xmp4 — Semantic Code Intelligence

OSS libs in your stack, really used: source, tests, callers. C#, Java, TS, Python, Rust, PHP+.

xmp4 is a streamable_HTTP MCP server that surfaces semantic code intelligence about the open-source libraries present in your codebase. It identifies which dependencies are actually used rather than merely declared, and maps that usage to source files, tests, and callers. The supported language set includes C#, Java, TypeScript, Python, Rust, and PHP. An agent connected through this server can query the semantic graph of library usage to verify that a declared package is reachable from application code, to locate the tests that exercise a third-party dependency, or to enumerate the call sites that invoke a specific open-source function. Because the server advertises no discrete tools in its registry record, interaction occurs through the streamable_HTTP transport surface itself. The publisher is ai.example4 and the repository is published at https://github.com/0ics-srls/lsai-xmp4.public. There are no package manager coordinates, version numbers, or installation commands recorded in the registry. Developers should treat this as a read-only semantic layer over an existing codebase.

Use cases

  • Audit which declared OSS dependencies are actually exercised in production source
  • Identify test coverage that invokes a specific third-party library
  • Trace caller chains from application code into an open-source dependency
  • Inventory library usage across a polyglot repository containing C#, Java, and TypeScript
  • Verify that a Rust or PHP library introduced by a pull request is reachable from existing code

When to use it

  • You need to distinguish declared dependencies from effectively used ones
  • Your stack mixes C#, Java, TypeScript, Python, Rust, or PHP and you want cross-language OSS visibility
  • You want caller-level evidence of how a library is integrated
  • You prefer a streamable_HTTP MCP transport

When not to use it

  • You require discrete MCP tools rather than transport-level interaction
  • Your codebase is outside the supported language set and you need first-class analysis for it
  • You need package manager or installation instructions, which are not provided
  • You require a local stdio transport instead of streamable_HTTP