Weavatrix — native MCP repository intelligence

Part of the Weavatrix ecosystem: evidence infrastructure for AI software agents.

Give your coding agent repository evidence before it starts guessing.

Weavatrix is the native MCP product for repository intelligence. It gives Codex, Claude Code, and other coding agents 47 read-only operations over one revision-bound evidence graph: impact, architecture, APIs, Git history, duplicates, dead code, search, semantic links, and temporal memory.

It does not answer from a larger grep or an invented confidence score. Every bounded result can carry the repository revision, file, line, extractor, evidence kind, and confidence that produced it.

Ecosystem place (UNDERSTAND)

Weavatrix (this) — code facts
        │
        ▼
Weavatrix Loom — semantic composition (capabilities, registry, compile → Rust)
        │
        ▼
Realforge — artifact construction (scaffold / package / deploy)

Loom consumes Weavatrix facts for semantic classification (e.g. “this fn is a candidate for data.json.parse@1”). Loom must not grow a second product code indexer. Normative Loom side: ADR-0012.

The same source is distributed in two forms:

The npm package exists for convenience; it does not contain a different JavaScript engine. Both distributions run the same native adapter and the same weavatrix-rust analysis engine. The separately versioned weavatrix-js package is the legacy JavaScript implementation used for compatibility and historical baselines; it is not bundled into weavatrix.

Install as a plugin

The repository ships one plugin bundle for Cursor, Codex, Claude Code, and Grok Build. Each client starts the published native npm distribution and loads the same read-only MCP tools. Its optional Weavatrix skill activates only for tasks that benefit from indexed, cross-file evidence; detailed tool routing is loaded separately when needed.

Cursor plugin

Search for Weavatrix in Cursor's Plugins view after its marketplace review is complete. The bundle can be tested before listing by copying or linking plugins/weavatrix to ~/.cursor/plugins/local/weavatrix and reloading the Cursor window.

Codex plugin

codex plugin marketplace add Weavatrix/weavatrix --sparse .agents/plugins plugins/weavatrix
codex plugin add weavatrix@weavatrix

Claude Code plugin

claude plugin marketplace add Weavatrix/weavatrix --sparse .claude-plugin plugins
claude plugin install weavatrix@weavatrix

Grok Build plugin

grok plugin marketplace add Weavatrix/weavatrix

Open /marketplace and install Weavatrix. Grok also accepts the plugin directly with grok plugin install Weavatrix/weavatrix#plugins/weavatrix.

Install in 30 seconds

Run the convenient prebuilt npm distribution:

npx -y weavatrix mcp .

Or install the same MCP product through Cargo:

cargo install weavatrix
weavatrix mcp .

Codex

# ~/.codex/config.toml
[mcp_servers.weavatrix]
command = "npx"
args = ["-y", "weavatrix", "mcp", "."]

Claude Code

claude mcp add weavatrix -- npx -y weavatrix mcp .

Grok

grok mcp add weavatrix -- npx -y weavatrix mcp .

Everything after -- is the server command, so -y reaches npx instead of Grok. The equivalent hand-written entry:

# ~/.grok/config.toml
[mcp_servers.weavatrix]
command = "npx"
args = ["-y", "weavatrix", "mcp", "."]
startup_timeout_sec = 120

The package unpacks to roughly 40 MB, so the first npx launch can spend longer fetching it than Grok's 30-second default startup timeout allows. startup_timeout_sec covers that once; npm i -g weavatrix or cargo install weavatrix removes the cold start for every later session.

Use --scope project to write .grok/config.toml inside a repository instead, so a clone carries the server with it.

Cursor

// ~/.cursor/mcp.json
{
  "mcpServers": {
    "weavatrix": {
      "command": "npx",
      "args": ["-y", "weavatrix", "mcp", "."]
    }
  }
}

Profiles expose bounded views of the same engine:

npx -y weavatrix mcp . --profile=all
npx -y weavatrix mcp . --profile=code
npx -y weavatrix mcp . --profile=seo

The npm package contains native binaries for Windows x64/arm64, macOS x64/arm64, and glibc Linux x64/arm64. It has no install script and performs no runtime download.

