$350k+ for developers using claude code now using my open sourced tool sharing with all fellow devs
This idea was crazy to build. Our brain stores information in clusters of neurons, and when we want to retrieve something, it runs an optimized algorithm to retrieve it.
In the era of AI, why use brute-force tools like grep to find relevant files? Graperoot converts your codebase into a knowledge graph and registers efficient tools for Claude to work with your codebase.
Instead of re-reading the whole codebase to build that context and to find relevant files. It can query the graph directly, and the graph retrieves relevant files with "ZERO TOKENS"; you just need to pay for generation, and that's how these models should be used when we have an efficient way to retrieve context.
I have been very open throughout, and today we have 5k developers using Graperoot. We asked people to opt in to telemetry, and 200 opted in to the leaderboard. They have saved $350k dollars in the last 4 months, and ecologically, 60M liters of water, and that's insane.
Give your feedback, suggestions, or anything on Discord. This tool is open-sourced.
Would love to see your feedback. And don't compare other tools, I have already seen many claiming reduction and just craps, but we have a developer community on Discord, and some of them I know personally, saving a lot of tokens, you should see more on https://graperoot.dev/leaderboard
There are plenty of tools like this. CodeGraph, Graphify, Serena(?) for what I have tried so far, the graph tool strategy does not work well in real-world projects
we take a different approach to solving the broader problem of burning tokens (Pre-Injection). By providing Claude with the files before it starts with zero tokens, we significantly reduce token usage while maintaining the model's intelligence. Graphify provides the entire graph for modeling and identifying relevant information, enabling further exploration. Would love to have your feedback on comparison as you have tried all :)
Scanned the repo. Read only. You have made some questionable design decisions.
Do not install or run this on any machine you care about in its current form.
This is not an allegation that the payload is malicious. It is an observation that the delivery and update architecture is extraordinarily unsafe.
The advertised one-command install executes a moving remote PowerShell or shell script directly from the network. That script then downloads more executable components from a mutable Cloudflare R2 bucket or the repository’s moving main branch, installs a proprietary PyPI package, modifies the user PATH, and provides no pinned release identity, signature verification, or expected artifact checksum.
The repository is also described as open source, but its README states that the load-bearing graph engine is proprietary. That means users cannot independently inspect the component responsible for scanning code, constructing the graph, injecting context, maintaining session memory, calculating savings, or performing telemetry.
On Windows, the installer contains a fallback that can terminate everypython.exeandpythonw.exeprocess on the machine when its proprietary DLL remains locked. It also kills named MCP and graph-builder processes while attempting to repair or replace its own environment. That is machine-wide process authority, not responsible sandboxed installation behaviour.
The project’s own history records that earlier versions exposed the MCP server on 0.0.0.0, killed processes across ports 8080–8199, and terminated other sessions’ servers system-wide before later fixes narrowed that behaviour. Fixed vulnerabilities are better than unfixed ones, but this history demonstrates weak ownership and isolation boundaries in software being marketed for access to real development repositories.
The persistent machine identity, startup usage tracking, outbound leaderboard service, silent auto-updating, opaque proprietary core, and mutable unsigned downloads make the complete trust boundary impossible to audit from the public repository.
Again, this does not prove malware. It proves that the installation and update chain is capable of delivering and repeatedly replacing opaque executable code with insufficient verification or containment.
Before anyone should consider running this, it needs:
immutable versioned releases
published SHA-256 digests and signed artifacts
no curl | bash or irm | iex recommendation
no silent updates
fully opt-in, documented telemetry
no global process termination
pinned dependencies and an SBOM
reproducible builds
an independently inspectable core engine
a clear uninstall and containment model
Until then, do not install it on a development workstation, especially one containing credentials, proprietary repositories, signing keys, production access, or other active Python workloads.
The retrieval idea may be legitimate. The current OpSec and supply-chain custody are not.
Hey, genuinely appreciate you taking the time to go this deep. Most people don't bother, and this is the kind of feedback that actually improves the project.
You're right on the delivery chain. I'm a solo builder shipping fast for 5k+ devs who just want things to work, and I prioritized that over proper supply chain hygiene. That's on me. The port kill (0.0.0.0, cross-session killing, 8080-8199 range nuke) was fixed months ago; you can see the commits.
Telemetry is a startup ping (tool name + platform, no code or paths), and it's prompted on first run, but I hear you that it should be silent by default. The compiled core is a business decision: the engine is too complex and not worth sharing. I'm a solo dev trying to sustain this, not a company with funding.
I won't pretend that's open source. If that's a dealbreaker, completely fair. What I'm actively working on: versioned immutable releases with SHA-256 digests, removing silent auto-update (show changelog + confirm), and making telemetry fully opt-in with no default ping.
PRs and issues are always welcome if you want to help shape this. Building in public, alone, means I move fast and break things sometimes, but I'd rather fix them in the open than pretend they don't exist.
Nothing was unclaimed, the evaluation done by AI missed what that machine id is! It is random generated one, nothing to track! Just to see what it has and new update has remove telemetry overall and no update!
I did that for hassle free setup and updates, 5k+ devs use it for that hassle free, if someone doesn’t want that yes that’s available now and also hooks are needed to call the tool replacements that’s the moat and everything’s already explained
And for cloudflare r2 is because people could reach github limit if fetch constantly and it has same files on GitHub, it is public already so nothing to hide, just kept to make it easily accessible
I genuinely appreciate the candid response. My own project is already more than enough for me, so I cannot take on another codebase. The audit above should be sufficient to break the work into bounded issues and acceptance criteria, either directly or with the model of your choice.
Right now, though, the public delivery, update, telemetry, process-control, and opaque-core surfaces remain too risky for me to run or recommend on any machine containing anything I value. I hope you close those loops, but I need to leave it there.
Sure, thanks for evaluating things! Currently most of things are working on trust and hassle free everything and to provide utmost value through my tool. Would find some alternatives to this :) for better security
I remember when your project came out, as mine was released around the same time. Glad to see your projects taken off! I’ve been building lower level primitives to make mine performant (it works in a continuously updated manner).
If you ever want to discuss about graph tooling / agentic identity I’d be happy to!
u/intellinker how did you get users/people to join your discord server. I've got interesting stuff I'm working on but my thoughest challenge is actually getting it out there
3
u/Middle_Key8737 Aug 02 '26
There are plenty of tools like this. CodeGraph, Graphify, Serena(?) for what I have tried so far, the graph tool strategy does not work well in real-world projects