# Dependencies Managed by DeusData/codebase-memory-mcp: Complete Package Reference

> Discover dependencies managed by DeusData/codebase-memory-mcp. This package uses two package.json files for Node.js and vendored C/C++ libraries, eliminating the need for pip or Cargo.

- Repository: [Martin Vogel/codebase-memory-mcp](https://github.com/DeusData/codebase-memory-mcp)
- Tags: api-reference
- Published: 2026-07-14

---

**DeusData/codebase-memory-mcp manages all third-party code through two NPM [`package.json`](https://github.com/DeusData/codebase-memory-mcp/blob/main/package.json) files for Node.js components and a comprehensive set of vendored C/C++ libraries including Tree-sitter, SQLite3, and mimalloc, requiring no external package managers like pip or Cargo.**

The `codebase-memory-mcp` repository is a mixed-language project combining high-performance C/C++ system code with a React-based visualization interface. Unlike typical Python or Rust codebases, it contains **no [`requirements.txt`](https://github.com/DeusData/codebase-memory-mcp/blob/main/requirements.txt)**, [`Cargo.toml`](https://github.com/DeusData/codebase-memory-mcp/blob/main/Cargo.toml), or `Pipfile`—instead, every dependency is either declared in NPM manifests or vendored directly into the source tree under permissive licenses.

## Node.js and NPM Dependencies

The project uses Node.js only for distribution packaging and the optional web-based graph UI. All external JavaScript dependencies are locked in two specific locations.

### Core CLI Package ([`pkg/npm/package.json`](https://github.com/DeusData/codebase-memory-mcp/blob/main/pkg/npm/package.json))

The primary NPM manifest at [`pkg/npm/package.json`](https://github.com/DeusData/codebase-memory-mcp/blob/main/pkg/npm/package.json) serves only as metadata for the binary distribution. It defines the `codebase-memory-mcp` command via the `"bin"` field and runs a post-install script ([`install.js`](https://github.com/DeusData/codebase-memory-mcp/blob/main/install.js)), but **imports zero runtime dependencies**. The CLI entry point in [`bin.js`](https://github.com/DeusData/codebase-memory-mcp/blob/main/bin.js) spawns the native binary directly without requiring external NPM packages:

```javascript
#!/usr/bin/env node
// bin.js – entry point defined in pkg/npm/package.json
import { spawn } from 'child_process';
const mcp = spawn('mcp', process.argv.slice(2));

```

### Graph UI Package ([`graph-ui/package.json`](https://github.com/DeusData/codebase-memory-mcp/blob/main/graph-ui/package.json))

The interactive visualization interface—built with React Three Fiber—declares its full dependency tree in [`graph-ui/package.json`](https://github.com/DeusData/codebase-memory-mcp/blob/main/graph-ui/package.json). This includes runtime libraries like `@react-three/fiber`, `@react-three/drei`, `react`, and `react-dom`, plus development tools such as `vite` and `tailwindcss`. The UI is served by the C-based HTTP server ([`src/ui/httpd.c`](https://github.com/DeusData/codebase-memory-mcp/blob/main/src/ui/httpd.c), [`src/ui/http_server.c`](https://github.com/DeusData/codebase-memory-mcp/blob/main/src/ui/http_server.c)) when the project is built with the `--with-ui` flag:

```tsx
import { Canvas } from '@react-three/fiber';
import { OrbitControls } from '@react-three/drei';
import { Suspense } from 'react';
import { Scene } from './Scene';

export default function App() {
  return (
    <Canvas>
      <Suspense fallback={null}>
        <Scene />
        <OrbitControls />
      </Suspense>
    </Canvas>
  );
}

```

## Vendored C and C++ Libraries

All native dependencies are bundled as source code under `vendored/` and `internal/cbm/vendored/`, compiled statically into the final MCP binary. The authoritative list appears in [`THIRD_PARTY.md`](https://github.com/DeusData/codebase-memory-mcp/blob/main/THIRD_PARTY.md).

### Core Runtime Libraries

- **Tree-sitter runtime** (`internal/cbm/vendored/ts_runtime/`) – MIT licensed parser runtime
- **Tree-sitter grammars** – 159 pre-generated parsers (mostly MIT) for multi-language support
- **SQLite 3** (`vendored/sqlite3/`) – Public Domain embedded database
- **mimalloc** (`vendored/mimalloc/`) – MIT licensed memory allocator
- **yyjson** (`vendored/yyjson/`) – MIT high-performance JSON parser
- **xxHash** (`vendored/xxhash/`) – BSD-2-Clause hashing library
- **TRE** (`vendored/tre/`) – BSD-2-Clause regex matching engine
- **Verstable** (`internal/cbm/vendored/verstable/`) – MIT hash table implementation
- **wyhash** (`internal/cbm/vendored/wyhash/`) – Unlicense fast hash function

