrics into ~2K tokens of Markdown plus a structured payload. Use at the start of a session to orient yourself instead of chaining get_pagerank + get_risk_hotspots + get_edge_bottlenecks + self_audit. Read-only. Returns JSON: { generated_at, totals, resolution_tiers, god_files, bridges, hotspots, gaps, markdown }.

Coupling analysis: afferent (Ca), efferent (Ce), instability index per file. Shows which modules are stable vs unstable. Use to identify fragile or overly-depended-on modules. For coupling changes over time use get_coupling_trend instead. Read-only. Returns JSON: [{ file, ca, ce, instability, assessment }]. Set `output_format:

Find circular dependency chains in the import graph (Kosaraju SCC algorithm). Considers only import-typed edges (esm_imports / imports / py_imports / py_reexports); call, reference, member_of, and test_covers edges are NOT walked. Test files (paths matching tests/**, **/*.test.*, **/*.spec.*, **/__tests__/**) are excluded by default to suppress spurious test↔source cycles — pass include_tests: true to opt in. Use to detect and break dependency cycles. Read-only. Returns JSON: { total_cycles, cycles: [{ files, length }] }.

File importance ranking via PageRank on the import graph. Shows most central/important files. Use to identify architecturally critical files. For combined health metrics use get_project_health instead. By default markdown files (.md/.mdx/.markdown/.qmd) are excluded — their cross-link patterns dominate the graph and bury real code. Pass `include_markdown: true` to keep them. Read-only. Returns JSON: [{ file, score }]. Set `output_format:

Find architectural bottleneck edges in the import graph: edges on many shortest paths (betweenness), edges whose removal would disconnect the graph (bridges), and single-point-of-failure nodes (articulation points). bottleneckScore = betweenness × (1 + coChangeWeight). Use to prioritize decoupling work. For general importance use get_pagerank instead. Read-only. Returns JSON: { edges: [{ sourceFile, targetFile, betweenness, coChangeWeight, bottleneckScore, isBridge }], articulationPoints: [...], stats }.

Find functions with high complexity called from many files — candidates for extraction to shared modules. Use during architecture review to identify hotspots worth refactoring. Read-only. Returns JSON: [{ symbol_id, name, file, cyclomatic, callerCount }]. Set `output_format:

Structural health: coupling instability, dependency cycles, PageRank rankings, refactor candidates. Use for architecture review as a single aggregated report. For individual metrics use get_coupling, get_circular_imports, or get_pagerank separately. Read-only. Returns JSON: { coupling, cycles, pagerank, refactorCandidates, hotspots }.

Git blame-based symbol ownership: who wrote which lines of a specific symbol. Requires git. Use for fine-grained ownership of a specific function/class. For file-level ownership use get_code_owners instead. Read-only. Returns JSON: { symbol_id, owners: [{ author, lines, percentage }] }.

File complexity over git history: cyclomatic complexity at past commits. Shows if a file is getting more or less complex. Requires git. Use to track whether a file is improving or degrading. For current snapshot use get_complexity_report; for symbol-level trends use get_symbol_complexity_trend. Read-only. Returns JSON: { file, snapshots: [{ commit, date, complexity }] }.

File coupling over git history: Ca/Ce/instability at past commits. Shows if a module is stabilizing or destabilizing. Requires git. Use to track module stability over time. For current coupling snapshot use get_coupling instead. Read-only. Returns JSON: { file, snapshots: [{ commit, date, ca, ce, instability }] }.

Single symbol complexity over git history: cyclomatic, nesting, params, lines at past commits. Requires git. Use to track a specific function

Check if a function/class name already exists before creating it. Pass `name` when planning new code, or `symbol_id` to check an existing symbol against others (excluded from its own results). `exclude_symbol_id` suppresses known matches. Score ≥0.7 means high likelihood of duplication — review before proceeding. Read-only. Returns JSON: { duplicates: [{ symbol_id, name, file, score }], hasDuplication }.

