wso2-docs-mcp-serverBLOCK
Production-ready MCP server providing RAG-based semantic search over WSO2 documentation (API Manager, Micro Integrator, Choreo, Ballerina, BI , IS).
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/wso2-docs-mcp-server) [](LICENSE)
"This is an unofficial community project. Not affiliated with or endorsed by WSO2."
A production-ready Model Context Protocol (MCP) server that provides AI assistants (Claude Desktop, Claude Code, Cursor, VS Code) with semantic search over WSO2 documentation via Retrieval-Augmented Generation (RAG).
Under the hood, it uses a blazing-fast dual-ingestion engine:
- GitHub Native: Fetches raw Markdown directly from WSO2's public GitHub repositories via the Git Trees API (avoids web-scraping noise and rate limits)
- Web Crawl Fallback: For products without dedicated GitHub docs repos (like the WSO2 Library)
Architecture
Documentation Sources
Prerequisites
- Node.js ≥ 20
- Docker (for pgvector)
- Embeddings - no API key required by default:
- [Ollama](https://ollama.com) (recommended) - runs locally, model auto-downloaded on first run
- If Ollama is not running, the server automatically falls back to HuggingFace ONNX (in-process, also downloads automatically)
- Cloud providers are also supported: OpenAI, Google Gemini, Voyage AI
Quick Start
Choose the setup path that fits your use case:
- Install from npm -
1e64cc16f8f4OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add wso2-docs-mcp-server --env OPENAI_API_KEY=${OPENAI_API_KEY} --env GEMINI_API_KEY=${GEMINI_API_KEY} --env VOYAGE_API_KEY=${VOYAGE_API_KEY} -- npx -y [email protected]Exposed tools (4)
4 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
explain_wso2_concept | read | Retrieve comprehensive documentation context for a WSO2 concept, searched across all products. |
get_wso2_guide | read | Retrieve documentation sections focused on a specific WSO2 product and topic. |
list_wso2_products | read | List all supported WSO2 documentation sources with their product IDs and base URLs. |
search_wso2_docs | read | Semantically search across all indexed WSO2 documentation and return the most relevant sections with metadata and source URLs. |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (5 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (11)
DATABASE_URL=postgresql://wso2mcp:wso2mcp@localhost:5432/wso2docs
DATABASE_URL="postgresql://wso2mcp:wso2mcp@localhost:5432/wso2docs" \
DATABASE_URL="postgresql://wso2mcp:wso2mcp@localhost:5432/wso2docs" \
DATABASE_URL="postgresql://wso2mcp:wso2mcp@localhost:5432/wso2docs" \
DATABASE_URL="postgresql://wso2mcp:wso2mcp@localhost:5432/wso2docs" \
import { PRODUCTS, PRODUCT_IDS } from '../../../src/config/constants';vi.mock('../../../src/config/env', () => ({import { DocChunker } from '../../../src/ingestion/chunker';import { ParsedPage } from '../../../src/ingestion/parser';vi.mock('../../../src/config/env', () => ({@google/generative-ai, @huggingface/transformers, @modelcontextprotocol/sdk, axios, cheerio, commander, dotenv, node-cron
Gates applied: no_behavioural_pass.
1e64cc16f8f4full audit observations/trust-audit/mcp-server/iamvirul__wso2-docs-mcp-server.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 1e64cc16f8f4 | BLOCK | D | 69 | first audit |
Questions
What is the wso2-docs-mcp-server MCP server?
Production-ready MCP server providing RAG-based semantic search over WSO2 documentation (API Manager, Micro Integrator, Choreo, Ballerina, BI , IS).
What tools does wso2-docs-mcp-server expose?
4 in total: 4 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is wso2-docs-mcp-server safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does wso2-docs-mcp-server need?
It reads GEMINI_API_KEY, OPENAI_API_KEY and VOYAGE_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does wso2-docs-mcp-server run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as wso2-docs-mcp-server at 1.3.13.
How current is this page?
The grade is for one exact copy of the source (1e64cc16f8f4), read on 2026-10-11. The repository is watched and re-audited when it changes.