roam-code MCP工具

Update / Uninstall

```bash

Uninstall

pipx uninstall roam-code # or: uv tool uninstall roam-code / pip uninstall roam-code ```

Before removing .roam/, back up any rules, annotations, memory, signed run ledgers, keys, or proof bundles you need to retain. That directory contains project state as well as the rebuildable index; uninstalling the package does not require deleting it.

Paid layers (free CLI stays Apache 2.0)

The CLI and MCP server are free under Apache 2.0 for individuals and teams. Static checks use local compute, not model calls; your agent's model charges are separate. You do not need a paid service to use Roam with your agents.

- PR Replay — paid report by request. A written assessment of an agreed change history, reviewed findings, and a founder walk-through. The existing Team and Deep scopes define the PR window; agree how commits map to those PRs before kickoff. Try the free local sample with roam pr-replay --tier sample. Its default range is HEAD~5..HEAD, not necessarily five PRs; your checkout needs that history. A replay does not prove that an incident would have been prevented. - Roam Review — planned, not available to subscribe to. A proposed hosted pull-request check using Roam's local analysis. The hosted app, installation flow, and billing are not built yet. - Roam Cloud — planned, not available to subscribe to. A proposed shared history of codebase measurements. The local roam metrics-push command exists; that does not establish a hosted dashboard. Inspect its payload with --dry-run.

See pricing and paid help and the PR Replay sample and scope. Questions go to hello@roam-code.com; describe the task first, without source code, credentials, or private reports. Availability and written terms are agreed before work starts.

Integration with AI coding tools

Use the integration guides for supported clients and project instructions. Review generated instructions before adding them to an existing agent configuration.

roam describe --agent-prompt

This prints guidance to inspect and incorporate; it does not establish that your agent has followed the workflow. The agent CLI guide covers bounded calls and incomplete output.

<a id="the-compiler--your-agents-first-token-already-knows-the-answer"></a>

CI/CD integration

Use the CI integration guide for GitHub, GitLab, Jenkins, Azure or Bitbucket. Generate configuration explicitly with roam ci-setup --platform github --write or roam init --with-ci=github; plain roam init does not change CI configuration.

<details> <summary>GitHub Actions example</summary>

```yaml

.github/workflows/roam.yml

name: Roam Analysis on: [pull_request]

jobs: roam: runs-on: ubuntu-24.04 steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 0 persist-credentials: false # For production, replace the tag with the reviewed 40-character SHA it # points at — a release tag is readable but remains movable. - uses: Cranot/roam-code@v14.1.0 with: version: '14.1.0' commands: health gate: "score>=70" sarif: 'true' comment: 'true'

Review permissions and pin actions to reviewed commit SHAs before adoption.
A quality-score gate is one configured check, not permission to merge.


**SARIF output.** 39 commands honour the global `--sarif` flag (health, complexity, dead, smells, clones, vulns, taint, secrets, n1, …). Minimal upload:

</details>

What's measured vs advisory

The measurement record separates historical agent comparisons, held-out repair-sibling retrieval results, and unmeasured detector accuracy. It preserves losses and limitations alongside wins. No general accuracy or savings claim follows from a passing regression suite.

<a id="tier-1--full-extraction-dedicated-parsers"></a>

How Roam Compares

Choose Roam for callable local code analysis and checks alongside your agent, not as another coding agent or a replacement for specialist review. Its MCP inventory is 259 (17 in default core preset); select tools for the task. Compare the roles, then evaluate the outputs on your own repository: resolution, false positives, latency, and usefulness.

FAQ

Does Roam send any data externally? Not during ordinary local analysis. Roam does not automatically upload source code, indexes, findings, telemetry, or analytics, and it performs no automatic update check. On first use, tree-sitter-language-pack downloads a checksum-verified parser bundle and keeps it in a local cache. Explicit features can contact PyPI, GitHub, user-selected URLs, Roam Cloud, or Sigstore services; docs/network-boundary.md lists every built-in trigger, destination, and payload class. Inspect roam metrics-push with --dry-run before sending its allow-listed payload.

Can Roam run in air-gapped environments? Yes, after installation and parser prewarming. Run roam index --force once while connected on each target platform; the retained bundle lets later grammar loads complete without network access. Avoid the explicit network triggers in the network-boundary inventory, use fixture/file inputs and offline-key signing, and enforce egress policy around project commands launched by roam verify or hooks.

Does Roam modify my source code? Read-only by default. Creates .roam/ with an index database. roam mutate (move/rename/extract) defaults to --dry-run; pass --apply explicitly to write changes.

Can I control where and when the index is built? Set ROAM_DB_DIR to redirect the SQLite database and its index.lock / index.state sidecars together, or save a per-project location with roam config --set-db-dir. Set ROAM_NO_AUTO_INDEX=1 to refuse implicit builds: an analysis command needing a missing or incomplete index exits 3 and emits a structured refusal in JSON mode. roam index and roam init still build when explicitly invoked. Use roam index if you only want to build the index; init intentionally also creates project configuration. The storage override does not redirect agent ledgers, response evidence, or other requested artifacts. Stop older indexers before upgrading or changing store locations; do not run mixed-version writers against one store.

How does Roam handle monorepos and multi-repo projects? Monorepos: indexes from the root; batched SQL handles 100k+ symbols. Multi-repo: roam ws init <repo1> <repo2> builds a workspace overlay DB for cross-repo API edges, then roam ws resolve / ws context / ws trace work across repos.

Is Roam compatible with SonarQube / CodeScene? Yes — they coexist in the same CI pipeline. SARIF output uploads to GitHub Code Scanning.

Does Roam satisfy SOC 2 / ISO 42001 / EU AI Act on its own? No. Configured Roam workflows can produce supporting records: ChangeEvidence packets, a run ledger, and audit-trail records. Read which checks and supplied decisions were captured, and which evidence is missing. These records do not authenticate who acted or prove complete coverage. Roam does not certify; framework applicability and assessment need appropriate specialist review.

What's the difference between the free CLI and Roam Review / Cloud / PR Replay? The CLI and MCP tools are free under Apache 2.0; their static checks run locally without model calls. Your agent's model usage is separate. PR Replay offers a free local sample and paid reports with founder review, by agreed scope. Roam Review and Roam Cloud are planned hosted products, not available to subscribe to. See pricing and availability.

Troubleshooting

See the troubleshooting guide and repository maintenance guide for environment repair, index recovery, and the meaning of doctor advisories.