RAGIX (ovitrac/RAGIX) is an MCP server listed on the M8ven Trust Index. It scores 68 out of 100, grade C. It declares 91 tools. No publisher has claimed this listing.

Caution

68/100

RAGIX

Item: RAGIX
Rating: 68
Author: M8ven

🧬 RAGIX: Local-first development assistant making LLMs behave like disciplined engineers – Unix-RAG retrieval, sandboxed execution, MCP-compatible, fully auditable

→ ovitrac/RAGIX · listed on github_repo_search

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

ovitrac

Source: github_repo_search

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

GitHub

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

⚠️

Tool descriptions don’t match what handlers do

3 tools describe read intent but their handlers mutate — ragix_models_list (line 1687: result = subprocess.run(); ragix_model_info (line 1759: result = subprocess.run(); ragix_system_info (line 1850: result = subprocess.run(["free", "-b"], capture_output=True, text=True, timeout=5))

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 3 credentials: SONAR_TOKEN, ANTHROPIC_API_KEY, OPENAI_API_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes97 tools · 6 behind config

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

validate_json

Validate JSON content

format_json

Format/prettify JSON

extract_headers

Extract headers from Markdown

generate_toc

Generate table of contents

search_pattern

Search for regex pattern

count_matches

Count pattern matches

replace_pattern

Replace pattern matches

ragix_chat

Run a single Unix-RAG step with the RAGIX agent.

ragix_scan_repo

Quick project overview: walk the sandbox root and list files.

ragix_read_file

Read a text file from within the sandbox root.

ragix_search

Hybrid BM25 + vector search across the codebase.

ragix_workflow

Execute a workflow template for multi-agent task execution.

ragix_health

Get comprehensive RAGIX system health status.

ragix_templates

List all available workflow templates and their parameters.

ragix_config

Get current RAGIX configuration.

ragix_verify_logs

Verify log integrity using SHA256 chain hashing.

ragix_logs

Get recent log entries.

ragix_agent_step

Execute a full agent step with config-based instantiation.

koas_init

Initialize a KOAS audit workspace for a project.

koas_run

Run KOAS audit stages on an initialized workspace.

koas_status

Get status of a KOAS audit workspace.

koas_summary

Get summaries from KOAS kernel outputs.

koas_list_kernels

List available KOAS kernels.

koas_translate_run

Run the KOAS-Translate pipeline over a workspace translation memory.

koas_translate_status

Translation-memory progress for a KOAS-Translate workspace.

koas_report

Get the generated audit report content.

ragix_ast_scan

Extract AST symbols from source code files or directories.

ragix_ast_metrics

Compute code quality metrics for source files.

ragix_models_list

List available Ollama models.

ragix_model_info

Get detailed information about an Ollama model.

ragix_system_info

Get comprehensive system information for RAGIX deployment.

koas_security_discover

Discover hosts on a network segment.

koas_security_scan_ports

Scan ports on target hosts.

koas_security_ssl_check

Analyze SSL/TLS configuration and certificates.

koas_security_vuln_scan

Scan for known vulnerabilities.

koas_security_dns_check

Analyze DNS configuration and security.

koas_security_compliance

Check compliance against security frameworks.

koas_security_risk

Calculate network security risk scores.

koas_security_report

Generate security assessment report.

koas_audit_scan

Scan a codebase and extract AST symbols.

koas_audit_metrics

Compute code metrics (complexity, LOC, maintainability).

koas_audit_hotspots

Identify complexity and risk hotspots.

koas_audit_dependencies

Analyze code dependencies and coupling.

koas_audit_dead_code

Detect potentially dead or unused code.

koas_audit_risk

Calculate code risk scores.

koas_audit_compliance

Check code quality compliance.

koas_audit_report

Generate code audit report.

memory_recall

Token-budgeted memory retrieval for context injection.

memory_search

Search memory items by text query, tags, and filters.

memory_propose

Submit memory candidates for policy evaluation and storage.

memory_write

Direct write to memory store (privileged, policy-checked).

memory_read

Read memory items by their IDs.

memory_update

Update fields on an existing memory item.

memory_link

Create a typed relationship between two memory items.

memory_consolidate

Trigger memory consolidation: deduplication, merge, and tier promotion.

memory_stats

Memory store statistics: item counts, tier distribution, search status.

memory_palace_list

Browse memory palace hierarchy (domain/room/shelf/card).

memory_palace_get

Get a memory item with its palace location.

presenter_render

Run the full KOAS Presenter pipeline on a document folder.

