> Source: https://wexa.ai/docs/tools/search-code

# search-code

Grep-like search over the project's ingested codebase (CodeChunk fulltext on the server). Use this for finding symbols, strings, and file text when you have no local repo access. Returns slim hits \{path, start_line, end_line, preview, score\}. Then call fetch-code for one span. Do NOT write Cypher / query-context for code text search.

## What it is called on each surface

The wire name is `search-code` everywhere: it is what the Wexa MCP server advertises, the REST path is
`POST /v1/search-code`, and each SDK exposes it under its own language's naming convention.

| Surface | Name |
| --- | --- |
| Wexa MCP server | `search-code` |
| REST API | `POST /v1/search-code` |
| TypeScript SDK | `fabric.searchCode()` |
| Python SDK | `fabric.search_code()` |

## Arguments

1 of the 4 arguments is required. Omitting a required one is refused before the tool runs, at the validation stage, so it costs nothing and changes nothing.

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `lang` | string | Optional | Optional language filter (python, rust, …) |
| `limit` | integer | Optional | Max hits (default 25, max 50) |
| `path_prefix` | string | Optional | Optional path prefix filter (e.g. src/) |
| `query` | string | Required | Search terms (symbol, string, or keywords) |

`project_id`, `projectID`, `organization_id` and `executed_by` are not arguments you pass: the
platform binds all four from the credential you authenticated with, and both SDKs refuse them
before the request leaves your process — see
[server-bound arguments](/docs/get-started/scope-and-server-bound-arguments).

## What it returns

The three surfaces wrap this differently, and code written against one will not read another
correctly — see [return shape](/docs/tools/overview#return-shape).

A real response, captured from a live call to `search-code`:

**Result of search-code**

**REST API**

```json
{
  "lifecycle_id": "qlc_000165",
  "result": {
    "backend": "fulltext_unavailable",
    "count": 0,
    "filtered_out": 0,
    "hits": [],
    "note": "Use fetch-code with path + start_line/end_line (or row_pk) to load one span. Prefer search-code over query-context for code text."
  }
}
```

**Wexa MCP server**

```json
{
  "content": [
    {
      "type": "text",
      "text": "{\"lifecycle_id\":\"qlc_000165\",\"result\":{\"backend\":\"fulltext_unavailable\",\"count\":0,\"filtered_out\":0,\"hits\":[],\"note\":\"Use fetch-code with path + start_line/end_line (or row_pk) to load one span. Prefer search-code over query-context for code text.\"}}"
    }
  ],
  "isError": false
}
```

**TypeScript SDK**

```ts
// the object you get back IS the result — there is no `.result` to read
{
  backend: 'fulltext_unavailable',
  count: 0,
  filtered_out: 0,
  hits: [],
  note: 'Use fetch-code with path + start_line/end_line (or row_pk) to load one span. Prefer search-code over query-context for code text.'
}

// The TS SDK names these camelCase — lifecycleId, traceId — where Python uses
// lifecycle_id and trace_id. Both are non-enumerable: readable, but omitted by
// Object.keys() and JSON.stringify(). `result.lifecycleId` here is undefined.
result.lifecycleId // 'qlc_000165'
```

**Python SDK**

```python
# a dict subclass; `result` is already unwrapped
{
 "backend": "fulltext_unavailable",
 "count": 0,
 "filtered_out": 0,
 "hits": [],
 "note": "Use fetch-code with path + start_line/end_line (or row_pk) to load one span. Prefer search-code over query-context for code text."
}

out.lifecycle_id  # 'qlc_000165' — an attribute, not a key
```

Keeping the `lifecycle_id` is what lets you ask later why a call was allowed, refused or held.

## Calling it

The same call on all four surfaces. Pick a tab once and every code block in the documentation follows it.

The ids in this example are real, and resolve against the project the documentation is written
against. Swap them for your own. A value in angle brackets is one only you can supply, and the
platform refuses a literal `<...>`.

**Call search-code**

**Wexa MCP server**

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "search-code",
    "arguments": {
      "query": "<query>"
    }
  }
}
```

**REST API**

```bash
curl -sS https://fabric.wexa.ai/v1/search-code \
  -H "authorization: Bearer $FABRIC_API_KEY" \
  -H "content-type: application/json" \
  -d '{"query":"<query>"}'
```

**TypeScript SDK**

```ts
import { Fabric } from '@wexa-fabric/sdk'

const fabric = new Fabric()
const { result } = await fabric.searchCode({
  query: "<query>"
})
```

**Python SDK**

```python
from wexa import Fabric

fabric = Fabric()
out = fabric.search_code(query="<query>")
```

## Errors

Both SDKs raise the same typed errors, chosen from the gateway's own error string first and its
HTTP status second. `search-code` checks the `fabric:query.read` grant, and reaches the seven classes every
tool reaches — listed under [the common set](/docs/tools/errors#the-common-set).

It reaches nothing beyond that set, and it is the only tool that does not. It takes no identifier that
has to resolve, so there is no 404; it is not consequential, so it is never held for approval; and it is
registered on every deployment, so it cannot be missing.

## Governance

Every call to `search-code` runs through the same ten-stage lifecycle as every other Wexa tool: the
credential is resolved to a scope, the `fabric:query.read` grant is checked, quota is drawn down, the arguments are
validated, policy rules are evaluated, the call is executed, the result is shaped and redacted, and an audit
record is written. The `lifecycle_id` in the response is the handle to that record.

`search-code` only reads, so it is not marked consequential: it is audited lightly and is never held for
approval. It still consumes quota and is still refused by policy like anything else.

## See also

[The tool index](/docs/tools/overview) and [errors](/docs/tools/errors).