MCP server · Org-owned · Audited from source

Claude Context MCP server

by zilliztech/claude-contextMIT licenceAudited 20 Sep 2026 · source 4a35db911c86

npm semanticcodesearch 0.1.11stdio★ 12,549

!CAUTIONGrade C · 80/100 · 20 Sep 2026 · 4a35db9

12,549GitHub stars

Is it safe? With care — CAUTION, grade C (80/100). It exposes 17 tools: 14 read, 2 write and 1 destructive. The audit recorded 28 findings (0 critical, 0 high, 6 medium, 17 low). Maintainer's description: Code search MCP for Claude Code. Make entire codebase the context for any coding agent.

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “Claude Context MCP server (zilliztech/claude-context)”. Retrieved 20 Sep 2026. https://modelsatlas.com/mcp/zilliztech/claude-context

Trust audit

Audit 0.4.1 · full source read 20 Sep 2026

Trust score80/100!CAUTION C

0 critical0 high6 medium17 low5 info

28 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemDeclared3 observations
NetworkDeclared6 observations
ShellDeclared1 observation
DependenciesNot pinnedSome ranges float
SecretsNone foundNo keys in source

“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.

Five audit layers

Layer	What we check	Result
`L0` Provenance	Repo owner, licence, archive status, activity	WARN 8 findings
`L1` Static source	Secrets, path traversal, supply chain	WARN 16 findings
`L2` Instructions	Prompt injection and authority framing in docs and tool descriptions	PASS
`L3` Inventory	Declared tools match the source	WARN 1 finding
`L4` Sandbox	Run in isolation and watch behaviour	SKIPPED

Provenance & runtime

Who published it, and what the audit could and could not run

Provenance

Repository owner zilliztechOrganizationAccount type recorded when we read the repository.
PackagePublished on npmsemanticcodesearch at version 0.1.11
LicenceMITFrom the repository, as read at the audited commit.
Last push2 months agoActivity of the repository when we read it.
Source commit read4a35db911c86The audit covers exactly this commit, read on 20 Sep 2026.

Runtime

Sandbox runNot run yetThis audit read the source only; it did not execute the server.
Tool inventory17 declaredRead from the source and classed read, write or destructive.

Every value here is read from the record's own repository and audit.Suggest a correction

Findings (28)

Sorted by severity · the 25 most severe of 28 are listed

MEDIUMInventory / provenanceinv.binary · packages/vscode-extension/wasm/tree-sitter-go.wasm

F-13 Inventory / provenanceCWE-1104Layer L0

tree-sitter-go.wasm

Why: a compiled or binary member cannot be reviewed from source
Fix: ship source, or explain the binary in the README

MEDIUMInventory / provenanceinv.binary · packages/vscode-extension/wasm/tree-sitter-java.wasm

F-13 Inventory / provenanceCWE-1104Layer L0

tree-sitter-java.wasm

Why: a compiled or binary member cannot be reviewed from source
Fix: ship source, or explain the binary in the README

MEDIUMInventory / provenanceinv.binary · packages/vscode-extension/wasm/tree-sitter-javascript.wasm

F-13 Inventory / provenanceCWE-1104Layer L0

tree-sitter-javascript.wasm

Why: a compiled or binary member cannot be reviewed from source
Fix: ship source, or explain the binary in the README

MEDIUMInventory / provenanceinv.binary · packages/vscode-extension/wasm/tree-sitter-python.wasm

F-13 Inventory / provenanceCWE-1104Layer L0

tree-sitter-python.wasm

Why: a compiled or binary member cannot be reviewed from source
Fix: ship source, or explain the binary in the README

MEDIUMNetwork egressnet.raw_ip · packages/core/src/embedding/ollama-embedding.ts:25

F-04 Network egressCWE-200 · CWE-319Layer L1

host: config.host || 'http://127.0.0.1:11434',

Why: No further detail recorded for this rule.
Fix: —

MEDIUMFilesystem / pathmcp.destructive_tools

F-05 Filesystem / pathCWE-22 · CWE-59Layer L3

clear_index

Why: 1 tool(s) can delete or overwrite
Fix: prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenanceinv.hidden_file · .eslintrc.js

