codecoradev · ajianaz · Aug 5, 2026 · Aug 4, 2026 · Aug 4, 2026 · Aug 4, 2026
diff --git a/.gitignore b/.gitignore
@@ -45,3 +45,4 @@ dist/
 *.zip
 .cora/history/
 .cora/index.db
+.commit-msg.txt
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.13.0]
+
+### Added
+
+- **Runtime embedding backend selection.** Brain Mode now reads `brain.embedding` from `.cora.yaml` to select the embedding backend at runtime instead of compile time. Supported values: `auto` (best available — default), `hashing` (force 256d zero-dependency), `pretrained` (force 768d nomic). No recompilation needed to switch.
+- **Incremental per-symbol embedding.** `embed_project()` now tracks an `embed_fingerprint` (hash of symbol name + signature) and skips re-embedding symbols that have not changed since the last index. On large projects, re-indexing after touching one file embeds only the changed symbols instead of all.
+- **Schema migration v7.** Adds `embed_fingerprint TEXT` column to the `symbols` table for incremental embedding tracking. Auto-migrates on first run; existing indexes are upgraded transparently.
+- **`Backend` enum + `resolve_backend()` in `embed` module.** Clean runtime dispatch with `OnceLock` caching, graceful fallback when a requested backend is not compiled, and `active_dims()` / `active_provider_name()` helpers.
+- **`BrainConfig` + `BrainEmbeddingMode` in config schema.** New `brain` section in `.cora.yaml` with `embedding` field. Includes `Display`, `FromStr`, and `serde` impls for CLI and YAML ergonomics.
+
+### Changed
+
+- **`embed_code_dispatch()` now checks `ACTIVE_BACKEND` at runtime.** Previously selected via `#[cfg]` at compile time only. Falls back to compile-time default if `resolve_backend()` was never called (lazy resolution).
+- **`cora index`, `cora brain`, `cora watch` all resolve embedding backend on startup.** Each command loads `.cora.yaml`, reads `brain.embedding`, and calls `resolve_backend()` before touching the vector index.
+- **Embedding doc comments updated.** Module-level docs now describe runtime selection and the three-tier architecture (hashing → pretrained → ONNX future).
+
 ## [0.12.0]
 
 ### Fixed

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cora-code"
-version = "0.12.0"
+version = "0.13.0"
 edition = "2024"
 description = "CLI-first AI code review — BYOK, diff/scan/branch, pre-commit hooks"
 license = "MIT"

diff --git a/README.md b/README.md
@@ -32,7 +32,7 @@
 - 🧠 **Brain Mode** — hybrid semantic search (FTS5 + vector KNN + graph) with RRF fusion
 - 🗄️ **Multi-project database** — one global index, search across all your repos at once
 - 🌳 **Tree-sitter** (opt-in) — AST-based symbol extraction for 13 languages: Rust, Go, Python, TypeScript/TSX, Java, C, C++, C#, Ruby, PHP, Scala, JavaScript, **Svelte** (via TypeScript delegation, zero extra dependency)
-- 🔌 **MCP server** — 15 tools for AI coding agents (review, search, brain, debt, trace, ...)
+- 🔌 **MCP server** — 18 tools for AI coding agents (review, search, brain, debt, trace, dead code, graph query, ...)
 - 💾 **Diff-hash caching** — skip repeat reviews automatically
 - 🔧 **Configurable** — per-project `.cora.yaml`, global `~/.cora/config.yaml`, or env vars
 
@@ -195,6 +195,9 @@ Works on **all CI platforms** — [Gitea, GitLab, Bitbucket →](https://codecor
 | `cora callers` | Find all callers of a symbol |
 | `cora impact` | Analyze blast radius of changing a symbol |
 | `cora affected` | Find tests impacted by changed files |
+| `cora dead-code` | Detect dead code — functions with zero callers |
+| `cora query` | Query the code graph (e.g. `"main -> *"`) |
+| `cora routes` | List detected HTTP routes (Axum, Actix, Express, FastAPI, Flask, Go) |
 
