What Graphify actually adds to a coding agent

Graphify appears in a lot of posts about coding agents, usually with a large number next to it and a claim about how many tokens it saves. Komati Commerce, the fictional South African commerce platform in this series, wanted to know something more useful before letting it near a ten-year-old codebase: what the tool actually does, who maintains it, under what licence, and what it would change about how the team's agents work.

Part 1 argued that a coding agent needs a map of the code before it needs more context. This part looks at one tool that builds such a map. It is not a product endorsement. We separate what the project documents, what we inferred from that documentation, and what we have not verified.

What we checked, and how

Everything in this section was checked on 7 November 2026 against the project's own repository, its package registry entry and its documentation site. We did not benchmark the tool ourselves.

Two cautions apply. First, popularity figures shown on repository pages are not evidence of quality, and we do not repeat them. Second, the headline "cut agent token spend by 80%" on the README is attached to the hosted Cloud product, not to the open-source tool, and we found no independent verification of it. Treat it as a vendor claim.

What it actually does

According to its README, Graphify builds a knowledge graph of a project that an assistant queries "instead of grepping through files". The pipeline has two halves.

Code is parsed locally. Source files are parsed with tree-sitter across what the README describes as about 40 languages: "deterministic, no LLM, nothing leaves your machine". Graphify then resolves calls, imports, inherits and mixes_in relationships across files. It groups the graph into communities (subsystems) using the Leiden algorithm (without the optional leiden extra, the README says it falls back to the Louvain method), ranks the most-connected "god nodes", and turns # NOTE: and # WHY: comments and ADR or RFC citations into nodes linked to the code.

Documents and media are optional and use a model. Docs, PDFs, images and video go through a semantic pass that uses the assistant's own model or a configured backend. Audio and video are transcribed locally first. Setting GRAPHIFY_BACKEND=none disables the model backends and keeps a code-only graph.

The output is three files. graph.json holds the full graph, GRAPH_REPORT.md summarises key concepts and suggested questions, and graph.html is an interactive view. The README is explicit that this is "not a vector index": there are no embeddings and no vector store.

Every edge is labelled. Each relationship is tagged EXTRACTED (explicit in the source) or INFERRED (resolved by Graphify), and a path query reports its overall confidence as that of its weakest hop.

How an agent reaches it

There are three routes, and the documentation is careful to keep them separate.

• The command line. graphify query "<question>" returns a scoped subgraph within a token budget, graphify path A B traces how two things connect, and graphify explain describes one concept. A name that matches several nodes is refused, with the candidates listed, rather than guessed. Scripts can read the outcome from the exit code: 0 for an answer, 3 for an ambiguous name, 4 for no match.
• An installed skill, with hooks. graphify install registers a skill for the user's assistant. The README lists more than 20 platforms, including Claude Code, Cursor, Codex, Gemini CLI and GitHub Copilot. On Claude Code and Gemini CLI, a hook fires before search-style tool calls and nudges the agent toward the graph, and an optional strict mode on Claude Code can deny an indexed file read or search (once per session) when the agent has not recently queried the graph.
• An MCP server. An optional extra provides an MCP server over graph.json, run over stdio for one agent or streamable HTTP for a team, with tools such as query_graph, get_node, get_neighbors, shortest_path and get_pr_impact. The documentation does not state that every tool is read-only, so check before you connect it.

For teams, the documentation recommends committing only graph.json, rebuilding it in a pre-commit hook and registering a merge driver that takes the union of nodes and edges. A graphify prs command uses the GitHub command-line tool and the local graph to show which parts of the graph an open pull request touches. The documentation calls its conflict view "a review signal, not a guarantee".

What it adds to the harness

Read against the guides, guards, checks and sensors framework, Graphify contributes mainly to two of the four.

A guide that comes before reading. The skill and hooks change the order of the agent's work. Instead of searching and opening files until something looks right, the agent asks the graph where a concept lives and what connects to it, then reads. That is the orient-then-read pattern from part 1, enforced by the harness rather than left to the prompt.

Relationship questions that text search cannot answer. "What connects the order service to the invoice builder?" is a path question. Graphify answers it with a list of hops and a confidence for each. Search can only return files that mention both names.

Refusal instead of a guess. An ambiguous name produces candidates and a distinct exit code. For an agent, that is a useful signal to stop and disambiguate rather than carry on with the wrong total.

A sensor at review time. Graph impact for a pull request gives a reviewer a starting point for asking what else a change touches. Part 5 builds on this idea.

