← Back to directory
R

RLM Tools BSL MCP Server

Community
Token-efficient analysis MCP server for 1C (BSL) codebases
Category
Dev Tools #121 of 438
Stars
★ 212 Popular
Transport
stdio (local process) · Streamable HTTP
Runtime
Python 3.10+ · Docker
Credentials
No credential needed
License
MIT
Last commit
Tools
6
60FMRS · C

RLM Tools BSL is an MCP server for 1C BSL codebases that cuts token and context usage far below naive file reading by executing scripts in a sandbox and returning only print() output, deliberately without RAG pre-indexing while offering an optional SQLite index and git grep full-text search for large configurations. The repository is MIT-licensed and not an official 1C project; it is an adaptation of the open-source rlm-tools. Its README cites an April 2026 comparison of six MCP servers claiming 10/10 quality on ten business tasks at the lowest average token use (117K), but those numbers come from the project itself and are self-reported, so treat them with caution. It suits developers and analysts who need deterministic, on-demand analysis of 1C sources; it is not for complete dependency graphs, embedding-based semantic search, or vague business questions. Before adopting, weigh the risks of sandboxed script execution, automatic git grep activation, and optional external LLM calls.

Strongest · Documentation 16/20 Weakest · Security and permissions 9/20

Reliability
10/20
Security and permissions
9/20
Maintenance
12/20
Documentation
16/20
Setup experience
13/20
Why each score
Reliability 10/20
The README claims a CI badge, an 83% coverage badge, Python 3.10+, six MCP tools (rlm_projects/rlm_index/rlm_start/rlm_help/rlm_execute/rlm_end) and 62 sandbox helpers, and states pre-release testing on real ERP/EDT/CF codebases. These are self-reported claims: no CI workflow files, no committed tests, and no server manifest (SERVER MANIFEST shows [not cached]) are available for static verification, so declared tools cannot be checked against real behavior. The happy path is plausible but error handling and edge cases are undocumented. Per the static calibration rule, reliability is capped at 12; uncertainty lowers the score, giving 10.
Security and permissions 9/20
The README shows positive intent: project registration requires a password, index mutation (build/update/drop) and registry mutations require a password parameter for confirmation, the CLI skips the password, and a sandbox with timeouts is mentioned. However several risks are not fully disclosed: rlm_execute runs Python scripts on the host where the project is open, which is a high-privilege capability whose sandbox isolation, resource limits, and network restrictions are not described; install scripts use irm/curl to download and execute remote scripts, a remote-code-execution path; and optional LLM endpoints (OpenRouter/Ollama/Anthropic) send data externally with incomplete data-flow disclosure. No malware, credential theft, hardcoded secrets, or irreversible default actions were found, and drop requires a password, so this is not a red-line 0-4. Deductions: privilege boundaries and confirmation for script execution are under-specified, and external network data flow is not fully disclosed.
Maintenance 12/20
Evidence of active maintenance exists: MIT license, PyPI releases (badge), CHANGELOG.md, CI workflow badge, coverage badge, 193 stars, 2 open issues, not archived, README states pre-release testing on multiple real 1C codebases, and a cited April 2026 comparison test. But deeper evidence is missing: no visible issue-response record, dependency-update policy, security-response channel, or governance/release-cadence details, and ownership appears to be a single author (Dach-Coin). Medium score: active with a clear license, but governance/versioning/security-response gaps.
Documentation 16/20
Documentation is layered and extensive: README covers installation (one-line Windows PowerShell, one-line Linux systemd, Docker, source), client config examples (.claude.json / mcp.json, type http and stdio), tool and helper listings with links, environment-variable reference, FAQ, QUICKSTART, INDEXING, ARCHITECTURE, PROJECT_REGISTRY, AGENT_INSTRUCTIONS, LLM_QUERY, ENV_REFERENCE, TELEMETRY, plus disclosed boundaries (when not to use it, RLM vs RAG), performance limits (pre-indexing needed on HDD/network drives, full strategy for weak models), and cost figures (25-95% token savings). Deductions: key mechanisms (sandbox isolation, exact timeout values, password/security model) are only summarized in the README rather than shown in reviewable config files; the unavailable SERVER MANIFEST prevents verifying tool parameters; and the marketing-style comparison table (10/10) relies on an external repo and cannot be independently verified. Usable but with hidden assumptions and troubleshooting gaps, hence 16.
Setup experience 13/20
The install path is clear and short with multiple mainstream options: a one-line Windows PowerShell script (installs the pip package, registers the service, starts it, and checks health), a one-line Linux script, Docker Compose (example file provided), and source install, with client config JSON examples for Claude Code/Cursor/Kilo/Roo and a default HTTP endpoint of http://127.0.0.1:9000/mcp. Deductions: the one-line installers download and execute remote scripts, which cannot be verified without execution; Windows + Docker is explicitly discouraged without a quantified fallback; the Docker path requires manually editing REPOS_ROOT and other env vars; and there is no verifiable minimal example for an environment without 1C sources. Per the calibration rule, setup cannot exceed 15 without verifiable execution evidence, so 13.

