ModelsAtlas
Explore
Atlas / MCP servers / iberi22 / xavier

xavierBLOCK

mcp/iberi22/xavier
MCP server by iberi22 · ai agents · embeddings · local first · Audited 2026-10-11
⚑ Report / re-scanSource ↗

Xavier — Rust vector memory & knowledge graph for AI agents (HTTP/CLI/MCP). Powers SWAL communal context

Verdict
BLOCK
Grade
F
Trust score
22 /100
Exposed tools
16 12r · 3w · 1d
Transport
—
License
NOASSERTION
Stars
1
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://www.gnu.org/licenses/agpl-3.0.html) [](https://github.com/iberi22/xavier) [](https://github.com/iberi22/xavier/actions/workflows/ci.yml) [](https://www.rust-lang.org/)

Xavier is a high-performance, Rust-based vector memory runtime for AI agents with native HTTP REST, CLI, and Model Context Protocol (MCP) entry points. It manages vector embeddings, hierarchical context graphs, and semantic relationships using a robust SQLite-backed store (sqlite-vec), granting agents sub-millisecond contextual recall without external service dependencies.

🚀 Quick Start

1. Build & Installation

Ensure you have Rust (1.91+) installed.

# Clone repository
git clone https://github.com/iberi22/xavier.git
cd xavier

# Build release binary
cargo build --release

# Or install binary locally to PATH
cargo install --path . --locked

For platform-specific installation options (such as Windows Scheduled Tasks or Linux systemd setup), see Installer Guides.

2. Environment Setup

Configure master credentials and target workspace path:

export XAVIER_TOKEN=your-secure-token
export XAVIER_WORKSPACE_DIR=.

3. Launching Services

Xavier provides unified daemons for HTTP REST and MCP interfaces:

# Start HTTP REST server on port 8006 and MCP HTTP+SSE on port 8100
xavier http

# Start HTTP REST server only (disabling MCP HTTP port)
xavier http --mcp-port 0

# Start MCP stdio server for Cursor, Claude Desktop, or CLI integration
xavier mcp

4. Basic CLI Usage

# Add a memory fragment
xavier add "Architectur
Read from source at commit 1d635eeb1870OBSERVED · 2026-10-11
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add ui --env GH_TOKEN=${GH_TOKEN} --env GITHUB_TOKEN=${GITHUB_TOKEN} --env PI_TOKEN_FILE=${PI_TOKEN_FILE} --env XAVIER_API_KEY=${XAVIER_API_KEY} -- npx -y @swal/[email protected]
claude-desktop
{
  "mcpServers": {
    "ui": {
      "command": "npx",
      "args": [
        "-y",
        "@swal/[email protected]"
      ],
      "env": {
        "GH_TOKEN": "${GH_TOKEN}",
        "GITHUB_TOKEN": "${GITHUB_TOKEN}",
        "PI_TOKEN_FILE": "${PI_TOKEN_FILE}",
        "XAVIER_API_KEY": "${XAVIER_API_KEY}"
      }
    }
  }
}
03

Exposed tools (16)

12 read · 3 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

ToolRiskDescription
agent_heartbeatwriteSend heartbeat for an agent
agent_listreadList active agents
agent_push_contextwritePush context document to an agent
agent_registerreadRegister a new AI agent
agent_unregisterreadUnregister an agent
code_contextreadGet surrounding context for a code symbol
code_findreadFind code symbols by name, kind, or file path
code_scanreadScan a codebase and index symbols into the code graph
code_statsreadGet code graph statistics
codegraphreadColby McHenry CodeGraph Engine — Fast Tree-sitter symbol graph & AST indexing
memory_addwriteAdd a new memory entry with metadata and zone tagging
memory_deletedestructiveDelete a memory entry by path
memory_exportreadExport all memories as JSON
memory_searchreadSearch memory with semantic + lexical hybrid search
memory_statsreadGet memory statistics and counts
rtk-kernelreadRTK Kernel Proxy plugin for real-time kernel acceleration and routing.
04

Trust audit

BLOCKgrade F · trust 22/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (18 observation(s))
Network
declared (21 observation(s))
Shell
declared (5 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

