Knowledge BaseBLOCK
This MCP server provides tools for listing and retrieving content from different knowledge bases.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/jeanibarz/knowledge-base-mcp-server/actions/workflows/test.yml) [](https://www.npmjs.com/package/@jeanibarz/knowledge-base-mcp-server) [](./UNLICENSE) [](./package.json)
Point this server at a folder of markdown notes and it becomes searchable by meaning, not just by keyword — from your AI client, or from your shell.
You keep your notes as ordinary files on your own disk. The server reads them, splits them into chunks, turns each chunk into a vector with an embedding model of your choosing (a local Ollama model, OpenAI, or HuggingFace), and stores those vectors in a local FAISS index. Run it with a local embedding model and a local LLM and your notes never leave the machine; point it at a hosted provider and only then do they cross the network. Two front doors sit on top of that index:
- An MCP server that any Model Context Protocol client — Claude Desktop, Codex CLI, Cursor, Continue, Cline — can call to search your notes, ask questions answered from them, and (optionally) write new ones.
- A `kb` command-line tool for the same corpus from a terminal or an agent's shell, plus the operational commands the MCP surface doesn't expose: indexing, diagnostics, evaluation, and note curation.
Throughout the docs, a knowledge base (or shelf) is one subdirectory of your notes root — work/, research/, personal/ — that you can search individually or together.
Demo
Real output, no mock data: the
cfa26aa4b638OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add knowledge-base-mcp-server --env HUGGINGFACE_API_KEY=${HUGGINGFACE_API_KEY} --env KB_CONTEXTUAL_MAX_TOKENS=${KB_CONTEXTUAL_MAX_TOKENS} --env KB_INGEST_SECRET_SCAN=${KB_INGEST_SECRET_SCAN} --env KB_INJECTION_GUARD_BYPASS_KBS=${KB_INJECTION_GUARD_BYPASS_KBS} -- npx -y @jeanibarz/[email protected]{
"mcpServers": {
"knowledge-base-mcp-server": {
"command": "npx",
"args": [
"-y",
"@jeanibarz/[email protected]"
],
"env": {
"HUGGINGFACE_API_KEY": "${HUGGINGFACE_API_KEY}",
"KB_CONTEXTUAL_MAX_TOKENS": "${KB_CONTEXTUAL_MAX_TOKENS}",
"KB_INGEST_SECRET_SCAN": "${KB_INGEST_SECRET_SCAN}",
"KB_INJECTION_GUARD_BYPASS_KBS": "${KB_INJECTION_GUARD_BYPASS_KBS}"
}
}
}
}Exposed tools (22)
22 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
agent-task-lessons | read | Operational task lessons from coding agent runs |
alpha | read | Alpha KB |
cite_sources | read | Answer a question strictly from retrieved knowledge-base chunks, citing the source path for every claim. |
compare_notes | read | Compare and contrast two topics using retrieved knowledge-base chunks, with citations for each side. |
echo | read | Echoes the supplied text |
focus | read | Optional topic to focus the summary on. |
job-search-agents | read | Job search agents, applications, and recruiting workflows |
k | read | How many chunks to retrieve before synthesizing (default 8). |
kb-document | read | Read an ingestable, non-quarantined knowledge-base document by KB name and relative path. |
knowledge_base_name | read | KB to summarize. Omit to summarize across all KBs. |
list_knowledge_bases | read | |
list_models | read | |
llm-agents | read | Autonomous LLM agents, planning, tool use, and evaluation |
llm-as-judge | read | LLM judge evals, rubric design, bias mitigation, and critic reliability |
paper.pdf | read | Document in knowledge base |
question | read | The question to answer from the knowledge base. |
recipes | read | Cooking notes and kitchen experiments |
research_brief | read | Produce a short, cited research brief on a topic from retrieved knowledge-base chunks. |