Static review · not runListed 2026-09-10

Read the FMRS scoring method →

Fit and risk

What it can accessReads local filesRuns commands or codeUses the networkConnects to a database

Best for

  • 1C:Enterprise projects with CF, EDT, or MDO source formats
  • Large configurations with 20K+ files that cannot fit into a single session context
  • Deterministic codebase questions, e.g. finding an HTTP service and its methods or how a document posting routine works
  • Teams that want to save context and tokens and avoid maintaining RAG infrastructure

Not for

  • Scenarios needing a complete dependency graph of all configuration objects (requires a pre-indexed RAG/graph MCP)
  • Semantic/embedding search over object descriptions
  • Vague, non-deterministic questions like 'how does budgeting work in ERP' or 'how do cellular warehouses work in UT', which need full RAG or a strong model to turn them into strict queries
  • Treating it as an official 1C product: it is not maintained by 1C

Required permissions

  • Read 1C source directories (BSL files, XML/MDO descriptions, metadata)
  • Write and manage SQLite index files on the host
  • Read and modify the projects.json registry next to the server directory (mutating operations require a password)
  • Execute agent-submitted Python scripts inside a sandbox
  • Optional access to an LLM endpoint (OpenAI-compatible OpenRouter, Ollama, vLLM, or the Anthropic API), only when llm_query is configured
  • Optional use of Git on the host to read the source repository (enables git_search)

Risks and side effects

  • Agent-submitted Python scripts are executed in a sandbox whose real strength determines the host's exposure surface
  • A .git directory in the sources automatically enables git grep full-text search over all files, which may surface 'raw' XML/MDO and text content developers did not expect to expose
  • When llm_query is configured, script content or code fragments may be sent to an external LLM endpoint
  • The registry password protects mutating operations to stop the AI acting without confirmation, but it is not strong encryption or isolation
  • Indexing is slow on HDDs or network shares, and indexes persist code content read from disk

Setup

Before you start

Runtime:Python 3.10+ · Docker

Other optional settings (3)
RLM_UPDATE_INDEX_ON_START optional Set to 1 in docker-compose.yml to have the container rebuild registered project indexes at startup; off by default.
RLM_STRATEGY_MODE optional Set to full to inline all helper recipes in rlm_start (~20K chars, better for weak models); slim default saves tokens. Set as a service environment variable.
REPOS_ROOT optional Mount path for the 1C source root when deploying via Docker; edit it in docker-compose.yml.

Windows (administrator PowerShell): run irm https://raw.githubusercontent.com/Dach-Coin/rlm-tools-bsl/master/simple-install-from-pip.ps1 -OutFile simple-install-from-pip.ps1 then PowerShell -ExecutionPolicy Bypass -File .\simple-install-from-pip.ps1; the script installs from PyPI, registers a Windows service, starts the server and checks health, and re-running it updates to the latest version. Linux: curl -LO https://raw.githubusercontent.com/Dach-Coin/rlm-tools-bsl/master/simple-install-from-pip.sh, then chmod +x simple-install-from-pip.sh && ./simple-install-from-pip.sh. Docker: cp docker-compose.example.yml docker-compose.yml, edit REPOS_ROOT and other variables, then docker compose up -d (not recommended on Windows + Docker Desktop). From source for development: Python 3.10+ and uv; run simple-install.ps1 on Windows or simple-install.sh on Linux. After installation, add an mcpServers entry in .claude.json / mcp.json pointing to http://127.0.0.1:9000/mcp.

