← Back to directory
O

Octocode MCP Server

Community
Structural code intelligence for AI agents — semantic search, knowledge graph, and a built-in MCP server in one Rust binary.
Category
Dev Tools #95 of 438
Stars
★ 518 Very popular
Transport
stdio (local process)
Runtime
Prebuilt binary
Credentials
Optional API key
License
Apache-2.0
Last commit
Tools
10
62FMRS · C

Octocode is an open-source (Apache-2.0) code intelligence tool by Muvon, written in Rust, delivered as a single binary that combines semantic search, a tree-sitter-based symbol/file knowledge graph, and a built-in MCP server usable from Claude Desktop, Cursor, Windsurf, Claude Code, Octomind, and other MCP clients. Its differentiator is understanding code structure (imports, calls, extends, implements) rather than treating code as flat text chunks, plus optional LSP support for go-to-definition and find-references. The project ships a reproducible retrieval benchmark showing that keyword-tuned hybrid retrieval notably improves Hit@5 and Recall@10. It is local-first and needs no API key by default, making it attractive to privacy-conscious teams that want structural understanding; however, it is a community project rather than an official product, and adopters should evaluate cloud data egress and index permissions before rolling it out.

Strongest · Documentation 15/20 Weakest · Reliability 9/20

Reliability
9/20
Security and permissions
12/20
Maintenance
13/20
Documentation
15/20
Setup experience
13/20
Why each score
Reliability 9/20
The static review sees only the README and server.json; no actual source files, CI workflow contents, or committed tests were supplied. Therefore there is no way to verify that MCP initialization and tool-list handshake succeed, or that the declared tools (semantic_search, view_signatures, graphrag, structural_search, LSP tools) match real behavior. The README claims 17-language tree-sitter parsing, optional LSP via --with-lsp, and self-published benchmarks, but these are untrusted self-reports and the benchmark does not exercise the protocol layer. Error handling, index failures, and degradation paths when an embedding provider is unavailable have no evidence. Per the static-calibration ceiling of 12 absent verifiable execution evidence, scored 9.
Security and permissions 12/20
The README states local-first operation, locally stored API keys, .gitignore respect, and a local-only MCP server with no external network for search, which is directionally sound. However, from README alone one cannot confirm: that embedded chunks sent to cloud providers (Voyage/OpenAI/JINA/Google) are bounded in scope, since the data-flow disclosure is generic; that LSP and MCP layers expose only intended portions of the codebase to clients; nor that credential storage, scope restriction, or confirmation for dangerous operations are implemented. No red-line indicators (malware, credential theft, covert exfiltration, real tokens in install examples) were found, so the 0-4 red-line band is not triggered; but least-privilege, confirmation flow, and data-flow specifics lack evidence, hence 12.
Maintenance 13/20
GitHub metadata shows 475 stars, only 5 open issues, not archived, Apache-2.0 license; the README carries CI and coverage badges, a Crates.io release, and version 0.26.1, indicating an ongoing release cadence. Yet the supplied material contains no commit history, issue-response latency, dependency-update record, or security-response channel (e.g., SECURITY.md) as direct evidence; governance and versioning rest on self-reported badges. Activity is visible but the governance and security-response path is under-evidenced, hence 13.
Documentation 15/20
Documentation is reasonably layered: the README covers installation (multi-platform, Homebrew, crates.io, binaries), API key setup and multiple embedding providers, index and search commands, MCP client config examples (Claude Desktop/Cursor/Windsurf/Claude Code), a 17-language support table, privacy/security notes, benchmark methodology with full metrics, and links to multiple doc/ guides. Limitations are also disclosed (local stack as a floor, generic reranker regressing results). Deductions: full MCP tool parameter specs, error codes, cost details, and troubleshooting mostly point to external files not included in the material, so their accuracy cannot be reviewed, and the benchmark numbers are unverifiable self-reports. Usable and layered, but with external-verification gaps, hence 15.
Setup experience 13/20
The install path is clear: a curl one-liner, Homebrew, cargo install, and GitHub Releases, followed by three steps (optional API key, octocode index, octocode search), plus JSON config snippets for Claude/Cursor/Windsurf and a Claude Code CLI command, giving fairly complete mainstream-client examples. However, default embeddings require downloading the fastembed model over the network, LSP tools need a separate --with-lsp flag plus an external language server (additional manual steps), and platform compatibility (especially Windows and macOS Gatekeeper) is only mentioned, not verified. Under the static-calibration ceiling of 15 and with no file-level execution evidence, scored 13.

