CallimachusBLOCK
One local, searchable index of your AI coding-agent history Claude Code, Codex, Cursor, Gemini & more. Keyword + semantic search, MCP server, CLI & VS Code extension.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Local index & search for your AI coding-agent threads — across 11 tools (Claude Code, Codex, Cursor, Gemini CLI, Qwen Code, Goose, OpenCode, Continue, Cline, Roo Code, Kilo Code) — plus a provider-agnostic chat, an MCP server, a CLI, and a VS Code / Cursor extension. Everything stays on your machine.
Named for Callimachus, who built the first catalogue of the Library of Alexandria.
Download
Grab the latest signed build from Releases — macOS (.dmg, Apple Silicon), Windows (.msi), or Linux (.AppImage / .deb). The app auto-updates from there on. Prefer to build it yourself? See Develop.
What it does
- Indexes every conversation from 11 coding agents into one local SQLite store — Claude Code, Codex, Cursor, Gemini CLI, Qwen Code, Goose, OpenCode, Continue, Cline, Roo Code, and Kilo Code. Adding another source is a small, documented contract.
- Searches them with hybrid ranking: keyword (SQLite FTS5 / BM25) fused with on-device semantic similarity (sqlite-vec KNN, no cloud) via Reciprocal Rank Fusion. Filter by source,
a099a2521c7cOBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add callimachus-mcp -- npx -y [email protected]
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (8 observation(s))
- Network
- declared (2 observation(s))
- Shell
- declared (4 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (14)
const { stdout } = await exec(bin, args, { maxBuffer: 64 * 1024 * 1024 });icon.icns
.vscodeignore
concat!(env!("CARGO_MANIFEST_DIR"), "/../../../README.md"),concat!(env!("CARGO_MANIFEST_DIR"), "/../../web/src/routes/cli.tsx"),"/../../web/src/routes/index.tsx"
"/../../web/src/routes/desktop.tsx"
M::up(include_str!("../../migrations/0001_init.sql")),@base-ui/react, @fontsource-variable/geist, @shadcn/react, @tailwindcss/vite, @tanstack/react-form, @tanstack/react-pacer, @tanstack/react-query, @tanstack/react-virtual
@base-ui/react, @tailwindcss/typography, @tailwindcss/vite, @types/node, @types/react, @types/react-dom, @types/vscode, @vitejs/plugin-react
@base-ui/react, @fontsource-variable/geist, @fontsource-variable/geist-mono, @fontsource/young-serif, @tanstack/react-router, @tanstack/react-start, @vercel/analytics, class-variance-authority
@tailwindcss/typography, react-markdown, remark-gfm, use-stick-to-bottom, @changesets/cli, turbo
- a6630f8: **Fix the macOS keychain prompt that re-popped on every Deny.** The in-memory key cache only stored successful reads and "no entry" results, a denied / cancelled / locked-keychain read retu
Gates applied: no_behavioural_pass.
a099a2521c7cfull audit observations/trust-audit/mcp-server/betabots-llc__callimachus.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | a099a2521c7c | BLOCK | D | 69 | first audit |
Questions
What is the Callimachus MCP server?
One local, searchable index of your AI coding-agent history Claude Code, Codex, Cursor, Gemini & more. Keyword + semantic search, MCP server, CLI & VS Code extension.
Is Callimachus safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does Callimachus need?
It reads GITHUB_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Callimachus run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as callimachus-mcp at 0.11.0.
How current is this page?
The grade is for one exact copy of the source (a099a2521c7c), read on 2026-10-08. The repository is watched and re-audited when it changes.