 ### Config & Setup
 
@@ -203,8 +206,12 @@ Works on **all CI platforms** — [Gitea, GitLab, Bitbucket →](https://codecor
 | `cora init` | Create project config + hook |
 | `cora auth login` | Save API key |
 | `cora config show` | Show resolved config |
+| `cora config validate` | Validate configuration |
 | `cora providers` | List available LLM providers |
-| `cora mcp` | Start MCP server (15 tools) for AI coding agents |
+| `cora profile list` | List quality profiles (strict, balanced, lax) |
+| `cora mcp` | Start MCP server (18 tools) for AI coding agents |
+| `cora serve` | Start MCP server + auto-reindex on startup |
+| `cora install` | Auto-detect and configure AI coding agents |
 | `cora hook install` | Install pre-commit hook |
 
 See **[CLI Reference →](https://codecora.dev/cora/docs/cli-reference)** for all flags and examples.

diff --git a/docs/cli-reference.md b/docs/cli-reference.md
@@ -21,65 +21,149 @@ Complete command reference for the cora CLI.
 
 ## Commands
 
+### Setup & Config
+
 | Command | Description |
 |---------|-------------|
-| `cora init` | Create `.cora.yaml` config file |
-| `cora commit` | Review staged + generate commit message + commit (HITL prompt) |
-| `cora commit --yolo` | Auto-commit without prompts (YOLO mode) |
-| `cora commit --force` | Commit even if quality gate fails |
-| `cora commit --no-review` | Skip review, only generate commit message |
-| `cora commit --edit` | Always open `$EDITOR` to edit message |
-| `cora review` | Review code changes (default: staged files) |
-| `cora review --staged` | Review staged git changes explicitly |
-| `cora review --unstaged` | Review unstaged working changes |
-| `cora review --unpushed` | Review unpushed commits |
-| `cora review --base` `<branch>` | Compare current branch against target |
-| `cora review --commit` `<ref>` | Review specific commit or range |
-| `cora review --diff-file` `<path>` | Review from a diff file |
-| `cora review --upload` | Review and upload SARIF to GitHub Code Scanning |
-| `cora scan` `<path>` | Scan files for issues |
-| `cora scan .` `[--incremental]` | Scan only changed files |
-| `cora scan .` `[--batch-files N]` | Max files per LLM batch (default: 20). Lower to work around provider token limits |
-| `cora scan .` `[--no-continue-on-batch-error]` | Abort the scan when a batch fails to parse (default: skip and continue) |
+| `cora init` | Create `.cora.yaml` config file and install pre-commit hook |
+| `cora init --force` | Overwrite existing config file |
+| `cora init --no-hook` | Skip pre-commit hook installation |
 | `cora config show` | Show resolved configuration |
 | `cora config show --global` | Show global config (`~/.cora/config.yaml`) |
 | `cora config show --project` | Show project config (`.cora.yaml`) |
 | `cora config set` `<key>` `<value>` | Set a config value |
-| `cora hook install` | Install pre-commit hook |
-| `cora hook uninstall` | Remove pre-commit hook |
-| `cora auth login` | Save API key to `~/.cora/auth.toml` |
+| `cora config set` `<key>` `<value>` `--global` | Write to global config instead of project |
+| `cora config validate` | Validate configuration and report status |
+| `cora auth login` | Save API key interactively |
+| `cora auth login --provider` `<name>` `--api-key` `<key>` | Non-interactive login |
+| `cora auth login --model` `<model>` | Set model with provider |
+| `cora auth login --base-url` `<url>` | Custom API endpoint |
+| `cora auth login --force` | Overwrite existing key without confirmation |
 | `cora auth status` | Check current auth status |
 | `cora auth remove` | Remove stored API key |
 | `cora providers` | List detected AI providers |
-| `cora upload-sarif` `<file>` | Upload SARIF to GitHub Code Scanning |
-| `cora debt` | Show tech debt report from review history |
-| `cora debt --json` | Debt report as JSON (for CI/dashboards) |
-| `cora debt --trend` | Quality score trend graph |
-| `cora debt --badge` | Shields.io badge JSON endpoint |
