Local code indexing MCP server that lets AI assistants search repositories, build symbol indexes, inspect file summaries, monitor changes, and navigate multi-language codebases.
Code Index MCP reads repository files, builds shallow and deep indexes, exposes file summaries, and can return source snippets through search and file resources., Point `--project-path` at one approved repository; avoid broad parent directories, home directories, generated dependency trees, or secret-heavy paths., Deep indexing and watcher refreshes can consume CPU, memory, disk IO, and temp storage on large codebases., The server can create and clear index/cache settings and temporary directories used for stored index data., Search results, file summaries, and symbol bodies can surface credentials, private code, customer data, internal URLs, or proprietary implementation details if they exist in the repository.
Privacy notes
Tool calls may expose file paths, filenames, source code snippets, imports, classes, methods, functions, symbols, search matches, complexity summaries, and project settings., Index data and temp directories can persist derived repository structure or symbol metadata outside the source tree., File watcher status, exclude patterns, and settings can reveal local project layout and development conventions., If an MCP client forwards tool results to a model provider, repository contents and search snippets may leave the local machine., Exclude secrets, generated artifacts, vendored dependencies, build output, and private data before indexing.
Author
johnhuang316
Submitted by
oktofeesh1
Claim status
unclaimed
Last verified
2026-06-06
Decision playbook
Review trust signals before you adopt
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
Compare context
Selected
0
Current score
63
Baseline
—
Delta
No baseline selected
No major trust-signal divergence detected in the current selection.
Source and provenance checks
Needs review
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Done
Source provenance statusRequired
Marked as source-backed.
Done
Metadata reviewed
No reviewed flag detected in metadata.
Pending
Safety and privacy checks
Complete
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Done
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Done
Trust level risk gateRequired
Trust level does not block evaluation.
Done
Package and install checks
Needs review
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Done
Package verification flag
No package verification flag provided.
Pending
Checksum metadata
No checksum provided for downloaded artifact.
Pending
Compare-driven decision checks
Needs review
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
5 safety and 5 privacy notes across 4 risk areas. Review closely: credentials & tokens, third-party handling.
4 areas
SafetyLocal filesCode Index MCP reads repository files, builds shallow and deep indexes, exposes file summaries, and can return source snippets through search and file resources.
SafetyCredentials & tokensPoint `--project-path` at one approved repository; avoid broad parent directories, home directories, generated dependency trees, or secret-heavy paths.
SafetyLocal filesDeep indexing and watcher refreshes can consume CPU, memory, disk IO, and temp storage on large codebases.
SafetyData retentionThe server can create and clear index/cache settings and temporary directories used for stored index data.
SafetyCredentials & tokensSearch results, file summaries, and symbol bodies can surface credentials, private code, customer data, internal URLs, or proprietary implementation details if they exist in the repository.
PrivacyData retentionIndex data and temp directories can persist derived repository structure or symbol metadata outside the source tree.
PrivacyLocal filesFile watcher status, exclude patterns, and settings can reveal local project layout and development conventions.
PrivacyThird-party handlingIf an MCP client forwards tool results to a model provider, repository contents and search snippets may leave the local machine.
PrivacyCredentials & tokensExclude secrets, generated artifacts, vendored dependencies, build output, and private data before indexing.
Disclosure: MIT-licensed Python MCP server for local code indexing and analysis. This entry is separate from semantic code agents and graph-indexing entries because it focuses on local project indexes, file discovery, search backends, and symbol summaries through the `code-index-mcp` package.
Safety notes
Code Index MCP reads repository files, builds shallow and deep indexes, exposes file summaries, and can return source snippets through search and file resources.
Point `--project-path` at one approved repository; avoid broad parent directories, home directories, generated dependency trees, or secret-heavy paths.
Deep indexing and watcher refreshes can consume CPU, memory, disk IO, and temp storage on large codebases.
The server can create and clear index/cache settings and temporary directories used for stored index data.
Search results, file summaries, and symbol bodies can surface credentials, private code, customer data, internal URLs, or proprietary implementation details if they exist in the repository.
Index data and temp directories can persist derived repository structure or symbol metadata outside the source tree.
File watcher status, exclude patterns, and settings can reveal local project layout and development conventions.
If an MCP client forwards tool results to a model provider, repository contents and search snippets may leave the local machine.
Exclude secrets, generated artifacts, vendored dependencies, build output, and private data before indexing.
Prerequisites
Python 3.10 or newer.
uv or another Python package runner that can install `code-index-mcp`.
An approved repository path that the MCP client is allowed to inspect.
Optional native search tools such as ripgrep, ugrep, ag, or grep for faster search backends.
Review of exclude patterns, file watcher behavior, temp/index storage, and deep-index cost for large repositories.
