ChromaSAFE
MCP server for Chroma
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A Model Context Protocol (MCP) server implementation that provides vector database capabilities through Chroma. This server enables semantic document search, metadata filtering, and document management with persistent storage.
Requirements
- Python 3.8+
- Chroma 0.4.0+
- MCP SDK 0.1.0+
Components
Resources
The server provides document storage and retrieval through Chroma's vector database:
- Stores documents with content and metadata
- Persists data in
src/chroma/datadirectory - Supports semantic similarity search
Tools
The server implements CRUD operations and search functionality:
Document Management
create_document: Create a new document- Required:
document_id,content - Optional:
metadata(key-value pairs) - Returns: Success confirmation
- Error: Already exists, Invalid input
read_document: Retrieve a document by ID- Required:
document_id - Returns: Document content and metadata
- Error: Not found
update_document: Update an existing document- Required:
document_id,content - Optional:
metadata - Returns: Success confirmation
- Error: Not found, Invalid input
delete_document: Remove a document- Required:
document_id - Returns: Success confirmation
- Error: Not found
list_documents: List all documents- Optional:
limit,offset - Returns: List of documents with content and metadata
Search Operations
search_similar: Find semantically similar documents- Required:
query - Optional:
num_results,metadata_filter,content_filter - Returns: Ranked list of similar documents with distance scores
- Error: Invalid filter
Features
- Semantic Search: Find documents based on meaning using Chroma's embeddings
- Metadata Filtering: Filter search results by metadata fields
- Content Filtering: Additional filtering based on document content
- Persistent Storage: Data persists in local directory between serve
01432ff8b528OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add chroma -- uvx chroma
{
"mcpServers": {
"chroma": {
"command": "uvx",
"args": [
"chroma"
]
}
}
}Exposed tools (6)
3 read · 2 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
create_document | write | Create a new document in the Chroma vector database |
delete_document | destructive | Delete a document from the Chroma vector database by its ID |
list_documents | read | List all documents stored in the Chroma vector database with pagination |
read_document | read | Retrieve a document from the Chroma vector database by its ID |
search_similar | read | Search for semantically similar documents in the Chroma vector database |
update_document | write | Update an existing document in the Chroma vector database |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (1)
delete_document
Gates applied: no_behavioural_pass.
01432ff8b528full audit observations/trust-audit/mcp-server/privetin__chroma-1.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | 01432ff8b528 | SAFE | B | 89 | first audit |
Questions
What is the Chroma MCP server?
MCP server for Chroma
What tools does Chroma expose?
6 in total: 3 read-only, 2 that write, and 1 that can delete or overwrite (delete_document). Every one is listed on this page with its risk.
Is Chroma safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Chroma need?
No credential environment variables were found in its source, so it appears to need none.
How does Chroma run?
It speaks stdio, so it runs as a local process your client starts. It is published on PyPI as chroma.
How current is this page?
The grade is for one exact copy of the source (01432ff8b528), read on 2026-10-08. The repository is watched and re-audited when it changes.