Code research MCP server that gives Claude GitHub code search, repository exploration, PR search, local ripgrep, local file reading, LSP definitions, references, call hierarchy, and package-to-source discovery.
Octocode can search and read public or private GitHub repositories according to the authenticated GitHub identity's permissions., Local tools can search local files, read file content, inspect directory structure, and use LSP features such as definitions, references, and call hierarchy., Clone and cache workflows can write local repository caches and should be monitored on shared or space-constrained machines., Package search can resolve npm and PyPI packages to source repositories, but package ownership and source links should still be verified before use., Octocode provides research evidence; generated implementation plans and code changes still need review, tests, and repository-specific policy checks.
Privacy notes
GitHub queries, repository names, PR searches, local paths, file snippets, symbol names, package names, and code excerpts may be visible to the MCP client and model provider., GitHub tokens should be scoped to the minimum repositories and permissions needed for research., The reviewed privacy policy describes de-identified telemetry for command/tool usage, performance, errors, and session IDs, with opt-out support through `LOG=false`., Searching private repositories or local workspaces can expose confidential source code and architecture context in model transcripts., Review local Octocode caches, logs, and config files before sharing machines or artifacts.
Author
Guy Bary
Submitted by
oktofeesh1
Claim status
unclaimed
Last verified
2026-06-06
Decision playbook
Review trust signals before you adopt
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
Compare context
Selected
0
Current score
63
Baseline
—
Delta
No baseline selected
No major trust-signal divergence detected in the current selection.
Source and provenance checks
Needs review
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Done
Source provenance statusRequired
Marked as source-backed.
Done
Metadata reviewed
No reviewed flag detected in metadata.
Pending
Safety and privacy checks
Complete
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Done
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Done
Trust level risk gateRequired
Trust level does not block evaluation.
Done
Package and install checks
Needs review
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Done
Package verification flag
No package verification flag provided.
Pending
Checksum metadata
No checksum provided for downloaded artifact.
Pending
Compare-driven decision checks
Needs review
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
5 safety and 5 privacy notes across 7 risk areas. Review closely: credentials & tokens, permissions & scopes, third-party handling.
7 areas
SafetyPermissions & scopesOctocode can search and read public or private GitHub repositories according to the authenticated GitHub identity's permissions.
SafetyLocal filesLocal tools can search local files, read file content, inspect directory structure, and use LSP features such as definitions, references, and call hierarchy.
SafetyData retentionClone and cache workflows can write local repository caches and should be monitored on shared or space-constrained machines.
SafetyGeneralPackage search can resolve npm and PyPI packages to source repositories, but package ownership and source links should still be verified before use.
SafetyGeneralOctocode provides research evidence; generated implementation plans and code changes still need review, tests, and repository-specific policy checks.
PrivacyThird-party handlingGitHub queries, repository names, PR searches, local paths, file snippets, symbol names, package names, and code excerpts may be visible to the MCP client and model provider.
PrivacyCredentials & tokensGitHub tokens should be scoped to the minimum repositories and permissions needed for research.
PrivacyCredentials & tokensThe reviewed privacy policy describes de-identified telemetry for command/tool usage, performance, errors, and session IDs, with opt-out support through `LOG=false`.
PrivacyExecution & processesSearching private repositories or local workspaces can expose confidential source code and architecture context in model transcripts.
PrivacyLocal filesReview local Octocode caches, logs, and config files before sharing machines or artifacts.
Safety notes
Octocode can search and read public or private GitHub repositories according to the authenticated GitHub identity's permissions.
Local tools can search local files, read file content, inspect directory structure, and use LSP features such as definitions, references, and call hierarchy.
Clone and cache workflows can write local repository caches and should be monitored on shared or space-constrained machines.
Package search can resolve npm and PyPI packages to source repositories, but package ownership and source links should still be verified before use.
Octocode provides research evidence; generated implementation plans and code changes still need review, tests, and repository-specific policy checks.
Privacy notes
GitHub queries, repository names, PR searches, local paths, file snippets, symbol names, package names, and code excerpts may be visible to the MCP client and model provider.
GitHub tokens should be scoped to the minimum repositories and permissions needed for research.
The reviewed privacy policy describes de-identified telemetry for command/tool usage, performance, errors, and session IDs, with opt-out support through `LOG=false`.
Searching private repositories or local workspaces can expose confidential source code and architecture context in model transcripts.