Schema details
Install type
cli
Troubleshooting
No
Source repository stats
Scope
Source repo
Collection metadata
Estimated setup
10 minutes
Difficulty
intermediate
Tool listing metadata
Disclosure
MIT-licensed Python MCP server for local code indexing and analysis. This entry is separate from semantic code agents and graph-indexing entries because it focuses on local project indexes, file discovery, search backends, and symbol summaries through the `code-index-mcp` package.
Code Index MCP is a local code-aware MCP server for indexing repositories and
answering project navigation questions. It lets an AI assistant set a project
path, refresh shallow file indexes, build deeper symbol indexes, search code,
find files, inspect file summaries, retrieve symbol bodies, and monitor file
watcher status.
Use it when a coding agent needs fast, repeatable local context from a specific
repository without granting a broader shell or editor-control server. It is best
configured with an explicit project path and reviewed exclude patterns so only
the intended source tree is indexed.
These sources were reviewed on 2026-06-06. Prefer the live repository,
README, PyPI metadata, license, package metadata, MCP server implementation,
well-known MCP manifest, FastMCP config, and restart playbook for current setup
and operation details.
Features
Set or bootstrap a project path for repository-specific indexing.
Build shallow file indexes and optional deep symbol indexes.
Search code with native search backends such as ugrep, ripgrep, ag, or grep
when available.
Find files through glob patterns.
Summarize files, imports, symbols, methods, functions, and complexity data.
Retrieve symbol bodies after building a deep index.
Monitor file changes and configure watcher behavior.
Store indexes and settings in temp/index directories.
Support tree-sitter strategies for Python, JavaScript, TypeScript, Java,
Kotlin, C#, Go, Objective-C, Zig, and Rust, with fallback handling for many
other file types.
Publish .well-known and FastMCP metadata for clients that can import MCP
manifests.
You can also start without --project-path and call the set_project_path tool
after launch, but an explicit startup path is easier to audit.
Use Cases
Find all files or functions related to a feature before editing.
Search for deprecated APIs, TODOs, config keys, routes, or error handling.
Summarize a file's imports, symbols, functions, and structural complexity.
Build a deep index before asking where a symbol is defined or used.
Keep a coding session's repository context fresh after file changes.
Compare project structure across Python, TypeScript, Java, Go, Rust, C#, and
other mixed-language repositories.
Safety and Privacy
Code Index MCP is read-oriented, but it still grants the model visibility into
local source code and derived repository metadata. Scope it to one repository,
review exclude patterns, and avoid indexing generated artifacts, vendored
dependencies, secret stores, customer data, or unrelated sibling projects.
Remember that search snippets and summaries can contain secrets if the
repository contains secrets. Treat MCP results as repository data, especially
when the MCP client sends tool output to a remote model provider.
Duplicate Notes
Existing catalog entries cover semantic code agents, graph-backed context
servers, and token-efficient code search tools. This entry covers the separate
johnhuang316/code-index-mcp Python package and its local repository indexing,
file discovery, watcher refresh, and symbol-summary workflow.
Show that Code Index MCP Server is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/mcp/code-index-mcp-server)
How it compares
Code Index MCP Server side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
Local code indexing MCP server that lets AI assistants search repositories, build symbol indexes, inspect file summaries, monitor changes, and navigate multi-language codebases.
Local-first codebase intelligence MCP server that indexes repositories with tree-sitter, stores searchable chunks in DuckDB, and gives Claude semantic search, regex search, daemon status, and deep code research tools.
Code intelligence MCP server with a Zig core for local project indexing, structural outlines, symbol lookup, search, dependency graphs, snapshots, remote public-repo queries, and fallback edits.
MCP server for Google Search Console that lets Claude list properties, inspect indexing status, query search analytics, compare performance periods, audit sitemaps, and manage Search Console resources with guarded destructive tools.
✓Code Index MCP reads repository files, builds shallow and deep indexes, exposes file summaries, and can return source snippets through search and file resources.
Point `--project-path` at one approved repository; avoid broad parent directories, home directories, generated dependency trees, or secret-heavy paths.
Deep indexing and watcher refreshes can consume CPU, memory, disk IO, and temp storage on large codebases.
The server can create and clear index/cache settings and temporary directories used for stored index data.
Search results, file summaries, and symbol bodies can surface credentials, private code, customer data, internal URLs, or proprietary implementation details if they exist in the repository.
✓ChunkHound reads source files, Markdown, text, PDFs, and supported config files under the target directory and stores indexed chunks in a local database.
Realtime indexing and daemon mode can continue watching project files after the initial MCP connection.
Code research and web search tools require embedding, reranking, and LLM configuration and may invoke local CLIs or external model APIs depending on settings.
