> ## Documentation Index > Fetch the complete documentation index at: https://docs.graphify.com/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > The PyPI package is graphifyy, with two y's. The command is graphify. > /graphify . is typed in an assistant chat, not in a shell. > Use only commands, flags, and endpoints shown on these pages. Do not invent one. > Choose the surface before you open a page. Local (Graphify Local) is the graphifyy package on the machine: the skill, the CLI, and the ten-tool MCP. Its pages are the Open Source tab (/open-source/) and the Graphify Local tab on each Integrations page. Graphify is the hosted workspace and https://api.graphify.com/mcp (Streamable HTTP, OAuth, no API key). Its pages are the Graphify tab (/platform/, /concepts/) and the Graphify (hosted) tab on each Integrations page. Prefer Graphify unless the user asks for a local or offline setup. Cookbooks (/cookbooks/) and /mcp/docs-search apply to both. Each page's source frontmatter records this as surface: local, cloud, or both. Buildkite is the CI integration. > In llms.txt, tell the surface from the page path. Graphify: /platform/ and /concepts/. Local: /open-source/. Most /integrations/ pages cover both, with a Graphify (hosted) tab and a Graphify Local tab. Everything else applies to both. > graphifyy release notes are published at https://github.com/Graphify-Labs/graphify/releases and https://graphify.com/changelog. The current package version is on PyPI (https://pypi.org/project/graphifyy/). > The official site is https://graphify.com. These docs are https://docs.graphify.com. > The local MCP server is the ten tools in the MCP tool reference and reads a graph on the machine. The hosted server is https://api.graphify.com/mcp (Streamable HTTP, OAuth, no API key). The JetBrains, ChatGPT, Codex, and Dots, and Vercel pages use the hosted server, not the ten-tool list. On pages with tabs, the Graphify (hosted) tab uses the hosted server and the Graphify Local tab uses the local skill or the ten-tool server. > Read https://docs.graphify.com/llms.txt, then open one page's .md link. Use https://docs.graphify.com/llms-full.txt only when one page is not enough. # Security and data handling > What Graphify stores, how long it keeps it, which GitHub and Google Drive permissions it asks for, and how assistants reach your graphs. Graphify stores the graphs it builds from the repositories you connect, plus the memory your workspace saves. It does not train models on your code. Data is encrypted in transit and at rest, and access is limited to the workspace and repositories you choose. > [!NOTE] > > This page covers Graphify, the hosted product. Graphify Local runs on your machine and sends nothing to Graphify; see [Graphify Local](#graphify-local) below. The [Privacy Policy](https://graphify.com/privacy) is the binding text. ## What Graphify stores | Data | Where it comes from | How long it is kept | | - | - | - | | Repository graphs, wiki, and review results | Repositories you connect and index | Until you delete them or close the account; then removed from active systems within 30 days. Backups expire on a rolling 90-day cycle. | | Memory notes | Notes saved by members and assistants | Same as above. | | Raw memory trails | Tool-call activity that memory distills into notes | Deleted 14 days after it is consolidated. Only the distilled notes persist. | | Google Drive graphs | Folders you choose to sync | Same as repository graphs. Ask support to delete the derived graph at any time. | | Operational logs and usage telemetry | Running the service | Up to 12 months. | To export or delete your data, contact the [Graphify team](https://graphify.com/contact). ## Model providers and training Graphify does not train models on your code. To produce results, the hosted service sends code and content to its LLM subprocessors, OpenAI and Anthropic. Under their API terms, neither Graphify nor they train models on it. The full list is on the [Subprocessors page](https://graphify.com/subprocessors). An assistant you connect, such as Claude Code or Cursor, sends what it retrieves from Graphify to its own provider. That traffic follows the assistant's terms, not Graphify's. ## GitHub App permissions Graphify reads repositories through a GitHub App. You choose **All repositories** or **Only select repositories** when you install it, and you can change the selection in GitHub at any time. | Permission or event | Why Graphify needs it | | - | - | | Repository contents: read | Index the repository and build its graph. | | `push` events | Rebuild the graph when the default branch changes. | | `pull_request` events | Start a review when a pull request is opened, reopened, or marked ready. | | `installation` and `installation_repositories` events | Track which repositories the App can reach. | Read access lets Graphify index a repository, not change it. Applying a suggested fix needs contents write access. For each webhook, Graphify queues only a sanitized copy of the event, not the raw payload. ## Google Drive Google Drive uses the read-only Drive permission. Graphify reads file names, contents, links, and modification times in the folders you choose. It never modifies or deletes Drive files. OAuth tokens are encrypted at rest, and the graph is stored on AWS in the United States. When you stop syncing a folder or disconnect Drive, Graphify stops reading it and revokes its token. See [Google Drive](https://docs.graphify.com/integrations/google-drive.md). ## Assistant access Assistants reach Graphify through the hosted MCP server at `https://api.graphify.com/mcp`. * Each assistant signs in with OAuth in the browser. No API key sits in a config file. * An agent that cannot open a browser, such as one in CI, uses an API token from the **MCP** tab of **Connectors**. Store it as a CI secret, never in the repository. * An assistant reaches only the workspace it signed in to, and only repositories indexed in that workspace. * Some tools save notes or switch workspaces. Approve a tool call only when that is what you meant. ## Graphify Local The open-source `graphifyy` package runs on your machine, with no account. * Code is parsed locally with tree-sitter. Source files are never executed. * The MCP server uses stdio by default. The HTTP transport is opt-in and binds to `127.0.0.1` unless you pass `--host 0.0.0.0`. * Semantic extraction sends content only to the model backend you configure. * Credential-shaped strings are redacted from labels before they are written to `graph.json`. The full threat model is in [SECURITY.md](https://github.com/Graphify-Labs/graphify/blob/v8/SECURITY.md). ## Compliance Graphify maintains a SOC 2 Type II program. A Data Processing Addendum is available on request. Check the [Trust Center](https://trust.graphify.com) for current evidence. For self-hosting, see [Enterprise](https://docs.graphify.com/platform/support/pricing.md#enterprise). ## Report a vulnerability Do not open a public issue for a security problem. For the open-source engine, use GitHub's [private vulnerability reporting](https://github.com/Graphify-Labs/graphify/security). For the hosted service, contact the [Graphify team](https://graphify.com/contact). The only official channels are graphify.com, the [Graphify-Labs GitHub organization](https://github.com/Graphify-Labs), and the `graphifyy` package on PyPI. [PreviousRate limits and plan limits](https://docs.graphify.com/platform/support/rate-limits.md) [NextMove from Graphify Local](https://docs.graphify.com/platform/support/move-from-local.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.