-| `cora debt --estimate` | Show estimated fix time |
-| `cora debt --since v0.4.5` | Filter by git tag or date |
-| `cora debt --branch main` | Filter by branch |
-| `cora findings list` | Show open findings (use `--all`, `--severity`, `--file`, `--json`) |
-| `cora findings stats` | Summary counts with resolution rate (`--json`) |
-| `cora findings dismiss <id>` | Mark finding as won't-fix (optional `--reason`) |
-| `cora findings reopen <id>` | Reopen a dismissed/resolved finding |
-| `cora arch` | Architecture overview — modules, edge types, top connectors |
-| `cora trace` `<symbol>` | Trace call chains from a symbol (depth-limited BFS) |
-| `cora brain` `<query>` | Hybrid search: FTS5 + vector + graph → RRF fusion |
-| `cora brain` `--json` | Brain search as JSON |
-| `cora brain` `--limit N` | Max results (default: 20) |
+| `cora install` | Auto-detect and configure AI coding agents for Cora MCP |
+| `cora install --list` | List detected agents without installing |
+| `cora install --agents` `"cline,cursor"` | Install specific agents |
+| `cora install --dry-run` | Show what would be changed |
+| `cora install --force` | Overwrite existing cora entry |
+| `cora install --yes` | Install ALL detected agents (non-interactive) |
+| `cora hook install` | Install pre-commit hook |
+| `cora hook uninstall` | Remove pre-commit hook |
+| `cora completion` `<shell>` | Generate shell completions (bash/zsh/fish/powershell) |
+
+### Review & Scan
+
+| Command | Description |
+|---------|-------------|
+| `cora review` | Review code changes (default: tries staged, then unpushed) |
+| `cora review --staged` | Review staged git changes |
+| `cora review --unstaged` | Review unstaged working changes |
+| `cora review --unpushed` | Review unpushed commits |
+| `cora review --base` `<branch>` | Compare current branch against target |
+| `cora review --commit` `<ref>` | Review specific commit or range |
+| `cora review --diff-file` `<path>` | Review from a diff file |
+| `cora review --upload` | Review and upload SARIF to GitHub Code Scanning |
+| `cora review --no-auto-chunk` | Disable auto-chunking for large diffs |
+| `cora review --progress` | Output NDJSON progress events to stderr |
+| `cora review --quiet` | Suppress all output except result |
+| `cora review --output-file` `<path>` | Write output to file instead of stdout |
+| `cora review --severity` `<level>` | Filter by min severity (info/minor/major/critical) |
+| `cora review --no-cache` | Disable review caching |
+| `cora review --ci` | CI mode: skip diff size limit, exit 2 if any findings |
+| `cora review --max-diff-size` `<chars>` | Override max diff size |
+| `cora review --memory` | Recall project patterns from Uteke before review |
+| `cora review --learn` | Save findings to Uteke after review (implies `--memory`) |
+| `cora commit` | Review staged + generate commit message + commit (HITL prompt) |
+| `cora commit --yolo` | Auto-commit without prompts |
+| `cora commit --force` | Commit even if quality gate fails |
+| `cora commit --no-review` | Skip review, only generate commit message |
+| `cora commit --edit` | Always open `$EDITOR` to edit message |
+| `cora commit --stream` | Stream LLM response in real-time |
+| `cora commit --quiet` | Suppress all output except result |
+| `cora scan` `[--path <dir>]` | Scan files for issues (default: current directory) |
+| `cora scan --include` `"src/**/*.rs"` | Include glob patterns |
+| `cora scan --exclude` `"vendor/**"` | Exclude glob patterns |
+| `cora scan --extensions` `"ts,js"` | Additional file extensions to scan |
+| `cora scan --incremental` | Scan only files changed since last scan |
+| `cora scan --focus` `security` | Override focus areas |
+| `cora scan --batch-files` `N` | Max files per LLM batch (default: 20) |
+| `cora scan --no-continue-on-batch-error` | Abort on batch failure (default: skip and continue) |
+
+### Code Intelligence
+
+See [Code Intelligence](./code-intelligence) for detailed usage.
+
+| Command | Description |
+|---------|-------------|