Exclude generated files, vendored dependencies, secrets, large artifacts, and unrelated repositories before indexing broad workspace roots.
Review MCP client configuration carefully when using an absolute project path in a global Claude Desktop config.
✓CodeDB indexes local projects and exposes file tree, outline, search, symbol, caller, dependency, read, snapshot, project, and context tools to the MCP client.
CodeDB's `codedb_edit` tool exists as a fallback editing tool and can create, replace, insert, delete, or modify files when used by a client without native edit tooling.
The npm package runs a postinstall step that downloads a native binary from GitHub Releases; review package and release provenance in environments that restrict native binaries.
Remote repo queries use the public `api.wiki.codes` service and should be treated as network access outside the local repository.
The upstream README marks the project as alpha software, with parser coverage and snapshot formats still stabilizing.
✓The server requests the Google Search Console webmasters scope and can access every property available to the authenticated account.
add_site, delete_site, and delete_sitemap are disabled by default and only run when GSC_ALLOW_DESTRUCTIVE is true.
manage_sitemaps can submit or delete sitemaps depending on action and destructive settings.
URL inspection and analytics tools can reveal indexing issues, search terms, landing pages, countries, devices, click-through rates, and ranking positions.
Use least-privilege service accounts, avoid full-access credentials where read-only analysis is enough, and confirm exact site_url values with list_properties.
Privacy notes
✓Tool calls may expose file paths, filenames, source code snippets, imports, classes, methods, functions, symbols, search matches, complexity summaries, and project settings.
Index data and temp directories can persist derived repository structure or symbol metadata outside the source tree.
File watcher status, exclude patterns, and settings can reveal local project layout and development conventions.
If an MCP client forwards tool results to a model provider, repository contents and search snippets may leave the local machine.
Exclude secrets, generated artifacts, vendored dependencies, build output, and private data before indexing.
✓Indexed chunks, file paths, symbols, comments, Markdown, PDFs, configuration values, database files, daemon state, and search results can reveal proprietary source code and internal architecture.
Embedding, reranking, LLM, and web search providers may receive code-derived queries or snippets if configured.
Local ChunkHound database files, logs, daemon state, and MCP transcripts may retain code-derived context after the session ends.
Avoid sharing ChunkHound databases, config files with API keys, verbose logs, research outputs, and screenshots from private repositories.
✓Local indexes, snapshots, file trees, symbol names, dependency graphs, snippets, read results, and search results can reveal proprietary code structure and implementation details.
Upstream documents sensitive-file blocking for patterns such as environment files, credentials, and keys, but users should still review ignore rules and avoid indexing secret-heavy directories.
CodeDB writes telemetry to `~/.codedb/telemetry.ndjson` unless `CODEDB_NO_TELEMETRY=1` is set, then syncs aggregate tool counts, latency, startup, file count, line count, language, version, and platform data on MCP session close.
Upstream telemetry docs state that source code, file contents, file paths, and search queries are not collected.
Remote public-repo queries and local MCP responses may still be logged by MCP clients, model providers, and terminal history.
✓OAuth client secrets, service account JSON, cached token files, Search Console properties, page URLs, query terms, sitemap URLs, countries, devices, clicks, impressions, CTR, and positions can be sensitive.
The server stores OAuth tokens under a user config directory unless GSC_CONFIG_DIR is changed.
Service account files and OAuth tokens must stay out of prompts, issue comments, logs, screenshots, and repository files.
Redact property URLs, query data, page URLs, tokens, credential file paths, and inspection results before sharing MCP transcripts.
Prerequisites
Python 3.10 or newer.
uv or another Python package runner that can install `code-index-mcp`.
An approved repository path that the MCP client is allowed to inspect.
Optional native search tools such as ripgrep, ugrep, ag, or grep for faster search backends.
Python 3.10 or newer and the `uv` package manager.
A local repository or workspace you are authorized to index.
ChunkHound JSON config reviewed for database path, excludes, embeddings, and LLM provider settings.
Optional embedding provider credentials for semantic search, or regex-only usage when no embedding key is configured.
macOS or Linux on x64 or arm64 for the published native binary launcher.
Node.js 18 or newer when using the `codedeebee` npm launcher.
A local project directory that the MCP client exposes through roots or launches from.
Review of which local repositories, file types, generated artifacts, and secrets patterns may be indexed.
Google Cloud project with the Search Console API enabled.
OAuth desktop client secrets JSON or service account JSON stored outside the repository.
Google Search Console properties where the authenticated user or service account has access.
MCP client that can run uvx or a local Python clone.
Run `uvx mcp-search-console` with either `GSC_OAUTH_CLIENT_SECRETS_FILE` for OAuth or `GSC_CREDENTIALS_PATH` plus `GSC_SKIP_OAUTH=true` for a service account.