MCP server · Audited from source
haiku.rag MCP server
by ggozad/haiku.ragMIT licenceAudited 28 Oct 2026 · source d91bc74ddd0e
npm haiku-rag-app 0.1.0stdiostreamable-http★ 642
Is it safe? With care — CAUTION, grade C (70/100). No tools were found in its source. The audit recorded 35 findings (0 critical, 1 high, 1 medium, 26 low). Maintainer's description: Agentic RAG for local and self-hosted document search: hybrid retrieval, reranking and multimodal RAG on embedded LanceDB, with Docling parsing and an MCP server
Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
Cite
Cite this page
ModelsAtlas. “haiku.rag MCP server (ggozad/haiku.rag)”. Retrieved 28 Oct 2026. https://modelsatlas.com/mcp/ggozad/haiku-rag
Trust audit
Audit 0.4.1 · full source read 28 Oct 2026
Trust score70/100!CAUTION C
0 critical1 high1 medium26 low7 info
35 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.
What the source does
- FilesystemDeclared1 observation
- NetworkDeclared3 observations
- ShellNone observedNothing seen in the source
- DependenciesNot pinnedSome ranges float
- SecretsFoundSee the findings
“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.
Five audit layers
| Layer | What we check | Result |
|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS 1 finding |
L1 Static source | Secrets, path traversal, supply chain | WARN 23 findings |
L2 Instructions | Prompt injection and authority framing in docs and tool descriptions | FAIL 1 finding |
L3 Inventory | Declared tools match the source | PASS |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED |
Provenance & runtime
Who published it, and what the audit could and could not run
Provenance
- Repository owner
ggozadUser accountAccount type recorded when we read the repository. - PackagePublished on npm
haiku-rag-appat version 0.1.0 - LicenceMITFrom the repository, as read at the audited commit.
- Last pushTodayActivity of the repository when we read it.
- Source commit readd91bc74ddd0eThe audit covers exactly this commit, read on 28 Oct 2026.
Runtime
- Sandbox runNot run yetThis audit read the source only; it did not execute the server.
- Tool inventoryNone declaredNo tools were found in the source.
Every value here is read from the record's own repository and audit.Suggest a correction
Findings (35)
Sorted by severity · the 25 most severe of 35 are listed
HIGHPrompt injectionprompt.credential_read · .claude/skills/debug-evals/SKILL.md:55
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- Read tokens are being replaced by **API keys** (`pylf_v2_<region>_...`). Same
- Why
- asks the agent to read credentials
- Fix
- —
MEDIUMHard-coded secretssecret.anthropic · tests/conftest.py:205
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWCode injectioncode.deserialize · tests/json_body_serializer.py:55
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
cassette_dict = yaml.load(cassette_string, Loader=SafeLoader)
- Why
- deserialises untrusted bytes into live objects
- Fix
- use json or yaml.safe_load
LOWInsecure cryptocrypto.weak_hash · haiku_rag_slim/haiku/rag/client/documents.py:622
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
"content_hash": hashlib.md5(
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWInsecure cryptocrypto.weak_hash · haiku_rag_slim/haiku/rag/client/documents.py:839
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
content_hash = hashlib.md5(data, usedforsecurity=False).hexdigest()
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWInsecure cryptocrypto.weak_hash · haiku_rag_slim/haiku/rag/converters/docling_local.py:314
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
key = hashlib.md5(
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWInsecure cryptocrypto.weak_hash · haiku_rag_slim/haiku/rag/sources/fs.py:122
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
content_hash = hashlib.md5(body, usedforsecurity=False).hexdigest()
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWInsecure cryptocrypto.weak_hash · haiku_rag_slim/haiku/rag/sources/http.py:92
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
content_hash=hashlib.md5(body, usedforsecurity=False).hexdigest(),
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.beacon_words · app/backend/tests/test_stream.py:454
F-04 Network egressCWE-200 · CWE-319Layer L1
"name": "exfiltrate",
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.beacon_words · app/backend/tests/test_stream.py:462
F-04 Network egressCWE-200 · CWE-319Layer L1
assert "exfiltrate" not in seen
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · app/backend/tests/test_stream.py:491
F-04 Network egressCWE-200 · CWE-319Layer L1
async with httpx.AsyncClient(base_url=f"http://127.0.0.1:{port}") as http:- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · docs/ingester.md:471
F-04 Network egressCWE-200 · CWE-319Layer L1
proxy_pass http://127.0.0.1:8765;
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · evaluations/tests/test_answer_equivalence.py:69
F-04 Network egressCWE-200 · CWE-319Layer L1
SystemOneConfig(base_url="http://127.0.0.1:8010"), AppConfig()
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · tests/test_config.py:427
F-04 Network egressCWE-200 · CWE-319Layer L1
assert system_one.base_url == "http://127.0.0.1:8010"
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWObfuscation / stealthobf.base64_blob · tests/cassettes/multi_db/test_capabilities/TestAskAcrossDatabases.test_searching_all_databases_reaches_both.yaml:31
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
