Dependencies Managed by DeusData/codebase-memory-mcp: Complete Package Reference

DeusData/codebase-memory-mcp manages all third-party code through two NPM package.json files for Node.js components and a comprehensive set of vendored C/C++ libraries including Tree-sitter, SQLite3, and mimalloc, requiring no external package managers like pip or Cargo.

The codebase-memory-mcp repository is a mixed-language project combining high-performance C/C++ system code with a React-based visualization interface. Unlike typical Python or Rust codebases, it contains no requirements.txt, Cargo.toml, or Pipfile—instead, every dependency is either declared in NPM manifests or vendored directly into the source tree under permissive licenses.

Node.js and NPM Dependencies

The project uses Node.js only for distribution packaging and the optional web-based graph UI. All external JavaScript dependencies are locked in two specific locations.

Core CLI Package (pkg/npm/package.json)

The primary NPM manifest at pkg/npm/package.json serves only as metadata for the binary distribution. It defines the codebase-memory-mcp command via the "bin" field and runs a post-install script (install.js), but imports zero runtime dependencies. The CLI entry point in bin.js spawns the native binary directly without requiring external NPM packages:

#!/usr/bin/env node
// bin.js – entry point defined in pkg/npm/package.json
import { spawn } from 'child_process';
const mcp = spawn('mcp', process.argv.slice(2));

Graph UI Package (graph-ui/package.json)

The interactive visualization interface—built with React Three Fiber—declares its full dependency tree in graph-ui/package.json. This includes runtime libraries like @react-three/fiber, @react-three/drei, react, and react-dom, plus development tools such as vite and tailwindcss. The UI is served by the C-based HTTP server (src/ui/httpd.c, src/ui/http_server.c) when the project is built with the --with-ui flag:

import { Canvas } from '@react-three/fiber';
import { OrbitControls } from '@react-three/drei';
import { Suspense } from 'react';
import { Scene } from './Scene';

export default function App() {
  return (
    <Canvas>
      <Suspense fallback={null}>
        <Scene />
        <OrbitControls />
      </Suspense>
    </Canvas>
  );
}

Vendored C and C++ Libraries

All native dependencies are bundled as source code under vendored/ and internal/cbm/vendored/, compiled statically into the final MCP binary. The authoritative list appears in THIRD_PARTY.md.

Core Runtime Libraries

• Tree-sitter runtime (internal/cbm/vendored/ts_runtime/) – MIT licensed parser runtime
• Tree-sitter grammars – 159 pre-generated parsers (mostly MIT) for multi-language support
• SQLite 3 (vendored/sqlite3/) – Public Domain embedded database
• mimalloc (vendored/mimalloc/) – MIT licensed memory allocator
• yyjson (vendored/yyjson/) – MIT high-performance JSON parser
• xxHash (vendored/xxhash/) – BSD-2-Clause hashing library
• TRE (vendored/tre/) – BSD-2-Clause regex matching engine
• Verstable (internal/cbm/vendored/verstable/) – MIT hash table implementation
• wyhash (internal/cbm/vendored/wyhash/) – Unlicense fast hash function

Compression and Preprocessing

• LZ4 (internal/cbm/vendored/lz4/) – BSD-2-Clause compression
• Zstandard (internal/cbm/vendored/zstd/) – BSD-3-Clause compression
• simplecpp (internal/cbm/vendored/simplecpp/) – 0BSD C/C++ preprocessor

These libraries are initialized directly from the vendored source. For example, yyjson is used without external linking:

#include "yyjson.h"

void init_parser(void) {
    yyjson_doc *doc = yyjson_read("{\"key\": \"value\"}", YYJSON_READ_INSITU);
    // … use the parsed JSON …
    yyjson_doc_free(doc);
}

Embedded Model Data and Build Tools

Nomic Embeddings

The semantic vector search engine uses Apache-2.0-licensed token embeddings from the nomic-embed-code model, stored in vendored/nomic/. These vectors are generated by scripts/extract_nomic_vectors.py and compiled into the binary for offline semantic code search.

Build Configuration

The repository contains no external build-time dependency managers. Compilation is orchestrated through:

• Makefile.cbm – Primary build script linking all vendored libraries
• Dockerfile* – Container definitions using only system toolchains
• install.sh / install.ps1 – Installation scripts with no package manager calls

Summary

• NPM manifests: Two package.json files exist—one minimal CLI wrapper at pkg/npm/package.json and one full UI dependency tree at graph-ui/package.json
• Zero external package managers: No requirements.txt, Pipfile, Cargo.toml, or Conan files are present
• Vendored native code: All C/C++ dependencies (SQLite3, Tree-sitter, mimalloc, LZ4, Zstd, etc.) live under vendored/ and internal/cbm/vendored/
• Static compilation: Third-party libraries are compiled directly into the MCP binary, eliminating system package dependencies
• Embedded assets: Model data (nomic embeddings) is vendored under vendored/nomic/

Frequently Asked Questions

Does codebase-memory-mcp require Python pip or a requirements.txt?

No. The repository contains no requirements.txt, Pipfile, or pyproject.toml. The only Python script (scripts/extract_nomic_vectors.py) is a development utility for generating embedding vectors, not a runtime dependency. All functionality is provided by vendored C/C++ code and the native binary.

How are the C and C++ libraries updated if they are vendored?

Updates require manually replacing the source directories under vendored/ and internal/cbm/vendored/ with new upstream versions, then verifying compatibility via Makefile.cbm. The THIRD_PARTY.md file tracks version numbers and licenses for audit purposes. This vendored approach ensures reproducible builds without relying on system package managers.

What Node.js version is required for the graph UI?

The graph-ui/package.json specifies modern React and Vite tooling that requires Node.js 18 or higher. However, the core MCP functionality operates entirely through the native binary; the UI is optional and only needed when building with the --with-ui flag to enable the Three.js-based visualization server.

Why vendored libraries instead of system packages or Conan/vcpkg?

The project prioritizes static, hermetic builds that produce a single portable binary. By vendoring libraries like SQLite3, yyjson, and Zstandard, the build avoids version conflicts across different Linux distributions or macOS Homebrew installations. All third-party code is inspected and blessed in THIRD_PARTY.md for license compliance before inclusion.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}