Boost (or demote) a symbol and/or file in PageRank-driven ranking by setting a multiplicative weight. Unifies pin_symbol/pin_file — pass symbol_id and/or file_path (at least one required; pass both to pin them together with the same weight). Capped at 50 active pins per project. Returns JSON: { ok, pins, errors? }.

Remove a ranking pin by target. Pass either symbol_id (for a pinned symbol) or file_path (for a pinned file). At least one is required. Returns JSON: { ok, deleted }.

List all active ranking pins with weight, scope, target, expiry, and creator. Use to inspect what is currently boosted/demoted in PageRank-driven ranking. Read-only. Returns JSON: { pins: [{ scope, target_id, weight, expires_at, created_by, created_at }], total, cap }.

Per-file git churn: commits, unique authors, frequency, volatility assessment. Requires git. Use to identify frequently-changed files. For combined churn+complexity hotspots use get_risk_hotspots instead. Read-only. Returns JSON: { results: [{ file, commits, authors, frequency, volatility }], total }. Set `output_format:

Code hotspots: files with both high complexity AND high git churn (Adam Tornhill methodology). Score = complexity × log(1 + commits). Heuristic triage, not validated (calibration notes in _methodology). Requires git. For per-file bug-risk triage use predict_bugs instead. Read-only. Returns JSON: { hotspots: [{ file, score, max_cyclomatic, commits, assessment, confidence_level }], total }. Supports `output_format:

Dead code detection. Modes:

Scan project files for OWASP Top-10 security vulnerabilities using pattern matching. Detects SQL injection (CWE-89), XSS (CWE-79), command injection (CWE-78), path traversal (CWE-22), hardcoded secrets (CWE-798), insecure crypto (CWE-327), open redirects (CWE-601), and SSRF (CWE-918). Skips test files. Weakly-grounded (

Detect performance & design antipatterns: N+1 queries, missing eager loading, unbounded queries, event listener leaks, circular ORM association cycles, missing FK indexes, memory leaks, god classes (>=25 methods or >=500 LOC), long methods (>=60 LOC), long parameter lists (>=6), deep nesting (>=5). ORM-scoped signals need an active ORM plugin; size/complexity detectors run on every symbol. For import cycles use get_circular_imports; for TODOs/debug artifacts use scan_code_smells; for security use scan_security. Read-only. Returns JSON: { findings: [{ category, severity, file, line, message, suggestion }], total }.

Find deferred work and shortcuts: TODO/FIXME/HACK/XXX comments, empty functions & stubs, hardcoded values (IPs, URLs, credentials, magic numbers), and per-language debug artifacts (console.log, debugger, var_dump, pdb.set_trace, etc). Combines comment scanning, symbol body analysis, and false-positive filtering — surfaces more than grep alone. Use for code quality audits / pre-release checks. For performance antipatterns use detect_antipatterns; for security use scan_security. Read-only. Returns JSON: { findings: [{ category, priority, file, line, message }], total, summary }.

Find Type-2 AST clones: functions/methods with identical structure after normalizing identifiers and literals (tree-sitter parse + AST subtree hash). Unlike check_duplication (name/signature similarity), this finds structurally identical bodies — prime DRY-refactor candidates. Supports TypeScript, JavaScript, Python, Ruby, Go, Java, Rust, PHP, C, C++, C#, Swift, Kotlin, Scala, Elixir. Read-only. Returns JSON: { groups: [{ hash, size, loc, symbols: [{ symbol_id, name, file, line_start, line_end }] }], total_groups, total_duplicated_symbols, files_scanned, symbols_scanned }.

Track flow of untrusted data from sources (HTTP params, env vars, file reads) to dangerous sinks (SQL queries, exec, innerHTML, redirects). Framework-aware (Express, Laravel, Django, FastAPI, etc). Reports unsanitized flows with CWE IDs and fixes; prunes flows that provably terminate at a non-string value. Heuristic, regex-based — not a sound dataflow engine, treat as triage. For pattern-based OWASP scanning use scan_security instead. Read-only. Returns JSON: { flows: [{ source, sink, path, sanitized, cwe, suggestion }], total }.

