Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "code-index": {
      "command": "uvx",
      "args": [
        "mcp-code-index==1.0.6"
      ]
    }
  }
}

claude mcp add code-index -- uvx mcp-code-index==1.0.6

[mcp_servers.code-index]
command = "uvx"
args = ["mcp-code-index==1.0.6"]

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "code-index": {
      "type": "local",
      "command": [
        "uvx",
        "mcp-code-index==1.0.6"
      ],
      "enabled": true
    }
  }
}

{
  "mcpServers": {
    "code-index": {
      "command": "uvx",
      "args": [
        "mcp-code-index==1.0.6"
      ]
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=code-index&config=eyJjb21tYW5kIjoidXZ4IiwiYXJncyI6WyJtY3AtY29kZS1pbmRleD09MS4wLjYiXX0%3D"
}

{
  "servers": {
    "code-index": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "mcp-code-index==1.0.6"
      ]
    }
  }
}

{
  "mcpServers": {
    "code-index": {
      "command": "uvx",
      "args": [
        "mcp-code-index==1.0.6"
      ]
    }
  }
}

extensions:
  "code-index":
    enabled: true
    name: "code-index"
    type: stdio
    cmd: "uvx"
    args:
      - "mcp-code-index==1.0.6"
    timeout: 300

This is a local package: the command runs on your machine.

Quality – / 100not scored

Not scored: fewer than three checks apply, usually because no remote answered a credential-free probe or the server is a local package.

protocoln/a · weight 25

n/a
protocol.modern, protocol.stateless, protocol.transport, protocol.list_ttlno remote answered a protocol handshake (not probed yet, unreachable, or local-only)

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygienen/a · weight 30

n/a
tools.descriptions, tools.description_length, tools.schemas, tools.annotations, tools.directory_hints, tools.token_cost, tools.api_dumptool list unknown (behind auth, not probed, or empty)

stabilityn/a · weight 15

n/a
stability.changes, stability.rug_pulltool list unknown

dependencies67 · weight 15

fail
deps.known_vulns4 advisories to act on (malicious, or rated high or critical with a fix available): GHSA-jhr6-gm9c-rqjv in [email protected] (direct, fixed in 5.6.0), GHSA-29pf-2h5f-8g72 in [email protected] (indirect, fixed in 5.3.0), GHSA-fgcw-684q-jj6r in [email protected] (indirect, fixed in 5.5.0), ...; 3 more of lower severity or without a fix
pass
deps.mcp_sdk_versionmcp 2.2.0, no known advisory
pass
deps.resolvable[email protected] resolved: 87 packages

Tool list unknown · checked 2026-10-20 00:54 UTC

Tool changes

No tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 81 / 100

provenance80

livenessn/a

freshness65

hygiene100

+repository +namespace-matches-repo ~liveness-unmeasured ~updated-158d-ago

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Dependencies

[email protected] PyPI86 dependencies, resolved · MCP SDK mcp 2.2.0 · advisories checked 2026-10-19

advisory	severity	package	fixed in
GHSA-jhr6-gm9c-rqjvsentence-transformers local model loading bypasses trust_remote_code and executes custom Python	critical	`[email protected]`direct	fixed in `5.6.0`
GHSA-29pf-2h5f-8g72HuggingFace transformers vulnerable to remote code execution	high	`[email protected]`indirect	fixed in `5.3.0`
GHSA-fgcw-684q-jj6rhuggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path	high	`[email protected]`indirect	fixed in `5.5.0`
GHSA-xrqw-3rrv-vx5wTransformers save_pretrained path traversal allows arbitrary file writes through chat template names	high	`[email protected]`indirect	fixed in `5.10.0`
GHSA-x9r9-c232-4q39Hugging Face Transformers downloads custom generation code before trust consent	high	`[email protected]`indirect	no fix yet
GHSA-69w3-r845-3855HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class	moderate	`[email protected]`indirect	fixed in `5.0.0rc3`
PYSEC-2025-217Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vuln	unrated	`[email protected]`indirect	no fix yet

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. The graph is what a clean install of this version resolves today; nothing was installed or run. How it is checked.

Endpoints

package	registry	version	runtime	secrets
`mcp-code-index`	pypi	1.0.6	–

Tools (0)

No tools observed. Local packages are never executed by the registry.

Schemas: list_tools.

Similar MCP servers

Official server.json

{
  "name": "io.github.achreftlili/code-index",
  "title": "Code Index",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "version": "1.0.6",
  "packages": [
    {
      "version": "1.0.6",
      "transport": {
        "type": "stdio"
      },
      "identifier": "mcp-code-index",
      "registryType": "pypi",
      "environmentVariables": [
        {
          "name": "CODE_INDEX_EMBEDDER",
          "format": "string",
          "description": "Embedder backend. Only 'jina' (local jina-embeddings-v2-base-code via sentence-transformers) is supported; the variable exists for future expansion."
        },
        {
          "name": "CODE_INDEX_EMBED_MODEL",
          "format": "string",
          "description": "HuggingFace model id. Defaults to 'jinaai/jina-embeddings-v2-base-code'. Override only if you know the model is dim-compatible."
        },
        {
          "name": "CODE_INDEX_EMBED_DIM",
          "format": "string",
          "description": "Embedding dimension. Defaults to 768 (matches jina-embeddings-v2-base-code). Must match the model's output dim."
        },
        {
          "name": "CODE_INDEX_DB",
          "format": "string",
          "description": "Path to the SQLite index database. Defaults to .claude/index.db relative to the working directory."
        },
        {
          "name": "CODE_INDEX_EMBED_BATCH",
          "format": "string",
          "description": "Encode batch size (default 32). Lower (e.g. 8 or 4) to reduce peak memory if the GPU OOMs on large files."
        },
        {
          "name": "CODE_INDEX_EMBED_DEVICE",
          "format": "string",
          "description": "Torch device override: 'cpu', 'mps', or 'cuda'. Unset = auto-detect. Set 'cpu' to avoid Apple-Silicon MPS out-of-memory errors."
        }
      ]
    }
  ],
  "repository": {
    "url": "https://github.com/achreftlili/code-index",
    "source": "github"
  },
  "description": "SQLite-backed hybrid (vector + FTS) code search index for Claude Code over MCP."
}