summarize_kb | read | Summarize what a knowledge base contains, grounded in retrieved chunks and cited by source path. |
topic | read | The topic to brief. |
topic_a | read | First topic to compare. |
topic_b | read | Second topic to compare. |
Trust audit
BLOCKgrade F · trust 52/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (4 observation(s))
- Network
- declared (4 observation(s))
- Shell
- declared (7 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
payload: 'ghp_1234567890abcdefghijklmnopqrstuvwxyzABCD', // pragma: allowlist secret
payload: 'xoxb-1234567890-token', // pragma: allowlist secret
secretNeedle: 'xoxb-1234567890-token', // pragma: allowlist secret
const parsed = yaml.load(fs.readFileSync(env.fixtureFile, 'utf-8'));
const fixture = normalizeRetrievalEvalFixture(yaml.load(raw));
return filePath.endsWith('.json') ? JSON.parse(raw) : yaml.load(raw);: yaml.load(raw);
**Requirement.** The KB root and every per-KB directory must not contain symlinks pointing outside `KNOWLEDGE_BASES_ROOT_DIR`. The realpath check would catch a jailbreak attempt at request time, but s
expect(redactSecrets('AKIA0123456789ABCDEF').text).toBe('[REDACTED]'); // pragma: allowlist secret[{ content: '{"api_key":"AKIA1234567890ABCDEF"}', location: 'frontmatter' }], // pragma: allowlist secretsecret: 'MIIEpAIBAAKCAQEA7uJ0j9mFq3Lr8sVtWuZ1aBcDeFgHiJkLmNoPqRsTuVwXyZ012',
secret: 'aB3xY9zK1mNpQ2rS4tU6vW8dE0fG',
secret: 'Xj7Kq2Wm9Rt4Yv6Bn1Zc3Pl5Sd8Fg0Hk2Lw4Qa6Ne8Ui0Op2',
const secret = 'ghp_abcdefghijklmnopqrstuvwxyz123456';
const secret = 'ghp_abcdefghijklmnopqrstuvwxyz123456';
const FAKE_SECRET = 'ghp_FAKE000111222333444555666777888999';
const secret = 'ghp_abcdefghijklmnopqrstuvwxyz123456';
const secret = 'ghp_abcdefghijklmnopqrstuvwxyz123456';
['github_token', 'ghp_1234567890abcdefghijklmnopqrstuvwxyzABCD'], // pragma: allowlist secret
'-----BEGIN RSA PRIVATE KEY-----', // pragma: allowlist secret
const truncated = '-----BEGIN PRIVATE KEY-----\nabcdefghijklmnopqrstuvwxyzABCDEF'; // pragma: allowlist secret
'-----BEGIN OPENSSH PRIVATE KEY-----', // pragma: allowlist secret
'-----BEGIN RSA PRIVATE KEY-----', // pragma: allowlist secret
['ssh_private_key', '-----BEGIN OPENSSH PRIVATE KEY-----'], // pragma: allowlist secret
expect(redactSecrets('xoxa-1234567890').text).toBe('[REDACTED]'); // pragma: allowlist secretGates applied: critical_finding, instruction_override, no_behavioural_pass.
cfa26aa4b638full audit observations/trust-audit/mcp-server/jeanibarz__knowledge-base.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | cfa26aa4b638 | BLOCK | F | 52 | first audit |
Questions
What is the Knowledge Base MCP server?
This MCP server provides tools for listing and retrieving content from different knowledge bases.
What tools does Knowledge Base expose?
22 in total: 22 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Knowledge Base safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (52/100) and found 8 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does Knowledge Base need?
It reads HUGGINGFACE_API_KEY, KB_CONTEXTUAL_MAX_TOKENS, KB_INGEST_SECRET_SCAN, KB_INJECTION_GUARD_BYPASS_KBS, KB_OPENROUTER_API_KEY, KB_SECRET_SCAN_BYPASS_KBS, MCP_AUTH_BACKOFF_MAX_ENTRIES, MCP_AUTH_BACKOFF_MS, MCP_AUTH_BACKOFF_THRESHOLD, MCP_AUTH_TOKEN, MCP_AUTH_TOKEN_FILE and OPENAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Knowledge Base run?
It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @jeanibarz/knowledge-base-mcp-server at 0.2.2.
How current is this page?
The grade is for one exact copy of the source (cfa26aa4b638), read on 2026-10-08. The repository is watched and re-audited when it changes.