Generate a Software Bill of Materials (SBOM) from package manifests and lockfiles. Supports npm, Composer, pip, Go, Cargo, Bundler, Maven. Outputs CycloneDX, SPDX, or plain JSON. Includes license compliance warnings for copyleft licenses. Use for supply chain audits or compliance reports. Returns JSON/CycloneDX/SPDX: { components: [{ name, version, license, type }], warnings }.

Surface non-code knowledge from the index: DB schemas (migrations, ORM models), API specs (routes, OpenAPI endpoints), infrastructure (docker-compose services, K8s resources), CI pipelines (jobs, stages), and config (env vars). All data from the existing index — no extra I/O. Use to discover infrastructure and config artifacts without reading files. Read-only. Returns JSON: { artifacts: [{ category, kind, name, file }], total }.

Analyze the impact of updating a package/dependency. Shows all affected files, import references, and generates a PR template with checklist. Use before upgrading a dependency to understand blast radius. Read-only (analysis only, does not modify files). Returns JSON: { package, affectedFiles, importReferences, prTemplate, checklist }.

Get complexity metrics (cyclomatic, max nesting, param count) for symbols in a file or across the project. Use to identify complex code before refactoring. For historical trends use get_complexity_trend instead. Read-only. Returns JSON: { symbols: [{ symbol_id, name, kind, file, line, cyclomatic, max_nesting, param_count }], total }. Set `output_format:

Pre-rename collision detection: checks the symbol

Rename a symbol across all usages (definition + all importing files). Runs collision detection first and aborts on conflicts. Dry-run by default — preview the plan, then re-call with dry_run: false to apply. Returns the list of edits applied. Modifies source files when dry_run is false. Use check_rename first to verify safety; use plan_refactoring with type=

Safely remove a dead symbol from its file. Verifies the symbol is actually dead (multi-signal detection or zero incoming edges) before removal. Warns about orphaned imports in other files. Dry-run by default — preview the plan, then re-call with dry_run: false to apply. Destructive when applied — deletes code from source files. Use get_dead_code first to identify candidates. Returns JSON: { success, removed: { symbol_id, file }, orphanedImports }.

Extract a line range out of an enclosing function into a new named helper (AST-aware, TypeScript/JavaScript). Computes the parameter list via free-variable analysis and a return value from bindings used after the slice. The helper is inserted after the enclosing function; the slice becomes a call. Dry-run by default — preview, then re-call with dry_run=false to apply. Returns JSON: { success, edits, extracted_params, return_value, confidence, files_modified }.

Structural (AST-aware) or regex find-and-replace across files. Default engine

Move a symbol to a different file or rename/move a file, updating all import paths across the codebase. Dry-run by default (safe preview). Modifies source files. Use plan_refactoring with type=

Change a function/method signature (add/remove/rename/reorder parameters) and update all call sites. Dry-run by default (safe preview). Modifies source files. Use plan_refactoring with type=

Preview any refactoring (rename, move, extract, signature) without applying. Returns all edits as {old_text, new_text} pairs. Read-only (does not modify files). Use to review the blast radius before calling apply_rename, apply_move, change_signature, or extract_function. Returns JSON: { success, type, edits: [{ file, old_text, new_text }], filesAffected }.

Search pre-indexed bundles for symbols from popular libraries (React, Express, etc.). Returns symbol definitions from dependency bundles — useful for go-to-definition into node_modules/vendor. Install bundles via CLI: `trace-mcp bundles export`. For project source code search use search instead. Read-only. Returns JSON: { results: [{ name, kind, signature, bundle }], bundles_searched }.

List installed pre-indexed bundles for dependency libraries. Shows package name, version, symbol/edge counts, and size. Read-only. Returns JSON: { bundles: [{ name, version, symbols, edges, size }], total }.

