Docs

Documentation

Install Quick start Clients CLI Env vars Tools Routing map Languages Safety Testing FAQ Resources

Installation

The two paths are functionally identical — only the index backend differs. Requires Node >= 20.

Standard install (recommended · full better-sqlite3 backend)
git clone <repo> liuhe && cd liuhe/malong && npm ci && node mcp-server.js --workspace .
Zero-build deployment (offline / sandbox · sql.js backend)
tar -xzf malong-liuhe-0.4.5-linux-x86_64.tar.gz && cd malong && node mcp-server.js --workspace .

The tarball prints a SQLITE BACKEND upgrade hint at startup; on a networked machine cd malong && npm ci upgrades it to the full backend.

Parsing daemon (malong-parse)

Both install paths bundle the Rust parsing binary — the MCP server auto-starts it on launch; no manual start needed.
Linux / macOS communicate over a Unix socket (default /tmp/malong-parse-$(id -u).sock); Windows uses TCP 127.0.0.1:31001 and the server spawns malong-parse.exe automatically.
Override the socket, port or binary with MALONG_SOCKET / MALONG_PORT / MALONG_PARSE_BIN (see environment variables).

Quick start

01
Get the toolkit
Clone the repo, npm ci inside malong/; or extract the platform tarball.
02
Register an MCP client
Pick opencode / Claude Desktop / Claude Code / codex — see clients.
03
Build the index
Run reindex once per workspace (optionally blocking=true) so symbol search and impact analysis have an index.
04
Just ask
e.g. "search for the symbol 'handle' in my workspace"
Typical workflow · from search to safe edit
reindex symbol_search impact_analysis edit_transaction test_bridge verify_pipeline

Index → locate the target symbol → assess blast radius → transactional edit (reversible) → run tests → lint/typecheck to finish.

MCP clients

The MCP layer is standard JSON-RPC over stdio, so any MCP client works. All configs below are tested end-to-end.

opencode (project-root opencode.json)
opencode.json
{ "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "malong": {
      "type": "local",
      "command": ["node", "--max-old-space-size=512", "malong/mcp-server.js", "--workspace", "."],
      "enabled": true
    }
  }
}
Claude Desktop (tested on Windows: %APPDATA%\Claude\claude_desktop_config.json)
claude_desktop_config.json
{ "mcpServers": {
    "malong": { "command": "node", "args": ["/path/to/malong/mcp-server.js"] }
  }
}
Claude Code (CLI registration; tools exposed as mcp__liuhe__<tool>)
claude mcp add
claude mcp add liuhe -- node /path/to/malong/mcp-server.js --workspace /path/to/project
claude mcp list        # → "liuhe … ✔ Connected"

# Headless example
claude -p "index the workspace with reindex, then find createDb with symbol_search" \
  --allowedTools "mcp__liuhe__reindex" "mcp__liuhe__symbol_search"
codex (~/.codex/config.toml; tools exposed as liuhe.<tool>)
config.toml
model = "deepseek-v4-flash"
model_provider = "opencode-zen"

[model_providers.opencode-zen]
name = "OpenCode Zen"
base_url = "https://opencode.ai/zen/go/v1"   # any OpenAI-compatible endpoint
wire_api = "chat"
env_key = "OPENCODE_ZEN_API_KEY"             # codex reads the API key from this env var

[mcp_servers.liuhe]
command = "node"
args = ["/path/to/malong/mcp-server.js", "--workspace", "/path/to/project"]

Version note: recent codex releases force the OpenAI Responses API — use a version that still supports wire_api = "chat" (verified with 0.50.0).

