SELF-HOSTED CODE INTELLIGENCE MCP SERVER · APACHE-2.0
Vaelor parses, graphs, and watches 16 languages, exposing 30+ MCP tools over one Apache-2.0 endpoint you run yourself.
KNOWLEDGE GRAPH
Your code as a property graph, indexed for agents. Every symbol, every call edge, every import, every test relationship. Queried in natural language via Cypher.
debug_investigate
file:function in 5 seconds.
Six-phase async pipeline: failure spikes, Jaeger failed traces, symbol resolution, callgraph walks upstream and downstream, log excerpts, LLM fusion. Returns ranked hypotheses with body excerpts. No one else does this.
semantic_search
Hybrid retrieval: BM25F lexical scoring, pgvector 768-dim embeddings, one-hop AGE graph expansion, ColBERT cross-encoder reranker. Finds what grep can't describe.
Apache AGE property graph on PostgreSQL. Every symbol, call edge, import, route handler, test relationship. Query the graph from plain English: Vaelor translates to Cypher and returns structured results.
MATCH (caller:Symbol)-[:CALLS]->(fn:Symbol)
WHERE fn.name = 'ValidateToken'
AND fn.package = 'auth'
OPTIONAL MATCH (fn)-[:TESTED_BY]->(test:Symbol)
RETURN caller.name,
caller.file,
caller.line,
test.name AS test_coverage
ORDER BY caller.file;dataflow_analyze + rewrite
IL/CFG analysis traces values from source to sink. Detects dead stores, unescaped user input reaching SQL or command execution. Rewrite applies AST search-replace patterns across all 16 languages with wildcard matching, survives multi-line code that regex can't touch.
return errors.New(msg)
return fmt.Errorf("%s: %w", msg, err)
return nil, errors.New(queryErr)
return nil, fmt.Errorf("query: %w", queryErr)
return errors.New(cacheErr)
return fmt.Errorf("cache: %w", cacheErr)
... +244 moreerrors.New($MSG) → fmt.Errorf("%s: %w", $MSG, err) positioning
grep sees text. LSP sees one file's types. Sourcegraph indexes repos for humans. Cursor's indexing is locked inside one editor. Vaelor ships the same structural depth as a portable, MCP-native endpoint any agent can call — Claude Code, Cursor, Windsurf, Aider, Cline. No editor lock-in, no per-session rebuild.
quickstart
Just an LLM endpoint and you have repo analysis, call tracing, structural rewrite, dataflow, and PR review. Add Postgres + AGE for code_graph; ox-embed-server + pgvector for semantic_search and code_research reranking; ox-codes for stricter dead_code + full code_health grades. Redis is just an L2 cache. All companions are open source.
$ docker build -t vaelor .
Building vaelor ... done
$ docker run -p 8897:8897 \
-e LLM_API_BASE=http://host.docker.internal:8317/v1 \
-e LLM_API_KEY=your-key \
vaelor
MCP server listening on :8897
$ claude mcp add -s user -t http vaelor http://127.0.0.1:8897/mcp
→ registered — Claude Code can now call vaelorFAQ
grep and ripgrep find the function. They don't tell an agent what else breaks when it changes, and they don't remember your last review or your last production incident. Vaelor parses 16 languages with tree-sitter, builds a call graph with type-aware Go resolution, and exposes 30+ MCP tools — understand, impact_analysis, call_trace, review_pr, debug_investigate — that surface blast radius, dead code, and prior review verdicts. The structural depth grep can't reach is the whole point.
An LSP gives you type-aware navigation inside one file in one editor. Sourcegraph indexes code for humans — full-text and symbols across an org, but no MCP, no call graph, no runtime view. Vaelor sits where neither does: structural depth (AST + call graph + type resolution) at multi-repo scale, exposed as a portable MCP endpoint any agent can call. It also adds what neither has: an Apache AGE knowledge graph carrying PageRank, community, and surprise scores, and a runtime observability bridge that correlates a Prometheus alert and a Jaeger trace back to the function that caused it.
Cursor's indexing is structural-ish, but it only serves Cursor — the index, the embeddings, and the chunk graph live inside one editor and one vendor's cloud. Vaelor is MCP-native, so the same endpoint serves Claude Code, Cursor, Windsurf, Aider, Cline, or any client implementing the Model Context Protocol. It's also self-hosted and Apache-2.0: you run the binary, you own the graph, the code never leaves your infrastructure. No editor lock-in, no vendor index.
Day one is two commands: docker build and docker run with an OpenAI-compatible LLM endpoint. That gives you call_trace, understand, impact_analysis, code_search, dead_code, code_health, repo_analyze, and the rest of the ~30 tools that don't need a graph or embeddings. Add PostgreSQL with Apache AGE (DATABASE_URL) to enable code_graph and the persistent PageRank/community/surprise signals. Add pgvector + an embedder (EMBED_URL) to enable semantic_search and code_research reranking. Redis is optional L2 cache. Each sidecar unlocks a specific tool family — nothing is required for the core, and the core is most of the tools.
Any MCP client. Vaelor speaks Streamable HTTP over the Model Context Protocol, so you register one URL and it works with Claude Code, Cursor, Windsurf, Aider, Cline, and any future client that implements MCP. One server, every agent — no per-editor plugin to maintain.
16: Go, Python, TypeScript/JavaScript, Rust, Java, C, C++, Ruby, C#, PHP, Svelte, Astro, Vue, Kotlin, Swift, and HTML. Tree-sitter AST parsing across all of them. Type-aware call resolution is live today on Go via go/types; SCIP-backed type resolution for the other languages is on the roadmap.
Apache-2.0 across the whole stack — engine, companions, and site. Self-host it, fork it, run it inside your firewall. There is no hosted SaaS today. A managed option is coming on krolik.tools for teams that don't want to operate the sidecars themselves; until then, self-hosting is the only path and it's free.
No. Most tools run without LLM_API_KEY — they skip only the narrative and ranking layer. call_trace, impact_analysis, dead_code, code_search, code_graph, and the structural tools return their raw structural results. Add an OpenAI-compatible endpoint (LiteLLM, CLIProxyAPI, or any wrapper) to get the LLM narratives and the reranker on code_research. The key is a capability unlock, not a gate.