We adopted code-review-graph, a local MCP tool that maps a repository's structure so a review can see the blast radius of a change instead of the whole codebase. Scoped to one project, its --dry-run listed two file writes. The real install quietly set a global git hook path that would have run in every repository on the machine.
It's MIT-licensed, Python, local-first: a tree-sitter structural graph of a repo, built into local SQLite and served over MCP, with no cloud component. It had been sitting as a trialled-but-undecided item since a first trial on 2026-07-22. We approved it twice over Telegram in early August and again explicitly on 2026-08-18, scoped deliberately to dekimu-hub and this machine — not the whole estate.
The numbers are worth having on record rather than assumed. Building the graph over Hub's 2,034 files produced 11,136 nodes and 100,869 edges in 36 seconds, 118 MB on disk; an incremental update after an edit ran in 0.82 seconds. We tested its blast-radius answer for lib/paywall-config.ts against grep as ground truth: 9 of 10 true dependents found. The miss was a dependency expressed as a string literal inside a mock call, which no static import graph resolves — grep finds it because grep is textual. The one extra result was a direction error: the tool returns both what a file depends on and what depends on it, not strictly what would break. Neither is disqualifying, and both nearly reproduce the original 2026-07-22 trial (8 of 9, one miss, one extra). The output is a starting set to verify, not a completeness claim — which is how a review tool should be used regardless.
install --dry-run reported exactly two actions: write .mcp.json, append to CLAUDE.md. The real run did that, plus generated four skills into the project's .claude/skills/, installed PostToolUse and SessionStart hooks into .claude/settings.json, and — outside the repo entirely — wrote a pre-commit hook to ~/.git-hooks/pre-commit and set git config --global core.hooksPath to point at it.
That last one is the one that mattered. A global core.hooksPath doesn't stay scoped to the repo you ran the installer in. It runs that hook in every git repository on the machine — 27+ repos in our case — from a command approved for one project on one platform. It also shadows any hook a repo already had locally, because core.hooksPath overrides repo-local .git/hooks entirely.
A dry-run that under-reports is worse than none, because it buys confidence for a decision it did not actually describe.
Before changing anything back, we checked whether any repo on the machine carried a real, non-sample local hook that the global path would have shadowed — none did, so nothing had been silently disabled in the meantime. Then we reverted: unset the global core.hooksPath, removed ~/.git-hooks/, and reinstalled the pre-commit hook repo-locally in dekimu-hub only, which is the scope we'd actually approved.
A few defaults we didn't take. We skipped the auto-append to CLAUDE.md (--no-instructions) — ours is curated and rule-ordered, and a tool appending to it is how that curation rots. We repointed the MCP command from uvx, which fetches its own copy from PyPI at every session start, to the pipx-installed binary, so the version the hooks call can't drift from what we tested. And .mcp.json is gitignored rather than committed, since it carries an absolute binary path that would break on the other machine or in CI.
Two things stay on the record rather than quietly accepted. The MCP server exposes 30 tools, including one write path into the codebase — reached only by an explicit call, with every normal git gate still in force, but worth knowing rather than discovering. And the per-edit hook adds 0.82 seconds, guarded by a command -v check so a machine without the binary just no-ops; revisit if that ever gets slower. Only Hub is indexed. id.dekimu.com and InvoiceUp are the obvious next candidates if this proves itself in real reviews — deliberately deferred until it earns that on one repo first.
This post was drafted by an AI system from Dekimu's public engineering record and published with automated checks, without per-post human editing.
← Back to blog