DeusData codebase-memory-mcp Dependencies: Complete Vendored Library Reference

DeusData codebase-memory-mcp ships as a fully static binary with all runtime dependencies vendored, requiring no external package managers, system libraries, or internet connectivity at install time.

The DeusData/codebase-memory-mcp repository provides a single-binary MCP server that embeds every library it needs for parsing, indexing, and semantic search. Because DeusData codebase-memory-mcp dependencies are compiled directly into the executable at build time, end users never execute npm install, pip install, or apt-get to deploy the tool.

Core Parsing and Storage Dependencies

The foundation of the indexing pipeline relies on Tree-sitter for AST generation and SQLite for persistent storage.

Tree-sitter Runtime and Language Grammars

At internal/cbm/vendored/ts_runtime, the project embeds the Tree-sitter C runtime, which serves as the core parser generator producing ASTs for 158 supported languages. The specific language grammars—160 pre-generated parsers including tree-sitter-python and tree-sitter-go—reside in internal/cbm/vendored/grammars. These components are compiled into the binary, eliminating runtime linking against external parser libraries.

SQLite Graph Database

Persistent graph storage—including nodes, edges, and FTS5 full-text search—depends on the public-domain SQLite engine located at vendored/sqlite3. The database driver is statically linked, allowing the binary to create and query *.db files without requiring a system SQLite installation.

Indexing Pipeline Utilities

High-throughput code analysis requires specialized memory management, compression, and data processing libraries.

Memory Allocation and Compression

For high-performance indexing, the project uses mimalloc (vendored/mimalloc), a fast, low-fragmentation memory allocator that reduces heap overhead during batch processing. Source code compression utilizes LZ4 (internal/cbm/vendored/lz4) for in-memory compression during indexing, while Zstandard (internal/cbm/vendored/zstd) handles final on-disk compression of SQLite graph databases, producing *.zst artifacts.

Hashing and Deduplication

Incremental indexing and deduplication rely on multiple high-speed hash implementations. xxHash (vendored/xxhash) provides rapid hashing for file content comparison. Verstable (internal/cbm/vendored/verstable) generates versioned stable hashes for graph nodes to support incremental updates. wyhash (internal/cbm/vendored/wyhash) offers low-overhead hashing for internal data structures.

Text Processing and Parsing

JSON parsing for the MCP JSON-RPC protocol uses yyjson (vendored/yyjson), while POSIX-compatible regular expressions for structural searches are handled by TRE (vendored/tre). For C/C++ header analysis, the simplecpp preprocessor (internal/cbm/vendored/simplecpp) parses macro definitions and include directives before Tree-sitter AST extraction.

Semantic Search and ML Components

Beyond syntax analysis, the tool provides neural code search through an embedded machine learning model.

Nomic Embeddings Model

The semantic search functionality utilizes the nomic-embed-code model, a 40K-token, 768-dimensional embedding system stored in vendored/nomic. Licensed under Apache 2.0, this model enables the cli semantic_query command to perform vector similarity searches without calling external APIs. When you execute:

codebase-memory-mcp cli semantic_query '{"query":"authentication"}'

The binary references the bundled embeddings stored in vendored/nomic to compute vector similarities against indexed code.

Optional Frontend Dependencies

The core binary operates independently of any JavaScript runtime. However, the optional 3-D visualization interface requires additional frontend libraries.

React and Three.js UI Stack

When building the -ui variant, the project bundles a React 18 application defined in graph-ui/package.json. This interface uses Three.js and @react-three/fiber for 3-D graph rendering, radix-ui for accessible UI components, lucide-react for iconography, and Tailwind CSS for styling. These dependencies are compiled into static assets served at localhost:9749 when running:

codebase-memory-mcp --ui=true --port=9749

Note that the standard binary does not include these web assets; they are only present in builds specifically marked with the UI variant.

Dependency Verification and Licensing

All vendored code is inventoried in THIRD_PARTY.md at the repository root. This document provides the complete licensing breakdown for every embedded library, from BSD-2-Clause hash implementations to MIT-licensed JSON parsers.

To inspect the exact dependency versions compiled into your binary:

# Display version information confirming embedded runtime presence

codebase-memory-mcp --version

# View the complete third-party attribution list

cat THIRD_PARTY.md

The pkg/npm/package.json file contains NPM packaging metadata showing the binary entry point, though this is used only for distribution wrapping and does not affect the binary's internal vendored dependencies.

Summary

• DeusData codebase-memory-mcp dependencies are entirely vendored and statically compiled—no runtime package installation is required.
• Core functionality relies on Tree-sitter (internal/cbm/vendored/ts_runtime), SQLite (vendored/sqlite3), and mimalloc (vendored/mimalloc).
• Compression, hashing, and JSON processing use LZ4, Zstandard, xxHash, and yyjson, all embedded in vendored/ and internal/cbm/vendored/ directories.
• Semantic search operates via the bundled nomic-embed-code model in vendored/nomic, enabling offline vector queries.
• The optional 3-D UI (graph-ui/package.json) requires React and Three.js, but only when explicitly building the UI-enabled binary variant.
• Authoritative licensing and dependency information resides in THIRD_PARTY.md.

Frequently Asked Questions

Does codebase-memory-mcp require npm, pip, or system package managers to run?

No. The binary embeds all required C libraries, Tree-sitter grammars, and the SQLite engine. You only need to download the archive for your OS and architecture. The optional UI variant includes pre-compiled JavaScript assets and does not require npm install at runtime.

Where are third-party libraries located in the source repository?

Vendored dependencies reside in two primary locations: vendored/ for top-level components like SQLite and xxHash, and internal/cbm/vendored/ for internal libraries like Tree-sitter grammars, LZ4, Zstandard, and simplecpp. The complete inventory is documented in THIRD_PARTY.md.

What embedding model powers the semantic search feature?

The semantic search tool uses the nomic-embed-code model, a 40K-token, 768-dimensional embedding system stored in vendored/nomic. This Apache 2.0-licensed model is bundled directly into the binary, allowing offline vector similarity searches without external API calls.

Is internet connectivity required after installation?

No. Because all dependencies—including the Tree-sitter grammars, SQLite database engine, and Nomic embedding model—are vendored into the static binary, the tool operates entirely offline after the initial binary download.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}