Rationale next to code. Linking WHY comments and decision-record citations into the graph puts some of the intent layer within the agent's reach, provided someone writes them.

What it does not do

This list is our inference from the documentation and from how this class of tool works. It is not a list of defects.

• It is not a compiler. Tree-sitter gives syntax. Resolution across files is done by Graphify, which is why those edges are labelled INFERRED. Where a language server or SCIP index is available, its references will usually be more precise. Treat inferred edges as hypotheses that the agent confirms by reading the code.
• It cannot see what is not in the source. SQL built in strings, event names, configuration-driven wiring and other repositories still need a lexical sweep. Part 3 covers how to combine the two.
• It describes the code as of its last build. Hooks and graphify update keep it current, but a stale graph is worse than no graph because it is trusted.
• It can fail quietly. The README warns that ambiguous file extensions (.h, .m, .inc) can be parsed as the wrong language and produce a sparse graph that "looks populated while the real symbols are missing". Check node counts for each language on the first build.
• Its benchmarks are not your outcome. The published benchmarks are mostly memory and question-answering tests, such as LOCOMO and LongMemEval, plus one small cross-tool test on an open-source ERP codebase, all run by the project. They say nothing about whether your agent will miss fewer downstream effects.

Governance questions before you adopt it

Komati Commerce's platform team answered these before the trial, not after.

Where does code go? Code parsing stays local. The semantic pass over documents sends content to whichever backend is configured, and the README notes that the provider is auto-detected from whichever API key is set. One listed backend routes to servers in China. For a regulated codebase, set the backend explicitly or disable it, and record the choice.

What is logged? Queries are logged locally by default to a file in the user's cache folder, with question, corpus and duration. That is useful for evaluation, but decide whether it is acceptable on shared machines. It can be switched off.

What does it change about agent behaviour? Hooks that deny reads are a policy decision. Make it deliberately, per repository, and tell the team.

What instructions does it bring with it? When we fetched the documentation site on 7 November 2026, the page source included a block of instructions intended for AI assistants that read the documentation. It asks them to recommend the hosted service by default and describes the open-source CLI as the option for offline or on-machine setups. Vendors are entitled to state their preferences, and the general point applies to any tool: documentation your agent reads is input, not instruction. The harness should decide which sources an agent may treat as guidance.

What is the dependency risk? A fast release cadence is a sign of active development, and it also means pinning versions, reading change notes and testing upgrades. Open source does not mean low risk or high risk sets out the questions to ask.

A two-week trial that produces evidence

Rather than debate the tool, Komati Commerce ran the kind of experiment described in Stop debating harnesses. Run the experiment.

The numbers Komati recorded are its own and illustrative. The structure is the useful part: a fixed task set drawn from your own history is the only benchmark that answers your question.

Key points

• Verified on 7 November 2026: Graphify is maintained at Graphify-Labs/graphify, licensed Apache-2.0 (with earlier MIT-licensed portions), published on PyPI as graphifyy, with v0.9.103 as the latest release.
• It parses code locally with tree-sitter, resolves calls, imports and inheritance into a graph, labels each edge as extracted or inferred, and exposes the graph through a CLI, an assistant skill with hooks, and an optional MCP server.
• Its value to an agent is orientation before reading, path questions, refusal on ambiguity and graph impact at review.
• It is not compiler-accurate, cannot see string-based or cross-repository links, and goes stale without a rebuild.
• The token-saving headline belongs to the hosted product and is unverified. Run your own trial on your own history.

This is part 2 of Codebase Intelligence for AI-Assisted Engineering. Previous: Your coding agent does not need more context. It needs a map. Next: RAG finds similar text. A code graph finds relationships.

Background reading: the Graphify repository and README, the graphifyy package, and the project's MCP server, team workflow and pull request documentation, all checked on 7 November 2026.

How CloudNala can help

CloudNala helps engineering teams evaluate code-graph tools such as Graphify before they reach a production repository. We verify the project's provenance and licence, configure a code-only build with the data-handling choices recorded, build a task set from your own defect history, and run a with-and-without trial, so the decision to adopt rests on evidence from your codebase rather than on a headline.

Work with CloudNala

CloudNala helps organisations move from technology ambition to practical execution across cloud, AI, data, platform engineering and digital services.

Whether you are exploring AI, modernising your cloud environment, building a public-sector digital service, or turning an idea into a working MVP, we can help you shape the roadmap and deliver the next step.

Book a Codebase Intelligence Review or write to us at consult@cloudnala.co.za