Code-Graph-RAG Files

⚠️ Breaking changes

The MCP server and the agent's file tools refuse three things they used to do:

• No file tool writes inside a .git directory any more, or inside the git directory a .git file points to (git init --separate-git-dir, a worktree), in the CLI or over MCP. Git runs the commands its config and hooks name, so a write there could run code on your machine. Change git's own files with git.
• MCP write_file and surgical_replace_code no longer change files that look like credentials (.env, .env.*, private keys, .aws/credentials, and the rest of the list MCP read_file already refuses). .env.example and other templates are still written. To keep the old behaviour, export CGR_ALLOW_SENSITIVE_WRITES=true in the environment the server starts with (a .env file cannot set it). The CLI agent already asks before every write and is unchanged.
• cgr mcp-server no longer starts in a directory that holds your home directory, or in a disk root such as /, unless TARGET_REPO_PATH names it (a client that names a narrower project in CLAUDE_PROJECT_ROOT gets that project served instead). A client that launches the server without TARGET_REPO_PATH from such a directory now gets a configuration error at start-up. Set TARGET_REPO_PATH to the project's directory in the client's server configuration, as the MCP setup guide shows.

The HTTP transport without MCP_HTTP_AUTH_TOKEN now also refuses requests whose Host or Origin header names anything other than 127.0.0.1, localhost or [::1] on the server's port. Local clients are unaffected. With a token nothing changes.

Existing installs: a server configured with TARGET_REPO_PATH set to a project, as the setup guide shows, starts as before. See Credential files and the MCP server guide.

Highlights

• Rust Upgrade: Updated Rust to version 1.99.1-slim-trixie.
• Security Improvements: Enhanced security by determining the target Git directory for writes and hardening the MCP server's file tools and HTTP transport.
• Signature Functionality: Added support for reading and writing JavaScript headers for change signatures, including the ability to change the signature of JavaScript functions or methods.
• Benchmark Enhancement: Added ColGrep to the retrieval benchmark for improved evaluation.
• Dependency Updates: Updated several dependencies including anthropics/claude-code-action, click, zensical, ty and eclipse-temurin.
• CI Improvements: Introduced a check to fail the merge if Greptile scores the head commit below 5/5.
• macOS Compatibility: The build now leaves macOS-14 support.

What's Changed

• fix(release): build the image with a pinned Rust and leave macos-14 by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3559
• feat(evals): add ColGrep as a third arm in the retrieval benchmark by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3539
• ci: fail the merge when Greptile scores the head commit below 5/5 by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3558
• feat(signature): read JavaScript headers for change_signature by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3511
• feat(signature): write JavaScript headers and call sites by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3512
• feat(signature): change the signature of a JavaScript function or method by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3513
• build(deps): bump anthropics/claude-code-action from 1.0.264 to 1.0.265 by @dependabot[bot] in https://github.com/vitali87/code-graph-rag/pull/3561
• build(deps): bump rust from 1.97.0-slim-trixie to 1.99.1-slim-trixie by @dependabot[bot] in https://github.com/vitali87/code-graph-rag/pull/3562
• build(deps-dev): bump maturin from 1.15.0 to 1.16.0 by @dependabot[bot] in https://github.com/vitali87/code-graph-rag/pull/3563
• build(deps): bump click from 8.4.2 to 8.5.0 by @dependabot[bot] in https://github.com/vitali87/code-graph-rag/pull/3564
• build(deps-dev): bump zensical from 0.0.72 to 0.0.73 by @dependabot[bot] in https://github.com/vitali87/code-graph-rag/pull/3565
• build(deps-dev): bump ty from 0.0.92 to 0.0.95 by @dependabot[bot] in https://github.com/vitali87/code-graph-rag/pull/3566
• build(deps): bump eclipse-temurin from 2d5d5e9 to 83f4a7f in /.oss-scanner by @dependabot[bot] in https://github.com/vitali87/code-graph-rag/pull/3567
• fix(security): ask git which git directory a write would land in by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3569
• fix(signature): carry a bare old Python parameter whose name is not ASCII by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3568
• fix(security)!: harden the MCP server's file tools and HTTP transport by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3557

Full Changelog: https://github.com/vitali87/code-graph-rag/compare/v0.4.19...v0.5.0