Static review · not runListed 2026-09-18

Read the FMRS scoring method →

Fit and risk

What it can accessReads local filesRuns commands or code

Best for

  • Developers who want Claude, Cursor, Windsurf, or other MCP clients to deeply understand codebase structure and dependencies.
  • Privacy-conscious teams that prefer local embeddings and a local-only MCP server.
  • Engineering teams working in supported languages such as Rust, Python, TypeScript/JavaScript, Go, PHP, and C++.
  • Code intelligence scenarios that need semantic search, a symbol graph, and LSP-precise navigation together.

Not for

  • Workflows that only need plain-text grep and no structural understanding.
  • Users who do not use an MCP client and only want a traditional IDE indexer.
  • Enterprise procurement needing official vendor support or an SLA (this is a community open-source project maintained by Muvon).
  • Situations where code must never leave the machine but local embedding models are also not acceptable.

Required permissions

  • Read source files under the specified project path (respects .gitignore by default and does not index sensitive files).
  • Write and update local index data inside the project.
  • Read local API key configuration and environment variables (VOYAGE_API_KEY, OPENROUTER_API_KEY, OPENAI_API_KEY, JINA_API_KEY, GOOGLE_API_KEY, etc., all optional).
  • When started with --with-lsp, launch and call the specified local language server (e.g. rust-analyzer).
  • Run as a local MCP server; search itself performs no external network access.

Risks and side effects

  • When a cloud embedding provider is enabled, only the code chunks being embedded are sent to that provider; use local models for fully offline indexing.
  • Indexing writes project content into a local index store, so the storage location and permissions should match team policy.
  • LSP tools depend on an external language server; misconfiguration or crashes affect those tools, though not the graph or semantic search.
  • Semantic search results are relevance-ranked candidates; an AI may draw conclusions from incomplete results, so important changes still need human review.
  • A generic local cross-encoder reranker (e.g. bge-reranker-base) can actually regress code retrieval; a code-aware reranker is needed.

Setup

Before you start

Runtime:Prebuilt binary

VOYAGE_API_KEY optionalsecret Optional cloud embedding provider key from voyageai.com (free tier available); local FastEmbed is the default, so no key is needed.
OPENROUTER_API_KEY optionalsecret Optional, for LLM features like commit messages and code review; get it at openrouter.ai.
OPENAI_API_KEY optionalsecret Optional, needed only when using OpenAI embedding models (e.g. text-embedding-3-small); get it at platform.openai.com.
JINA_API_KEY optionalsecret Optional, needed when using Jina embedding models (e.g. jina-embeddings-v3); get it at jina.ai.
GOOGLE_API_KEY optionalsecret Optional, needed when using Google embedding models (e.g. text-embedding-005); get it at Google AI Studio.
  1. Install: use the universal installer curl -fsSL https://raw.githubusercontent.com/Muvon/octocode/master/install.sh | sh, or on macOS brew install muvon/tap/octocode, or cargo install octocode, or from source cargo install --git https://github.com/Muvon/octocode, or download a binary from GitHub Releases.
  2. API keys (optional): embeddings default to local FastEmbed with no key required; for cloud embeddings or an LLM, set VOYAGE_API_KEY, OPENROUTER_API_KEY, and so on, e.g. export VOYAGE_API_KEY="your-voyage-api-key".
  3. Index your codebase: cd /your/project then run octocode index.
  4. Search your code: octocode search "authentication middleware"; filter by language with --language rust, or search commit history with --mode commits.
  5. Connect your AI assistant: add {"mcpServers":{"octocode":{"command":"octocode","args":["mcp","--path","/your/project"]}}} to your MCP client config. With Claude Code you can run claude mcp add octocode -- octocode mcp --path /path/to/your/project.
  6. (Optional) Enable LSP tools: octocode mcp --path /your/project --with-lsp="rust-analyzer".
  7. (Optional) Enable indexed GraphRAG: octocode config --graphrag-enabled true then re-run octocode index.
claude_desktop_config.json
{
  "mcpServers": {
    "octocode": {
      "command": "octocode",
      "args": [
        "mcp",
        "--path",
        "/your/project"
      ]
    }
  }
}

Shown for Claude Desktop. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json
{
  "servers": {
    "octocode": {
      "command": "octocode",
      "args": [
        "mcp",
        "--path",
        "/your/project"
      ]
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal
claude mcp add octocode -- octocode mcp --path /your/project

Run it in a terminal; replace any <…> placeholders with your own values first.

