codebase-memory-mcp Files

A focused follow-up to v0.8.0.

First-party HTTP server

The graph-UI web server has been reimplemented from scratch as a lean in-house module — a refactor that removes the last third-party server library from the binary. The new transport (src/ui/httpd.c) is purpose-built for what the UI actually needs:

• Localhost-only by construction — binds 127.0.0.1 exclusively, with platform-correct socket options on every OS.
• Strict HTTP/1.1 parsing — hard request caps (16 KB head / 1 MB body), strict CRLF handling, raw path matching, and a per-connection receive deadline.
• Simple by design — one request per connection (Connection: close); no keep-alive state machine, no chunked encoding.

A new 28-test transport and routing suite covers the parsing edge cases, CORS policy, RPC dispatch, and shutdown behavior. All routes, status codes, and the localhost-only CORS policy behave exactly as before.

Also in this release

• Slimmer grammar set — the nim grammar (by far the largest vendored grammar at 66 MB) was dropped; 158 languages remain supported.
• Attribution bundle in every archive — release archives now include THIRD_PARTY_NOTICES.md, a consolidated file with the license texts of all vendored components. Homebrew and AUR installs place it alongside the binary.
• Richer SBOM — per-component license and version metadata for everything compiled into the binary.
• Test suite: 5,604 tests (+27 vs v0.8.0).

Update

:::bash
codebase-memory-mcp update

or grab the binaries below — every asset is signed, checksummed, and attested as usual.

Security Verification

All release binaries scanned with 70+ antivirus engines — 0 detections.