Cora Code: From Code Review to Code Intelligence

Most code review tools assume your codebase lives in someone else's cloud. They also assume "review" is the only thing you'd want to do with a tool that actually understands your code. Both assumptions are wrong.

The Problem

Here's what cloud-locked code review looks like in practice. You grant a third-party service read access to your private repository. Their servers clone your code, run analysis on their infrastructure, and send back results. Your source (your intellectual property) sits on machines you don't control, in a region you didn't pick, retained under a policy you probably didn't read.

Then there's the diff problem. Most review tools look at what changed in a pull request and nothing else. A function gets renamed. The tool sees the rename. It does not see the 47 call sites across 12 files that now point at a stale signature. That's not code review. That's diff theater.

What You're Missing

A tool that only reads diffs can't understand architecture. It can't tell you which module is a hub. It can't trace a call chain. It can't tell you that the function you're about to delete is actually load-bearing for three features you forgot existed.

This matters because the hardest bugs and the riskiest refactors aren't in the diff. They're in the relationships between files: the edges, not the nodes. If your review tool doesn't model those edges, it's reviewing a crossword puzzle by looking at one square at a time.

You end up compensating. You keep a mental map of the codebase in your head. You ask a senior engineer every time you need to know "what calls this." You run grep and hope the function name is unique. It works. It's slow.

Cora Code

Cora Code (renamed from Cora CLI in v0.8.0, released July 24, 2026) is a Rust-based code intelligence tool that runs entirely on your machine. It's published on crates.io under the cora-code crate, MIT licensed, and currently at v0.9.0 (released July 28, 2026).

The old name implied a review tool. The tool outgrew that label months ago. Cora Code now covers five areas:

Deterministic code review. Twelve built-in rules catch real issues (unused imports, unreachable code, duplicate logic, missing error handling) without sending anything to an LLM. These rules run locally, produce SARIF output, and integrate with pre-commit hooks. No API key required.

Cross-file review. Since v0.7.0, Cora resolves inbound callers for any symbol under review. Change a function signature and Cora tells you every call site affected. This is blast-radius analysis, not line-by-line nitpicking.

Code intelligence. Brain Mode, call graph tracing, architecture maps: features that turn your codebase into a queryable graph.

Findings tracking. New in v0.9.0, the cora findings CLI tracks, filters, dismisses, and reopens findings across reviews. Findings persist to cora.db with severity, file, line, title, and a fingerprint for deduplication. Findings from prior reviews that no longer appear get auto-resolved. Findings that come back stay open.

MCP integration. A Model Context Protocol server exposes 15 tools to AI coding agents. Your agent can search the codebase semantically, trace call chains, and pull architecture summaries, all through the same local index.

How Brain Mode Works

Brain Mode is Cora's hybrid search engine. It answers "where is this concept implemented" and "what's related to this symbol" without requiring you to download a model.

Three retrieval strategies run in parallel:

FTS5 keyword search. Standard SQLite full-text search. Fast, exact, good for symbol names and identifiers.

Vector KNN via usearch. Cora builds 256-dimensional static token embeddings from a deterministic hashing scheme, not from a downloaded model. The embeddings live in the same SQLite database, indexed through usearch's HNSW algorithm for approximate nearest neighbor lookup.

Graph BFS proximity. Cora's call graph knows which symbols call which. A breadth-first traversal from the query symbol returns neighbors within a depth limit. This catches relationships that keyword and vector search both miss: things connected by call structure, not by naming or semantics.

Results from all three are fused using Reciprocal Rank Fusion (RRF, k=60). The final ranking balances lexical match, semantic similarity, and structural proximity.

The index lives at ~/.codecora/cora-code/cora.db and is shared across all projects. v0.9.0 renamed the file from graph.db and bumped the schema to v5, adding tables for reviews, findings, and finding events. Everything lives in one database now.

v0.9.0 Performance

Benchmarked on the cora-code repo (1,864 symbols, 115 Rust files):

Cold index (full rebuild): ~1,260ms down to ~936ms (1.3x faster)
Incremental (no changes): ~414ms down to ~6ms (52x faster)
Brain search (hybrid): ~250ms down to ~5ms (40x faster)

Three things made this happen. Rayon parallelizes file extraction and embedding across CPU cores. The vector index is cached in memory with a LazyLock, eliminating file I/O on every brain search. SQLite got PRAGMA tuning (WAL, mmap_size, cache_size) for faster writes. Change detection switched from SHA256 hashing to mtime:size fingerprinting, which is why the incremental case dropped to single digits.

Quick Start

cargo install cora-code

That gives you the cora binary. Run your first review:

cora review

Cora scans the project, applies all 12 rules, and outputs findings. Add --sarif for machine-readable output in CI. Add --byok with your provider credentials for LLM-assisted review (supports OpenAI, Anthropic, Groq, Ollama, and Z.AI). Your keys, your endpoints, nothing leaves your machine unless you want it to.

Track findings across reviews:

cora findings list --severity error
cora findings stats
cora findings dismiss <id> --reason "false positive"
cora findings reopen <id>

Trace a call chain:

cora trace handle_auth --depth 5

Get an architecture overview:

cora arch

Cora outputs a module breakdown with edge types and the top connector nodes: the modules that everything else depends on. That's usually where your technical debt lives.

Start the MCP server for your AI agent:

cora mcp

Your agent gets 15 tools for codebase navigation. Point it at a symbol and it can trace, search, and summarize through the local index.

What's Next

The graph has languages, edges, and persistence. The next step is richer edge types that distinguish "calls" from "implements" from "imports," and surfacing those distinctions in both CLI output and MCP tool responses. More tree-sitter language targets are in flight (currently 12+, including Rust, Python, JavaScript, TypeScript, Go, Java, Svelte, and Dart).

The GitHub Action companion repo exists for CI pipelines. If you want SARIF in your GitHub Checks tab, it works today. Need a clean index? cora index --rebuild drops and reindexes from scratch.

Brain Mode turns your codebase into something you can query the way you query a database: by concept, by relationship, by architecture. cargo install cora-code and run cora arch on your project. The graph changes how you see the code.