- embedding: yhaPOfPruTwCGD08pU02vd6toTqW7xA9QilkPa0R37vc9wQ9SEHOOQl4GL0n3MU8Zf/tuU9HWr2HD2g9bRJZPA/D9TxBKSC9dCXYvFtXz7sCV9a8FL0kPMK4n7xfIVu6YAYaPW4XorzFbeC8gA9gvXSVrzwtCS28g5tNvAilZL2PZms9ut1SvBtJYju
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWObfuscation / stealthobf.base64_blob · tests/cassettes/multi_db/test_capabilities/TestAskAcrossDatabases.test_searching_all_databases_reaches_both.yaml:71
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
- embedding: yhaPOfPruTwCGD08pU02vd6toTqW7xA9QilkPa0R37vc9wQ9SEHOOQl4GL0n3MU8Zf/tuU9HWr2HD2g9bRJZPA/D9TxBKSC9dCXYvFtXz7sCV9a8FL0kPMK4n7xfIVu6YAYaPW4XorzFbeC8gA9gvXSVrzwtCS28g5tNvAilZL2PZms9ut1SvBtJYju
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWObfuscation / stealthobf.base64_blob · tests/cassettes/multi_db/test_capabilities/TestAskAcrossDatabases.test_the_capability_searches_the_selected_databases.yaml:31
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
- embedding: yhaPOfPruTwCGD08pU02vd6toTqW7xA9QilkPa0R37vc9wQ9SEHOOQl4GL0n3MU8Zf/tuU9HWr2HD2g9bRJZPA/D9TxBKSC9dCXYvFtXz7sCV9a8FL0kPMK4n7xfIVu6YAYaPW4XorzFbeC8gA9gvXSVrzwtCS28g5tNvAilZL2PZms9ut1SvBtJYju
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWObfuscation / stealthobf.base64_blob · tests/cassettes/multi_db/test_capabilities/TestCollectionIdentityForTheModel.test_in_code_search_names_the_collection.yaml:31
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
- embedding: yhaPOfPruTwCGD08pU02vd6toTqW7xA9QilkPa0R37vc9wQ9SEHOOQl4GL0n3MU8Zf/tuU9HWr2HD2g9bRJZPA/D9TxBKSC9dCXYvFtXz7sCV9a8FL0kPMK4n7xfIVu6YAYaPW4XorzFbeC8gA9gvXSVrzwtCS28g5tNvAilZL2PZms9ut1SvBtJYju
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWObfuscation / stealthobf.base64_blob · tests/cassettes/multi_db/test_capabilities/TestCollectionIdentityForTheModel.test_in_code_search_names_the_collection.yaml:71
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
- embedding: yhaPOfPruTwCGD08pU02vd6toTqW7xA9QilkPa0R37vc9wQ9SEHOOQl4GL0n3MU8Zf/tuU9HWr2HD2g9bRJZPA/D9TxBKSC9dCXYvFtXz7sCV9a8FL0kPMK4n7xfIVu6YAYaPW4XorzFbeC8gA9gvXSVrzwtCS28g5tNvAilZL2PZms9ut1SvBtJYju
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWObfuscation / stealthobf.decode_call · app/backend/haiku_rag_app/images.py:27
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
raw = base64.b64decode(value, validate=True)
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWObfuscation / stealthobf.decode_call · app/backend/tests/test_stream.py:700
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
raw = base64.b64decode(_png(64, 64))
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWObfuscation / stealthobf.decode_call · evaluations/tests/test_frames.py:305
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
with Image.open(io.BytesIO(base64.b64decode(encoded))) as im:
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWObfuscation / stealthobf.decode_call · evaluations/tests/test_frames.py:318
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
assert base64.b64decode(encoded) == raw
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWObfuscation / stealthobf.decode_call · evaluations/tests/test_frames.py:329
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
assert base64.b64decode(encoded) == svg.read_bytes()
- Why
- No further detail recorded for this rule.
- Fix
- —
Tools it exposes
None declared in source
No tools were found in the source, so we cannot say what this server exposes.
Install
Package version 0.1.0 · audited commit d91bc74
Read the findings first. The most severe is Prompt injection (high) at .claude/skills/debug-evals/SKILL.md.
claude mcp add haiku-rag -- uvx haiku-rag=={{VERSION}}The command pins the package version recorded in the source (0.1.0); the audit covers commit d91bc74ddd0e. Transport: stdio · streamable-http. Reads these environment variables: ANTHROPIC_API_KEY, CO_API_KEY, GOOGLE_API_KEY, GROQ_API_KEY, INGESTER_TOKEN, JINA_API_KEY, LOGFIRE_CREDENTIALS_DIR, LOGFIRE_READ_TOKEN and 4 more. Give it the narrowest token it needs.
Audit history
- !CAUTION C 70 / 100
First audit ·
d91bc74ddd0e
README badge
For maintainers · updates on every re-audit
[](https://modelsatlas.com/mcp/ggozad/haiku-rag/)
The badge always shows the latest audit; a maintainer cannot pin an old verdict.
Other ratings
Cited, never blended into our score
No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.
Questions about haiku.rag MCP server
What is the haiku.rag MCP server?
Agentic RAG for local and self-hosted document search: hybrid retrieval, reranking and multimodal RAG on embedded LanceDB, with Docling parsing and an MCP server
Is haiku.rag safe to connect to an agent?
With care. The audit graded it C (70/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does haiku.rag need?
It reads ANTHROPIC_API_KEY, CO_API_KEY, GOOGLE_API_KEY, GROQ_API_KEY, INGESTER_TOKEN, JINA_API_KEY, LOGFIRE_CREDENTIALS_DIR, LOGFIRE_READ_TOKEN, MISTRAL_API_KEY, OPENAI_API_KEY, OPENROUTER_API_KEY and TYPESAFE_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does haiku.rag run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as haiku-rag-app at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (d91bc74ddd0e), read on 2026-10-28. The repository is watched and re-audited when it changes.
Sources
- ggozad/haiku.rag on GitHub — the source we read, its licence, stars and activityObserved · 28 Oct 2026
- ModelsAtlas trust audit — CAUTION verdict for commit d91bc74ddd0eObserved · 28 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What is the haiku.rag MCP server?
- Is haiku.rag safe to connect to an agent?
- What credentials does haiku.rag need?