 | `cora index` | Index project symbols into SQLite + usearch |
 | `cora index --rebuild` | Rebuild index from scratch |
 | `cora index --watch` | Auto-sync file watcher (2s poll interval) |
 | `cora index --stats` | Show index statistics (symbol count, languages, DB size) |
 | `cora index --prune` | Remove stale entries for deleted files |
+| `cora explore` `<query>` | Keyword search (FTS5) over symbol names |
+| `cora explore --kind` `function` | Filter by symbol kind |
+| `cora explore --file` `"src/"` | Filter by file path prefix |
+| `cora explore --language` `rust` | Filter by language |
+| `cora explore --limit` `N` | Max results (default: 50) |
+| `cora brain` `<query>` | Hybrid search: FTS5 + vector + graph → RRF fusion |
+| `cora brain --limit N` | Max results (default: 20) |
 | `cora callers` `<symbol>` | Find all callers of a symbol (reverse call graph) |
-| `cora callers` `--limit N` | Max callers to return (default: 50) |
+| `cora callers --limit N` | Max callers to return (default: 50) |
 | `cora impact` `<symbol>` | Analyze blast radius of changing a symbol |
-| `cora impact` `--depth N` | Traversal depth (default: 3) |
+| `cora impact --depth N` | Traversal depth (default: 3) |
+| `cora trace` `<symbol>` | Trace call chains (depth-limited BFS) |
+| `cora trace --direction incoming` | Trace callers instead of callees |
+| `cora trace --depth N` | Max hops (default: 3) |
+| `cora arch` | Architecture overview — modules, edge types, top connectors |
 | `cora affected` `<files...>` | Find test files affected by source changes |
-| `cora completion` `<shell>` | Generate shell completions (bash/zsh/fish) |
+| `cora affected --stdin` | Read changed files from stdin (pipe from `git diff --name-only`) |
+| `cora affected --filter` `"*test*"` | Custom test file glob pattern |
+| `cora dead-code` | Detect dead code — functions/methods with zero callers |
+| `cora dead-code --include-tests` | Include test functions in results |
+| `cora dead-code --min-lines N` | Filter out tiny functions |
+| `cora query` `"main -> *"` | Query the code graph with simple patterns |
+| `cora query --limit N` | Max results (default: 50) |
+| `cora routes` | List detected HTTP routes (Axum, Actix, Express, FastAPI, Flask, Go) |
+| `cora routes --method GET` | Filter by HTTP method |
+| `cora routes --prefix /api` | Filter by path prefix |
+
+### Quality Profiles
+
+| Command | Description |
+|---------|-------------|
+| `cora profile list` | List available quality profiles |
+| `cora profile show` `<name>` | Show details of a specific profile |
+| `cora profile validate` `<path>` | Validate a custom profile YAML file |
+
+### Findings & Debt
+
+| Command | Description |
+|---------|-------------|
+| `cora findings list` | Show open findings |
+| `cora findings list --all` | Show all findings including resolved |
+| `cora findings list --severity major` | Filter by severity |
+| `cora findings list --file "src/main.rs"` | Filter by file |
+| `cora findings list --json` | JSON output |
+| `cora findings stats` | Summary counts with resolution rate |
+| `cora findings dismiss <id>` | Mark finding as won't-fix |
+| `cora findings dismiss <id> --reason "..."` | Dismiss with reason |
+| `cora findings reopen <id>` | Reopen a dismissed/resolved finding |
+| `cora debt` | Show tech debt report from review history |
+| `cora debt --json` | Debt report as JSON (for CI/dashboards) |
+| `cora debt --trend` | Quality score trend graph |
+| `cora debt --badge` | Shields.io badge JSON endpoint |
+| `cora debt --estimate` | Show estimated fix time |
+| `cora debt --since v0.4.5` | Filter by git tag or date |
+| `cora debt --branch main` | Filter by branch |
+| `cora upload-sarif` `<file>` | Upload SARIF to GitHub Code Scanning |
+
+### MCP Server
+
+| Command | Description |
+|---------|-------------|
 | `cora mcp` | Start MCP server for AI coding agents (Claude Code, Cursor, Windsurf) |
+| `cora serve` | Start MCP server with auto-reindex on startup |
 
