LAIN: an in-memory code graph and MCP tools for agents

What LAIN is, in the README's own words

LAIN-mcp is an open-source project by spuentesp, published on GitHub under the MIT license. The README calls it "a persistent, high-performance code intelligence and coordination engine built specifically for AI coding agents". It talks to agents over the Model Context Protocol (MCP). The README names Claude Code, Cursor, Copilot, Codex, Agy, Cline and Windsurf as example clients.

The pitch is simple. Many coding agents treat code as flat text and search it by keyword. LAIN indexes a codebase into an in-memory, typed structural property graph instead. It builds that graph from Tree-sitter, language servers and Git commit history. Then it exposes a set of deterministic MCP tools, so an agent can ask structural questions and get exact answers. The README says this lets agents work on complex codebases "without hallucinations, blind edits, or context-window waste". That is the project's own claim. This article did not test it.

How it works, according to the README

The README describes five stages. First, indexing and parsing: LAIN scans the code with Tree-sitter and language servers and extracts functions, classes, imports and references into a property graph. Second, a persistent graph store: the graph is serialized to `.lain/graph.bin`, with identifiers derived deterministically as UUID v5, so it reloads fast. Third, temporal mining: LAIN reads git commit logs to build a "co-change coupling radar", which finds modules that evolve together even when they do not import each other. Fourth, advisory presence: in-memory and on-disk registries track agent sessions and file claims, to prevent overlapping edits. Fifth, universal MCP delivery: the tools are served over stdio or HTTP.

The architecture diagram adds detail. There are two transports: stdio for a single repository, and HTTP on port 9999 with JSON-RPC and SSE. Behind them sits a core with a unified tool dispatcher, an in-memory graph engine built on Petgraph, a presence and claim registry described as "advisory leases and locks", and a federation engine for N repositories.

The tool surface

The README groups the MCP tools into six families.

• **Blast radius and dependency tracing:** `get_blast_radius`, `get_call_chain`, `trace_dependency` and `get_coupling_radar`. They report downstream impact of changing a symbol, the shortest path between two functions, upstream dependencies, and files that change together.
• **Architectural discovery:** `find_anchors`, `list_entry_points`, `get_context_depth` and `explore_architecture`. They find the most-called and most-stable symbols, entry points such as `main()`, HTTP routes and event handlers, and a hierarchical module tree.
• **Multi-agent coordination, called "Multiplayer Mode":** `register_agent`, `heartbeat`, `claim_files`, `release_files`, `detect_overlap`, `list_active_agents` and `who_am_i`.
• **Search and deep queries:** `semantic_search`, `query_graph` and `explain_symbol`. `query_graph` is a composable JSON pipeline with `find`, `connect`, `filter`, `semantic_filter`, `sort` and `limit` operations.
• **Multi-repo federation:** `list_repos`, `get_repo_info`, `get_federation_health`, `get_cross_repo_blast_radius`, `get_cross_repo_blast_radius_for_repo` and `search_org`.
• **Code health:** `find_dead_code`, `suggest_refactor_targets`, `get_agent_strategy` and `get_world_state`.

`semantic_search` needs an optional ONNX embedding model. The README recommends BAAI/bge-small-en-v1.5 (384 dimensions, about 120 MB) and points to it with the `LAIN_EMBEDDING_MODEL` variable. Without a model, the tool is removed from `tools/list`, so agents never see a tool they cannot use. The README states that all graph, blast radius, navigation and coordination tools work without the model.

Install and connect

The README offers a one-line installer: `curl -fsSL https://raw.githubusercontent.com/spuentesp/lain/main/install.sh | bash`, followed by `lain --version`. It also points to a QUICKSTART for Homebrew and manual builds. Building needs Rust 1.75 or newer. Git is required for the co-change analysis.

Connecting an agent is a short step. For Claude Code the command is `claude mcp add lain -- lain mcp`. For Cursor and Windsurf, `lain setup --agent cursor` writes `~/.cursor/mcp.json`. The same `setup` command has modes for VS Code, Codex, Continue and a generic `.mcp.json`. For a shared service across repositories, `lain server --config ./repos.yaml --transport http --port 9999` starts the HTTP mode.

Command Center, CLI and hot reload

In HTTP mode the server serves a browser dashboard called the Command Center at `GET /`. It has five tabs: Overview (node and edge counts, memory footprint, federation health), Graph (a D3 force-directed view), Repos, Query and Tools. The Tools tab can run any MCP tool from a form and produce a "Copy as cURL" snippet.

The CLI has many commands. `lain mcp` runs a single-repo stdio server. `lain server` runs the multi-repo server. `lain doctor` diagnoses the repository without changing files, and its exit codes are 0 for ready, 1 for usable but degraded, and 2 for unusable. `lain hooks` provides pre-edit hooks for claiming files and checking overlap. `lain schema` dumps the tool schema so CI can catch drift. `scripts/demo.sh` checks the server's answers against a synthetic repository whose call graph is known by construction, then benchmarks the tools on the repository itself at about 3.5k nodes. The README gives no benchmark figures.

Hot reload is a notable operational feature. The server watches `repos.yaml` and `workspaces.yaml` and updates its state without a restart and without dropping active agent sessions. CLI commands talk to the running server over a local Unix socket.

Our analysis

The design answers a real weakness of text-only agents: a keyword hit says little about who calls a function or what breaks if it changes. A pre-built graph with call chains and blast radius gives an agent a cheaper, more exact way to check an edit before making it. The co-change radar is a useful second signal, because Git history reveals coupling that static imports miss.

The multi-agent side is the less common idea. Claims, heartbeats and overlap detection treat several agents in one workspace as a coordination problem. The README is careful to call the locks "advisory", and we read that literally: they work when every agent follows the protocol. They do not appear to force a misbehaving agent to stop.

The supply-chain badges are also worth a note. The README shows an OpenSSF Scorecard, OpenSSF Best Practices, a CycloneDX SBOM, SLSA L2 build provenance, and a SafeSkill score of 88/100 marked "Passes with Notes". These are signals for a security review, not proof of safety.

Limits and open questions

Everything here comes from the README. We did not install or run LAIN. Several claims are untested by us: "answered in milliseconds", freedom from hallucinations, and the benchmark at about 3.5k nodes with no numbers shown.

The README does not say which languages get the full graph, beyond naming `rust-analyzer` and `pylsp` as examples of language servers. It does not say how large a repository the in-memory design can hold. Its own troubleshooting notes hint at limits: indexing can time out on large working trees on a cold cache, and the fix is to raise `LAIN_REINDEX_TIMEOUT` from the defaults of 300 seconds overall and 60 seconds per repository. It also warns that a long-lived stdio process can serve stale answers after a rebuild until the client restarts.

Practical takeaways

Developers who use MCP-capable agents can try the single-repo path first: install, run `lain doctor`, then add the server with the command for their client. Teams with several repositories can look at the federation tools and the HTTP mode.

Teams that run several agents at once should read `docs/multiplayer.md` and `docs/hooks.md` before relying on claims. Security-minded readers should read the install script before piping it to a shell, and check the provenance notes in `docs/VERIFICATION.md`. Treat any accuracy claim as a hypothesis until you have run `scripts/demo.sh` and your own tasks.