Local RAGSAFE
Local-first RAG server for developers. Semantic + keyword search for code and technical docs. Works with MCP or CLI. Fully private, zero setup.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/shinpr/mcp-local-rag) [](https://www.npmjs.com/package/mcp-local-rag) [](https://opensource.org/licenses/MIT) [](https://registry.modelcontextprotocol.io/)
English | 简体中文 | Deutsch | Español | Português (Brasil) | Français
Search private documents from an MCP client or the terminal without sending them to an embedding API.
mcp-local-rag indexes PDF, DOCX, Markdown, and text files on your machine. Search combines semantic similarity with keyword matching, so queries can match both intent and exact technical terms such as API names, class names, and error codes.
Features
- Runs locally: Document parsing, embeddings, storage, and search run on your machine.
After the initial model download, text ingestion and search work offline.
- Hybrid search: Semantic retrieval finds related concepts, while keyword matching boosts
exact technical terms.
- Configurable embeddings: Choose a Hugging Face embedding model that fits the language and
domain of your documents.
- Semantic chunking: Documents are split at topic boundaries instead of fixed character
counts. Markdown code blocks stay intact.
- MCP and CLI: Use the same index from an AI coding tool or directly from the terminal.
No API key, Docker, Python, or external database is required.
Quick Start
Requirements
- Node.js 22 or later
- Internet access on fi
c7d0d3c39c80OBSERVED · 2026-10-02Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add mcp-local-rag -- npx -y [email protected]
Exposed tools (7)
5 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
ingest_data | read | Ingest in-memory content as a string (use ingest_file for files on disk). The source identifier enables re-ingestion to update existing content. Returns { filePath, chunkCount, timestamp, fileTitle }. |
ingest_file | read | Ingest a document file (PDF, DOCX, TXT, MD) into the vector database. Path must be absolute; re-ingesting the same path replaces its existing data. Returns { filePath, chunkCount, timestamp, fileTitle }. |
list_files | read | List supported files (PDF, DOCX, TXT, MD) under the configured base directories and whether each is ingested. Returns { baseDirs, files, sources }; sources lists ingested items reported apart from the file scan, chiefly ingest_data content (web pages, clipboard, etc.). |
query_documents | read | Search ingested documents with hybrid keyword + semantic matching. Use the returned order as the ranking; score may disagree with it. Each has filePath, chunkIndex, text, fileTitle, score (lower is closer), and source (for ingest_data items). |
status | read | Get index status: { documentCount, chunkCount, memoryUsage (MB), uptime (s), ftsIndexEnabled, searchMode }. |
sync_start | write | Reconcile the index with the files on disk: ingest new and changed files, leave unchanged files alone, and remove index entries for files that are gone. Each changed PDF is re-ingested with the visual profile ( |
sync_status | write | Get the current or latest sync job record: { jobId, state ( |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (1 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (12)
sample-e2e.docx
it('should reject ~/.ssh paths', () => {expect(validatePath('~/.ssh/keys', '--db-path')).toContain('sensitive system path')it('should reject ~/.gnupg paths', () => {expect(validatePath('~/.gnupg/data', '--cache-dir')).toContain('sensitive system path')import { getCauseChain } from '../../utils/errors.js'const MOCKED_PATHS = ['../../vectordb/index.js', '../../embedder/index.js'] as const
let createEmbedder: typeof import('../../cli/common.js').createEmbedderlet createVectorStore: typeof import('../../cli/common.js').createVectorStorelet formatCliError: typeof import('../../cli/common.js').formatCliError'/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAMCAgICAgMCAgIDAwMDBAYEBAQEBAgGBgUGCQgKCgkICQkKDA8MCgsOCwkJDRENDg8QEBEQCgwSExIQEw8QEBD/wAALCAABAAEBAREA/8QAFAABAAAAAAAAAAAAAAAAAAAACf/EABQQAQAAAAAAAAAAAAAAAAAAAAD/2gA
@huggingface/transformers, @lancedb/lancedb, @modelcontextprotocol/sdk, jsdom, jszip, mammoth, mupdf, @types/jsdom
Gates applied: no_behavioural_pass.
c7d0d3c39c80full audit observations/trust-audit/mcp-server/shinpr__local-rag-1.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-02 | c7d0d3c39c80 | SAFE | B | 89 | first audit |
Questions
What is the Local RAG MCP server?
Local-first RAG server for developers. Semantic + keyword search for code and technical docs. Works with MCP or CLI. Fully private, zero setup.
What tools does Local RAG expose?
7 in total: 5 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Local RAG safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Local RAG need?
No credential environment variables were found in its source, so it appears to need none.
How does Local RAG run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as mcp-local-rag at 0.20.0.
How current is this page?
The grade is for one exact copy of the source (c7d0d3c39c80), read on 2026-10-02. The repository is watched and re-audited when it changes.