grasp

Grasp is a code architecture visualization and static analysis tool that also provides an MCP (Model Context Protocol) server. It can turn any GitHub or GitLab repository (cloud or self-hosted) or local codebase into an interactive architecture map within seconds. The current version v3.21.0 includes a total of 150 MCP tools, 8 resources, and 2 prompts, supports 35 languages, 11 AI providers, and more than 200 models accessible through OpenRouter, 10 graphical views, and integrates a multimodal knowledge graph.

In terms of use, Grasp is primarily aimed at developers, tech leads, and teams who need to understand complex code architecture. Through views such as dependency graphs, architecture layer diagrams, tree maps (showing file size by line count), and team dashboards, it helps users quickly grasp the structure of a codebase.

Main capabilities include:

• Code intelligence analysis: gives an A–F rating (0–100 points) based on dead code, circular dependencies, coupling metrics, and security issues.
• Security scanning: detects hardcoded secrets, SQL injection risks, dangerous eval() usage, and production debug statements. v3.20.0 expanded the five-layer security scanning suite grasp_vulnerabilities, covering dependency CVEs (OSV.dev), container/runtime CVEs (NIST NVD), local supply chain integrity checks, Socket.dev behavioral analysis, and scheduled monitoring (grasp_vuln_watch).
• Pattern detection: identifies singleton, factory, observer/event patterns, React hooks, and anti-patterns (such as god objects and high coupling).
• Impact scope analysis: after selecting a file, all downstream affected files can be seen, and PR impact analysis can paste a PR URL to calculate the impact scope of changes.
• Activity heatmap: colors by commit frequency, supporting the GitHub API or local git log.
• Duplication and similarity detection: Dup color mode highlights exact or near-duplicate code, and the grasp_similarity tool returns ranked duplicate clusters.
• Code attribution: obtains the main contributor and line percentage for each file from git history, and can jump to GitHub Blame.
• Technical debt quantification: converts architectural issues into developer hours (configurable estimates, such as 4 hours for circular dependencies, 16 hours for god files, and 8 hours for serious security issues).
• Shared embeddings: generates <iframe>, README badges, React snippets, and direct links.
• Multimodal knowledge graph (v3.21.0, MCP server only): grasp_ingest parses PDF, DOCX, XLSX, HTML, images (OCR), audio/video (local Whisper via @xenova/transformers + ffmpeg), YouTube, and URLs, with entities and relations marked as EXTRACTED or INFERRED, stored in SQLite kg.db, supporting BM25 + vector hybrid retrieval; tools such as grasp_kg_ask enable natural-language question answering with citations. The local-first multi-LLM layer automatically detects Ollama and falls back to a zero-credential deterministic engine when no cloud key is available.
• Native AST languages add Bash, Elixir, and Julia, with tree-sitter-supported function extraction, call counting, and complexity scoring reaching 19 languages.
• Optional MCP-over-HTTP bridge: set GRASP_HTTP_MCP=1 to share an instance over Streamable HTTP (Bearer Token authentication), port 7333.
• Grasp Brain persistent architectural intelligence: combines SQLite Brain (~/.grasp/brain.db, with FTS5 full-text indexing and 384D vector embedding storage) with the Kuzu graph database (~/.grasp/graph/, supporting Cypher queries), so you can index once and query instantly.
• CLI subcommands and editor hooks: grasp setup detects .claude/, .cursor/, .windsurf/ and installs hooks, automatically providing codebase context for AI coding assistants, while writing CLAUDE.md and AGENTS.md.

Usage:

• Browser application: zero configuration, no build step or npm install required, composed of two HTML files.
• IDE extension: supports MCP-compatible agents such as Claude Code and Cursor.
• Browser extension: displays a floating Grasp button on GitHub and GitLab pages, supporting self-hosted GitLab, GitHub Enterprise, and custom hosts.
• MCP server: exposes all analysis engines to AI assistants.
• Team dashboard: tracks health across repositories, supporting public or private repositories (Token required).
• Organization-level dashboard: analyzes an entire GitHub organization with one command (up to 500 repositories, 5 concurrent), outputting HTML with embedded Chart.js.
• PR Impact GitHub Action: automatically posts a structured comment for each PR, including risk badges, impact scope of changed files, suggested reviewers, and test coverage gaps.

Use cases: code review, architecture understanding, technical debt management, security auditing, team collaboration, and providing AI-assisted coding context.

Limitations: The multimodal knowledge graph runs only on the Node MCP server, not in the browser application; some parsers are optional lazy-loaded dependencies; the function-level canvas node limit is 300; Socket.dev scans at most 50 packages per scan; the organization-level dashboard supports at most 500 repositories. All analysis is done client-side, with zero data collection.

Regarding specific pricing, charging models, platform compatibility details, and performance data, the information does not currently provide them.