ThallyCAUTION
Open-source docs platform and product knowledge layer that turns merged product changes into evidence-backed updates for human review.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Build and publish Git-owned docs for people and AI tools with Thally's MIT-licensed documentation engine and public toolchain. One MDX source can serve HTML, Markdown, structured JSON, JSON-LD, llms.txt, RSS, and a live MCP endpoint. Self-host it or connect the site to Thally Cloud.
Start a docs site
npx create-thally-docs my-docs cd my-docs npm run dev
create-thally-docs installs dependencies by default (pass --no-install to skip) and prints the exact preview command. Sites that include the thally CLI as a dev dependency can also run npx thally dev, which prints the local llms.txt and MCP endpoints plus a claude mcp add command once the server is ready.
Or clone the dedicated starter directly:
npx degit thallylabs/starter my-docs cd my-docs npm install npm run dev
The server starts at http://localhost:3040, or the next available port when 3040 is already in use.
Keep product knowledge aligned
The product knowledge layer for software teams.
Your product changed. Did your docs, website, and help center? Connect the repositories that define your product and the places customers learn about it. When a pull request merges, Thally Track gathers the evidence, traces the impact, and opens evidence-backed pull requests for your team to review. A no-change result is valid. Nothing publishes without human approval.
Features
- MDX content — write docs in Markdown with React components
- Unified content engine — each page is parsed once into a typed content graph; HTML, JSON, JSON-LD, Markdown, search, and embeddings are all projections of that one model
- Auto-generated API reference — drop in an OpenAPI spec and get interactive docs with a "Try It" console
- Sidebar & tabs — configured from a single
docs.jsonfile - Hybrid search — instant client-side command palette plus a server-side full-text + vector
/api/search - Retrieval-grounded AI chat — Q&A wi
500ec109e056OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add migrate --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env DOX_ACCESS_PASSWORD=${DOX_ACCESS_PASSWORD} --env DOX_ACCESS_SECRET=${DOX_ACCESS_SECRET} --env DOX_ADMIN_PASSWORD=${DOX_ADMIN_PASSWORD} -- npx -y @thallylabs/[email protected]{
"mcpServers": {
"migrate": {
"command": "npx",
"args": [
"-y",
"@thallylabs/[email protected]"
],
"env": {
"ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
"DOX_ACCESS_PASSWORD": "${DOX_ACCESS_PASSWORD}",
"DOX_ACCESS_SECRET": "${DOX_ACCESS_SECRET}",
"DOX_ADMIN_PASSWORD": "${DOX_ADMIN_PASSWORD}"
}
}
}
}Exposed tools (29)
20 read · 9 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
Content | read | Read and search the published documentation corpus. |
Discovery | read | Discover published pages and capabilities. |
Docs | read | Fixture docs |
Documentation | read | |
Readiness | read | Inspect machine-readability health. |
Thally | read | Thally is the product knowledge layer for software teams. It keeps your docs, website, and support platform in sync as your product changes. |
add_page | write | Add a new MDX page to a Thally project and register it in docs.json navigation |
add_tab | write | Add a new top-level tab to a Thally project navigation (content tab or redirect link) |
agent_readiness | read | Fetch the Agent Readiness Score (0-100) for a deployed Thally site — the same report as /api/agent-readiness and |
api-operation | read | One API reference operation as compact Markdown, by operation id (see list_api_operations). |
connect-mcp | read | Attach an MCP client to this site and use its docs as native tools. |
create_project | write | Scaffold a new Thally documentation project from the GitHub template |
get_context | read | Get the most relevant documentation context for a topic or question, within a token budget |
import_docs | write | Import content into an existing Thally project without scaffolding; use only when an in-place import is explicitly requested |
lint_project | read | Check a Thally project for issues: broken nav references, orphan files, missing frontmatter |
list_pages | read | List pages. |
migrate_docs | write | Create a fresh canonical Thally template, then migrate a GitHub repository or public docs site into it; the target must be new or empty |
