KoditBLOCK
👩💻 MCP server to index external repositories
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Kodit
A code and document intelligence server that indexes Git repositories and provides search through MCP and REST APIs.
[](./LICENSE) [](https://github.com/helixml/kodit/discussions)
AI coding assistants work better when they have access to real examples from your codebase. Kodit indexes your repositories, splits source files into searchable snippets, and serves them to any MCP-compatible assistant. When your assistant needs to write new code, it queries Kodit first and gets back relevant, up-to-date examples drawn from your own projects.
Kodit also handles documents. PDFs, Word files, PowerPoint decks, and spreadsheets are rasterized and indexed so you can search across both code and documentation in one place.
What you get:
- Multiple search strategies including BM25 keyword search, semantic vector search, regex grep, and visual document search, each exposed as a separate MCP tool so your assistant picks the right approach for each query
- MCP server that works with Claude Code, Cursor, Cline, Kilo Code, and any other MCP-compatible assistant
- REST API for programmatic access to search, repositories, enrichments, and indexing status
- AI enrichments (optional) including architecture docs, API docs, database schema detection, cookbook examples, and commit summaries, all generated by an LLM
- Document intelligence with visual search across PDF pages, Office documents, and images using multimodal embeddings
- No external dependencies required for basic operation, with a built-in embedding model and SQLite storage
ce7a470a60d5OBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add kodit-benchmark -- uvx kodit-benchmark
{
"mcpServers": {
"kodit-benchmark": {
"command": "uvx",
"args": [
"kodit-benchmark"
]
}
}
}Exposed tools (26)
24 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
commit_sha | write | The commit SHA to get docs for (defaults to latest) |
glob | read | File path filter (e.g. \ |
keywords | read | Keywords to search for |
kodit_api_docs | read | Get API documentation for a repository |
kodit_architecture_docs | read | Get high-level architecture documentation for a repository |
kodit_commit_description | write | Get commit description for a repository |
kodit_cookbook | read | Get cookbook with usage examples for a repository |
kodit_database_schema | read | Get database schema documentation for a repository |
kodit_grep | read | Search file contents in a repository using git grep with regex patterns. Returns matching file URIs with line numbers. Use for exact/regex matching; use kodit_keyword_search for fuzzy/semantic matching. |
kodit_keyword_search | read | Search indexed files using keyword-based BM25 search and return file resource URIs |
kodit_ls | read | List files matching a glob pattern in a repository |
kodit_read_resource | read | Read the contents of a file resource URI. Use this to fetch file content from URIs returned by kodit_semantic_search, kodit_keyword_search, kodit_grep, and kodit_ls. |
kodit_repositories | read | List all repositories tracked by kodit |
kodit_semantic_search | read | Search indexed files using semantic similarity and return file resource URIs |
kodit_version | read | Get the kodit server version |
kodit_visual_search | read | Search indexed document pages (PDFs, etc.) using visual similarity. Embeds a text query and matches against page image embeddings to find visually relevant pages. |
kodit_wiki | read | Get the table of contents for a repository |
kodit_wiki_page | read | Get the content of a specific wiki page |
language | read | Filter by file extension (e.g. .go, .py) |
limit | read | Maximum number of results (default 10) |
page_slug | read | The slug of the wiki page to retrieve |
pattern | read | Regex pattern to search for (git grep syntax) |
query | read | Natural language description of what you are looking for |
repo_url | read | The remote URL of the repository |
source_repo | read | Filter by source repository URL |
uri | read | The file resource URI (e.g. file://1/main/src/foo.go?lines=L17-L26&line_numbers=true) |
Trust audit
BLOCKgrade D · trust 65/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (6 observation(s))
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- found
Findings (19)
- DB_URL=postgresql://postgres:[email protected]:5432/kodit
common-4.5.0.tgz
DB_URL: postgresql://postgres:mysecretpassword@vectorchord:5432/kodit
dsn: "postgresql://postgres:secret@localhost:5432/kodit",
want: "postgresql://postgres:secret@localhost:5432/kodit?search_path=public%2Cbm25_catalog%2Ctokenizer_catalog",
dsn: "postgresql://postgres:secret@localhost:5432/kodit?sslmode=disable",
streamable-http
.air.toml
.ort-version
.tokenizers-version
.helmignore
{input: "/root/.ssh/id_rsa", wantErr: true},relPath: "../../etc/passwd",
relPath: "src/../../../../etc/shadow",
{input: "a/../../etc/passwd", wantErr: true},{input: "../../etc/passwd", wantErr: true},repo.ID(), url.QueryEscape("../../etc/*")))test/benchmark/data/swebench-lite.json
test/benchmark/data/swebench-verified.json
Gates applied: no_behavioural_pass.
ce7a470a60d5full audit observations/trust-audit/mcp-server/helixml__kodit.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | ce7a470a60d5 | BLOCK | D | 65 | first audit |
Questions
What is the Kodit MCP server?
👩💻 MCP server to index external repositories
What tools does Kodit expose?
26 in total: 24 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Kodit safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (65/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does Kodit need?
No credential environment variables were found in its source, so it appears to need none.
How does Kodit run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on PyPI as kodit-benchmark.
How current is this page?
The grade is for one exact copy of the source (ce7a470a60d5), read on 2026-10-07. The repository is watched and re-audited when it changes.