Review local Octocode caches, logs, and config files before sharing machines or artifacts.
Prerequisites
Node.js 20 or newer and npx available to the MCP client runtime.
GitHub authentication through Octocode login, GitHub CLI, or a scoped token for GitHub-backed tools.
Approval for the MCP client to search and read any local workspace paths used with local tools.
Review of telemetry, cache, and private-repository handling before connecting sensitive workspaces.
Octocode MCP is a Model Context Protocol server for code research and context
gathering. It gives Claude tools for GitHub code search, repository search, pull
request search, remote file reads, repository structure browsing, local ripgrep,
local file reads, local directory views, LSP go-to-definition, LSP references,
LSP call hierarchy, package search, and optional repository cloning.
It is aimed at evidence-first coding workflows: ask the model to inspect real
implementations, trace local symbols, compare package sources, or research
public and private GitHub code before it drafts a plan or proposes a change.
These sources were reviewed on 2026-06-06. Prefer the live repository,
README, npm registry metadata, MCP package metadata, server manifest, server
entrypoint, privacy policy, authentication guide, and license file for current
install commands, tool behavior, authentication, telemetry, and licensing.
Features
npm package octocode-mcp.
Stdio MCP server launched with npx -y octocode-mcp@latest.
GitHub tools for code search, repository search, pull request search, remote
file content, repository structure, and optional clone workflows.
Local tools for ripgrep search, file discovery, file reads, and directory views.
LSP tools for go-to-definition, references, and call hierarchy.
Package search for npm and PyPI packages mapped to source repositories.
GitHub authentication through Octocode login, GitHub CLI, or token-based setup.
Authenticate GitHub through the documented Octocode or GitHub CLI flow before
using GitHub-backed tools against private repositories.
Use Cases
Search public GitHub repositories for real implementation patterns.
Search private repositories available to the authenticated GitHub identity.
Read specific remote files without fetching an entire repository.
Search local code with ripgrep before editing.
Use LSP definitions, references, or call hierarchy to trace a symbol.
Resolve a package name to its source repository.
Gather evidence for a PR review or implementation plan.
Safety and Privacy
Octocode can expose real code from GitHub and local workspaces. Scope GitHub
tokens carefully, avoid querying private repositories unless the model session is
approved for that code, and keep local paths restricted to projects you intend
Claude to inspect.
The reviewed privacy policy describes de-identified telemetry for usage and
performance data, with LOG=false documented as an opt-out. Review telemetry,
cache, and config behavior before using Octocode in regulated or highly
confidential environments.
Duplicate Check
Existing MCP content includes GitHub, GitMCP, repository, and developer-tool
entries. This entry is distinct because it covers bgauryy/octocode and the
octocode-mcp npm package, combining GitHub code research, local file search,
LSP symbol tools, package-to-source discovery, and optional clone/cache
workflows. No matching Octocode source URL or dedicated Octocode MCP entry was
found in content/mcp.
Code research MCP server that gives Claude GitHub code search, repository exploration, PR search, local ripgrep, local file reading, LSP definitions, references, call hierarchy, and package-to-source discovery.
Code intelligence MCP server with a Zig core for local project indexing, structural outlines, symbol lookup, search, dependency graphs, snapshots, remote public-repo queries, and fallback edits.
✓Octocode can search and read public or private GitHub repositories according to the authenticated GitHub identity's permissions.
Local tools can search local files, read file content, inspect directory structure, and use LSP features such as definitions, references, and call hierarchy.
Clone and cache workflows can write local repository caches and should be monitored on shared or space-constrained machines.
Package search can resolve npm and PyPI packages to source repositories, but package ownership and source links should still be verified before use.
Octocode provides research evidence; generated implementation plans and code changes still need review, tests, and repository-specific policy checks.
✓CodeDB indexes local projects and exposes file tree, outline, search, symbol, caller, dependency, read, snapshot, project, and context tools to the MCP client.
CodeDB's `codedb_edit` tool exists as a fallback editing tool and can create, replace, insert, delete, or modify files when used by a client without native edit tooling.
The npm package runs a postinstall step that downloads a native binary from GitHub Releases; review package and release provenance in environments that restrict native binaries.
Remote repo queries use the public `api.wiki.codes` service and should be treated as network access outside the local repository.
The upstream README marks the project as alpha software, with parser coverage and snapshot formats still stabilizing.