CRITICALHard-coded secrets · secret.anthropic · CWE-798, CWE-321
src/clavis/mod.rs:408
assert_eq!(mask_key("sk-ant-api03-abcdef1234567890"), "sk-a...7890");
CRITICALHard-coded secrets · secret.anthropic · CWE-798, CWE-321
src/clavis/mod.rs:424
let secret1 = "sk-ant-api03-abcdef1234567890";
CRITICALHard-coded secrets · secret.anthropic · CWE-798, CWE-321
src/coordination/secrets.rs:586
let secret = "sk-ant-api03-abcdef1234567890";
CRITICALHard-coded secrets · secret.github · CWE-798, CWE-321
src/security/layers/entropy.rs:242
detect_secrets("ghp_abcdefghijklmnopqrstuvwxyz1234567890abcd", &mut result);
CRITICALHard-coded secrets · secret.github · CWE-798, CWE-321
src/security/scanner/scanner_impl.rs:674
let result = scanner.scan("github token: ghp_abcdefghijklmnopqrstuvwxyz1234567890");
HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
scripts/validate-cron.js:35
const data = yaml.load(content);
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
scripts/eval/xavier_brain_eval.py:333
ap = argparse.ArgumentParser(description="Xavier brain eval (LoCoMo-style)")
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
scripts/release-smoke.sh:43
if not eval(expression, {"__builtins__": {}}, {"payload": payload, "len": len, "bool": bool, "isinstance": isinstance, "list": list, "any": any}):
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
src/nodes/provision.rs:533
let res = validate_no_personal_ssh_key(Some("~/.ssh/id_ed25519"));
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
src/pageindex_glue/tools.rs:622
"id_rsa",
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
src/security/ingest_guard.rs:18
const DENIED_FILE_NAMES: &[&str] = &[".env", ".netrc", ".npmrc", ".pypirc"];
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
src/security/ingest_guard.rs:32
const DENIED_PREFIXES: &[&str] = &["id_rsa", "id_ed25519"];
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
src/security/ingest_guard.rs:172
"id_rsa",
Why it matters. touches a credential store
HIGHNetwork egress · net.env_exfil · CWE-200, CWE-319
scripts/eval/legal_rag_http_eval.py:21
'.env' ... urllib.request
Why it matters. reads secrets in the same file that sends data out
HIGHNetwork egress · net.env_exfil · CWE-200, CWE-319
scripts/subagents/dispatch.py:55
".env" ... urllib.request
Why it matters. reads secrets in the same file that sends data out
HIGHNetwork egress · net.env_exfil · CWE-200, CWE-319
scripts/subagents/run_ab_experiment.py:51
".env" ... urllib.request
Why it matters. reads secrets in the same file that sends data out
HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319
src/security/egress.rs:170
"169.254.169.254", // IPv4 link-local
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319
src/security/url_validator.rs:25
"169.254.169.254",
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319
src/security/url_validator.rs:26
"metadata.google.internal",
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319
src/security/url_validator.rs:89
assert!(validate_internal_url("http://169.254.169.254").is_err());
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319
src/security/url_validator.rs:90
assert!(validate_internal_url("http://metadata.google.internal").is_err());
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
HIGHPrompt injection · prompt.override · CWE-94, CWE-1427
docs/SECURITY.md:141
| Phrase Detection | Aho-Corasick | Injection commands, role switches, jailbreak |
Why it matters. asks the agent to drop prior instructions or safety
Fix. remove the instruction
HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
.cargo/audit_ignore.txt:1
# Security advisories to ignore
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
MEDIUMInventory / provenance · inv.binary · CWE-1104
panel-ui/src-tauri/gen/android/gradle/wrapper/gradle-wrapper.jar
gradle-wrapper.jar
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
panel-ui/src-tauri/icons/icon.icns
icon.icns
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README

Gates applied: critical_finding, instruction_override, no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 1d635eeb1870full audit observations/trust-audit/mcp-server/iberi22__xavier.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-111d635eeb1870BLOCKF22first audit
06

Questions

What is the xavier MCP server?

Xavier — Rust vector memory & knowledge graph for AI agents (HTTP/CLI/MCP). Powers SWAL communal context

What tools does xavier expose?

16 in total: 12 read-only, 3 that write, and 1 that can delete or overwrite (memory_delete). Every one is listed on this page with its risk.

Is xavier safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (22/100) and found 23 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does xavier need?

It reads GH_TOKEN, GITHUB_TOKEN, PI_TOKEN_FILE, XAVIER_API_KEY, XAVIER_TOKEN and XAVIER_TOKEN_FILE from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How current is this page?

The grade is for one exact copy of the source (1d635eeb1870), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement