rag-ratBLOCK
Local repo-intelligence index + MCP server: semantic search, symbol/graph navigation, impact-surface preflight, git + GitHub papertrail, and a source-anchored memory graph.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/cq27-dev/rag-rat/actions/workflows/ci.yml) [](https://codecov.io/gh/cq27-dev/rag-rat) [](https://crates.io/crates/rag-rat) [](https://bencher.dev/perf/rag-rat/plots) [](https://rag-rat.cq27.dev)
What a repository knows about itself. rag-rat is a local repo-intelligence index and MCP server for coding agents. It keeps source files read-only, writes only its own SQLite database, and answers with provenance on every result — current source, the code graph, git/GitHub history, and durable, source-anchored repo memories that persist across sessions and agents.
Explore the live VS Code Lens demo — no installation required. It surfaces clone classes, repo memories, and issue/decision context alongside the code; press Ctrl+Alt+R to reveal clone overlays.
Every coding harness already has grep and file reads. rag-rat adds the layer they do not provide: source-anchored rationale. It connects the code an agent is about to touch to its callers, callees, tests, git/GitHub history, prior decisions, invariants, risks, and duplicate-code signals — and labels every result with confidence and coverage, so an agent can judge it instead of trusting it.
sequenceDiagram participant Repo as Repository participant Engine as rag-rat engine participant Agent as Coding agent Repo->>Engine: Source · git/GitHub · repo memories
286a38b8a730OBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add bin -- npx -y @rag-rat/[email protected] mcp
Trust audit
BLOCKgrade F · trust 42/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (12 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (7 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (25)
Eval(EvalArgs),
pub(crate) fn eval(config: &Config, args: &EvalArgs) -> anyhow::Result<()> {Cmd::Eval(args) => eval(&config, &args)?,
.claude/skills/configure-rag-rat-dream
.claude/skills/dream-review
.claude/skills/init-rag-rat
.claude/skills/rust-modern-style
.claude/skills/using-rag-rat
assert_eq!(hex(&encode(&sample()).unwrap()), "830100818500f6f658202a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a81835820bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
"8378237261672d7261742f636f6e74726f6c2d636865636b706f696e742d62756e646c652f315901568378237261672d7261742f636f6e74726f6c2d636865636b706f696e742d7369676e65642f3158ec88781c7261672d7261742f636f6e74726f6c2
"8d6f7261672d7261742f656e7472792f3358201111111111111111111111111111111111111111111111111111111111111111582022222222222222222222222222222222222222222222222222222222222222225820fe812c12f3ab4ce6ac5db69ac
"83767261672d7261742f7369676e65642d656e7472792f3158c88258c28d6f7261672d7261742f656e7472792f3358201111111111111111111111111111111111111111111111111111111111111111582022222222222222222222222222222222222
"8258678d777261672d7261742f6163636f756e742d656e7472792f315820aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa005820fe812c12f3ab4ce6ac5db69ac352f906cb1b11ef43fb33e252ef7ff55226388900f6f
.vscodeignore
name: eval (search-quality)
new Function('module', 'exports', 'require', result.outputFiles[0].text)(mkdir -p ~/.ssh
printf '%s\n' '${{ secrets.DEPLOY_HOST_KEY }}' > ~/.ssh/known_hostschmod 600 ~/.ssh/known_hosts
serde_json::from_str(include_str!("../../../../plugin/hooks/hooks.json")).unwrap();serde_json::from_str(include_str!("../../../../plugin/hooks.vscode.json")).unwrap();serde_json::from_str(include_str!("../../../../plugin/hooks.cursor.json")).unwrap();PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../target/bench-corpus")"../../../../rag-rat-clones/src/bag_blob.rs",
query_endpoint = "http://127.0.0.1:11999"
Gates applied: no_behavioural_pass.
286a38b8a730full audit observations/trust-audit/mcp-server/cq27-dev__rag-rat.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | 286a38b8a730 | BLOCK | F | 42 | first audit |
Questions
What is the rag-rat MCP server?
Local repo-intelligence index + MCP server: semantic search, symbol/graph navigation, impact-surface preflight, git + GitHub papertrail, and a source-anchored memory graph.
Is rag-rat safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (42/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does rag-rat need?
No credential environment variables were found in its source, so it appears to need none.
How does rag-rat run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as rag-rat-oracle-toolchain at 0.0.0.
How current is this page?
The grade is for one exact copy of the source (286a38b8a730), read on 2026-10-10. The repository is watched and re-audited when it changes.