# Build Tools Used in DeusData codebase-memory-mcp: Complete Build System Guide

> Discover the build tools in DeusData codebase-memory-mcp including GNU Make, npm, Vite, and Go modules. Learn how they orchestrate this complex project for optimal performance and development.

- Repository: [Martin Vogel/codebase-memory-mcp](https://github.com/DeusData/codebase-memory-mcp)
- Tags: deep-dive
- Published: 2026-07-25

---

**The DeusData codebase-memory-mcp project uses GNU Make as its primary build orchestrator, supplemented by npm and Vite for the React UI, Go modules for LSP components, and custom shell scripts for asset embedding and security auditing.**

The **codebase-memory-mcp** repository employs a hybrid build architecture that combines traditional C/C++ compilation with modern JavaScript tooling. Understanding the build tools used in this project is essential for contributors who need to compile the native binary, embed the optional React Three Fiber UI, or run the comprehensive test suites with various sanitizers.

## Core Build System: GNU Make and Makefile.cbm

At the heart of the project lies **GNU Make**, driven by the custom `Makefile.cbm` located in the repository root. This makefile serves as the single source of truth for building, testing, linting, and packaging the entire project.

### C/C++ Compilation Targets

The `Makefile.cbm` handles compiler selection through the `CC` and `CXX` variables and manages platform-specific linking requirements. For Windows builds, it automatically includes `-lws2_32` for Winsock support. Key make targets include:

- **`cbm`**: Compiles the pure C binary without UI dependencies
- **`cbm-with-ui`**: Builds the full production binary with embedded React assets
- **`clean-c`**: Removes all compiled artifacts and object files

### Sanitizer and Testing Targets

The build system integrates AddressSanitizer, UndefinedBehaviorSanitizer, and ThreadSanitizer through dedicated targets:

- **`test`**: Builds `build/c/codebase-memory-mcp` and executes the C test suite with ASan and UBSan
- **`test-tsan`**: Runs the ThreadSanitizer variant for concurrency bug detection
- **`test-repro`**: Provides specialized builds for bug reproduction scenarios

## Frontend Build Pipeline: npm and Vite

The UI layer resides in `graph-ui/` and utilizes **npm** combined with **Vite** as the build tool. This modern toolchain handles the React 19 and Three.js 0.183 dependencies declared in [`graph-ui/package.json`](https://github.com/DeusData/codebase-memory-mcp/blob/main/graph-ui/package.json).

### React Three Fiber UI Dependencies

The [`package.json`](https://github.com/DeusData/codebase-memory-mcp/blob/main/package.json) specifies the complete dependency tree for the 3D visualization interface. When building the full application, the `frontend` make target executes:

```bash
npm ci && npm run build

```

This process generates a static bundle that must be converted before embedding into the native binary.

### Asset Embedding with Shell Scripts

After the Vite build completes, the **[`scripts/embed-frontend.sh`](https://github.com/DeusData/codebase-memory-mcp/blob/main/scripts/embed-frontend.sh)** shell script transforms the generated JavaScript and CSS assets into C object files. The `embed` make target invokes this script, which produces linkable objects that get compiled into the final `cbm-with-ui` binary. This approach allows the C application to serve the UI directly without external file dependencies.

## Go Module Support for LSP Components

For the Language Server Protocol implementations and other Go-based utilities, the project uses **Go modules** defined in `pkg/go/go.mod`. The standard Go toolchain handles dependency resolution and compilation for these components, separate from the main C build process.

## Static Analysis and Security Tooling

The repository maintains high code quality through automated static analysis and security scanning tools orchestrated by the makefile.

### Linting with clang-tidy and cppcheck

The `Makefile.cbm` defines several lint targets that enforce code standards:

- **`lint-tidy`**: Runs **clang-tidy** against the source tree for C++ best practice enforcement
- **`lint-cppcheck`**: Executes **cppcheck** for deep static analysis and bug detection
- **`lint-format`**: Invokes **clang-format** to verify code formatting compliance

### Security Audits via Custom Bash Scripts

Security validation relies on custom **bash** scripts located in `scripts/`:

- **[`scripts/security-audit.sh`](https://github.com/DeusData/codebase-memory-mcp/blob/main/scripts/security-audit.sh)**: Performs comprehensive binary-level security audits
- **[`scripts/security-strings.sh`](https://github.com/DeusData/codebase-memory-mcp/blob/main/scripts/security-strings.sh)**: Scans binaries for suspicious string patterns
- **`security` make target**: Orchestrates the complete security validation suite, including UI checks and dependency scans

## How to Build the Project

To compile the project using the build tools described above:

```bash

# Build the production binary (pure C, no UI)

make -f Makefile.cbm cbm

# Build and embed the UI (requires Node.js and npm)

make -f Makefile.cbm cbm-with-ui

# Run the full test suite with AddressSanitizer & UndefinedBehaviorSanitizer

make -f Makefile.cbm test

# Run the ThreadSanitizer test suite

make -f Makefile.cbm test-tsan

# Clean all compiled artifacts

make -f Makefile.cbm clean-c

# Lint the source code (clang-tidy, cppcheck, clang-format)

make -f Makefile.cbm lint

```

## Summary

- **GNU Make** (`Makefile.cbm`) serves as the primary build orchestrator for all C/C++ compilation, testing, and packaging tasks.
- **npm and Vite** handle the React Three Fiber UI build process in the `graph-ui/` directory.
- **Shell scripts** ([`scripts/embed-frontend.sh`](https://github.com/DeusData/codebase-memory-mcp/blob/main/scripts/embed-frontend.sh)) convert UI assets into linkable C objects for binary embedding.
- **Go modules** manage dependencies for the Go-based LSP components in `pkg/go/`.
- **clang-tidy**, **cppcheck**, and **clang-format** provide static analysis and formatting enforcement.
- **Custom bash scripts** under `scripts/` perform security audits and binary validation.

## Frequently Asked Questions

### What is the primary build tool for the C/C++ code?

The project uses **GNU Make** with a custom makefile named `Makefile.cbm`. This file controls compiler selection, sanitizer flags, static linking options, and platform-specific configurations such as Windows Winsock linking.

### How is the React UI embedded into the native binary?

The build process uses **Vite** to create a static bundle from the React code, then executes [`scripts/embed-frontend.sh`](https://github.com/DeusData/codebase-memory-mcp/blob/main/scripts/embed-frontend.sh) to convert those assets into C object files. The `cbm-with-ui` make target links these objects directly into the final binary, eliminating external file dependencies.

### Can I build the project without the UI components?

Yes. Running `make -f Makefile.cbm cbm` produces a pure C binary without any UI dependencies or Node.js requirements. This is useful for server deployments or environments where the 3D visualization interface is not needed.

### What testing and sanitization options are available?

The build system supports **AddressSanitizer**, **UndefinedBehaviorSanitizer**, and **ThreadSanitizer** through dedicated make targets. Run `make test` for standard ASan/UBSan testing, or `make test-tsan` specifically for race condition detection. All test binaries are built from the comprehensive C test suite located in `tests/`.