 ## Quick Examples
 

diff --git a/docs/code-intelligence.md b/docs/code-intelligence.md
@@ -110,7 +110,7 @@ FTS5 full-text search over symbol names and signatures.
 ```bash
 cora explore "authenticate"         # Search by name
 cora explore --kind function        # Filter by symbol kind
-cora explore --lang rust             # Filter by language
+cora explore --language rust        # Filter by language
 cora explore --limit 20              # Max results
 cora explore --json                 # JSON output
 ```
@@ -214,6 +214,43 @@ cora arch --json   # JSON output
 
 Shows: module breakdown, edge types (calls, imports), and top connector symbols.
 
+### `cora dead-code` — Dead Code Detection
+
+Find functions and methods that have zero callers — candidates for removal.
+
+```bash
+cora dead-code                     # Find dead functions
+cora dead-code --include-tests     # Include test functions (test_*, *_test)
+cora dead-code --min-lines 10      # Filter out tiny functions
+cora dead-code --json              # JSON output
+```
+
+> **Tip:** Use `analysis.entry_point_patterns` in `.cora.yaml` to mark entry points (e.g. `*Handler`, `main`) so they're not flagged as dead code.
+
+### `cora query` — Code Graph Query
+
+Query the call graph with simple pattern syntax.
+
+```bash
+cora query "main -> *"             # What does main call?
+cora query "* -> authenticate"     # What calls authenticate?
+cora query "MyStruct"              # Find all edges involving MyStruct
+cora query --limit 100 "main -> *"
+```
+
+Pattern syntax: `source -> target`, where each side can be a symbol name or `*` (wildcard).
+
+### `cora routes` — HTTP Route Listing
+
+List detected HTTP routes from framework annotations. Supports Axum, Actix, Express, FastAPI, Flask, and Go (net/http, gin, echo, chi).
+
+```bash
+cora routes                        # All routes
+cora routes --method GET           # Filter by HTTP method
+cora routes --prefix /api          # Filter by path prefix
+cora routes --json                 # JSON output
+```
+
 ## Test Impact Analysis
 
 ### `cora affected`
@@ -223,8 +260,9 @@ Find tests that are impacted by changed files.
 ```bash
 cora affected                              # From git diff
 cora affected src/auth.rs src/api.rs      # Specific files
-cora affected --test-glob "*test*"         # Custom test file pattern
-cora affected --json                     # JSON output
+cora affected --stdin                      # Pipe from git diff --name-only
+cora affected --filter "*test*"            # Custom test file pattern
+cora affected --json                       # JSON output
 ```
 
 ## MCP Integration
@@ -266,11 +304,13 @@ cora index --rebuild
 
 ## Schema Versioning
 
-The database uses automatic migrations. Current schema version: **v4**.
+The database uses automatic migrations. Current schema version: **v6**.
 
 | Version | Changes |
----------|---------|
+|---------|---------|
 | v1 | Initial symbols table + FTS5 |
 | v2 | Added language column |
 | v3 | Added `edges` table for call graph |
-| v4 | Added `embedding_tier`, `embedding_dims`, `embedding_model`, `last_embedded_at` to projects |
+| v4 | Added `embedding_tier`, `embedding_dims`, `embedding_model`, `last_embedded_at` to projects |
+| v5 | Added `reviews`, `findings`, `finding_events` tables for review history and findings tracking |
+| v6 | Added index config hash column for fingerprint invalidation on config changes |