50
/ 100
14 days ago
glama

RAG Vault

RAG Vault lets your AI coding assistant search your private documents locally. Everything runs on your machine and your data stays private.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Known vulnerabilities in dependencies: 1 critical, 4 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 2 credentials: RAG_API_KEY, RAG_HYDE_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies1 critical4 high1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@4.0.18GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

highmulter@2.0.2GHSA-5528-5vmv-3xc2

Multer Vulnerable to Denial of Service via Uncontrolled Recursion

highmulter@2.0.2GHSA-72gw-mp4g-v24j

Multer vulnerable to Denial of Service via deeply nested field names

highmulter@2.0.2GHSA-v52c-386h-88mc

Multer vulnerable to Denial of Service via resource exhaustion

highmulter@2.0.2GHSA-xf7r-hgr6-v32p

Multer vulnerable to Denial of Service via incomplete cleanup

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configALLOWED_SCAN_ROOTSHome directory Directories allowed for database scanning
configBASE_DIR2. Pick a documents directory and set to that path.
configCACHE_DIR"": "./.cache",
configCODEX_HOME
configCORS_ORIGINSlocalhost Allowed origins (comma-separated, or )
configDB_PATH"": "./documents/.rag-db",
configEMBEDDER_INIT_TIMEOUT_MS
configJSON_BODY_LIMIT5mb Max request body size
configMAX_FILE_SIZE104857600 (100 MB) Biggest file you can ingest
configMCP_CONNECT_TIMEOUT_MS
configMODEL_NAMEXenova/all-MiniLM-L6-v2 HuggingFace embedding model
🔐 secretRAG_API_KEYAPI Authentication: Optional API key via
configRAG_EMBEDDING_DEVICE"": "cpu",
configRAG_GROUPING"": "related"
configRAG_HYBRID_WEIGHT"": "0.6",
configRAG_HYDE_API_BASE_URL
🔐 secretRAG_HYDE_API_KEYunset API key for LLM backend (required when RAG_HYDE_BACKEND=api)
configRAG_HYDE_API_MODELclaude-haiku-4-5-20251001 Model for LLM-based expansion
configRAG_HYDE_BACKENDrule-based rule-based for local template expansion, api for LLM-based HyDE
configRAG_HYDE_ENABLEDfalse Turn on query expansion for better recall
configRAG_HYDE_EXPANSIONS2 Number of expanded queries to generate
configRAG_MAX_DISTANCEunset Drops results below this relevance threshold (use with boost mode; rrf scores are rank-based)
configRAG_RERANKER_CANDIDATE_MULTIPLIER2 Fetch this many extra candidates for the reranker to score
configRAG_RERANKER_DEVICEauto Device for the reranker (same options as RAG_EMBEDDING_DEVICE)
configRAG_RERANKER_ENABLEDfalse Turn on cross-encoder reranking for better results
configRAG_RERANKER_MODELXenova/ms-marco-MiniLM-L-6-v2 HuggingFace cross-encoder model (~23MB ONNX, downloads on first use)
configRAG_RRF_K60 RRF smoothing constant (only applies in rrf mode). Industry standard is 60.
configRAG_SEARCH_MODEboost Fusion mode: boost (multiplicative keyword boost) or rrf (Reciprocal Rank Fusion)
configRATE_LIMIT_MAX_REQUESTS100 Max requests per window
configRATE_LIMIT_WINDOW_MS60000 Rate limit time window (ms)
configREQUEST_LOGGINGfalse Turn on request audit logging
configREQUEST_TIMEOUT_MS30000 API request timeout
configRERANKER_INIT_TIMEOUT_MS600000 (10 min) Timeout for model download and initialization
configUPLOAD_DIR./uploads/ Temporary directory for web UI file uploads
configVECTORSTORE_INIT_TIMEOUT_MS
configWEB_PORT3000 Port for web interface
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 8 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/robthepcguy-rag-vault-9kylie)](https://m8ven.ai/mcp/robthepcguy-rag-vault-9kylie)
commit: 595c6271a660f9c5c65d3ab74957cc3f34e8f814
code hash: 074ef07b7858b90ede0866735decf799db93430718c9a14f167dec5cb046838e
verified: 7/17/2026, 8:33:56 AM
view raw JSON →