MCP server bridging OpenGrok search engine with AI for instant context across massive codebases
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
undici WebSocket client vulnerable to denial of service via fragment count bypass
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
process.env. You'll be asked to provide them before it can run.OPENGROK_ALLOWED_ORIGINS— comma-separated origins CORS allowlist (replaces wildcard CORS)OPENGROK_AUTH_SERVERS— comma-separated URLs Trusted authorization server URIsOPENGROK_BASE_URL— opengrok-mcp status Health check: validates connectivity and detects installed MCP clients. Reads config from ~/.claude.json, ~/.copilot/mcp-config.json, or Codex TOML when is not in envOPENGROK_CONTEXT_BUDGET— standard (default) / minimal / generous Response size tier: 8 KB / 4 KB / 16 KBOPENGROK_JWKS_URI— URL JWKS endpoint for JWT validation (OAuth 2.1 resource server mode)OPENGROK_LOG_LEVEL— debug / info (default) Verbose structured logging to stderrOPENGROK_MAX_INLINE_LINESOPENGROK_MAX_RESPONSE_BYTESOPENGROK_PASSWORD— string Authentication password (prefer OS keychain via npx opengrok-mcp-server setup)OPENGROK_PASSWORD_FILEOPENGROK_RESOURCE_URI— URL This server's resource URI, advertised in RFC 9728 metadataOPENGROK_RESPONSE_FORMAT_OVERRIDE— tsv / toon / yaml / text / markdown Force a response format globally for all toolsOPENGROK_SCOPE_MAP— scope:role,... Map JWT scopes to RBAC roles (e.g., read:readonly,admin:admin)OPENGROK_SEARCH_AND_READ_CAPOPENGROK_STRICT_OAUTH— true / false Reject requests without a valid JWT when OPENGROK_JWKS_URI is setOPENGROK_USERNAME— string Authentication username (optional — leave unset for anonymous access)VSCODE_IPC_HOOK_CLIXDG_CONFIG_HOME[](https://m8ven.ai/mcp/npm-https-github-com-icyhot09-opengrok-mcp-server)