Synthetic token efficiency benchmark: compare raw file reads vs trace-mcp compact responses across symbol lookup, file exploration, search, and impact analysis scenarios. Read-only, no side effects. Use to quantify token savings. Returns JSON: { scenarios: [{ name, raw_tokens, compact_tokens, savings_pct }], summary }.

What every session pays before your first message, what it costs, and what went unused: source decomposition, cache-rebuild prices, and removals proven unused — never merely big. `textCompression` finds text the block says twice, as a delete-only diff. Read-only, local. Returns JSON: { startupTokens, sources, cost, cacheBreakers, mcpServers, instructionFiles, recommendations, textCompression, observationWindow }.

Apply or preview a get_startup_context_audit recommendation: disable an unused MCP server, move an unused skill aside, or delete duplicated instruction lines. dry_run defaults to true; every write is backed up first. Returns JSON: { dryRun, backupId, outcomes }.

Undo one apply_startup_recommendations(dry_run:false) call byte-for-byte: restores files and moved skills. Defaults to the latest backup. Returns JSON: { backupId, restored, errors }.

Pin and re-check a 16-string canary against the active embedding provider. Catches silent provider model swaps (OpenAI/Voyage/etc.) that quietly degrade hybrid retrieval. First call (or with capture=true) saves the baseline; subsequent calls report max cosine distance vs baseline. Read-only or write-only (capture). Returns JSON: { status, message, max_distance?, mean_distance?, per_string? }.

Retrieval fusion ranking for `search`, not decision memory (that is `tune_decision_weights`): read the persistent ranking ledger and learn per-repo signal-fusion weights, written to ~/.trace-mcp/tuning.jsonc. Requires telemetry.enabled in config. Read-only by default (dry_run=true unless explicitly disabled). Returns JSON: { applied, reason, weights?, before?, events_used? }.

Per-tool latency telemetry: p50/p95/max, count, error_rate. Default reads the current session ring; `window=1h|24h|7d|all` reads from ~/.trace-mcp/telemetry.db (requires telemetry.enabled in config). Sorted by p95 descending so the slowest tools surface first. Read-only. Returns JSON: { tools: [{ tool, p50, p95, max, count, errors, error_rate }], total_tools, source }. Set `output_format:

Session history: all tool calls made, files read, zero-result searches, and duplicate queries. Use to avoid repeating work. For a compact snapshot use get_session_snapshot instead. Read-only. Returns JSON: { calls, filesRead, zeroResults, duplicates }.

Compact session snapshot (~200 tokens) for context recovery after compaction. Returns focus files (by read count), edited files, key searches, and dead ends. Also used by the PreCompact hook to preserve session orientation automatically. Read-only. For full journal use get_session_journal; for cross-session context use get_wake_up with scope:

Build a component render tree starting from a given .vue file. Use to visualize parent-child component hierarchy. Read-only. Returns JSON: { root, children: [{ component, props, slots, depth }], totalComponents }.

Trace request flow for a URL+method: route → middleware → controller → service (Laravel/Express/NestJS/Fastify/Hono/tRPC/FastAPI/Flask/DRF). Use to understand how a request is handled end-to-end. For middleware-only analysis use get_middleware_chain instead. Read-only. Returns JSON: { route, steps: [{ type, symbol_id, name, file }] }.

Trace middleware chain for a route URL (Express/NestJS/FastAPI/Flask). Use when you only need the middleware stack, not the full request flow. For full route→controller→service flow use get_request_flow instead. Read-only. Returns JSON: { url, middlewares: [{ name, file, order }] }.

Build NestJS module dependency graph (module -> imports -> controllers -> providers -> exports). Use to understand NestJS module structure and DI wiring. For provider-level DI tree use get_di_tree instead. Read-only. Returns JSON: { module, imports, controllers, providers, exports, edges }.

Trace NestJS dependency injection tree (what a service injects + who injects it). Use to understand DI wiring for a specific provider. For module-level graph use get_module_graph instead. Read-only. Returns JSON: { service, injects: [{ name, kind }], injected_by: [{ name, kind }] }.