presenter_export

Export an existing presenter workspace to PDF/HTML via marp-cli.

presenter_status

Query the status and metadata of a presenter workspace.

review_md_run

Run the full KOAS Reviewer pipeline on a Markdown document.

review_md_status

Query the review status and statistics for a document.

review_md_revert

Revert one or more changes by their RVW-NNNN IDs.

review_md_show_change

Show details of a specific change from the ledger.

koas_saqqara_run

Read documents into typed trees with provenance and recognise their structure.

koas_saqqara_status

What a previous saqqara run found, read back from its stored result.

koas_saqqara_index

Chunk what a previous read produced into a queryable store.

koas_saqqara_search

Query the store, keeping both lane ranks and every hit's citation.

summary_ingest

Ingest a document corpus into memory.

summary_run

Run the full KOAS Summary pipeline.

summary_status

Check the status of a KOAS Summary workspace.

summary_query

Search memory items by text query.

summary_drift

Compute drift between two corpus versions.

summary_viz

Generate HTML visualizations for a workspace.

summary_summarize

Generate summary from existing memory (Stage 2+3 only).

koas_tender_probe

Report what a document store holds, without modifying it.

koas_tender_status

What the configuration resolves to, without opening the store.

nmap

Network mapper and port scanner

masscan

Fast port scanner (optional, nmap suffices)

arp-scan

ARP scanner for LAN discovery

dig

DNS lookup utility

dnsrecon

DNS enumeration tool

openssl

SSL/TLS toolkit

testssl

TLS/SSL testing tool

nuclei

Template-based vulnerability scanner

nikto

Web server vulnerability scanner

curl

HTTP client

httpx

HTTP probing tool

tcpdump

Packet analyzer

tshark

Terminal Wireshark

memory_session_injectbehind config

Claude Session Bridge — pre-call injection.

memory_session_storebehind config

Claude Session Bridge — post-call storage.

memory_workspace_listbehind config

List all registered memory workspaces.

memory_workspace_registerbehind config

memory_workspace_removebehind config

Remove a named memory workspace.

memory_metricsbehind config

Memory MCP server metrics: call counts, latency, errors.

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configRAGIX_MEMORY_DB

configRAGIX_MEMORY_EMBEDDER

configRAGIX_MEMORY_FTS

configRAGIX_MEMORY_SECRECY

configRAGIX_MEMORY_BUDGET

configRAGIX_REASONING_STRATEGY

configSONAR_URL

🔐 secretSONAR_TOKEN

configSONAR_ORGANIZATION

configRAGIX_MEMORY_ENABLED

configRAGIX_ENABLE_SWE

configRAGIX_AUTO_DIFF

configUNIX_RAG_PROFILE

configRAGIX_DENYLIST

configUNIX_RAG_MODEL

configUNIX_RAG_SANDBOX

configUNIX_RAG_ALLOW_GIT_DESTRUCTIVE

configRAGIX_LLM_BACKEND

configRAGIX_LLM_MODEL

configRAGIX_PROFILE

configRAGIX_AIR_GAPPED

configRAGIX_MCP_ENABLED

configRAGIX_MCP_PORT

configRAGIX_LOG_HASHING

configRAGIX_SANDBOX_ROOT

configRAGIX_AGENT_MODE

configRAGIX_PLANNER_MODEL

configRAGIX_WORKER_MODEL

configRAGIX_VERIFIER_MODEL

🔐 secretANTHROPIC_API_KEY

🔐 secretOPENAI_API_KEY

configRAGIX_CLAUDE_MODEL

configRAGIX_OPENAI_MODEL

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

97/97 tools missing one or more hints — validate_json (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); format_json (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); extract_headers (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +94 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Descriptions match behaviour

Rename the tool, rewrite the description, or move the side-effect into a separate clearly-named tool.

Tool test coverage

77/97 tools referenced in tests (79%)

Write tests that reference each tool by name so every tool has at least one test.

Tool description accuracy

3 tools have description/behavior mismatches: ragix_models_list: description implies read-only but handler writes/deletes/executes; ragix_model_info: description implies read-only but handler writes/deletes/executes; ragix_system_info: description implies read-only but handler writes/deletes/executes

Update tool descriptions to accurately reflect all capabilities — especially write, delete, or execute operations.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/ovitrac/ragix?variant=verified)](https://m8ven.ai/mcp/ovitrac/ragix)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: dadd598fd9518544495710e895f41e9ebeb79230

code hash: 24ff62f1ea874066f45b2eb7103ab7a43cb5c06e0fe3018bbfa520807ea44a28

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client