lorepackBLOCK
Give AI agents cited, versioned context from your docs and spreadsheets. Build, diff and roll back what Claude Code, Codex and any MCP client read. Local-first, no API keys.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Lorepack turns the documents and tables your AI depends on into versioned context builds. It gives an agent a stable, inspectable source of truth instead of an untracked folder or a mutable search index.
Every build is immutable and content-addressed. You can inspect what entered it, see what was excluded and why, ask for bounded context with citations, compare versions, activate a known version, and roll back without rebuilding. AI clients read the active build over MCP or HTTP. They cannot edit sources, build, deploy, or run shell commands through the Lorepack boundary.
Why teams use it
Lorepack is for teams whose AI answers must be grounded in project material that changes over time:
- Keep engineering runbooks, product specifications, policies, and operational notes in a
reviewable context build.
- Let Claude Code, Codex, VS Code, or another MCP client answer from the same local build.
- Preserve spreadsheets as typed tables instead of flattening them into prose.
- Review a context update before activating it, then recover immediately if a bad source update
reaches the active version.
- Inspect every answer back to a file, heading, line range, sheet, or cell range.
Lorepack is a context build system, not a hosted knowledge base, generic crawler, chat app, or replacement for your source control. Retrieval is one capability of a versioned build.
Where Lorepack fits
Lorepack is useful when an AI system depends on files that change and those changes need the same reviewability as code or infrastructure. Common environments include:
- Local coding agents that need one checked-in context for a repository, its runbooks, and its
design documents.
- Engineering and operations teams that review deployment procedures, incident notes, and
policies before an agent can use a new version.
- Regulated or security-sensitive teams that need immutable builds, explicit activation, and a
source location for every returned passage or table row.
- P
f514e382ea83OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add test-support --env CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN} --env LOREPACK_TEST_TOKEN=${LOREPACK_TEST_TOKEN} --env LORE_REMOTE_BEARER_TOKEN=${LORE_REMOTE_BEARER_TOKEN} --env RAG_BENCH_API_KEY=${RAG_BENCH_API_KEY} -- npx -y @lorepack/[email protected]{
"mcpServers": {
"test-support": {
"command": "npx",
"args": [
"-y",
"@lorepack/[email protected]"
],
"env": {
"CLOUDFLARE_API_TOKEN": "${CLOUDFLARE_API_TOKEN}",
"LOREPACK_TEST_TOKEN": "${LOREPACK_TEST_TOKEN}",
"LORE_REMOTE_BEARER_TOKEN": "${LORE_REMOTE_BEARER_TOKEN}",
"RAG_BENCH_API_KEY": "${RAG_BENCH_API_KEY}"
}
}
}
}Exposed tools (54)
47 read · 5 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
activate | read | Point this project at a build. Never recompiles. |
build | read | build id or unambiguous prefix |
builds | read | List build history, newest first. |
client | read | which client (${CLIENT_CHOICES}) |
completion | read | Print shell completion for lorepack. |
config | read | Show the resolved configuration, and where each value came from. |
connect | read | Configure an AI client to read this project, and verify that it works. |
deploy | write | Project a build onto a remote target and activate it after verification. |
dev | read | Turn a folder into a running context runtime. Builds, serves, and connects. |
diff | read | Compare two builds. Reads build data only, never the sources. |
disconnect | destructive | Remove the Lorepack entry from an AI client, leaving everything else. |
doctor | read | Check this environment and project, and say how to fix what is wrong. |
document | read | Returns a document the user asked for. |
echo | read | Echoes its arguments. |
export | write | Write a bounded, cited context bundle for a task. Markdown or JSON. |
fail-build | read | Fails with a build error. |
fail-environment | read | Fails with an environment error. |
fail-lock | read | Fails with a concurrency error. |
fail-remote | read | Fails with a remote error. |
fail-unexpected | read | Throws something that is not a LoreError. |