F-13 Inventory / provenanceCWE-1104Layer L0

.eslintrc.js

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.symlink · AGENTS.md

F-13 Inventory / provenanceCWE-1104Layer L0

AGENTS.md

Why: link not followed
Fix: —

LOWInsecure cryptocrypto.weak_hash · packages/core/src/context.ts:293

F-09 Insecure cryptoCWE-327 · CWE-338Layer L1

const pathHash = crypto.createHash('md5').update(normalizedPath).digest('hex').substring(0, 8);

Why: No further detail recorded for this rule.
Fix: —

LOWInsecure cryptocrypto.weak_hash · packages/core/src/sync/synchronizer.ts:30

F-09 Insecure cryptoCWE-327 · CWE-338Layer L1

const hash = crypto.createHash('md5').update(normalizedPath).digest('hex');

Why: No further detail recorded for this rule.
Fix: —

LOWInsecure cryptocrypto.weak_hash · packages/core/src/sync/synchronizer.ts:247

F-09 Insecure cryptoCWE-327 · CWE-338Layer L1

const hash = crypto.createHash('md5').update(normalizedPath).digest('hex');

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · packages/mcp/scripts/path-resolution-e2e.mjs:10

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

const repoRoot = path.resolve(path.dirname(__filename), "../../..");

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · packages/mcp/scripts/sync-lock-e2e.mjs:11

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

const repoRoot = path.resolve(path.dirname(__filename), "../../..");

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · docs/getting-started/environment-variables.md:55

F-04 Network egressCWE-200 · CWE-319Layer L1

| `OLLAMA_HOST` | Ollama server URL | `http://127.0.0.1:11434` |

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · docs/getting-started/quick-start.md:190

F-04 Network egressCWE-200 · CWE-319Layer L1

"OLLAMA_HOST": "http://127.0.0.1:11434",

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · docs/troubleshooting/faq.md:29

F-04 Network egressCWE-200 · CWE-319Layer L1

- `OLLAMA_HOST=http://127.0.0.1:11434` (or your Ollama server URL)

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · packages/mcp/README.md:131

F-04 Network egressCWE-200 · CWE-319Layer L1

# Optional: Specify Ollama host (default: http://127.0.0.1:11434)

Why: No further detail recorded for this rule.
Fix: —

LOWObfuscation / stealthobf.decode_call · packages/chrome-extension/src/background.ts:374

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

return atob(data.content.replace(/\n/g, ''));

Why: No further detail recorded for this rule.
Fix: —

LOWSupply chainsupply.unpinned · examples/basic-usage/package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

tsx, typescript, @types/node, dotenv

Why: 4 dependency range(s) float
Fix: pin exact versions or ship a lockfile

LOWSupply chainsupply.unpinned · package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

@types/node, @typescript-eslint/eslint-plugin, @typescript-eslint/parser, assert, browserify-zlib, eslint, https-browserify, os-browserify

Why: 14 dependency range(s) float
Fix: pin exact versions or ship a lockfile

LOWSupply chainsupply.unpinned · packages/chrome-extension/package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

@types/chrome, @types/node, assert, browserify-zlib, buffer, copy-webpack-plugin, crypto-browserify, https-browserify

Why: 21 dependency range(s) float
Fix: pin exact versions or ship a lockfile

LOWSupply chainsupply.unpinned · packages/core/package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

@google/genai, @zilliz/milvus2-sdk-node, faiss-node, fs-extra, glob, ignore, langchain, ollama

Why: 27 dependency range(s) float
Fix: pin exact versions or ship a lockfile

LOWSupply chainsupply.unpinned · packages/mcp/package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

@modelcontextprotocol/sdk, zod, @types/node, tsx, typescript

Why: 5 dependency range(s) float
Fix: pin exact versions or ship a lockfile

INFOInventory / provenanceinv.oversize · assets/signup_and_create_cluster.jpeg

F-13 Inventory / provenanceCWE-1104Layer L0

assets/signup_and_create_cluster.jpeg

Why: 1375267 bytes not read
Fix: —

INFOInventory / provenanceinv.oversize · packages/chrome-extension/src/icons/icon128.png

F-13 Inventory / provenanceCWE-1104Layer L0

packages/chrome-extension/src/icons/icon128.png

Why: 1125350 bytes not read
Fix: —

Tools it exposes

17 declared in source · 1 destructive

14 read2 write1 destructive

1 tool can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one, so give it a token scoped to what you need.