DeepSeek Harness (dsh web) — optional convenience
bash malong/dsh/install-dsh.sh
bash malong/dsh/install-dsh.sh        # idempotent; edits ~/.dsh/profiles/web/cordis.patch.yml with backup
pkill -f "dsh web"; dsh web --port 3456 --host 0.0.0.0 --trusted-host <LAN IP>

The bridge registers all 38 tools as malong__<tool> and auto-fills workspace_dir from the current conversation's workspace (explicit paths still win). Full guide incl. index rules: malong/dsh/DSH接入说明.md

CLI options

Option Description
--workspace <dir>Root directory to index and operate on
--concurrency <n>Number of parallel tasks
--max-old-space-size=<MB>V8 heap cap, 512 recommended; warns at startup if unset and the heap is unlimited
--expose-gcEnables periodic GC + memory monitoring (pairs with the health / gc tools)

Environment variables

All optional — sensible defaults apply when unset.

Variable Default Purpose
MALONG_STATE_DIR~/.config/malongWhere usage / feedback / edit-stats files are written; override for tests or sandboxed hosts
MALONG_SOCKET/tmp/malong-parse-$(id -u).sockUnix socket path to the parse daemon (Linux / macOS)
MALONG_PORT31001TCP port for the parse daemon (Windows)
MALONG_PARSE_BINbundled / PATHBinary used when the client auto-starts the daemon
MALONG_PARSE_MODErust-serviceParse transport; only rust-service is supported in the current version
MALONG_WS_GC_DAYS14Days a workspace index cache may sit untouched before health cleanup prunes it; 0 disables

44 MCP tools

Every tool is pure regex / AST — zero LLM calls, reproducible, auditable, CI-friendly. Expand a group for per-tool descriptions.

I/O primitives ×3 Index & search ×5 Analysis ×8 Editing & refactor ×7 Quality & security ×8 Engineering ×8 Deps & system ×5
I/O primitives 3
read_symbolReads symbol body + version; the required base anchor before any write
write_symbolGuarded symbol-level write: version / lock / conflict detection against stale overwrites
write_symbolsBatch cross-file writes, all-or-nothing, deadlock-safe
Index & search 5
reindexFull-workspace symbol index; always the first step in a new workspace
symbol_searchFinds definitions by symbol-name substring (incl. fully-qualified paths)
code_searchNatural-language intent search over code; deterministic, zero LLM
repo_mapFile ↔ symbol project map; built for 100+ file codebases
outline_readerFile structure outline (functions / classes / signatures) without reading it all
Analysis 8
impact_analysisAssesses blast radius and caller scope before modifying / renaming
call_chainPinpoint a line; get its caller / callee chain
referencesCross-file usages of a symbol with usage counts
dep_graphImport dependency graph with cycle detection
inspectOutline + references + call chain in one call — replaces three separate ones
trace_symbolTraces constant values and finds hardcoded copies
active_todosTODO / FIXME scan prioritized by current work
code_qualityFive-dimension shape probe: tech debt / architecture / blast radius
Editing & refactor 7
batch_editMultiple edits to one file applied atomically; dry-run preview supported
edit_transactionMulti-file transaction: begin → edit → commit, with rollback / undo
edit_collision_guardSnapshot compare between read and write; detects concurrent external edits
git_worktreeIsolated-branch multi-file changes: zero working-tree pollution, rollback on failure
rename_symbolCross-file symbol rename (word-boundary, string / comment aware)
fix_importsRemoves unused imports, resolves undefined symbols, breaks circular deps
edit_sandboxPre-edit validation (syntax / structure dry-run)
Quality & security 8
code_reviewShape-level check: naming / comments / long functions / duplicated blocks
security_reviewScans for injection / XSS / secrets / CORS patterns, severity-graded
dead_code_sweeperDead code detection: unused imports / orphan files (miss-over-delete bias)
guard_patternsAST rule gate: no bare except / debugger / eval
exception_guardChecks project exceptions vs builtins; pair with test_bridge to verify fixes
config_driftDetects env vars / tables / services missing from .env.example
mock_syncerDetects mock / patch mismatches after signature changes
naming_consistencyChecks new symbol names against project style
Engineering 8
test_bridgeRuns tests, parses output, enriches failures with context
verify_pipelineRuns lint / test / typecheck from package.json in one go
debug_runnerRuns commands / scripts with 14-class error pattern analysis
patch_parserSEARCH/REPLACE patch parsing with dry-run preview
diff_factsAST symbol-change facts after an edit transaction + test-sync hints
find_testsReverse-lookup tests for a source file (naming + imports)
spec_genGenerates module / API specs from a source file's symbols
style_snifferSniffs project code style and produces a style spec
Deps & system 5
dependency_gatekeeperImports vs manifests: undeclared deps + install hints
tsc_checkTypeScript type-check (tsc --noEmit)
healthSystem check + self-healing (DB integrity / memory / semaphores)
gcManual GC trigger (requires --expose-gc)
feedbackReports tool issues / ideas, collected locally

