Sourcebot

Overview

From the repository's own README, as read at the audited commit.

<div align="center"><picture>  <source media="(prefers-color-scheme: dark)" srcset=".github/images/logo_dark.png">  <img height="150" src=".github/images/logo_light.png"></picture></div><div align="center">   <div>      <h3>         <a href="https://docs.sourcebot.dev">            <strong>Self Host</strong>         </a> ·          <a href="https://app.sourcebot.dev">            <strong>Public Demo</strong>         </a>      </h3>   </div>   <div>      <a href="https://docs.sourcebot.dev/"><strong>Docs</strong></a> ·      <a href="https://github.com/sourcebot-dev/sourcebot/issues/459"><strong>Roadmap</strong></a> ·      <a href="https://github.com/sourcebot-dev/sourcebot/issues/new?template=bug_report.yml"><strong>Report Bug</strong></a> ·      <a href="https://github.com/sourcebot-dev/sourcebot/issues/new?template=feature_request.md"><strong>Feature Request</strong></a> ·      <a href="https://www.sourcebot.dev/changelog"><strong>Changelog</strong></a>   </div>   <br/>   <div>   </div></div><p align="center">  <a href="mailto:[email protected]"><img src="https://img.shields.io/badge/Email%20Us-brightgreen" /></a>  <a href="https://github.com/sourcebot-dev/sourcebot/actions/workflows/release-prod.yml"><img src="https://img.shields.io/github/actions/workflow/status/sourcebot-dev/sourcebot/release-prod.yml"/><a>  <a href="https://github.com/sourcebot-dev/sourcebot/stargazers"><img src="https://img.shields.io/github/stars/sourcebot-dev/sourcebot" /></a></p><p align="center"></p>Sourcebot is a self-hosted tool that helps you understand your codebase. - **Ask Sourcebot:** Ask questions about your codebase and have Sourcebot provide detailed answers grounded with inline citations.- **Code search:** Search and navigate across all your repos and branches, no matter where they’re hosted.Try it out in our [public demo](https://app.sourcebot.dev)!https://github.com/user-attachments/assets/ed66a622-e38f-4947-a531-86df1e1e0218# Features![Sourcebot Features](https://github.com/us

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude mcp add web --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env AUTH_SECRET=${AUTH_SECRET} --env AUTH_URL=${AUTH_URL} --env EXPERIMENT_DISABLE_API_KEY_CREATION_FOR_NON_ADMIN_USERS=${EXPERIMENT_DISABLE_API_KEY_CREATION_FOR_NON_ADMIN_USERS} -- npx -y @sourcebot/[email protected]

{
  "mcpServers": {
    "web": {
      "command": "npx",
      "args": [
        "-y",
        "@sourcebot/[email protected]"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "AUTH_SECRET": "${AUTH_SECRET}",
        "AUTH_URL": "${AUTH_URL}",
        "EXPERIMENT_DISABLE_API_KEY_CREATION_FOR_NON_ADMIN_USERS": "${EXPERIMENT_DISABLE_API_KEY_CREATION_FOR_NON_ADMIN_USERS}"
      }
    }
  }
}

Exposed tools (58) 48 read · 9 write · 1 destructive

Blast radius: 1 tool can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one.

Details

Source

sourcebot-dev/sourcebot

npm

@sourcebot/web@0.1.0

Transports

streamable-http

Credentials it reads

ANTHROPIC_API_KEYAUTH_SECRETAUTH_URLEXPERIMENT_DISABLE_API_KEY_CREATION_FOR_NON_ADMIN_USERSSCIM_TOKENSENTRY_AUTH_TOKENSETUP_TEST_CREDENTIAL_DIRSETUP_TEST_DEV_TOKENSOURCEBOT_API_KEY

License

NOASSERTION

Stars

3,937 · pushed 0d ago

Trust audit

Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

declared (11 observation(s))

Network

declared (7 observation(s))

Shell

none-observed

Dependencies

not all pinned

Secrets in source

found

Findings (25)

DATABASE_URL: postgresql://postgres:postgres@postgres:5432/postgres

DATABASE_URL="postgresql://postgres:postgres@localhost:5432/postgres"

install = ["cd /workspace && (test -f node_modules/.yarn-state.yml || DATABASE_URL=postgresql://postgres:[email protected]:5432/postgres make yarn)", "cd /workspace && test -f config.json 

logger.debug(`Refreshing OAuth token for account ${account.id} (${account.providerId})...`);

logger.error(`OAuth token refresh failed for account ${account.id} (${account.providerId}): ${message}`);

logger.debug(`Successfully refreshed OAuth token for account ${account.id} (${account.providerId}).`);

logger.warn(`Failed to get token for connection ${connection.id}:`, error);

logger.warn(`Access token for MCP server ${serverName} is expired and has no refresh token. User ${userId} needs to re-authorize.`);

DATABASE_URL: postgresql://postgres:postgres@localhost:5432/sourcebot

DATABASE_URL: postgresql://postgres:postgres@localhost:5432/sourcebot

token: 'not-an-oauth-token-response',

token: 'azure-devops-test-token',

password: 'azure-devops-test-token',

delete_issue

.env.development

.gitmodules

.trivyignore

.yarnrc.yml

import { PrismaClient } from "../../dist";

import { PrismaClient } from "../../dist";

import { PrismaClient } from "../../dist";

import { PrismaClient } from "../../dist";

import { PrismaClient } from "../../dist";

'.env' ... fetch(

const requestUrl = new URL(request.url ?? '/', 'http://127.0.0.1');

Gates applied: no_behavioural_pass.

Audited 2026-09-15 · audit v0.4.0 · source sha 21920dda1711 · full audit: observations/trust-audit/mcp-server/sourcebot-dev__sourcebot.json · Report an issue or request a re-scan

Audit history

Alternatives

Other servers in the same categories, safer ones first.

Questions