fail-user | read | Fails with a user error. |
first | read | first argument |
from | read | build to compare from |
init | write | Create a minimal Lorepack project in a directory. |
inspect | read | Show what the build contains. Subjects: ${SUBJECTS.join( |
lore_build_info | read | |
lore_context_for_task | read | |
lore_describe_table | read | |
lore_list_tables | read | |
lore_query_table | read | |
lore_read_source | read | |
lore_search | read | |
mcp | read | Serve the active build to an AI client over MCP on stdio. |
pack | write | Write a portable .lorepack archive of a build. |
path | read | for explain: a dotted key, e.g. chunking.targetTokens |
plan | read | Preview what a build would change. Makes no changes itself. |
progress | read | A command that reports progress and returns a result. |
prune | destructive | Remove old builds, keeping the active one and the previous five. |
query | read | what to look for |
report | read | Reports a file name, through every human channel. |
rollback | read | Return to the previous verified build. Never recompiles. |
same | read | one |
search | read | Search the active build. Every result carries its source location. |
second | read | optional second |
serve | read | Serve the active build over HTTP and MCP. Read-only, and never rebuilds. |
shell | read | one of ${SHELLS.join( |
show-cwd | read | Reports the resolved working directory. |
show-flags | read | Reports resolved global options. |
status | read | Report whether the active build still matches the sources. |
subject | read | show or explain |
succeed | read | A command that succeeds. |
target | write | which target to deploy to |
to | read | build to compare to |
validate | read | Compile and validate a candidate without activating it. |
Trust audit
BLOCKgrade F · trust 43/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (7 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
id_rsa: '-----BEGIN PRIVATE KEY-----\nnot-a-real-key\n',
Lorepack_Local_First_MVP_Architecture_Final.docx
discover.ts
builder.ts
baseUrl: typeof window === 'undefined' ? 'http://127.0.0.1:43110' : window.location.origin,
return typeof window === 'undefined' ? 'http://127.0.0.1:43110' : window.location.origin;
return text.startsWith('') ? text.slice(1) : text;manifest: { token: 'super-secret-value-1234' },const token = 'lore_rt_deployed_worker';
const TOKEN = 'lore_rt_acceptance_worker_token';
expect(redact('use ghp_abcdefghijklmnopqrstuvwxyz012345', [])).toContain(REDACTED);'gcp-credentials.json': '{"private_key":"-----BEGIN PRIVATE KEY-----"}',disconnect, prune
environments.xlsx
.node-version
'nested/id_rsa': 'KEY',
expect(result.stdout).toContain('nested/id_rsa');writeFileSync(join(project, 'docs', `id_rsa${ESC}[31m.pem`), 'not a key\n');'id_rsa',
'id_ed25519.pub',
outDir: '../../packages/cli/studio-dist',
await expect(store.get('../../../escape.txt')).rejects.toMatchObject<Partial<LoreError>>({await expect(store.has('../../../escape.txt')).rejects.toMatchObject<Partial<LoreError>>({seedLock(path, { pid: 999_999, token: '../../escaped' });'../../etc/passwd',
Gates applied: critical_finding, no_behavioural_pass.
f514e382ea83full audit observations/trust-audit/mcp-server/burakdede__lorepack.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | f514e382ea83 | BLOCK | F | 43 | first audit |
Questions
What is the lorepack MCP server?
Give AI agents cited, versioned context from your docs and spreadsheets. Build, diff and roll back what Claude Code, Codex and any MCP client read. Local-first, no API keys.
What tools does lorepack expose?
54 in total: 47 read-only, 5 that write, and 2 that can delete or overwrite (disconnect, prune). Every one is listed on this page with its risk.
Is lorepack safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (43/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does lorepack need?
It reads CLOUDFLARE_API_TOKEN, LOREPACK_TEST_TOKEN, LORE_REMOTE_BEARER_TOKEN, RAG_BENCH_API_KEY and RAG_BENCH_TOKENIZER from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does lorepack run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @lorepack/test-support at 0.0.0.
How current is this page?
The grade is for one exact copy of the source (f514e382ea83), read on 2026-10-11. The repository is watched and re-audited when it changes.