page | read | Any published documentation page as Markdown, by page ID (e.g. docs://pages/guides/authentication). |
read-page-markdown | read | Fetch any documentation page as clean Markdown instead of HTML. |
read_api_spec | read | Read a bounded UTF-8 window from an OpenAPI JSON or YAML source configured by this project; follow next-start-byte until complete |
read_page | write | Read a bounded UTF-8 body window from a documentation page; follow next-start-byte until complete before replacing a page |
replace_page_text | read | Replace one exact unique span in an existing MDX page; prefer this for small edits so the full page never travels through the model response |
search-docs | read | Search this documentation site and retrieve ranked, cited results. |
search_docs | read | Search documentation pages by keyword — returns ranked list of matching pages |
semantic_search | read | Hybrid (full-text + vector) semantic search against a deployed Thally site — uses the same index as the in-app command palette and /api/search |
sync_from_repo | write | Thally Track: analyze a merged pull request in a tracked product repo and preview the docs task it would produce (dryRun), or dispatch it to the docs repo so the docs agent drafts a documentation PR |
translate_docs | read | Translate Thally documentation pages to a secondary locale using Claude AI |
update_api_spec | write | Replace and validate an OpenAPI JSON or YAML source explicitly configured by this Thally project |
update_page | write | Update one page. |
Trust audit
CAUTIONgrade C · trust 75/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (4 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (25)
ai-chat-suggestions.ts
console.log(minted.token)
const BARE_IDENTIFIER_PATH = /^[\p{ID_Start}$_][\p{ID_Continue}$]*(?:\.[\p{ID_Start}$_][\p{ID_Continue}$]*)*$/uconst BARE_OBJECT_SHORTHAND = /^\{\s*([\p{ID_Start}$_][\p{ID_Continue}$]*)\s*\}$/u.env.production
"export const viaFunction = () => Function('return process')().env;",new Function('exports', 'require', output)(exports, (specifier: string) => {const cliPath = fileURLToPath(new URL('../../dist/index.js', import.meta.url))const packageMetadata = createRequire(import.meta.url)('../../package.json') as {for (const pageId of ['../secret', 'guides/../../secret', '/absolute', 'guide\\secret', 'guide\u0000secret']) {import { slugify } from '../../slugify'import { updateAnchorId } from '../../slugify''http://169.254.169.254/latest/meta-data',
for (const server of ['http://127.0.0.1', 'http://localhost:3000', 'http://169.254.169.254', 'http://10.0.0.5']) {expect(parseDevServerUrl(' - Network: http://192.168.1.4:3040')).toBeUndefined()'http://127.0.0.1/admin',
'http://10.0.0.5/',
'http://169.254.169.254/latest/meta-data',
'# Site URL\nTHALLY_SITE_URL=http://localhost:3040\nNEXT_PUBLIC_SITE_URL="http://127.0.0.1:3000/"\n# ANTHROPIC_API_KEY=\n',
const json = atob(payload.replace(/-/g, '+').replace(/_/g, '/'))
return atob(padded)
['unicode lookalike', { ga4: { measurementId: 'G-ТEST1234' } }],['GA4 unicode lookalike', { ga4: { measurementId: 'G-ТEST1234' } }, 'ga4', false],['Plausible unicode', { plausible: { domain: 'dоcs.example.com' } }, 'plausible', false],const body = '---\ndescription: "{x}"\n---\n\n{vendor}'Gates applied: no_behavioural_pass.
500ec109e056full audit observations/trust-audit/mcp-server/thallylabs__thally.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 500ec109e056 | CAUTION | C | 75 | first audit |
Questions
What is the @thallylabs/mcp MCP server?
Open-source docs platform and product knowledge layer that turns merged product changes into evidence-backed updates for human review.
What tools does @thallylabs/mcp expose?
29 in total: 20 read-only, 9 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @thallylabs/mcp safe to connect to an agent?
With care. The audit graded it C (75/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does @thallylabs/mcp need?
It reads ANTHROPIC_API_KEY, DOX_ACCESS_PASSWORD, DOX_ACCESS_SECRET, DOX_ADMIN_PASSWORD, DOX_ADMIN_SECRET, DOX_ANALYTICS_SECRET, DOX_AUTH_SECRET, DOX_CLOUD_SITE_TOKEN, DOX_DATABASE_TOKEN, DOX_EMBEDDING_API_KEY, DOX_GITHUB_APP_PRIVATE_KEY and DOX_GITHUB_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @thallylabs/mcp run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @thallylabs/migrate at 0.2.27.
How current is this page?
The grade is for one exact copy of the source (500ec109e056), read on 2026-10-12. The repository is watched and re-audited when it changes.