harborclerkBLOCK
An MCP server that lets AI agents query your document archive instead of uploading it — with OCR, hybrid search, and cited local-AI answers in a private, Mac-native app.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Private document intelligence with search, citations, and local AI.
Harbor Clerk turns watched folders into a private, searchable document archive.
Harbor Clerk packages a serious local document intelligence stack into a Mac-native app: OCR for scans, hybrid lexical and semantic search, local embeddings and reranking, cited AI answers, and MCP/CLI access for agents. A technical operator could assemble pieces of this from open-source tools; Harbor Clerk makes that power available to small teams without turning document search into an infrastructure project.
It reads your files in place, extracts text (including OCR for scanned documents), splits them into searchable passages, and indexes everything locally so you can search or ask questions across your entire collection. Results always come with clear citations so you can jump straight back to the original document and verify the source.
Everything runs on your machine. No SaaS account. No background sync. No shared tenancy. Your originals never move — Harbor Clerk just reads them where they live.
Harbor Clerk is designed for document-heavy small teams, independent operators, researchers, and privacy-focused individuals. It runs comfortably on a Mac mini or similar hardware and includes cited answers powered by local AI models.
If you want to connect external AI tools, Harbor Clerk exposes an MCP endpoint that allows them to search your knowledge base safely. With the recommended cloud-connector scope, they receive retrieved passages and citations rather than the whole corpus.
Cloud models are supported through scoped MCP/connectors in the
cc8f021a7a09OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add harbor-clerk-frontend --env DOVECOT_TEST_PASSWORD=${DOVECOT_TEST_PASSWORD} --env HARBOR_CLERK_API_KEY=${HARBOR_CLERK_API_KEY} --env HC_API_KEY=${HC_API_KEY} --env HC_PASSWORD=${HC_PASSWORD} -- npx -y [email protected]{
"mcpServers": {
"harbor-clerk-frontend": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"DOVECOT_TEST_PASSWORD": "${DOVECOT_TEST_PASSWORD}",
"HARBOR_CLERK_API_KEY": "${HARBOR_CLERK_API_KEY}",
"HC_API_KEY": "${HC_API_KEY}",
"HC_PASSWORD": "${HC_PASSWORD}"
}
}
}
}Exposed tools (19)
17 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
kb_batch_search | write | Run multiple search queries in one call (max 5), grouped per query. |
kb_corpus_overview | read | Survey the corpus: doc types, date ranges, sample titles. |
kb_document_outline | read | Get a document |
kb_documents_by_date | read | Return documents sorted by their effective date. |
kb_entity_cooccurrence | read | Find which entities appear together in the same documents or chunks. |
kb_entity_overview | read | Survey entities in the corpus (or scoped to a single doc). |
kb_entity_search | read | Find documents that mention a specific named entity (person, organization, place). |
kb_expand_context | read | Read N chunks immediately before/after a given chunk_id. |
kb_find_all | read | Enumerate documents matching a query — deduped by document, with |
kb_find_related | read | Find documents related to a given doc_id by semantic overlap. |
kb_get_document | read | Get a document |
kb_ingest_status | read | Inspect a document |
kb_list_recent | read | List the most recently-added documents in the corpus. |
kb_read_document | read | Read the full text of a document by doc_id. |
kb_read_passages | read | Read specific passages by chunk_id. Use to verify content before answering. |
kb_reprocess | write | Re-run the ingestion pipeline for a specific document. ADMIN-ONLY. |
kb_search | read | Search the knowledge base by topic, keyword, or question. Hybrid FTS + vector retrieval. |
kb_system_health | read | Check HC |
kb_verify_identifier | read | Verify a document identifier resolves to exactly one document. |
Trust audit
BLOCKgrade F · trust 47/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (10 observation(s))
- Network
- declared (11 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
g = p.add_argument_group("answer-eval (only with --mode answer-eval)")g = parser.add_argument_group("retrieval-eval (only with --mode retrieval-eval)")p.add_argument("--insecure", action="store_true", help="Skip TLS verify (self-signed dev cert)")parser.add_argument("--insecure", action="store_true")p.add_argument("--insecure", action="store_true", help="disable TLS verify (self-signed)")*/var j0="popstate";function Hg(i={}){function c(o,h){let{pathname:d,search:g,hash:S}=o.location;return Ks("",{pathname:d,search:g,hash:S},h.state&&h.state.usr||null,h.state&&h.state.key||"default")}f"DIFF vs %s n_common=%d Δrecall@10=%+.3f Δmrr=%+.3f regressions=%d improvements=%d",
_INVISIBLE_CHARS = ""
source.token = "t1-rotated-by-the-rest-client" # the REST client re-logged in on its own 401
CLAUDE.md
alembic/CLAUDE.md
frontend/CLAUDE.md
macos/CLAUDE.md
src/harbor_clerk/CLAUDE.md
"A Developer ID app carrying these is killed at exec (exit 137) and every "
import skillMarkdown from '../../../skills/harbor-clerk/SKILL.md?raw'
import { stageLabel } from '../../utils/stageLabel'import type { CompletedItem } from '../../hooks/useQueueTray'import { stageLabel } from '../../utils/stageLabel'import { PIPELINE_STAGES, type DocumentQueueItem } from '../../hooks/useQueueTray'HC_API_BASE="http://127.0.0.1:8100",
unreachable = run_cli("http://127.0.0.1:9", "hc_" + "0" * 48, "search", "anything", timeout_s=60)apiBaseURL: "http://127.0.0.1:\(settings.apiPort)",
guard let url = URL(string: "http://127.0.0.1:\(AppSettings.shared.tikaPort)/tika") else { return false }monkeypatch.setenv("RERANKER_URL", "http://127.0.0.1:8201")Gates applied: no_behavioural_pass.
cc8f021a7a09full audit observations/trust-audit/mcp-server/r0shi__harborclerk.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | cc8f021a7a09 | BLOCK | F | 47 | first audit |
Questions
What is the harborclerk MCP server?
An MCP server that lets AI agents query your document archive instead of uploading it — with OCR, hybrid search, and cited local-AI answers in a private, Mac-native app.
What tools does harborclerk expose?
19 in total: 17 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is harborclerk safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (47/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does harborclerk need?
It reads DOVECOT_TEST_PASSWORD, HARBOR_CLERK_API_KEY, HC_API_KEY, HC_PASSWORD, HF_TOKEN, OPENAI_API_KEY and SECRET_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does harborclerk run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as harbor-clerk-frontend at 0.8.0.
How current is this page?
The grade is for one exact copy of the source (cc8f021a7a09), read on 2026-10-11. The repository is watched and re-audited when it changes.