Build React Native navigation tree from screens, navigators, and deep links. Use to understand app navigation structure. For details on a specific screen use get_screen_context instead. Read-only. Returns JSON: { navigators, screens, deepLinks, edges }.

Get full context for a React Native screen: navigator, navigation edges, deep link, platform variants, native modules. Use to understand a specific screen before modifying it. For the full navigation tree use get_navigation_graph instead. Read-only. Returns JSON: { screen, navigator, deepLink, platformVariants, nativeModules, navigationEdges }.

Get full model context: relationships, schema, and metadata (Eloquent/Mongoose/Sequelize/SQLAlchemy/Prisma/TypeORM/Drizzle). Use to understand a specific ORM model. For raw table schema without ORM context use get_schema instead. Read-only. Returns JSON: { model, table, relationships: [{ type, related, foreignKey }], fields, metadata }.

Get database schema reconstructed from migrations or ORM model definitions. Use to understand table structure. For ORM-level context with relationships use get_model_context instead. Read-only. Returns JSON: { tables: [{ name, columns: [{ name, type, nullable, default }], indexes }] }.

Get event/signal/task dispatch graph (Laravel events, Django signals, NestJS events, Celery tasks, Socket.io events). Use to understand event-driven architecture and trace event producers/consumers. Read-only. Returns JSON: { events: [{ name, dispatchers, listeners, file }] }.

Find all references to a symbol or file (imports, calls, renders, dispatches). Use instead of Grep for symbol usages — semantic, not text matches. For raw text use search_text; for a bidirectional call graph use get_call_graph. Weakly-grounded `text_matched` edges into a name-colliding target are dropped by default (phantom god-node filter); `include_ambiguous_text_matched: true` keeps them. Read-only. Returns JSON: { references: [{ edge_type, resolution_tier, file, symbol }], total, truncated?, ambiguous_filtered? } — page caps at 50, `total` counts all.

Build a bidirectional call graph centered on a symbol (who calls it + what it calls). Each branch keeps its direction: depth 2 = callers of callers, callees of callees. Use to understand control flow through a function. For flat list of all references use find_usages instead. Read-only. Returns JSON: { root: { symbol_id, name, calls: [...], called_by: [...] } }.

Find test files/functions covering a given symbol or file. Understands test-to-source mapping, not just filename conventions. With symbol_id/fqn, narrows to tests that actually exercise it (direct_invocation, import_and_call, or text_match confidence tiers; default min_confidence is import_and_call). For project-wide coverage gaps use get_untested_symbols instead. Read-only. Returns JSON: { tests: [{ test_file, symbol_id, test_name, line, edge_type, confidence }], total, symbol_filtered?, fell_back_to_file_level? }.

Get full context for a Livewire component: properties, actions, events, view, child components. Use to understand a specific Livewire component before modifying it. Read-only. Returns JSON: { component, properties, actions, events, view, children }.

Get full context for a Laravel Nova resource: model, fields, actions, filters, lenses, metrics. Use to understand a Nova admin resource before modifying it. Read-only. Returns JSON: { resource, model, fields, actions, filters, lenses, metrics }.

List all Zustand stores and Redux Toolkit slices with their state fields, actions/reducers, and dispatch sites. Use to understand state management architecture. Read-only. Returns JSON: { stores: [{ type, name, handler, metadata }], dispatches, totalStores, totalDispatches }.

Pack a slice of project context into a persistent corpus on disk so future query_corpus calls can prime an LLM with the same snapshot without re-running the pack pipeline. Mutates the corpora store; returns JSON with the saved manifest. Pair with query_corpus for

List every corpus saved on disk with its manifest (scope, project_root, sizes, timestamps). Read-only. Use to discover what corpora are available to query.

Answer a natural-language question against a saved corpus. Loads the corpus body, primes the configured AI provider with it as system context, and returns the response. When mode=

Remove a saved corpus (manifest + packed body). Returns JSON: { deleted: bool, name }.