Tool	Risk	What it does
`clear_index`	destructive	Clear the search index. IMPORTANT: You MUST provide an absolute path.
`edit`	write	Edits the specified file with the given modifications.
`startLine`	write	Start line number of the chunk
`content`	read	Document content
`content_bm25_emb`	read	content bm25 function
`directory_tree`	read	Generates a tree structure of a directory.
`endLine`	read	End line number of the chunk
`fileExtension`	read	File extension
`get_indexing_status`	read	Get the current indexing status of a codebase. Shows progress percentage for actively indexing codebases and completion status for indexed codebases.
`id`	read	Document ID
`list_directory`	read	Lists the contents of a directory.
`metadata`	read	Additional document metadata as JSON string
`read_file`	read	Reads the content of a text file at the specified path.
`relativePath`	read	Relative path to the codebase
`search_text`	read	Searches for a regular expression pattern within the content of files in a specified directory (or current working directory). Can filter files by a glob pattern. Returns the lines containing matches, along with their file paths and line numbers.
`sparse_vector`	read	Sparse vector embedding from BM25
`vector`	read	Embedding vector

Install

Package version 0.1.11 · audited commit 4a35db9

Read the findings first. The most severe is Inventory / provenance (medium) at packages/vscode-extension/wasm/tree-sitter-go.wasm.

Add to Cursor Add to VS Code

One-click links open your editor with the config below filled in, exactly as the snippets show it, pinned to version 0.1.11. The audit covers commit 4a35db9 only.

claude mcp add semanticcodesearch --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env GITHUB_TOKEN=${GITHUB_TOKEN} --env MOONSHOT_API_KEY=${MOONSHOT_API_KEY} --env OPENAI_API_KEY=${OPENAI_API_KEY} -- npx -y [email protected]

{
  "mcpServers": {
    "semanticcodesearch": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "GITHUB_TOKEN": "${GITHUB_TOKEN}",
        "MOONSHOT_API_KEY": "${MOONSHOT_API_KEY}",
        "OPENAI_API_KEY": "${OPENAI_API_KEY}"
      }
    }
  }
}

The command pins the package version recorded in the source (0.1.11); the audit covers commit 4a35db911c86. Transport: stdio. Reads these environment variables: ANTHROPIC_API_KEY, GITHUB_TOKEN, MOONSHOT_API_KEY, OPENAI_API_KEY. Give it the narrowest token it needs.

Audit history

2026-09-20
!CAUTION C 80 / 100
Source changed, verdict held · 4a35db911c86

README badge

For maintainers · updates on every re-audit

[![ModelsAtlas: CAUTION C](https://modelsatlas.com/mcp/zilliztech/claude-context/badge.svg)](https://modelsatlas.com/mcp/zilliztech/claude-context/)

The badge always shows the latest audit; a maintainer cannot pin an old verdict.

Other ratings

Cited, never blended into our score

No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.

Questions about Claude Context MCP server

What is the Claude Context MCP server?

Code search MCP for Claude Code. Make entire codebase the context for any coding agent.

What tools does Claude Context expose?

17 in total: 14 read-only, 2 that write, and 1 that can delete or overwrite (clear_index). Every one is listed on this page with its risk.

Is Claude Context safe to connect to an agent?

With care. The audit graded it C (80/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does Claude Context need?

It reads ANTHROPIC_API_KEY, GITHUB_TOKEN, MOONSHOT_API_KEY and OPENAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Claude Context run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as semanticcodesearch at 0.1.11.

How current is this page?

The grade is for one exact copy of the source (4a35db911c86), read on 2026-09-20. The repository is watched and re-audited when it changes.

Sources

zilliztech/claude-context on GitHub — the source we read, its licence, stars and activityObserved · 20 Sep 2026
ModelsAtlas trust audit — CAUTION verdict for commit 4a35db911c86Observed · 20 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the Claude Context MCP server?
GChatGPT CClaude PPerplexity
What tools does Claude Context expose?
GChatGPT CClaude PPerplexity
Is Claude Context safe to connect to an agent?
GChatGPT CClaude PPerplexity