roam-code
bycranot· 1 MCP server
The local codebase intelligence layer that lets AI coding agents earn the right to change code — with evidence for what was checked.
How to install roam-code?
cranot/roam-code
$git clone https://github.com/cranot/roam-codeInstalls into the current project.
›Prefer a prompt? Paste this to your agent
Install roam-code by running `git clone https://github.com/cranot/roam-code`, then use it for the current task and follow its documentation at https://github.com/cranot/roam-code.
README.md
| 1 | <div align="center"> |
| 2 | |
| 3 | # roam-code |
| 4 | |
| 5 | **The local codebase intelligence layer that lets AI coding agents earn the right to change code — with evidence for what was checked.** |
| 6 | |
| 7 | [](https://pypi.org/project/roam-code/) |
| 8 | [](https://github.com/Cranot/roam-code/stargazers) |
| 9 | [](https://github.com/Cranot/roam-code/actions/workflows/roam-ci.yml) |
| 10 | [](https://www.python.org/downloads/) |
| 11 | [](https://opensource.org/licenses/Apache-2.0) |
| 12 | |
| 13 | <sub>Credential-free · 100% local by default (opt-in `metrics-push` is the only outbound surface) · tamper-evident `ChangeEvidence` packets · Apache 2.0 · runs entirely on your machine</sub> |
| 14 | |
| 15 | <!-- BEGIN auto-count:readme-headline-counts --> |
| 16 | <sub>281 commands · 244 MCP tools (16 in the default `core` preset) · 28 languages</sub> |
| 17 | <!-- END auto-count:readme-headline-counts --> |
| 18 | |
| 19 |  |
| 20 | |
| 21 | </div> |
| 22 | |
| 23 | --- |
| 24 | |
| 25 | **Jump to** — |
| 26 | [Why Roam](#why-roam-is-different) · |
| 27 | [Install](#install--first-four-commands) · |
| 28 | [The Compiler](#the-compiler--your-agents-first-token-already-knows-the-answer) · |
| 29 | [Core commands](#core-commands) · |
| 30 | [MCP server](#mcp-server) · |
| 31 | [AI-tool integration](#integration-with-ai-coding-tools) · |
| 32 | [Roam Guard (PR gate)](#roam-guard-for-prs) · |
| 33 | [Performance](#performance) · |
| 34 | [Compare](#how-roam-compares) · |
| 35 | [Pricing](#paid-layers-free-cli-stays-apache-20) · |
| 36 | [FAQ](#faq) |
| 37 | |
| 38 | --- |
| 39 | |
| 40 | ## Why Roam is different |
| 41 | |
| 42 | [METR](https://metr.org/notes/2026-03-10-many-swe-bench-passing-prs-would-not-be-merged-into-main/) and [FrontierCode](https://cognition.ai/blog/frontier-code) both point at the same gap: passing tests is not the same as mergeable code. Roam is an **agent-first CLI surface** that gives the agent local graph facts before it edits, gates risky changes, and emits scoped evidence after the run. In the agent/review tools surveyed as of 2026-06-12, the differentiator is this combination: |
| 43 | |
| 44 | - **Credential-free.** No account, no API key, no cloud login. `pip install` and run. |
| 45 | - **100% local by default.** Source code never leaves the machine; air-gapped repos work like cloud repos. The single outbound surface (`roam metrics-push`) is opt-in, summary-only, and prints its exact payload under `--dry-run`. |
| 46 | - **Tamper-evident `ChangeEvidence` packets.** A Roam-guided change can compile into one portable packet — HMAC-chained run ledger + signed Code Graph Attestation + signed PR bundle — answering eight questions: *who acted, what authority existed, what context was read, what changed, what could break, what policy applied, what verified it, who accepted risk*. PR Replay maps those eight questions today: structural change/risk/policy axes are in scope, context and verification are partial, and missing identity/authority/approval evidence is disclosed instead of invented. Cursor logs the run; Roam records and verifies the evidence its producers captured. |
| 47 | - **MCP runtime security at the wrapper boundary.** Every MCP response is scrubbed for secrets on egress, gated against the active mode (`read_only` / `safe_edit` / `migration` / `autonomous_pr`) with a closed-enum `policy_decision`, and each decision receipt is HMAC-linked into the signed run ledger. Inside-server controls; the gateway layer (Interlock / Lasso / Portkey) composes on top — see [`dev/MCP-SECURITY-POSTURE.md`](dev/MCP-SECURITY-POSTURE.md). |
| 48 | |
| 49 | Underneath sits a SQLite-backed graph of symbols, calls, imports, layers, git history, runtime traces, smells, clones, security flows, and algorithmic patterns across 28 languages — the same local facts queried before, during, and after a change. |
| 50 | |
| 51 | **Dependency-aware, not string-b |
Related
6 picksType
- code-review-graphLocal-first knowledge graph for token-efficient code review through MCP and CLIJul 2026
- repowiseCodebase intelligence for AI coding agents — graph, git history, docs, decisions, code health.Jul 2026
- mcp-server-atlassian-bitbucketNode.js/TypeScript MCP server for Atlassian Bitbucket. Enables AI systems (LLMs) to interact with workspaces, repositories, and pull requests via tools (list, get, comment, search). Connects AI directly to version control workflows through the standard MCP interface.Mar 2026
- gemini-mcp-toolMCP server for Gemini CLI integrationJul 2026
- socraticodeEnterprise-grade (40m+ LOC) codebase intelligence, zero-setup, local & private Plugin/Skill/Extension or MCP: hybrid semantic search, polyglot dependency graphs, symbol-level impact analysis & call-flow, interactive HTML viewer, cross-project & branch-aware search, DB/API/infra…Jul 2026
- github-mcpProduction-ready Model Context Protocol server providing Claude with complete GitHub integration - comprehensive tools for repository management, branch operations, file handling, issue tracking, and collaboration features with OAuth 2.0 authentication and MongoDB persistence.Jun 2026
