Audit row
id #1170
actor db@src.land
action push
ns rethunk/payments/payments-core
at 2026-06-04T18:17:30Z
Code, queryable.
Symbols, callers, impact analysis, and cross-language edges - rebuilt on every push. Query from the CLI, the web UI, or an agent token over MCP.
For evaluators
How the knowledge graph differs from a plain forge, a forge plus a search add-on, or a standalone code-intelligence layer.
Push-indexed symbol graphEvery push rebuilds callers, cross-language edges, and impact analysis. Not text search, not a batch indexer with lag.vs Sourcegraph
Git host and index combinedNo separate search cluster alongside your forge. One binary covers hosting, indexing, and querying.vs GitHub
Standard MCP server for agentsAgents query the graph with scoped bearer tokens over the MCP protocol. No user-impersonation workarounds.vs GitLab
Per-action audit attributionEvery push and every agent query lands an audit row attributed to the exact token and namespace.vs Sourcegraph
Try a query
Pick a task below to see what the knowledge graph returns. Each result links to the live fixture so you can run it yourself.
Find every caller of AssignSeat across all languages in the fixture.Run this live →
fn AssignSeat (ctx, SeatRequest) -> (Seat, error)
callers 3 (go: 2 ts: 1)
handlers/checkout.go:112 -> AssignSeat
jobs/fulfillment.go:44 -> AssignSeat
lib/booking.ts:88 -> AssignSeat [cross-ns]
Example output from the public fixture. Results update on every push.
What changes
git, plus an index.
A plain git host
Citadel adds
host repos, issues, PRs, releases
same - full parity, native Go transport
no push-indexed symbol graph
every push indexed into a symbol graph
no built-in MCP server
agents query it over a built-in MCP server
coarse personal access tokens
scoped tokens: per namespace, per action, revocable
log in with a third party
be the identity provider - OAuth 2.1, passkeys
someone else's servers
self-host the whole thing - one Go binary
Issues
Cross-namespace issue relationships, visualized.
Every push indexes issues alongside code, so typed edges connect work across orgs and repos. blocks, tracks, and relates render as colored edges; cross-namespace counterparts carry their own lane label.
⊞ tracks
⊞ tracks
⊘ blocked by
#214
Harden identity surface
acme/platform
#48
Rotate signing keys
acme/auth-service
#19
Unify auth copy
acme/web-app
#7
Publish key-rotation runbook
acme/auth-service
Why it matters
A refactor, two ways.
Without the graph
grep for callers, hope you got them all
miss the TypeScript caller of a Go route
ship it - break checkout in prod
find out in an incident channel
With the graph
kg_impact returns every caller, all languages
impact shows the blast-radius before you merge
a caller check gates the risky PR
the audit row already says who and when
Workflow
A safe rename, start to finish.
The graph turns a scary refactor into four legible steps - the same on the web or from an agent.
Find
Search the symbol by name - no UUID hunting.
citadel-cli kg search processPayment
Check blast-radius
Direct + transitive callers across projects, with impact.
citadel-cli kg impact processPayment
Patch & PR
Edit in-browser or push; suggested edits roll up.
git push origin rename/process-pay
Gate the merge
CODEOWNERS zones + caller checks block a risky merge.
4 callers - 2 owners - 1 pending
No testimonials
Receipts, not quotes.
We won't show you logos. Here's what the system actually emits on a push.
Symbol diff
processPaymentmodified
body sha256 4f9c...a210 -> 7b1e...c904
callers 2 -> 3
0 symbols removed
See it on your code
Point it at one repository.
A single repo is enough to browse the graph, run impact analysis, and watch the audit log fill in.