The MCP server “io.github.Anandb71/arbor” provides a Graph-Native Intelligence Layer for codebases. Named “Arbor” in the excerpt, it focuses on understanding code using graph-native approaches, with an emphasis on identifying issues early (“Know what breaks before you break it.”).
Graph-native intelligence for codebases.
Know what breaks before you break it.
Side-by-side: an agent navigating tokio with grep-and-read (47 tool calls, still searching) vs the same agent with arbor's code graph (4 graph calls + 1 read, done)
Simulated replay — the arbor commands and their output are real (tokio @ 178k LOC). Methodology: BENCHMARKS.md
v3.0.0 — The Right Node · v2.6.0 stopped dropping colliding symbols. It did not stop resolving them to the wrong one. When a bare name matched several modules, resolution fell through to "same directory" and confidently attached the edge to whichever definition happened to sit next to the caller. On a graded fixture the three largest hubs reported zero downstream impact while unrelated siblings inherited their centrality. A file's own imports now settle it. Reproduce it yourself: getArbor-dev/arbor-torture
Why Arbor
Most AI coding tools treat code as text. Arbor builds a semantic dependency graph — functions, classes, and modules as nodes; calls, imports, and inheritance as edges — then answers execution-aware questions with deterministic precision:
Question
Arbor answer
If I change this symbol, what breaks?
Blast radius with depth, confidence, and risk level
Who calls this — directly and transitively?
Caller/callee traversal on the call graph
What's the shortest path between A and B?
A* path through real dependencies
Is this PR too risky to merge?
CI gate on blast-radius thresholds
No keyword guessing. No embedding hallucinations. One graph, every interface.
Where the graph is unsure, it says so — edges carry a confidence, and ambiguous resolutions are labelled rather than hidden. An honest unknown beats a confident wrong answer.
What's new in v3.0.0
One fix, measured.
Symbol resolution consults the importing file. When a bare name matched
definitions in several modules, resolve_ref fell through to SameDir and
attached the edge to whichever definition sat in the caller's own directory —
not a dropped edge, a confidently misrouted one, stamped at 0.55 confidence.
GraphBuilder already kept a per-file import map, but only
apply_import_validation read it, and that scores an edge after one has been
chosen. It never saw the references going to the wrong node. Consulting it
between the same-file and same-directory checks keeps a local definition
shadowing an import, while letting a written import beat mere adjacency.
Resolution::ViaImport scores 0.93, above SameDir's 0.55.
Measured
A fixture of 260 modules across 10 layers, each layer defining the same 26
function names. Ground truth is derived from the generator's own edge list, so
the expected answer is exact rather than estimated.
True downstream
v2.6.0
v3.0.0
179
0
163
178
0
161
161
0
133
143
22
133
122
22
119
36
22
61
16
22
46
Previously flat at about 22 regardless of the real answer. Now it tracks. Risk
on the largest hub moves from LOW to CRITICAL.
Total edge count barely moves (1335 → 1334). That is the signature of
misrouting rather than loss: the edges were always there, pointing at the wrong
nodes.
Breaking
Resolution gains a ViaImport variant — an exhaustive match will not compile
Edges land on different nodes, so cached graphs, stored node ids, and
centrality baselines from 2.6.0 will differ
Known and still open
Written down rather than left to be discovered:
Small targets now over-report (36 → 61, 16 → 46). Safer direction than
silence, but not yet correct.
PageRank has no escape from a closed cycle. Every member of a 500-function
ring scores above 90% centrality on one caller each, so mutually recursive
clusters — parsers, tree walkers, state machines — crowd the top of any
ranking.
Inheritance produces no edges. class Middle(Base) is invisible, so changing
a base class shows zero blast radius.
Dynamic and reflective imports (importlib, __import__, import(),
eval(require(...))) are unresolvable by construction and are documented as
expected misses in the fixture rather than counted as defects.
Correctness, not speed. Each of these was silently wrong before.
Fix
Why it mattered
Colliding symbols are kept
SymbolTable used HashMap::insert, so a second handler, new, or process replaced the first. The loser had zero callers and was invisible to blast radius.
Resolution is deterministic
Same-directory locality was decided by iterating a HashMap. Rust seeds RandomState per process, so the same binary on the same input could build different edges between runs. Now asserted across eight fresh processes.
Edges carry confidence
A proven same-file call and a same-directory guess were identical evidence. Each edge now scores [0,1] by how it resolved.
Exported TS symbols indexed once
export_statement recursed into its children, then the generic loop recursed again — every exported symbol became two vertices sharing one node id. 133 phantom nodes on a 149-file app, 25% of the graph.
Method calls on untyped receivers resolve
obj.method() was dropped outright, leaving the graph nearly edgeless on TS/JS — and an empty graph reports a blast radius of zero, which reads as "safe" rather than "unknown".
Centrality is a percentile rank
Scores were divided by the graph maximum, so the top node was 1.0 by construction and a 0.6 threshold meant nothing consistent between repos. Adding one hub rescaled every other node.
Resolution is O(1), not O(refs × nodes × files)
Unresolvable references — stdlib and third-party calls, most call sites in real code — paid the worst case. Suffixes are now indexed.
New capability — concept search. Substring matching cannot find get_authenticated from login; they share no substring. Identifiers are now tokenized and expanded through curated concept clusters, and docstrings, signatures, and paths are indexed alongside names. Deterministic, offline, no model. Available on the library as ArborGraph::search_ranked (arbor query remains literal-substring for now).
New capability — hunk-level impact.changed_node_ids_for_ranges keeps only symbols whose lines actually changed, instead of every symbol in a touched file.
Measured on identical node sets, after the duplicate-extraction fix:
Codebase
Before
After
TypeScript (149 files)
172 edges
196 (+14%)
Rust (arbor-graph)
116 edges
167 (+44%)
Graph caches from earlier versions are invalidated — centrality now means something different, so a stale cache would be read wrong.
v2.5.0 — The Last Excuse (PageRank 23x, parallel indexing, warm-start centrality)