List projects registered with trace-mcp (~/.trace/registry.json) — the roots call_project_tool accepts. Use to query a project other than the one this session is attached to. Subprojects nested inside those roots are not valid targets, so they are opt-in via include_subprojects. Read-only. Returns JSON: { projects: [{ root, name, type, lastIndexed }], subprojects?: [{ name, repo_root, project_root }], total }.

Relay a trace-mcp tool call to a DIFFERENT registered project than this session

Initialize structured execution state for a task (arXiv:2608.26263). Saves state to SQLite and returns compact initial state.

Apply an RFC 7396 JSON Merge Patch to update state atomically. Validates schema and increments version. Returns compact status.

Retrieve current execution state for a task in compact markdown (~150 tokens) or full JSON.

Save a named state checkpoint snapshot for safe rollback if a future exploration path fails.

Rollback task execution state to a previously saved checkpoint snapshot by label or ID.

Shortcut to record a failed approach or dead end into task state without a full patch.

List recent agent execution task states and their status in storage.

Find files that frequently change together in git history (temporal coupling). Requires git. Use to discover hidden dependencies between files. For cross-module co-change anomalies use detect_drift instead. Read-only. Returns JSON: { file, coChanges: [{ file, confidence, count }] }.

Rebuild co-change index from git history. Mutates the co-change index; idempotent. Use after significant git history changes. Returns JSON: { status, pairs_stored, window_days }.

Map a git diff to affected symbols (functions, classes, methods), for PR review. If

Compare two branches at symbol level: what was added, modified, removed. Resolves merge-base automatically, groups by category/file/risk, includes blast radius and risk assessment. Requires git. For a quick list of changed symbols without risk analysis use get_changed_symbols instead. Read-only. Returns JSON: { branch, base, mergeBase, changes: [{ symbol_id, category, risk }], summary }.

Run Leiden community detection on the file dependency graph. Identifies tightly-coupled file clusters (modules). Mutates the community index (stores results); idempotent. Deterministic — same `seed` produces identical assignments across runs. Use before get_communities or get_community. Returns JSON: { communities: [{ id, files, size }], modularity, seed }.

Get previously detected communities (file clusters). Run detect_communities first. Read-only. Returns JSON: { communities: [{ id, files, size }], total }.

Get details for a specific community: files, inter-community dependencies. Read-only. Use after detect_communities to drill into a specific cluster. Returns JSON: { id, files, interCommunityDeps }.

Rank cross-module file edges by how unexpected they look (deep folder distance + popular target + few edges = high surprise). Surfaces hidden coupling that shotgun-changes through unrelated modules. Requires detect_communities to have been run first. Read-only. Returns JSON: { edges: [{ sourceFile, targetFile, surpriseScore, ... }], totalCommunities }.

Scan AI agent config files (CLAUDE.md, AGENTS.md, .cursorrules, etc.) for stale references, dead paths, token bloat, and (when include_drift is set) drift between agent rules and the live MCP tool / skill / command surface. Read-only. Returns JSON: { issues: [{ file, line, category, issue, severity, fix? }], total }.

Detect drift between AI agent config files (CLAUDE.md, AGENTS.md, .cursorrules) and the live tool/skill/command surface: dead path references, references to non-existent MCP tools, references to missing skills/commands, oversized sections. Convenience alias for `audit_config { drift_only: true }`. Read-only. Returns JSON: { issues: [{ file, line, category, issue, severity, fix? }], files_scanned, total_tokens, summary }.

Build a Control Flow Graph (CFG) for a function/method: if/else branches, loops, try/catch, returns, throws. Shows logical paths through the code. Outputs Mermaid diagram, ASCII, or JSON. Use to understand branching logic before modifying complex functions. For call-level graph (who calls whom) use get_call_graph instead. Read-only. Returns Mermaid/ASCII/JSON: { nodes, edges, entryPoint, exitPoints }.

