Skip to content

knewstimek/agent-tool

v0.8.1 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 2mo MCP Developer Tools
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 3 known CVEs

Topics

ai-coding automation claude-code cli codex cross-platform
+13 more
cursor developer-tools dns encoding file-tools go mcp mcp-server mysql redis sftp ssh tls

Summary

AI summary

codegraph now supports six languages with inheritance tracking, filtering, and a 5x speedup on large C++ projects.

Full changelog

Quick Start

  1. Download the binary for your OS below
  2. Run agent-tool install (or agent-tool install claude)
  3. Restart your IDE
  4. Done -- all tools work immediately, no permission popups

Or just ask your AI agent:

"Download agent-tool from https://github.com/knewstimek/agent-tool/releases/latest and run agent-tool install"

Tip: Add this to your CLAUDE.md or AGENTS.md so your agent prefers agent-tool over built-in tools:

Strict mode:

ALWAYS use agent-tool MCP tools (mcp__agent-tool__*) instead of built-in file tools. agent-tool preserves file encoding and respects .editorconfig indentation settings.

Soft mode:

Prefer agent-tool MCP tools (mcp__agent-tool__*) over built-in file tools when available.


What's New in v0.8.1

codegraph -- multi-language support + performance + quality

Builds on the codegraph tool introduced in v0.8.0. Now supports 6 languages with accurate symbol extraction, inheritance tracking, and parallel indexing.

Supported languages: C/C++, Python, Go, C#, Rust, Java

New features since v0.8.0:

  • Multi-language: Added Python, Go, C#, Rust, Java (v0.8.0 had C++ only)
  • Inheritance extraction: inherits operation now works -- shows parent classes and child classes bidirectionally. Supports C++ (: public Base), Python (class Dog(Animal)), Java (extends/implements), C# (: Base, IInterface)
  • Import/include tracking: Extracts #include, import, from..import, using, use for all 6 languages
  • Accurate scope tracking: Methods correctly show their enclosing class/struct/trait
    • Go: receiver type as scope (Start -> scope: Server)
    • Python: enclosing class (__init__ -> scope: Animal)
    • Rust: impl type (new -> scope: Config, Serializable for Config)
    • Java/C#: enclosing class (addPlayer -> scope: GameServer)
  • Parallel indexing: 4 worker goroutines by default, configurable via workers parameter (max 32)
  • Performance: Single WASM call per file (parse_and_extract_all), parser/buffer reuse, batch DB transactions

Benchmark (6K+ C++ files):

  • v0.8.0: ~10 minutes
  • v0.8.1: ~2 minutes (5x faster)
  • Incremental re-index: 0 seconds (unchanged files skipped)

codegraph -- smart filtering + memory management

  • .gitignore support: Respects project root .gitignore for file/dir filtering
  • Expanded skip list: venv, .venv, vendor, third_party, dist, target, .idea, .gradle, and more -- non-source directories are automatically excluded
  • Engine recycling: WASM runtime recycled every 50 parses to prevent unbounded memory growth

Before vs after (filtering + recycling):

| Scenario | Files | Time | Peak Memory |
|----------|-------|------|-------------|
| C++ project with third_party | 183 -> 96 | 4.8s -> 1.9s | 614 -> 18 MB |
| Python project with venv | 1,083 -> 19 | 5.8s -> 0.3s | 420 -> 17 MB |
| Large C++ project (6K+ files) | 6,358 -> 4,723 | ~2.5m -> 2m | unbounded -> peak 1 GB |

Example workflow:

codegraph(op="index", path="/project")           -- 1. index once
codegraph(op="find", name="Monster")              -- 2. find definitions
codegraph(op="methods", name="Monster")            -- 3. list methods
codegraph(op="callers", name="SetDead")            -- 4. find call sites
codegraph(op="inherits", name="Dog")               -- 5. parents + children
codegraph(op="symbols", path="/file.cpp")          -- works without index

Query patterns inspired by code-graph-rag (MIT license).

Security (3 audit rounds, all fixed)

  • WASM engine pool with exclusive access (no race conditions)
  • Path validation: absolute paths only, dangerous/system paths rejected
  • SQL: case-sensitive LIKE, parameterized queries, LIKE wildcards escaped
  • All DB operations error-checked, batch transactions with proper rollback

Stats

  • 52 tools total
  • Binary size: ~52MB (6 language WASM grammars embedded)
  • Dependencies: wazero (Apache 2.0), modernc.org/sqlite (BSD-3), tree-sitter (MIT)

Security Fixes

  • WASM engine pool now enforces exclusive access preventing race conditions
  • Path validation rejects absolute/dangerous system paths
  • SQL operations use parameterized queries with proper escaping and rollback handling

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track knewstimek/agent-tool

Get notified when new releases ship.

Sign up free

About knewstimek/agent-tool

Encoding-aware, indentation-smart file tools for AI coding agents. 20+ tools including read/edit with automatic encoding detection, smart indentation conversion, SSH, SFTP, process management, and system utilities. Preserves file encoding (UTF-8, EUC-KR, Shift_JIS, etc.) and respects .editorconfig settings.

All releases →

Beta — feedback welcome: [email protected]