✓Context+ can inspect source files, build AST and embedding indexes, run static analysis, create memory graph nodes, and propose code changes.
The `propose_commit` tool is designed to write code after validation and creates shadow restore points before saving.
Static analysis tools may invoke local compilers, linters, or language tools depending on the repository.
Runtime caches and memory graph data can persist source-derived embeddings and relationships after the MCP session ends.
External embedding providers can receive source-derived text, identifiers, prompts, and cluster-labeling context.
✓This server sends web searches, URLs, scraping targets, browser actions, package names, and dataset requests to Bright Data APIs.
Review website terms, robots policies, rate limits, jurisdictional requirements, and internal scraping policies before automating collection.
`PRO_MODE`, browser automation groups, data-product groups, and batch tools can increase cost, request volume, and operational impact.
The server can create or use Bright Data zones through API calls; review account permissions and zone settings before running it with broad API tokens.
Use `RATE_LIMIT`, group selection, and explicit tool allowlists to keep agent-driven browsing and scraping bounded.
Privacy notes
✓GitHub queries, repository names, PR searches, local paths, file snippets, symbol names, package names, and code excerpts may be visible to the MCP client and model provider.
GitHub tokens should be scoped to the minimum repositories and permissions needed for research.
The reviewed privacy policy describes de-identified telemetry for command/tool usage, performance, errors, and session IDs, with opt-out support through `LOG=false`.
Searching private repositories or local workspaces can expose confidential source code and architecture context in model transcripts.
Review local Octocode caches, logs, and config files before sharing machines or artifacts.
✓Local indexes, snapshots, file trees, symbol names, dependency graphs, snippets, read results, and search results can reveal proprietary code structure and implementation details.
Upstream documents sensitive-file blocking for patterns such as environment files, credentials, and keys, but users should still review ignore rules and avoid indexing secret-heavy directories.
CodeDB writes telemetry to `~/.codedb/telemetry.ndjson` unless `CODEDB_NO_TELEMETRY=1` is set, then syncs aggregate tool counts, latency, startup, file count, line count, language, version, and platform data on MCP session close.
Upstream telemetry docs state that source code, file contents, file paths, and search queries are not collected.
Remote public-repo queries and local MCP responses may still be logged by MCP clients, model providers, and terminal history.
✓Source code, file paths, symbol names, comments, identifiers, embeddings, memory nodes, relations, prompts, API keys, static-analysis output, proposed diffs, and tool results may be visible to the MCP client and model provider.
Proprietary codebases can expose internal architecture, feature maps, naming conventions, secrets accidentally present in code, and product plans.
Keep API keys and provider base URLs out of committed MCP configs, logs, screenshots, and shared prompts.
Review `.mcp_data` and generated restore-point data before sharing workspaces or artifacts.
✓Bright Data API tokens must stay in environment variables or secret managers and should never be committed to MCP configuration files.
Queries, URLs, package names, web pages, scraping outputs, dataset filters, and browser activity may be visible to Bright Data, the MCP client, and the model provider.
Public web data can still contain personal data, copyrighted content, customer information, or contractual restrictions.
Tool outputs can include scraped page text, search results, social or ecommerce dataset fields, package metadata, and browser screenshots depending on enabled tools.
Prerequisites
Node.js 20 or newer and npx available to the MCP client runtime.
GitHub authentication through Octocode login, GitHub CLI, or a scoped token for GitHub-backed tools.
Approval for the MCP client to search and read any local workspace paths used with local tools.
Review of telemetry, cache, and private-repository handling before connecting sensitive workspaces.
macOS or Linux on x64 or arm64 for the published native binary launcher.
Node.js 18 or newer when using the `codedeebee` npm launcher.
A local project directory that the MCP client exposes through roots or launches from.
Review of which local repositories, file types, generated artifacts, and secrets patterns may be indexed.
Node.js and npx available to the MCP client runtime.
A repository or workspace you are authorized to index and expose to an MCP client.
Ollama embedding model available, or an approved OpenAI-compatible embedding provider and API key.
Static analysis tools installed if you want Context+ to run native linters or compilers.
Node.js and npx available to the MCP client runtime.
Bright Data account and API token stored as `API_TOKEN`.
Review of Bright Data plan limits, free-tier scope, paid modes, and data-product terms.
A decision about whether to use default rapid tools, `PRO_MODE`, `GROUPS`, or explicit `TOOLS`.