feat: add codebase-memory-mcp (v0.9.0) + bump Claude Code to 2.1.221

[intech]

Summary

Two changes to the hardened container image:

1. Claude Code 2.1.220 → 2.1.221 (tools/package.json + lockfile regenerated inside node:22).
   npm audit surfaced three pre-existing high-severity ip-address advisories (<=10.3.0, SSRF /
   trust-boundary bypass); npm audit fix --package-lock-only lifts the transitive pin to 10.4.0,
   inside express-rate-limit's ^10.2.0 range, with no top-level version drift.
2. New MCP server: codebase-memory-mcp v0.9.0 — a tree-sitter code-intelligence engine
   (persistent knowledge graph of functions, classes, call chains, HTTP routes),
   https://github.com/DeusData/codebase-memory-mcp.

Why not the npm package

The npm package is a 12 kB shim: its postinstall downloads the real binary from GitHub Releases
outside npm's sha512 integrity, treats a missing checksums.txt as non-fatal (silently skipping
verification), and its bin.js re-downloads the binary on first run if it is absent — an unverified
fetch at runtime, which this image forbids. Installed the RTK way instead: pinned tag
(ARG CBM_VERSION=v0.9.0), per-arch -portable static asset, sha256 hardcoded in the
case "$TARGETARCH" block, build gate on --version.

Verification (built amd64 image, --cap-drop=ALL, --pids-limit=100, tmpfs HOME)

• claude --version → 2.1.221; claude doctor reports no invalid settings.
• claude mcp list: all five servers ✓ Connected under the default MCP_TIMEOUT=10000; the whole
  health check takes ~4.6 s despite the 258 MB binary.
• index_repository on /workspace → 255 nodes / 282 edges, 1.8 MB cache; search_graph and
  get_architecture answer from it, both via the CLI and via an MCP tools/call over stdio.
• Both release archives' sha256 checked against the release checksums.txt and against the
  downloaded bytes. arm64 is exercised by the CI matrix only (same posture as RTK).

Measured deviation from upstream docs

The MCP surface is 8 tools, not the 14 the upstream README advertises: index_repository,
search_graph, query_graph, trace_path, get_code_snippet, get_graph_schema,
get_architecture, search_code. list_projects, index_status, detect_changes, manage_adr,
ingest_traces and trace_call_path exist in the CLI only. Recorded in CLAUDE.md.

Flagged factors (documented, not silently absorbed)

• Image size: the binary is a 258 MB layer (159 vendored tree-sitter grammars + a vendored
  embedding model); the image is now 2.52 GB. No comparable "before" image was measured.
• Index lives in tmpfs: CBM_CACHE_DIR is deliberately left at its default, so the graph lands in
  the 512 MB HOME tmpfs and is rebuilt per session. A baked /workspace path would be wrong for the
  ACP entrypoint, which mounts the project at its host-absolute path. Escape hatch documented:
  -e CBM_CACHE_DIR=/workspace/.cache/codebase-memory-mcp.
• Residual supply-chain gap: the binary carries a manual update subcommand (source overridable
  via CBM_DOWNLOAD_URL) with no equivalent of CODEGRAPH_NO_DOWNLOAD to forbid it. Nothing in the
  image invokes it. Upstream's "zero network requests" claim is not independently verified here.
  Recorded in SECURITY.md.

Also fixed in passing: CLAUDE.md documented a build arg RTK_SHA256 that does not exist — the
sha256 values are hardcoded in the RUN layers.

🤖 Generated with Claude Code