Halve every answer on a client that reads structured output

An MCP result carries the payload twice: once as structuredContent, and once mirrored into a text block for clients that read only content. The mirror is the pretty-printed copy, so it is the larger of the two.

npx -y weavatrix mcp . --output-format=structured

Measured on run_audit over a real repository, the response falls from 8931 to 3589 bytes, 59.8% smaller. Whether a client reads structured output does not change between calls, so it is chosen once at startup rather than restated as an argument on every call; WEAVATRIX_OUTPUT_FORMAT=structured does the same where a flag is awkward, and a call that names its own output_format still wins.

json is the default and keeps the mirror, because a client that ignores structuredContent would otherwise see an empty result. text returns the concise text block alone.

What an agent can ask

What breaks if I change src/auth/middleware.ts?
Trace POST /api/orders through this backend and its clients.
Which production symbols are dead, and what evidence proves it?
Show duplicate implementations but suppress router boilerplate.
Which dependency violates .weavatrix/architecture.json?
Find every GraphQL, gRPC, Kafka, RabbitMQ, NATS, JMS, SQS, or SNS
contract affected by this branch.
Build the smallest source bundle needed to edit this symbol safely.
Show me this file as it was two commits ago, without a checkout.
Suggest internal links without mixing inferred SEO relationships into
the deterministic code graph.

The graph is built once per revision. Impact, API traces, health findings, architecture checks, clone families, and context bundles therefore agree about repository identity instead of recomputing incompatible partial views.

See it answer

Real answers from Weavatrix analyzing its own repository at commit ec8bf30, abridged (…) and with the local root shortened. Reproduce any of them with weavatrix tool <name> . '<arguments>'.

Orient in one call — and know exactly which repository and revision answered:

{"name": "graph_stats", "arguments": {}}

{
  "nodes": 1294,
  "edges": 2771,
  "freshness": {"state": "CURRENT", "source_revision": "sha256:dd3d96d3…"},
  "relations": {"calls": 651, "contains": 1271, "imports": 419, "references": 314, "…": "…"},
  "repository_context": {
    "root": "…/weavatrix",
    "git_head": "ec8bf3041588623f23ec5e7ebbaff3a333da9ca7",
    "scan_revision": "sha256:dd3d96d3…",
    "graph_age_seconds": 0
  }
}

Every answer carries that repository_context block. Add "expected_repository": "weavatrix" to any call and a server that was retargeted elsewhere fails loudly instead of answering about the wrong repository.

Blast radius before you edit:

{"name": "get_dependents", "arguments": {"label": "file:src/mcp/server/mod.rs", "max_nodes": 6}}

{
  "dependents": [
    {"distance": 1, "node": {"id": "file:src/main.rs", "language": "rust"}},
    {"distance": 1, "node": {"id": "file:src/mcp/mod.rs"}},
    {"distance": 1, "node": {"id": "file:src/mcp/server/tests/catalog.rs"}},
    {"…": "…"}
  ]
}

The file as it was — no checkout (git_read_blob):

{"name": "git_read_blob", "arguments": {"path": "Cargo.toml", "revision": "HEAD~3", "max_bytes": 400}}

{
  "path": "Cargo.toml",
  "revision": "70b5bc788a10ec89ab28b9ecbc005e3b9c7f9829",
  "oid": "f5f54bac00a4feb6e965c0d87c5c6d4d25782e91",
  "kind": "utf8-text",
  "lines": ["[package]", "name = \"weavatrix\"", "version = \"1.9.2\"", "…"],
  "size_bytes": 1224,
  "returned_bytes": 400,
  "truncated": true
}

Three commits before ec8bf30 this package was 1.9.2; the agent reads that follow-up to a diff without touching the worktree. Binary blobs fail closed instead of being decoded into garbage.