Cross-repo package dependency analysis: find which registered projects depend on a package, or what packages a project publishes. Scans package.json/composer.json/pyproject.toml across all repos in the registry. Use for cross-project dependency mapping. For impact of upgrading a specific package use plan_batch_change instead. Read-only. Returns JSON: { dependents, dependencies, package }.

Verify a markdown document against the code graph — the reverse of generate_docs, for catching doc drift after a rename. forward: backticked paths and identifiers that no longer resolve, each with its heading path. reverse: public symbols in a scope the document never mentions. Read-only. Returns JSON: { doc, forward: { checked, resolved, misses }, reverse: { unmentioned } }.

Generate project documentation from the code graph — architecture, API surface, data models, components, dependencies. For checking an existing document instead, use verify_docs. Returns JSON: { format, sections, outputPath }.

Pack project context into a single document for external LLMs. Intelligent selection by graph importance, fits within token budget. Better than Repomix for focused context. Strategies: most_relevant (default — feature/PageRank ranked), core_first (PageRank always wins, surfaces architecturally central code), compact (signatures only — drops source bodies, lets outlines cover much more of the repo per token). Read-only. Use when sharing project context with external tools. Returns XML/Markdown/JSON with selected code within budget.

Auto-generated, prioritized review questions derived from the analyses we already cache (untested framework entry points, circular imports, ast-clone clusters, dead-export drift, untested-but-exported symbols). Use during PR review to surface

Run configurable quality gate checks (complexity, coupling, circular imports, dead exports, tech debt, security, antipatterns, code smells). Designed for CI / pre-commit verification. Read-only. With no gates configured, returns `NO_GATES_CONFIGURED` with a `_warnings` advisory — never a misleading `PASS`. Pass `use_default_gates: true` for a conservative built-in ruleset. Returns JSON: { gates, summary: { result:

Export security context for MCP server analysis. Generates enrichment JSON for skill-scan: tool registrations with annotations, transitive call graphs classified by security category (file_read, file_write, network_outbound, env_read, shell_exec, crypto, serialization), sensitive data flows, and per-file capability maps. Use to analyze MCP server security before installation. Read-only. Returns JSON: { tool_registrations, sensitive_flows, capability_map, warnings }.

Edit-safety preflight: before modifying a symbol or file, get one verdict for

Execute type-checker (tsc, mypy, pyright) and map errors to enclosing AST symbols. Read-only.

Get index status, statistics, health, and pipeline progress (indexing, summarization, embedding). Read-only, no side effects. Use to verify the index is ready before running queries. Returns JSON: { totalFiles, totalSymbols, languages, frameworks, pipelineProgress, embedding }.

Trigger (re)indexing of the project or a subdirectory. Mutates the local index (SQLite). Use after major file changes; for single-file updates prefer register_edit instead. The optional `postprocess` flag controls how much work runs after raw symbol extraction:

Precompute and cache symbol embeddings for semantic / hybrid search. Also computed lazily on first semantic query — call this once after a fresh index to avoid that latency spike. Requires an AI provider (ollama/openai) enabled in config. force=true recomputes all embeddings. Mutates the vector store; idempotent. Returns JSON: { status, indexed_this_run, total_embedded, coverage_pct, duration_ms }. Failed batches return status

Read-only structural check of the local SQLite index: SQLite integrity_check, foreign-key violations, required-table presence, FTS5 integrity-check, embedding dimension consistency, and orphan embedding detection. Returns a check-by-check report with status (ok/warn/error) and a suggested repair mode for any non-ok finding. Never writes. Use as a preflight before reindex/embed_repo or when search is misbehaving. Returns JSON: { ok, status, checks: [{ name, status, detail, count?, suggested_repair? }] }.

Apply a targeted repair to the local SQLite index. Modes: drop-orphans (delete embedding rows whose symbol_id no longer exists), drop-vec (drop the entire vector store — search falls back to BM25; embed_repo rebuilds), rebuild-fts (drop and reload symbols_fts from the symbols table). Each mode runs in a transaction so a partial failure leaves the DB unchanged. DESTRUCTIVE — verify_index first to find out which mode is needed. Returns JSON: { mode, ok, detail, affected }.