### Compression and Preprocessing

- **LZ4** (`internal/cbm/vendored/lz4/`) – BSD-2-Clause compression
- **Zstandard** (`internal/cbm/vendored/zstd/`) – BSD-3-Clause compression
- **simplecpp** (`internal/cbm/vendored/simplecpp/`) – 0BSD C/C++ preprocessor

These libraries are initialized directly from the vendored source. For example, `yyjson` is used without external linking:

```c
#include "yyjson.h"

void init_parser(void) {
    yyjson_doc *doc = yyjson_read("{\"key\": \"value\"}", YYJSON_READ_INSITU);
    // … use the parsed JSON …
    yyjson_doc_free(doc);
}

```

## Embedded Model Data and Build Tools

### Nomic Embeddings

The semantic vector search engine uses Apache-2.0-licensed token embeddings from the **nomic-embed-code** model, stored in `vendored/nomic/`. These vectors are generated by [`scripts/extract_nomic_vectors.py`](https://github.com/DeusData/codebase-memory-mcp/blob/main/scripts/extract_nomic_vectors.py) and compiled into the binary for offline semantic code search.

### Build Configuration

The repository contains **no external build-time dependency managers**. Compilation is orchestrated through:

- `Makefile.cbm` – Primary build script linking all vendored libraries
- `Dockerfile*` – Container definitions using only system toolchains
- [`install.sh`](https://github.com/DeusData/codebase-memory-mcp/blob/main/install.sh) / `install.ps1` – Installation scripts with no package manager calls

## Summary

- **NPM manifests**: Two [`package.json`](https://github.com/DeusData/codebase-memory-mcp/blob/main/package.json) files exist—one minimal CLI wrapper at [`pkg/npm/package.json`](https://github.com/DeusData/codebase-memory-mcp/blob/main/pkg/npm/package.json) and one full UI dependency tree at [`graph-ui/package.json`](https://github.com/DeusData/codebase-memory-mcp/blob/main/graph-ui/package.json)
- **Zero external package managers**: No [`requirements.txt`](https://github.com/DeusData/codebase-memory-mcp/blob/main/requirements.txt), `Pipfile`, [`Cargo.toml`](https://github.com/DeusData/codebase-memory-mcp/blob/main/Cargo.toml), or Conan files are present
- **Vendored native code**: All C/C++ dependencies (SQLite3, Tree-sitter, mimalloc, LZ4, Zstd, etc.) live under `vendored/` and `internal/cbm/vendored/`
- **Static compilation**: Third-party libraries are compiled directly into the MCP binary, eliminating system package dependencies
- **Embedded assets**: Model data (nomic embeddings) is vendored under `vendored/nomic/`

## Frequently Asked Questions

### Does codebase-memory-mcp require Python pip or a requirements.txt?

No. The repository contains **no [`requirements.txt`](https://github.com/DeusData/codebase-memory-mcp/blob/main/requirements.txt)**, `Pipfile`, or [`pyproject.toml`](https://github.com/DeusData/codebase-memory-mcp/blob/main/pyproject.toml). The only Python script ([`scripts/extract_nomic_vectors.py`](https://github.com/DeusData/codebase-memory-mcp/blob/main/scripts/extract_nomic_vectors.py)) is a development utility for generating embedding vectors, not a runtime dependency. All functionality is provided by vendored C/C++ code and the native binary.

### How are the C and C++ libraries updated if they are vendored?

Updates require manually replacing the source directories under `vendored/` and `internal/cbm/vendored/` with new upstream versions, then verifying compatibility via `Makefile.cbm`. The [`THIRD_PARTY.md`](https://github.com/DeusData/codebase-memory-mcp/blob/main/THIRD_PARTY.md) file tracks version numbers and licenses for audit purposes. This vendored approach ensures reproducible builds without relying on system package managers.

### What Node.js version is required for the graph UI?

The [`graph-ui/package.json`](https://github.com/DeusData/codebase-memory-mcp/blob/main/graph-ui/package.json) specifies modern React and Vite tooling that requires Node.js 18 or higher. However, the core MCP functionality operates entirely through the native binary; the UI is optional and only needed when building with the `--with-ui` flag to enable the Three.js-based visualization server.

### Why vendored libraries instead of system packages or Conan/vcpkg?

The project prioritizes **static, hermetic builds** that produce a single portable binary. By vendoring libraries like SQLite3, yyjson, and Zstandard, the build avoids version conflicts across different Linux distributions or macOS Homebrew installations. All third-party code is inspected and blessed in [`THIRD_PARTY.md`](https://github.com/DeusData/codebase-memory-mcp/blob/main/THIRD_PARTY.md) for license compliance before inclusion.