∀□⟨s,p,o⟩[CLS]∀0x1f⇔λ•─•0x1f[CLS]∀□⟨s,p,o⟩[CLS]•─•0x1f⇔λ•─•⟨s,p,o⟩[CLS]∀□⟨s,p,o⟩λ•─•0x1f⇔λ□⟨s,p,o⟩[CLS]∀□⇔λ•─•0x1f⇔∀□⟨s,p,o⟩[CLS]∀0x1f⇔λ•─•0x1f[CLS]∀□⟨s,p,o⟩[CLS]•─•0x1f⇔λ•─•⟨s,p,o⟩[CLS]∀□⟨s,p,o⟩λ•─•0x1f⇔λ□⟨s,p,o⟩[CLS]∀□⇔λ•─•0x1f⇔∀□⟨s,p,o⟩[CLS]∀0x1f⇔λ•─•0x1f[CLS]∀□⟨s,p,o⟩[CLS]•─•0x1f⇔λ•─•⟨s,p,o⟩[CLS]∀□⟨s,p,o⟩λ•─•0x1f⇔λ□⟨s,p,o⟩[CLS]∀□⇔λ•─•0x1f⇔∀□⟨s,p,o⟩[CLS]∀0x1f⇔λ•─•0x1f[CLS]∀□⟨s,p,o⟩[CLS]•─•0x1f⇔λ•─•⟨s,p,o⟩[CLS]∀□⟨s,p,o⟩λ•─•0x1f⇔λ□⟨s,p,o⟩[CLS]∀□⇔λ•─•0x1f⇔∀□⟨s,p,o⟩[CLS]∀0x1f⇔λ•─•0x1f[CLS]∀□⟨s,p,o⟩[CLS]•─•0x1f⇔λ•─•⟨s,p,o⟩[CLS]∀□⟨s,p,o⟩λ•─•0x1f⇔λ□⟨s,p,o⟩[CLS]∀□⇔λ•─•0x1f⇔

Security

Trust you can verify.

The open-source core runs on your device: your code never leaves your machine, there is no telemetry, and the source is Apache 2.0-licensed; you can read exactly what it does.

01 / The short answer

Is Graphify safe? Check for yourself.

Yes, and you do not have to take our word for it. Graphify is Apache 2.0-licensed open source with a named maintainer: the code, the license, and the package registry are all public, so every claim below is verifiable.

Open source, Apache 2.0

The full source is public and auditable. Every claim on this page can be checked against the code, not taken on faith.

On-device parsing

Code is parsed locally by 36 bundled tree-sitter grammars. The deterministic pass makes no network calls; your code is never uploaded.

No telemetry

There is no analytics SDK and no phone-home in the codebase. The only network activity is what you explicitly initiate, like a URL you ask it to fetch or an LLM backend you configure with your own keys.

A named team

Built by Graphify Labs (YC S26) and maintained by Safi Shamsi, the copyright holder named in the LICENSE file.

Official channels

graphify.com is the only official Graphify website. The GitHub organization and the PyPI package below are the only official sources of Graphify code. This list is complete.

Website

graphify.com

The only official Graphify website, operated by Graphify Labs.

Source code

github.com/Graphify-Labs/graphify

The Apache 2.0-licensed source. Releases are cut from this repository, and its README links back to graphify.com.

PyPI package

graphifyy

The only official distribution, note the double y. Its metadata points to the GitHub organization above.

Other domains that use the Graphify name, for example graphify.net, are not affiliated with or operated by Graphify Labs, and nothing published there is ours. If you are unsure which site is official, see graphify.net vs graphify.com.

02 / Data flow

What leaves your machine

For the open-source core, the honest answer is: nothing, unless your AI assistant sends it. There is no graphify server in the loop. Every line below is verifiable in the Apache 2.0-licensed source.

Stays on your machine

NOTHING LEAVES

Your source code
Parsed entirely on-device by 36 bundled tree-sitter grammars. No API is called to read or analyze your code.
The parsed graph
Every node and edge is computed and stored locally. Querying it is a local read, not a network request.
The artifacts
Everything graphify writes lands in your repo, in plain formats you can open and inspect:
graph.jsongraph.htmlGRAPH_REPORT.md

What your model provider sees

YOUR API KEYS

Only what your assistant sends
The queries and prompts your AI assistant chooses to send its model, under your API keys, through your provider, on your terms. Graphify adds no channel of its own.
Nothing from graphify itself
The open-source core has no server behind it. It makes no network calls of its own and sends no telemetry; there is nowhere for your data to go.

The MCP server follows the same rule: it runs locally over stdio by default, or as HTTP you self-host; either way, the transport stays inside your infrastructure.

03 / Controls

SOC 2 Type II: in progress

We're working toward SOC 2 Type II for the enterprise offering. No report yet. We'll publish status here as the audit progresses.

Encryption: Enterprise early access

The hosted enterprise layer is being built to TLS 1.3 in transit and AES-256 at rest, part of the Enterprise early-access track. The open-source core needs none of this: it never sends your data anywhere.

SSO & audit logs

SSO via OIDC/JWT; the MCP server speaks OAuth 2.1 with your IdP (Okta, Auth0, Keycloak). No SAML today. Exportable audit logs are part of the Enterprise early-access track.

Self-host / VPC

Run the open-source core air-gapped or in your own VPC. Your ingested data never leaves your infrastructure.

On-device by default

The open-source CLI builds and queries your graph locally. No accounts, no telemetry, no server in the loop.

Data ownership

Your data is yours. Export or delete at any time; we never train on or sell your content.

Report a vulnerability

Found a security issue? We appreciate responsible disclosure and respond within one business day.

founders@graphifylabs.ai

04 / Common questions

Safety and trust, asked directly

Is Graphify safe?

Yes, and you can verify it instead of taking our word for it. Graphify is Apache 2.0-licensed open source at github.com/Graphify-Labs/graphify, so the code is fully auditable. Parsing runs on your device with bundled tree-sitter grammars, and the deterministic pass makes no network calls and sends no telemetry. The official package is graphifyy on PyPI.

Does Graphify send my code anywhere?

No. Your code is parsed on-device and never uploaded; Graphify has no server of its own and no telemetry. The only network activity is what you explicitly initiate: content you ask it to fetch with graphify add <url>, or the optional LLM backend you configure for semantic extraction, called with your own API keys.

Is Graphify legit?

Graphify is an open-source project by Graphify Labs, a Y Combinator S26 company, with a named maintainer, Safi Shamsi. The source is public at github.com/Graphify-Labs/graphify under the Apache 2.0 license, the official package is graphifyy on PyPI, and both point back to graphify.com.

What are the official Graphify channels?

The official website is graphify.com. The only official code sources are the GitHub organization github.com/Graphify-Labs/graphify and the PyPI package graphifyy. Other domains that use the Graphify name, for example graphify.net, are not affiliated with or operated by Graphify Labs.

How do I make sure I install the real Graphify?

Install the official PyPI package with uv tool install graphifyy (the package name has a double y), or build from source at github.com/Graphify-Labs/graphify. If you found instructions or downloads on another domain, verify them against graphify.com/docs/install before running anything.