mcp-local-ragSAFE
Local-first RAG server for developers. Semantic + keyword search for code and technical docs. Works with MCP or CLI. Fully private, zero setup.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/shinpr/mcp-local-rag) [](https://www.npmjs.com/package/mcp-local-rag) [](https://opensource.org/licenses/MIT) [](https://registry.modelcontextprotocol.io/)
English | 简体中文 | Deutsch | Español | Português (Brasil) | Français
Search private documents from an MCP client or the terminal without sending them to an embedding API.
mcp-local-rag indexes PDF, DOCX, Markdown, and text files on your machine. Search combines semantic similarity with keyword matching, so queries can match both intent and exact technical terms such as API names, class names, and error codes. Results include source passages and, where available, headings, line numbers, or page numbers so you can check and cite the original document.
No API key, Docker, Python, or external database is required. After the initial model download, text ingestion and search work offline.
Quick Start
Requirements
- Node.js 22 or later
- Internet access on first use to download the npm package and embedding model
- A directory containing the documents you want to search
Set BASE_DIR to that directory. It is also the security boundary for file operations. Replace /absolute/path/to/your/documents below with the directory's absolute path.
Use one of the examples below, or register npx -y mcp-local-rag and set BASE_DIR using your client's MCP configuration format.
Set DB_PATH
1307bb775518OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add mcp-local-rag -- npx -y [email protected]
Exposed tools (6)
4 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
ingest_data | read | Ingest in-memory content as a string (use ingest_file for files on disk). The source identifier enables re-ingestion to update existing content. Returns { filePath, chunkCount, timestamp, fileTitle }. |
ingest_file | read | Ingest a document file (PDF, DOCX, TXT, MD) into the vector database. Path must be absolute; re-ingesting the same path replaces its existing data. Returns { filePath, chunkCount, timestamp, fileTitle }. |
list_files | read | List supported files (PDF, DOCX, TXT, MD) under the configured base directories and whether each is ingested. Returns { baseDirs, files, sources }; sources lists ingested items reported apart from the file scan, chiefly ingest_data content (web pages, clipboard, etc.). |
status | read | Get index status: { documentCount, chunkCount, memoryUsage (MB), uptime (s), ftsIndexEnabled, searchMode }. |
sync_start | write | Reconcile the index with the files on disk: ingest new and changed files, leave unchanged files alone, and remove index entries for files that are gone. Each changed PDF is re-ingested with the visual profile ( |
sync_status | write | Get the current or latest sync job record: { jobId, state ( |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (2 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (12)
sample-e2e.docx
it('should reject ~/.ssh paths', () => {expect(validatePath('~/.ssh/keys', '--db-path')).toContain('sensitive system path')it('should reject ~/.gnupg paths', () => {expect(validatePath('~/.gnupg/data', '--cache-dir')).toContain('sensitive system path')import { getCauseChain } from '../../utils/errors.js'const MOCKED_PATHS = ['../../vectordb/index.js', '../../embedder/index.js'] as const
let createEmbedder: typeof import('../../cli/common.js').createEmbedderlet createVectorStore: typeof import('../../cli/common.js').createVectorStorelet formatCliError: typeof import('../../cli/common.js').formatCliError'/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAMCAgICAgMCAgIDAwMDBAYEBAQEBAgGBgUGCQgKCgkICQkKDA8MCgsOCwkJDRENDg8QEBEQCgwSExIQEw8QEBD/wAALCAABAAEBAREA/8QAFAABAAAAAAAAAAAAAAAAAAAACf/EABQQAQAAAAAAAAAAAAAAAAAAAAD/2gA
@huggingface/transformers, @lancedb/lancedb, @modelcontextprotocol/sdk, jsdom, jszip, mammoth, mupdf, @types/jsdom
Gates applied: no_behavioural_pass.
1307bb775518full audit observations/trust-audit/mcp-server/shinpr__mcp-local-rag.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 1307bb775518 | SAFE | B | 89 | first audit |
Questions
What is the mcp-local-rag MCP server?
Local-first RAG server for developers. Semantic + keyword search for code and technical docs. Works with MCP or CLI. Fully private, zero setup.
What tools does mcp-local-rag expose?
6 in total: 4 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is mcp-local-rag safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does mcp-local-rag need?
No credential environment variables were found in its source, so it appears to need none.
How does mcp-local-rag run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as mcp-local-rag at 0.21.3.
How current is this page?
The grade is for one exact copy of the source (1307bb775518), read on 2026-10-12. The repository is watched and re-audited when it changes.