# com.knitli/codeweaver > Semantic code search built for AI agents. Hybrid, AST-aware, context for 166 languages. - name: com.knitli/codeweaver - version: 0.1.0-alpha.3 - connection class: L0 (run_local_package) - trust: 83/100 - quality: –/100 (not scored) - owner: not claimed - descriptor: https://api.protogrid.dev/v1/servers/com.knitli%2Fcodeweaver - tools: https://api.protogrid.dev/v1/servers/com.knitli%2Fcodeweaver/tools **Runs on your machine: something must execute the package.** Only local packages are published (npm, PyPI, OCI, …). The registry never executes them, so tools are unknown until you run it. ## Connection (mcpServers) ```json { "mcpServers": { "codeweaver": { "command": "uvx", "args": [ "code-weaver==0.1.0a3", "server", "--project", "--config", "--host", "127.0.0.1", "--port", "9328", "--transport", "streamable-http", "--verbose", "--debug" ], "env": { "CODEWEAVER_DEBUG": "false", "CODEWEAVER_EMBEDDING_API_KEY": "${CODEWEAVER_EMBEDDING_API_KEY}", "CODEWEAVER_EMBEDDING_MODEL": "voyage-code-3", "CODEWEAVER_EMBEDDING_PROVIDER": "voyage", "CODEWEAVER_HOST": "localhost", "CODEWEAVER_LOG_LEVEL": "WARNING", "CODEWEAVER_MCP_PORT": "9328", "CODEWEAVER_PORT": "9329", "CODEWEAVER_RERANKING_API_KEY": "${CODEWEAVER_RERANKING_API_KEY}", "CODEWEAVER_RERANKING_MODEL": "rerank-2.5", "CODEWEAVER_RERANKING_PROVIDER": "voyage", "CODEWEAVER_SPARSE_EMBEDDING_MODEL": "prithivida/Splade_pp_en_v1", "CODEWEAVER_SPARSE_EMBEDDING_PROVIDER": "fastembed", "CODEWEAVER_VECTOR_STORE_API_KEY": "${CODEWEAVER_VECTOR_STORE_API_KEY}", "CODEWEAVER_VECTOR_STORE_PORT": "6333", "CODEWEAVER_VECTOR_STORE_PROVIDER": "qdrant", "CODEWEAVER_VECTOR_STORE_URL": "http://localhost", "CODEWEAVER__TELEMETRY__DISABLE_TELEMETRY": "false", "CODEWEAVER__TELEMETRY__TOOLS_OVER_PRIVACY": "false", "OPENAI_API_KEY": "${OPENAI_API_KEY}", "AI_GATEWAY_API_KEY": "${AI_GATEWAY_API_KEY}", "AWS_SECRET_ACCESS_KEY": "${AWS_SECRET_ACCESS_KEY}", "AZURE_COHERE_API_KEY": "${AZURE_COHERE_API_KEY}", "AZURE_OPENAI_API_KEY": "${AZURE_OPENAI_API_KEY}", "DEEPSEEK_API_KEY": "${DEEPSEEK_API_KEY}", "INFERENCE_KEY": "${INFERENCE_KEY}", "QDRANT__SERVICE__API_KEY": "${QDRANT__SERVICE__API_KEY}", "TOGETHER_API_KEY": "${TOGETHER_API_KEY}", "VERCEL_OIDC_TOKEN": "${VERCEL_OIDC_TOKEN}", "VOYAGE_API_KEY": "${VOYAGE_API_KEY}" } } } } ``` Placeholders to fill: `${CODEWEAVER_EMBEDDING_API_KEY}`, `${CODEWEAVER_RERANKING_API_KEY}`, `${CODEWEAVER_VECTOR_STORE_API_KEY}`, `${OPENAI_API_KEY}`, `${AI_GATEWAY_API_KEY}`, `${AWS_SECRET_ACCESS_KEY}`, `${AZURE_COHERE_API_KEY}`, `${AZURE_OPENAI_API_KEY}`, `${DEEPSEEK_API_KEY}`, `${INFERENCE_KEY}`, `${QDRANT__SERVICE__API_KEY}`, `${TOGETHER_API_KEY}`, `${VERCEL_OIDC_TOKEN}`, `${VOYAGE_API_KEY}`. ## Trust - hygiene: 95 - liveness: n/a - freshness: 45 - provenance: 100 - drivers: +repository +namespace-matches-repo +dns-namespace +website ~liveness-unmeasured -stale-322d -unpinned-packages(1) - Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. ## Quality –/100 (not scored) Not scored: fewer than three checks apply, usually because no remote answered a credential-free probe or the server is a local package. ### protocol: n/a (weight 25) - n/a `protocol.modern`, `protocol.stateless`, `protocol.transport`, `protocol.list_ttl`: no remote answered a protocol handshake (not probed yet, unreachable, or local-only) ### authorization: n/a (weight 15) - n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth - n/a `auth.secret_in_url`: no templated URL ### tool hygiene: n/a (weight 30) - n/a `tools.descriptions`, `tools.description_length`, `tools.schemas`, `tools.annotations`, `tools.directory_hints`, `tools.token_cost`, `tools.api_dump`: tool list unknown (behind auth, not probed, or empty) ### stability: n/a (weight 15) - n/a `stability.changes`, `stability.rug_pull`: tool list unknown ### dependencies: 67 (weight 15) - fail `deps.known_vulns`: 4 advisories to act on (malicious, or rated high or critical with a fix available): GHSA-2g87-pp6c-29x5 in aiohttp@3.14.3 (indirect, fixed in 3.14.4), GHSA-5wr8-gcqf-gqf3 in aiohttp@3.14.3 (indirect, fixed in 3.14.4), GHSA-6fqq-452j-qhrp in pydantic-ai@2.51.0 (direct, fixed in 2.53.0), ...; 3 more of lower severity or without a fix - pass `deps.mcp_sdk_version`: mcp 2.2.0, no known advisory - pass `deps.resolvable`: code-weaver@0.1.0a3 resolved: 162 packages - tools: unknown - badge: [![protogrid quality](https://protogrid.dev/badge/com.knitli/codeweaver.svg)](https://protogrid.dev/servers/com.knitli/codeweaver) - Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. ### Tool changes _No tool definition changes recorded._ ## Dependencies - pypi code-weaver@0.1.0a3: resolved, 161 dependencies, MCP SDK mcp 2.2.0 - GHSA-2g87-pp6c-29x5 (high) in `` aiohttp@3.14.3 ``, indirect, fixed in `` 3.14.4 ``, advisory summary: "aiohttp: Multiple instances of excessive or unbounded memory/CPU use" https://osv.dev/vulnerability/GHSA-2g87-pp6c-29x5 - GHSA-5wr8-gcqf-gqf3 (high) in `` aiohttp@3.14.3 ``, indirect, fixed in `` 3.14.4 ``, advisory summary: "aiohttp server lacks an initial request/header timeout" https://osv.dev/vulnerability/GHSA-5wr8-gcqf-gqf3 - GHSA-6fqq-452j-qhrp (high) in `` pydantic-ai@2.51.0 ``, direct, fixed in `` 2.53.0 ``, advisory summary: "Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early" https://osv.dev/vulnerability/GHSA-6fqq-452j-qhrp - GHSA-6fqq-452j-qhrp (high) in `` pydantic-ai-slim@2.51.0 ``, indirect, fixed in `` 2.53.0 ``, advisory summary: "Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early" https://osv.dev/vulnerability/GHSA-6fqq-452j-qhrp - GHSA-v36g-jcw9-x7cw (moderate) in `` pydantic-ai@2.51.0 ``, direct, fixed in `` 2.52.0 ``, advisory summary: "Pydantic AI: Excessive resource use when local web fetching converts nested HTML" https://osv.dev/vulnerability/GHSA-v36g-jcw9-x7cw - GHSA-v36g-jcw9-x7cw (moderate) in `` pydantic-ai-slim@2.51.0 ``, indirect, fixed in `` 2.52.0 ``, advisory summary: "Pydantic AI: Excessive resource use when local web fetching converts nested HTML" https://osv.dev/vulnerability/GHSA-v36g-jcw9-x7cw - GHSA-494j-54xm-rwp3 (low) in `` aiohttp@3.14.3 ``, indirect, fixed in `` 3.14.4 ``, advisory summary: "AIOHTTP: Secure attribute not enforced for shared cookie" https://osv.dev/vulnerability/GHSA-494j-54xm-rwp3 Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. ## Remotes _none_ ## Packages - pypi code-weaver@0.1.0a3 secrets: CODEWEAVER_EMBEDDING_API_KEY, CODEWEAVER_RERANKING_API_KEY, CODEWEAVER_VECTOR_STORE_API_KEY, OPENAI_API_KEY, AI_GATEWAY_API_KEY, AWS_SECRET_ACCESS_KEY, AZURE_COHERE_API_KEY, AZURE_OPENAI_API_KEY, DEEPSEEK_API_KEY, INFERENCE_KEY, QDRANT__SERVICE__API_KEY, TOGETHER_API_KEY, VERCEL_OIDC_TOKEN, VOYAGE_API_KEY - oci docker.io/knitli/codeweaver:0.1.0-alpha.3 secrets: CODEWEAVER_EMBEDDING_API_KEY, CODEWEAVER_RERANKING_API_KEY, CODEWEAVER_VECTOR_STORE_API_KEY, OPENAI_API_KEY, AI_GATEWAY_API_KEY, AWS_SECRET_ACCESS_KEY, AZURE_COHERE_API_KEY, AZURE_OPENAI_API_KEY, DEEPSEEK_API_KEY, INFERENCE_KEY, QDRANT__SERVICE__API_KEY, TOGETHER_API_KEY, VERCEL_OIDC_TOKEN, VOYAGE_API_KEY ## Tools (0) _none observed_