.mcp.json
{
  "mcpServers": {
    "rlm-tools-bsl": {
      "type": "http",
      "url": "http://127.0.0.1:9000/mcp"
    }
  }
}

Shown for Claude Code. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json
{
  "servers": {
    "rlm-tools-bsl": {
      "type": "http",
      "url": "http://127.0.0.1:9000/mcp"
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal
claude mcp add --transport http rlm-tools-bsl http://127.0.0.1:9000/mcp

Run it in a terminal; replace any <…> placeholders with your own values first.

Check that it works

The client's MCP tool list should show the six tools: rlm_projects, rlm_index, rlm_start, rlm_help, rlm_execute, rlm_end; the installer also checks the health endpoint at http://127.0.0.1:9000/mcp.

Troubleshooting

  1. Windows service does not start (e.g. error 1053): see the 'Windows service diagnostics' section of docs/INSTALL.md
  2. Timeouts on glob_files/tree/find_files for large configurations (60-90s per call): pre-build the SQLite index on slow disks or network shares, see docs/INDEXING.md
  3. Weak models (Haiku, Minimax, Gemini Flash, etc.) analyze poorly and mix up helpers: restart the server with RLM_STRATEGY_MODE=full so the full strategy is inline and rlm_help is removed from the MCP manifest
  4. Inaccurate or noisy results for metadata object references, relations, or attribute types: usually a sign of missing pre-built indexes
  5. Docker container does not rebuild indexes on start: set RLM_UPDATE_INDEX_ON_START=1
  6. Marked slowdown under Windows + Docker Desktop: caused by WSL2/Virtiofs I/O overhead; install on the host (pip/service) instead

Things to try

Once connected, you can ask your AI assistant things like:

  • Register my 1C sources directory /path/to/1c-sources as a project named My Config with rlm_projects
  • Use rlm_start to begin analyzing My Config and find where the ОбработкаПроведения procedure is defined
  • Call extract_procedures via rlm_execute to list all procedure signatures in this BSL module
  • After building the index, find the http-сервис ОбменСКорпоративнымиСегментами and describe its methods

Tools 6

rlm_projects writes
Manage the project registry: register projects by name with path and password, plus password-protected remove/update/rename operations
rlm_index writes
Manage project indexes by building, updating, or dropping the SQLite index; requires the project password
rlm_start read-only
Start an analysis session, defaulting to the compact slim strategy roadmap, or full strategy
rlm_help read-only
Load detailed helper recipes and descriptions on demand to save startup context tokens
rlm_execute read-only
Execute a Python script in the sandbox; only print() output is returned to the agent context
rlm_end read-only
End the current analysis session

Use cases

Get up to speed on an unfamiliar 1C configuration or extension: point at the sources and the agent starts immediately, without hours of indexing
Estimate implementation effort: which metadata objects are affected, what needs rework, where ready-made functionality exists
Check the team's daily commits in a 1C repository synced to Git via gitsync
Analyze several active 1C bases at once without time to build a RAG index for each
Write technical documentation and descriptions for already-implemented customizations
Answer user questions as an analyst on a project without RAG
Targeted analysis of a specific subsystem, mechanism, or block of custom changes

Supported clients

Claude Code
Kilo Code
Roo Code
Cursor

Listed from the project's documentation, not tested by this site.

Overview

RLM Tools BSL is an MCP server for token-efficient analysis of 1C:Enterprise BSL codebases. It is an adaptation of the open-source rlm-tools project to 1C platform specifics: large codebases, source formats (CF/EDT/CFE), metadata structure, Cyrillic code, and XML object descriptions. Its core philosophy is to give an AI assistant codebase search comparable in quality to RAG but without RAG itself — no pre-vectorization — while saving substantial tokens and context. How it works: the agent sends a Python script to the server, the script runs in a sandbox, and only its print() output returns to the agent's context, replacing raw files with compact filtered results. The server exposes six MCP tools (rlm_projects, rlm_index, rlm_start, rlm_help, rlm_execute, rlm_end) and a sandbox with 62 helpers (52 BSL-specific + 8 standard + 2 LLM), plus session caches, timeouts, and security controls. An optional SQLite index of methods and the call graph speeds up large configurations, and a .git directory in the sources automatically enables git_search, a git grep full-text engine. A project registry lets you register sources by name with a required password. Licensed under MIT.

Similar servers

Context7 80 · B

Upstash's official server providing up-to-date third-party library docs for AI coding assistants

★ 63.3k · Tools 2 Compare with this →

Source revision b160fa56c506 Data synced 2026-10-19 Read the FMRS scoring method