Check that it works

After adding the octocode MCP server config, restart the client and confirm tools like semantic_search, graphrag, and structural_search appear in the tool list; then ask "Where is authentication handled?" — if the AI answers with a concrete file path via semantic_search, the connection works.

Troubleshooting

  1. Verify that the `octocode` executable is on PATH so the MCP client's command launches correctly.
  2. Check that `--path` points to the correct project directory; a wrong path yields an empty graph and no search results.
  3. If using cloud embeddings or an LLM, confirm the matching API key is set and rate limits are not exceeded (see the rate-limit notes in GETTING_STARTED).
  4. If LSP tools are unavailable, confirm the server was started with --with-lsp and that the language server is installed and runnable.
  5. The graphrag tool works without an index, but indexed GraphRAG requires `octocode config --graphrag-enabled true` followed by a re-run of `octocode index`.
  6. For weak retrieval results, try adjusting hybrid search weights or switching to a code-aware reranker; see the comparison data in benchmark/RESULTS.md.

Things to try

Once connected, you can ask your AI assistant things like:

  • Where is user authentication handled in my codebase?
  • What files depend on the payment module?
  • Find every call site of the process_payment function
  • Search for all .unwrap() calls in the API layer

Tools 10

semantic_search read-only
Find code by meaning — "authentication flow", "error handling", "database queries".
view_signatures read-only
View file structure — function signatures, class definitions, imports.
graphrag read-only
Always-on file/symbol graph — search nodes, inspect relationships, and find paths without indexing.
structural_search read-only
AST pattern matching — find .unwrap() calls, new instantiations, and specific patterns.
lsp_goto_definition read-only
Jump to a symbol's definition (requires starting with --with-lsp).
lsp_find_references read-only
Find all usages of a symbol across the workspace (requires starting with --with-lsp).
lsp_hover read-only
Type info and documentation for a symbol (requires starting with --with-lsp).
lsp_document_symbols read-only
List the symbols defined in a single file (requires starting with --with-lsp).
Show 2 more tools
lsp_workspace_symbols read-only
Search symbols by name across the whole workspace (requires starting with --with-lsp).
lsp_completion read-only
Provide code completion suggestions at a position (requires starting with --with-lsp).

Use cases

Let an AI assistant find code by meaning instead of keywords, e.g. "where is authentication handled".
Query dependencies between files, e.g. "what files depend on the payment module".
Inspect function signatures and file structure without reading entire files.
Use AST pattern matching to surface risky calls such as .unwrap().
Combine LSP precision for go-to-definition, find-references, and hover documentation.
Switch between local and cloud embedding providers for hybrid code and commit-history retrieval.

Supported clients

Claude Desktop
Claude Code
Cursor
Windsurf
Octomind
Cline
Continue
Zed
Replit

Listed from the project's documentation, not tested by this site.

Overview

Octocode is a Rust-built code intelligence tool that turns a project into a navigable knowledge graph so that Claude, Cursor, and other MCP clients can search, understand, and navigate the codebase structure. It builds a live graph of file and symbol nodes with deterministic contains, imports, calls, extends, and implements relationships directly from the current source via tree-sitter AST parsing; the MCP graphrag tool works from this graph without an index, embeddings, or an LLM. Optional indexed GraphRAG overlays semantic file matches, LLM descriptions, and broader file-level architectural relationships. Retrieval is hybrid: semantic similarity combined with BM25 full-text search and reranking. It is local-first by default, using fastembed so embeddings can run without an API key, while cloud embedding providers such as Voyage, OpenAI, Jina, and Google are also supported. It supports full tree-sitter AST parsing for 17 languages and is licensed under Apache-2.0.

Similar servers

Context7 80 · B

Upstash's official server providing up-to-date third-party library docs for AI coding assistants

★ 64.1k · Tools 2 Compare with this →

Source revision 65266c4f51ca Data synced 2026-11-02 Read the FMRS scoring method