damoqiongqiu-local-ragCAUTION
Local-first RAG server for developers. Semantic + keyword search for code and technical docs. Works with MCP or CLI. Fully private, zero setup.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/damoqiongqiu/mcp-local-rag) [](https://www.npmjs.com/package/@damoqiongqiu/mcp-local-rag) [](https://opensource.org/licenses/MIT) [](https://www.typescriptlang.org/) [](https://registry.modelcontextprotocol.io/)
🍴 Forked from shinpr/mcp-local-rag — original work by Shinsuke Kagawa Local code intelligence engine for AI coding assistants. AST-level semantic chunking + keyword boost for pinpointing functions, classes, and APIs — fully private, zero setup.
📖 中文文档
Table of Contents
- Features
- Quick Start
- 2.1 Configure Your AI Coding Tool
- 2.2 CLI Quick Start
- 2.3 First-Time Project Indexing
- Core Concepts
- 3.1 Dual-Strategy Chunking
- 3.2 Hybrid Search
- 3.3 Security Boundary
- MCP Tool Reference
- 4.1 Ingest Tools
- 4.2 Search Tools
- 4.3 Management Tools
- 4.4 Code Intelligence
- 4.5 System Tools
- CLI
- 5.1 Basic Commands
- 5.2 CLI Configuration
- [Networ
57b5597aef5eOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add mcp-local-rag -- npx -y @damoqiongqiu/[email protected]
Exposed tools (12)
10 read · 1 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
config | write | Read or update runtime configuration. Without arguments, returns current config (hybridWeight, maxDistance, maxFiles, grouping). With arguments, updates the specified keys and returns the new config. Changes take effect immediately — no restart required. |
dedup_check | read | Detect near-duplicate documents in the index by computing content hashes for every chunk. Returns file pairs with high chunk overlap, sorted by similarity. Use to identify accidentally duplicated or re-ingested content. |
export_index | read | Export the current index to a JSON file for backup or migration. Returns the export file path and stats (document count, chunk count, file size). The exported file can be re-imported with a future import_index tool. |
health_check | read | Diagnose server health and configuration. Checks embedder (model loaded?), LanceDB (readable?), BASE_DIRs (reachable on disk?), and cache directory (writable?). Returns structured pass/fail results with a human-readable summary and per-check fix suggestions for any failures. |
ingest_data | read | Ingest in-memory content as a string (use ingest_file for files on disk). The source identifier enables re-ingestion to update existing content. Returns { filePath, chunkCount, timestamp, fileTitle }. |
ingest_directory | read | Batch ingest all supported files in a directory. Recursively scans for code and document files under the given path, ingesting each one with AST-level (code) / semantic chunking. Returns per-file status plus totals. Use this for initial bulk ingestion or after deleting the database. |
ingest_file | read | Ingest a document file (PDF, DOCX, TXT, MD) into the vector database. Path must be absolute; re-ingesting the same path replaces its existing data. Returns { filePath, chunkCount, timestamp, fileTitle }. |
list_files | read | List supported files (PDF, DOCX, TXT, MD) under the configured base directories and whether each is ingested. Returns { baseDirs, files, sources }; sources lists ingested items reported apart from the file scan, chiefly ingest_data content (web pages, clipboard, etc.). |
query_documents | read | Search ingested documents with hybrid keyword + semantic matching. Returns results sorted by relevance, each with filePath, chunkIndex, text, fileTitle, score (0 = best, higher = worse), and source (for ingest_data items). |
reindex_all | destructive | Re-ingest ALL indexed files from scratch. Delete existing chunks, then re-ingest every previously-indexed file. Use after changing the embedding model, chunker parameters, or when the index is corrupted. This is a slow, destructive operation — prefer reindex_stale for routine updates. |
reindex_stale | read | Re-ingest all files whose disk contents have changed since the last ingestion (detected via mtime comparison). Returns the count of stale files that were re-ingested. Use when you know files have been modified but the index is out of date. |
status | read | Get index status: { documentCount, chunkCount, memoryUsage (MB), uptime (s), ftsIndexEnabled, searchMode, instances }. When multiple instances are configured, pass instance name for per-instance status. |
Trust audit
CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (4 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (17)
export HTTPS_PROXY=http://127.0.0.1:7890
reindex_all
sample-e2e.docx
it('should reject ~/.ssh paths', () => {expect(validatePath('~/.ssh/keys', '--db-path')).toContain('sensitive system path')it('should reject ~/.gnupg paths', () => {expect(validatePath('~/.gnupg/data', '--cache-dir')).toContain('sensitive system path')let run: typeof import('../../bin/install-skills.js').run;({ run } = await import('../../bin/install-skills.js'))import { getCauseChain } from '../../utils/errors.js'const MOCKED_PATHS = ['../../vectordb/index.js', '../../embedder/index.js'] as const
let createEmbedder: typeof import('../../cli/common.js').createEmbedder"env": { "HTTPS_PROXY": "http://127.0.0.1:7890" }"env": { "HTTPS_PROXY": "http://127.0.0.1:7890" }export HTTPS_PROXY=http://127.0.0.1:7890
export HTTP_PROXY=http://127.0.0.1:7890
@huggingface/transformers, @lancedb/lancedb, @modelcontextprotocol/sdk, chokidar, code-chunk, ignore, jsdom, mammoth
Gates applied: no_behavioural_pass.
57b5597aef5efull audit observations/trust-audit/mcp-server/damoqiongqiu__mcp-local-rag.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 57b5597aef5e | CAUTION | B | 89 | first audit |
Questions
What is the damoqiongqiu-local-rag MCP server?
Local-first RAG server for developers. Semantic + keyword search for code and technical docs. Works with MCP or CLI. Fully private, zero setup.
What tools does damoqiongqiu-local-rag expose?
12 in total: 10 read-only, 1 that write, and 1 that can delete or overwrite (reindex_all). Every one is listed on this page with its risk.
Is damoqiongqiu-local-rag safe to connect to an agent?
With care. The audit graded it B (89/100) and found 17 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does damoqiongqiu-local-rag need?
No credential environment variables were found in its source, so it appears to need none.
How does damoqiongqiu-local-rag run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @damoqiongqiu/mcp-local-rag at 0.21.0.
How current is this page?
The grade is for one exact copy of the source (57b5597aef5e), read on 2026-10-11. The repository is watched and re-audited when it changes.