Graphify Review: A YC-Backed Knowledge Graph for AI Agents

A GitHub org avatar, a YC batch badge, and a tool that promises to replace grep — that's what's sitting at #5 on GitHub's daily trending leaderboard today, October 23, 2026, after gaining 1,408 stars in a single day and climbing past 132,925 total.

The project is Graphify: type /graphify in Claude Code, Cursor, Codex, or Gemini CLI and it turns your entire project — code, docs, SQL schemas, configs, and PDFs — into a graph you query instead of grepping through files, per its own README. This Graphify review walks through what the free CLI actually does, what the paid Graphify Cloud layer adds, and the parts of the pitch worth treating skeptically.

Graphify review: what the free CLI actually does

The core loop is short. Install the CLI — uv tool install graphifyy or pipx install graphifyy — run graphify install to register the skill with whichever coding assistant you have, then type /graphify . inside that assistant. Three files land in a graphify-out/ folder: graph.html, GRAPH_REPORT.md, and graph.json, according to the README.

The code-parsing half is local and free: Graphify uses tree-sitter to build the graph deterministically, with no LLM call and "0" credits spent, and the README is explicit that it's "not a vector index" — it traverses an explicit graph rather than searching embeddings. Every edge is tagged either EXTRACTED (read directly from source) or INFERRED (resolved by Graphify), which is a useful honesty mechanism most "AI understands your code" tools skip. Docs, PDFs, images, and video go through your assistant's model instead, since that step needs more than syntax parsing.

The part that costs money: Graphify Cloud

The free CLI is the funnel. The README's top line is a vendor claim — "Cut agent token spend by 80%" — attached to Graphify Cloud, a separate hosted product with a "free 14-day trial" at app.graphify.com. A companion repo describes a hosted MCP endpoint (api.graphify.com/mcp) that lets an assistant search an indexed repository, trace relationships, and check static change impact over a remote connection, authenticated through OAuth.

Neither repo lists an actual price.

It ships almost every day

What's unusual for a six-month-old project is the release cadence. The CHANGELOG shows version bumps nearly daily through October: 0.9.94 on Oct 22 (19 community PRs), 0.9.93 on Oct 20 (22 PRs), 0.9.92 on Oct 16 (23 PRs), 0.9.91 on Oct 14 (8 PRs) — each one patching language-specific extraction bugs across stacks like Kotlin, Rust, Swift, and T-SQL. The PyPI release history confirms the package itself goes back to version 0.4.10 in April 2026, meaning the "132.9k star" project trending today has actually been shipping quietly for about six months.

That's the kind of traction curve worth comparing to other GitHub-native launches we've covered — Treg's unreleased API gateway climbed past 3,100 stars in days with zero version tags at all, where Graphify has nearly 100 dated releases behind it.

One honest caveat: Graphify didn't appear anywhere in the top 15 of GitHub's weekly trending leaderboard when we checked the same day it hit #5 on the daily chart — which suggests today's spike, not sustained week-long growth, is doing most of the work on that star count.

A real vulnerability, publicly disclosed and patched

Fast shipping cuts both ways, and Graphify's own history shows it. GitHub Security Advisory GHSA-pcc4-rvhr-2pr8 documents a path-traversal flaw in Graphify's Fortran extractor: a crafted .F/.F90 file in an untrusted repo could abuse an incomplete include-path check to pull arbitrary files off the host machine into the generated graph output. GitHub rates it Moderate severity, CVSS v4 score 6.8, affecting versions 0.7.2 up to but not including 0.9.70. It was disclosed on September 27, 2026, patched the same release cycle, and last updated October 19, 2026, credited to reporter aeonframework.

It's a legitimate reminder that pointing any code-graphing tool — Graphify included — at a repository you don't trust carries real risk, not just a theoretical one.

The benchmark numbers are the company's own

Graphify's BENCHMARKS.md claims 0.497 recall@10 on the LOCOMO conversational-QA benchmark (n=300) versus 0.149 for Supermemory and 0.048 for Mem0, and 76% QA accuracy on LongMemEval-S (n=50), tied with dense RAG. On a 1M-line ERPNext codebase, it claims 82.0% key-fact coverage against 70.8% for a plain grep/read baseline. The methodology page says the harness used Kimi K2.6 as judge and Claude Opus 4.8 as the coding agent, with a second independent judge agreeing 90.6% of the time.

These are self-reported, unaudited figures from the maker's own benchmark harness — there's no independent replication we could find. The same document also flags its own caveat: Supermemory's lower recall score is "embedder-confounded" by Graphify's own admission, meaning the comparison isn't entirely apples-to-apples. Read that table as a starting point for your own testing, not a verdict.

Who's behind it, and a license wrinkle

The GitHub org bio lists no YC reference in prose, but the repo's own badge reads "YC S26", linking out to a Y Combinator company page we weren't able to independently load this session. The founder, per his GitHub profile, is Safi Shamsi, listed as "CEO & Founder" at Graphify Labs, based in London, with an MSc in Data Science from the University of Birmingham and prior AI research work spanning healthcare and defense applications.

One detail worth flagging for anyone planning to build on this: the repo ships two license files that don't obviously agree. The main LICENSE is Apache-2.0, dated 2004 with no copyright holder filled in — but there's also a separate LICENSE-MIT file with the copyright line "Copyright (c) 2026 Safi Shamsi," and neither file states which parts of the project each license actually covers.

The takeaway

Graphify is a real, actively maintained open-source tool with a legitimate commercial layer behind it, not a vaporware repo farming stars — the near-daily patch cadence and a publicly disclosed, promptly fixed security advisory are both signs of a team actually running this in production. But today's #5 trending slot looks more like a one-day spike than sustained momentum, the Cloud pricing is currently unverifiable, and the headline "80% token savings" and benchmark table are entirely self-reported. If you're curious, the free CLI costs nothing to try on a repo you trust — run it, read GRAPH_REPORT.md yourself, and treat the vendor's own numbers as a hypothesis rather than a fact, the same way we'd treat any GitHub-trending agent skill or the free creative suite that topped this same leaderboard two weeks ago.