Tool Routing Map

All 44 tools split into 4 sequence diagrams — every ok/err route is drawn (green solid = ok, red dashed = err); dashed card = target lives in another group; thick green = main chain. The edit → test loop (edit_transaction ↔ diff_facts ↔ test_bridge ↔ debug_runner) is fully inside 2/4.

1/4 Indexing, Reading & Impact 2/4 Edit, Commit & Test Loop 3/4 Review, Verify & Ops 4/4 Hygiene & Cleanup

Legend

── ok = ok (green solid) = success → next step (every edge from measured handler next_step)
╌╌ err = err (red dashed) = failure → routing
thick green = main chain between layers

Node index (T01–T44) (44)

T01 reindex
reindex
okread_symbol / symbol_search / references
okhealth(check) self-check
T02 active
active_todos
errhigh → address in current files
T03 ss
symbol_search
okimpact_analysis
errempty → reindex / glob
T04 cs
code_search
okread_symbol / references
T05 ft
find_tests
oktest_bridge(scope)
errnone → create tests
T06 rs
read_symbol
okimpact_analysis → edit_batch
after edit → test_bridge
T07 insp
inspect
okimpact_analysis
after edit → test_bridge
T08 ol
outline_reader
okimpact_analysis
T09 cc
call_chain
okimpact_analysis (full radius)
T10 refs
references
okfind_tests (test refs)
T11 tr
trace_symbol
errhardcoded copies → rename_symbol
T12 dg
dep_graph
errcycles → fix_imports
okimpact_analysis
T13 repo_map
read-only overview
T14 patch_parser
read-only parse preview
T15 ia
impact_analysis
errhigh → sandbox_validate
errmedium → review callers
okedit · after → test_bridge
T16 ecg
edit_collision_guard
oksafe → edit_transaction / edit_batch
errexternal change → re-read → record_read
T17 et
edit_transaction
okcommit → diff_facts → test_bridge
errdebug_runner
T18 eb
edit_batch
oktest_bridge → debug_runner
via txn → diff_facts · TS → tsc_check
T19 ws
write_symbol
oktest_bridge → debug_runner
via txn → diff_facts
T20 wss
write_symbols
oktest_bridge → debug_runner
via txn → diff_facts
T21 rn
rename_symbol
dry_run → apply
oktest_bridge
T22 sv
sandbox_validate
okedit_transaction
errfix → re-validate
T23 gw
git_worktree
okcommit → revert / reset (undo)
T24 ms
mock_syncer
errmismatch → fix → test_bridge
oktest_bridge
T25 df
diff_facts
errstale tests → test_bridge(scope)
errcallers → impact_analysis
okno sync issues
T26 tb
test_bridge
errtimeout → +timeout / inspect
errfail → debug_runner / verify_pipeline
okpass → edit_transaction commit
T27 dr
debug_runner
errsuggested_action (14 types)
okcontinue
T28 tc
tsc_check
errfix type errors
okcontinue
T29 vp
verify_pipeline
errover-budget → single-stage lint
or test_bridge by scope
T30 cr
code_review
errwarnings → code_quality deep probe
after fix → test_bridge
T31 cq
code_quality
5-dim shape scores → review flagged
T32 sr
security_review
errhigh → fix injection / secrets
okNOT a guarantee
T33 eg
exception_guard
errissues → edit_transaction → test_bridge
test file → skip
T34 gp
guard_patterns
errviolations → fix → re-run
T35 nc
naming_consistency
errissues → edit_transaction
T36 fi
fix_imports
errissues → edit_transaction → test_bridge
okclean → sweep_dead_code
T37 sdc
sweep_dead_code
errdead code → edit_transaction
unused_guard → manual trace
T38 cd
config_drift
errdrift → edit_transaction → re-run
okin sync
T39 dk
dependency_gatekeeper
errmissing → manifest → re-run
T40 sg
spec_gen
okread_symbol per export
T41 st
style_sniffer
okreview rules → commit
T42 fb
feedback
errissues → fix
okhealth(stats) usage
T43 hth
health
errunregistered → register Y004 matrix
restart → MCP host · cleanup → re-run
T44 gcc
gc
memory reclaim (no next_step)

