semantic-code-mcp (huawang1258/semantic-code-mcp) is an MCP server listed on the M8ven Trust Index. It scores 73 out of 100, grade C. It declares 1 tool. No publisher has claimed this listing.

Back to MCP Trust IndexM8ven
C
Limited view
73/100

semantic-code-mcp

A self-hosted semantic code retrieval MCP server that enables natural language queries to find relevant code snippets using Tree-sitter AST parsing, embedding, and hybrid search with reranking.

→ huawang1258/semantic-code-mcp· listed on glama

Limited view. Automated analysis covers part of this stack. Findings reflect what we verified. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

Limited view: static analysis for Python is partially covered.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

huawang1258

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 3 credentials: VOYAGE_API_KEY, SCM_LLM_API_KEY, COHERE_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configSCM_EVAL_TARGET
configSCM_RERANK_BACKENDauto rerank 后端：auto（有 VOYAGE key 用 Voyage，其次 Cohere）/ voyage / cohere / off
configSCM_EMBED_BACKENDlocal # 本地 embedding（默认 Qwen/Qwen3-Embedding-0.6B）
configSCM_EMBED_CHAR_BUDGET200000 单批最大字符数（未绑卡时可调小）
configSCM_EMBED_DTYPEfloat 向量精度：float（最高精度）/ int8（省 71% 存储）
configSCM_EMBED_MAX_RETRIES4 API 限流/错误时自动重试次数
🔐 secretVOYAGE_API_KEY「效果优先」技术栈：Tree-sitter AST 切分 + voyage-code-3 embedding（int8 量化）+ sqlite-vec 向量库 + BM25 全文 + RRF 融合 + Voyage rerank-2.5 重排 + Call Graph 图扩展。一个 跑通 embedding + rerank 全链路。
configSCM_EMBED_MIN_INTERVAL0 请求最小间隔秒数（未绑卡 3 RPM 限制时设 21）
configSCM_LOCAL_EMBED_MODEL
configSCM_LOCAL_EMBED_DEVICE
configSCM_LOCAL_EMBED_MAX_SEQ
configSCM_LOCAL_EMBED_BATCH
configSCM_LLM_BASE_URL
🔐 secretSCM_LLM_API_KEY
configSCM_LLM_MODEL
configSCM_LLM_TIMEOUT
configSCM_QUERY_EXPANSION自配 LLM 端点（可选，默认关） 仅查询文本（不含代码） =on 时
configSCM_EMBED_CONCURRENCYvoyage 3 / local 1 索引时 embedding 并发请求数（实测 3 路≈提速 3 倍）
configSCM_RERANK_MIN_INTERVAL节流；429 自动退避重试兜底。
configSCM_RERANK_MODEL按后端 voyage → rerank-2.5，cohere → rerank-v3.5
🔐 secretCOHERE_API_KEY否 可选 rerank 后备后端；默认用 Voyage rerank-2.5，无需此 key
configSCM_LOG_FILE
configSCM_DB_DIR~/.semantic-code-mcp 索引数据库存放目录
configSCM_LOG_DISABLE
configSCM_LOG_MAX_BYTES
configSCM_LOG_STDERR
configSCM_EMBED_MODELvoyage-code-3 Embedding 模型
configSCM_MAX_WORKSPACES8 最大同时管理的工作区数（LRU 淘汰）
configSCM_TOP_K50 向量召回候选数
configSCM_TOP_N10 最终返回结果数
configSCM_WATCH1 文件监控：1 启用（默认），0 禁用
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

1/1 tools missing one or more hints — codebase_search (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint). OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tests exist

No test files found

Add tests that exercise each declared tool.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/huawang1258/semantic-code-mcp)](https://m8ven.ai/mcp/huawang1258/semantic-code-mcp)
Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.
commit: 9a13610049858647493514df1802913c0b428597
code hash: 42fad4e8acd3f0bdeb5a7b9efc9d8aed70b0690699d350c066d804fefe9fda59
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client