Notify trace-mcp that a file was edited. Reindexes the single file and invalidates search caches. Call after Edit/Write to keep index fresh — much lighter than full reindex. Also flags duplicate symbols — if `_duplication_warnings` appears, you may be recreating existing logic; review them. Each one is reported once per file, not on every edit; `check_duplication` re-asks. Mutates the index; idempotent. Returns JSON: { status, file, totalFiles, indexed, _duplication_warnings? }.

Single-call orientation context (~150 tokens). Returns project shape, top 3 risk hotspots, top 3 PageRank-central files, top 3 communities, and 3-5 task-routed next-tool suggestions. Use at session start instead of chaining get_project_map + get_pagerank + get_risk_hotspots + get_communities. The optional `task` argument biases the suggestions toward review / refactor / debug / add_feature / understand. Read-only. Returns JSON: { project, health, communities, next_steps }.

Get project overview: detected frameworks, languages, file counts, structure. Read-only, no side effects. Call with summary_only=true at session start to orient yourself before diving into code. Use instead of manual ls/find. Returns JSON: { frameworks, languages, fileCount, symbolCount, structure }.

List environment variable keys from .env files with inferred value types/formats. Never exposes actual values — only keys, types, and formats (url/email/ip/path/uuid/json/base64/csv/dsn/etc). Safe for secrets. Pass `redacted: true` with `file` for a line-by-line redacted view of one file (keys + type hints, no values, preserves order/comments). Returns JSON grouped by file: { [file]: [{ key, type, format, comment }] }.

Explain a symbol in detail using AI — purpose, behavior, relationships, usage patterns

Suggest test cases for a symbol using AI

AI-powered review of a file change — identify issues, risks, and suggestions

Find semantically similar symbols using vector search + optional AI reranking

AI-powered architecture analysis — layers, patterns, and data flow

All-in-one context for starting a dev task: execution paths, tests, entry points, adapted by task type. Use as your FIRST call when beginning any new task — replaces manual chaining of search → get_symbol → Read. For narrower feature-code lookup use get_feature_context instead. Read-only. Returns JSON (default) or Markdown.

Onboarding helper: shows top imported files, most connected symbols (PageRank), language stats, and example tool calls. Call this first when exploring an unfamiliar project. For a structured project map use get_project_map instead. Read-only. Returns JSON: { topFiles, topSymbols, languageStats, exampleQueries }.

Look up a symbol by symbol_id or FQN and return its source code. Use instead of Read when you need one specific function/class/method — returns only the symbol, not the whole file. For multiple symbols at once, prefer get_context_bundle. Read-only. Returns JSON: { symbol_id, name, kind, fqn, signature, file, line_start, line_end, source }.

Full change impact report: risk score + mitigations, breaking change detection, enriched dependents (complexity, coverage, exports), module groups, affected tests, co-change hidden couplings. Pass symbol_ids to scope analysis to changed symbols only. Use before modifying code to understand blast radius. For a quick risk score alone use assess_change_risk; for who-calls-what use get_call_graph. Read-only. Returns JSON: { risk, dependents, affectedTests, breakingChanges, totalAffected }.

Find symbols related via co-location (same file), shared importers, and name similarity. Use when exploring a symbol to discover sibling code. For call-graph relationships use get_call_graph instead; for all usages use find_usages. Read-only. Returns JSON: { related: [{ symbol_id, name, kind, file, relation_type, score }] }.

Get a symbol

Search code by keyword/topic → returns ranked source snippets within a token budget. Use when you need to READ actual code for a concept or feature. For structured task context with tests and entry points use get_task_context instead; for symbol metadata without source use search. Read-only. Returns JSON (default) or Markdown: { items: [{ symbol_id, name, file, source, score }], token_usage } | { content: