Field-by-field comparison

Compare the evidence before choosing an MCP.

Each signal stays separate, missing facts remain visible, and the column order follows your selection.

MCPs in this comparison

CodeGraph MCPGitHub MCP

Uncheck an MCP to remove it. Comparing two or three keeps each signal in its own row.

Comparable alternatives

Azure MCP ServerMCP100 SelectedChrome DevTools MCPMCP100 SelectedContext7 MCPMCP100 SelectedFirecrawl MCPMCP100 SelectedGrafana Cloud MCPMCP100 SelectedGoogle MCP Toolbox for DatabasesMCP100 Selected

Shown only when capability or industry context overlaps.

Side-by-side MCP evidence comparison
Evidence field	CodeGraph MCPWatchlist candidate	GitHub MCPMCP100 Selected
Task fit
Best for	Exploring callers, callees, imports, dependencies, and change impact Large multilingual repositories where graph relationships add value beyond text search Teams wanting local code indexing without an external API key	Repository, issue, pull-request, and code context Teams that can issue a narrowly scoped PAT or use the hosted OAuth flow Read-only GitHub investigation using restricted toolsets
Not ideal for	Small repositories adequately served by native code search Memory-constrained environments that cannot support the default embedding model Repositories whose source-derived indexes may not be persisted locally	Git hosting outside GitHub Users unable to run Docker for the documented local configuration Workflows that need only a small amount of public repository context
Avoid when	Source code cannot be indexed into a local persistent database The MCP process may start in an unintended working directory Generated, private, or credential-bearing paths cannot be excluded	You cannot restrict the token to the necessary repositories and scopes The agent must not receive private repository, issue, pull-request, or user data Your organization has not approved the OAuth app or PAT policy
Provenance
Provenance details	First-party MCP CodeGraph AI · Publisher source ↗	First-party MCP GitHub · Publisher source ↗
Maintenance
Maintenance details	Repo: Aug 10, 2026 Package: Aug 10, 2026	Repo: Aug 14, 2026 Package: Not documented
Popularity evidence
GitHub stars	61 GitHub stars · checked 2026-08-14T18:46:26.000Z	32,248 GitHub stars · checked 2026-08-14T18:46:26.000Z
30-day package downloads	5,470 30-day package downloads · checked 2026-08-14T18:46:26.000Z	No reliable download data
External adoption evidence	github: repository stars: 61Exact attributable signal.github: repository stars · Admission snapshot · checked 2026-08-14T18:46:26.000ZEvidence source ↗	github: repository stars: 32,248Exact attributable signal.github: repository stars · Admission snapshot · checked 2026-08-14T18:46:26.000ZEvidence source ↗
Client coverage
Client coverage details	Claude Code✓ Local stdio Claude Desktop✓ Local stdio Codex✓ Local stdio VS Code✓ Local stdio Cursor✓ Local stdio OpenCode✓ Local stdio	Claude Code✓ Streamable HTTP Claude Desktop✓ Streamable HTTP Codex✓ Streamable HTTP VS Code✓ Streamable HTTP Cursor✓ Streamable HTTP OpenCode✓ Streamable HTTP
Client coverage note	Local stdio runs on your computer. Streamable HTTP connects to a remotely hosted MCP server.
Access and data
Authentication	None for the local stdio community server.	Hosted service supports OAuth; local stdio uses GITHUB_PERSONAL_ACCESS_TOKEN. GitHub recommends minimum scopes, separate tokens, rotation, and environment-variable handling.
Cost	The repository is Apache-2.0 licensed and the community server has no documented service fee. Local compute and storage apply, and separately offered CodeGraph Pro capabilities may be paid.	The open-source server is MIT licensed. GitHub account, Copilot, Enterprise, Actions, API, or other product charges and limits may apply independently.
Permissions	The server reads and indexes the current working directory by default or explicit `--workspace` paths. Tools can query and reindex code, index Markdown, persist project memories, and generate architecture documentation. Exclusion flags and profiles narrow filesystem and tool reach.	Access follows the authenticated GitHub identity and granted OAuth/PAT permissions. The server supports tool allow-lists, read-only mode, repository-oriented toolsets, and lockdown mode; write tools remain possible unless read-only mode is enabled.
Data handling	Code-derived graph data, embeddings, indexed documentation, and memories persist locally under the CodeGraph data directory. The default embedding model is downloaded on first run; built-in exclusions cover common build, credential, and secret-file paths but do not replace an explicit workspace review.	Repository contents, issues, pull requests, users, actions, and other enabled GitHub API data may be returned to the MCP client. The local server passes requests to GitHub; the hosted server is operated by GitHub. Do not place PATs in committed configuration.
Limitations
Tradeoffs	Semantic graphs provide relationship-aware context but indexing consumes local CPU, memory, and storage. Graph-only and narrow tool profiles reduce resource and context cost but remove semantic or broader tool capabilities. Community features are open source, while additional Pro analysis and security capabilities are separately offered.	The default local toolsets include repositories, issues, pull requests, users, and context; limiting toolsets reduces capability and context size. Local Docker keeps the MCP process local but still sends authorized requests to GitHub APIs. PAT setup is explicit and portable, while hosted OAuth is easier but relies on GitHub's remote MCP service.
Risk context	The main risks are indexing unintended source or sensitive files, persisting source-derived embeddings and memories, and exposing broad tools to the agent. Set an explicit workspace, add exclusions, start with a narrow profile or graph-only mode, and protect or remove local index data when no longer needed.	A broadly scoped token plus write-capable tools can alter repositories and collaboration records. Prefer fine-grained credentials, repository restriction, explicit toolsets, GITHUB_READ_ONLY=1, and lockdown mode where public-content prompt injection is a concern.
Evidence date
Editorial review	2026-07-24	2026-07-24
Candidate evidence	2026-08-14T18:46:26.000Z	2026-08-14T18:46:26.000Z

Popularity, maintenance, fit, permissions, and client support are independent evidence fields.

Read the evidence method →