Language support

Symbol-level read / write (read & write_symbol) supports 10 language families, with automatic syntax self-check after writes (node --check / py_compile).

JavaScript (.js/.mjs/.cjs/.jsx) TypeScript (.ts) MTS / CTS (.mts/.cts) TSX Python Go Rust (impl/trait/enum) C / C++ (incl. headers) Java Bash

Safety mechanisms

Inline suppression malong-ignore
Append malong-ignore at end of a line to suppress all findings on it; malong-ignore[eval,exec-cmd] targets specific rules; a reason is encouraged.
Declarative config .ai-patterns.json
Declare ignores by files / rules in the securityIgnore array (* / ** globs supported); injection rules (eval / exec / SQL / spawn) are only ever suppressed by an explicit marker you authored — never heuristically. Suppressed findings still count in the summary's suppressed field.
Undo journal .malong/journal/
Every safe write (write_symbol / write_symbols / batch_edit) leaves a rollback journal in the workspace's .malong/journal/; terminal transactions are pruned after a 24h TTL (at most once per hour per workspace). In-flight and needs_review journals are never auto-deleted — and only the tool's own rollback backups are touched, never your source files.

Self-checks

One-shot full chain (daemon must be running)
./scripts/ci.sh # cargo test + npm test + dogfood
npm test # 2013 assertions / 81 test files
node tests/test-db-adapter.js # 22 assertions: sql.js backend + persistence
node tests/test-mcp-server.js # 25 assertions: MCP stdio + daemon round-trip
cd malong-parse && cargo test # 92 assertions: extraction / protocol / cache / dispatch

FAQ

How does the MCP server start the parsing service?
Both npm ci and the tarball bundle the Rust parsing binary (malong-parse); the server auto-starts it on launch. Parse crashes are isolated by catch_unwind and never take down the MCP process.
Where is the index stored?
Each workspace gets its own SQLite file (WAL mode) under the workspace's .malong/ directory (gitignored). Corruption is auto-healed via integrity_check rebuild.
Which languages support symbol-level writes?
read / write_symbol cover 10 language families: JS / TS / TSX / Python / Go / Rust / C-C++ / Java / Bash; writes are followed by an automatic syntax self-check (node --check / py_compile).
Do the quality-gate tools call an LLM?
No. All quality / security tools are deterministic regex / AST implementations — the same input always yields the same output. Reproducible, CI-friendly, auditable.
What if the parsing daemon is not running?
Parse-dependent tools (symbol extraction etc.) degrade; SQLite-backed tools (repo-map / code-index / health-check) keep working. The MCP server auto-starts the daemon by default — manual starts are only needed when calling the parse-client API directly.
How should Windows paths be written?
Escape backslashes as \\ in JSON; relative paths resolve against the directory where the client is launched, so prefer absolute paths; tar -xzf works on Win10+.
Are the two SQL backends data-compatible?
Yes. Both better-sqlite3 and sql.js use SQLite, so index data files are fully interchangeable and you can switch freely.
Can edits be undone?
Every safe write leaves a rollback journal under .malong/journal/; terminal transactions are pruned on a 24h TTL while in-flight / needs-review journals are never deleted — only the tool's own backups are cleaned, never your source.

More resources