A local code-intelligence MCP server that provides structural, exact-query, related-search, and research capabilities from a validated repo-local index, enabling agents to perform deterministic lookups, semantic search, and code analysis.
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
simple-git is vulnerable to Remote Code Execution
process.env. You'll be asked to provide them before it can run.OLLAMA_CHAT_MODEL— "nemotron-3-nano:4b-128k"OLLAMA_EMBED_MODEL— "qwen3-embedding:0.6b-32k"OLLAMA_HOST— No Override Ollama host unsetOPENAI_API_KEY— Conditional Fallback alias for API key unsetOPENAI_BASE_URL— No Fallback alias for base URL https://api.openai.com/v1OPENAI_CHAT_MODELOPENAI_EMBED_MODEL— No Fallback alias for embedding model text-embedding-3-smallSCPLUS_CHAT_PROVIDERSCPLUS_EMBED_BATCH_SIZE— No Embedding batch size, clamped in code 8SCPLUS_EMBED_CHUNK_CHARS— No Chunk chars before vector merge, clamped in code 2000SCPLUS_EMBED_LOW_VRAM— No Pass low_vram into Ollama embed optionsSCPLUS_EMBED_MAIN_GPU— No Pass main_gpu into Ollama embed optionsSCPLUS_EMBED_NUM_BATCH— No Pass num_batch into Ollama embed optionsSCPLUS_EMBED_NUM_CTX— No Pass num_ctx into Ollama embed optionsSCPLUS_EMBED_NUM_GPU— No Pass num_gpu into Ollama embed optionsSCPLUS_EMBED_NUM_THREAD— No Pass num_thread into Ollama embed optionsSCPLUS_EMBED_PROVIDER— export =openaiSCPLUS_IDLE_TIMEOUT_MS— No Idle shutdown timeout for MCP process unsetSCPLUS_MAX_EMBED_FILE_SIZE— No Max file size for embed-aware search paths tool fallback in semantic-search.tsSCPLUS_OPENAI_API_KEY— export =YOUR_API_KEYSCPLUS_OPENAI_BASE_URL— export =https://your-proxy.example.com/v1SCPLUS_OPENAI_CHAT_MODELSCPLUS_OPENAI_EMBED_MODEL— export =text-embedding-3-smallSCPLUS_PARENT_POLL_MS— No Parent-process polling interval unset[](https://m8ven.ai/mcp/cesar514-scplus-mcp-15qio9)