MCP Local RAG — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Track this specific mcp_server implementation and its adoption, setup drift, privilege model, and source activity.

Reviewed Oct 9, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Local hybrid retrieval for private documents

What we know

Node-based local MCP for PDF/DOCX/Markdown/text indexing, embedding and hybrid semantic/keyword search.

Maintenance / activity evidence

Exact GitHub repository pushed_at 2026-10-07T20:19:32Z

Tracking evidence observed Oct 9, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Write local search index; read documents Reported action classes: Write local search index; read documents. Complete write authority is not verified.
No account/API key for local operation
Sensitive access: Private file content, Search queries

BASE_DIR acts as file access boundary; first-run model download is external
BASE_DIR and local file ingestion determine scope; first-run model downloads can make network requests.
File system limited to BASE_DIR; rejects symlink escapes; no built-in auth for multi-user deployment; local index may be written.
Unknown vulnerabilities and client-side tool approvals were not exhaustively evaluated.

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

411 repository stars

Stars observed Oct 9, 2026.

Repository total for shinpr/mcp-local-rag.

All limitations / Review context

What changed in documented permissions, distribution and MCP integration of MCP Local RAG before the next review?

No verified blocker to PUBLIC RADAR TRACKING within the bounded first-party evidence reviewed; material permissions and mitigations are explicitly disclosed.

BASE_DIR acts as file access boundary; first-run model download is external
BASE_DIR and local file ingestion determine scope; first-run model downloads can make network requests.
File system limited to BASE_DIR; rejects symlink escapes; no built-in auth for multi-user deployment; local index may be written.
Write local search index; read documents
No account/API key for local operation
Depends on configured local process, connected account and remote APIs; review first-party privacy terms for any hosted component.
Reviewed write actions: Write local search index; read documents
Sensitive access: Private file content, Search queries
Complete write authority is not verified.
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Unknown vulnerabilities and client-side tool approvals were not exhaustively evaluated.
Exact dated attributable activity evidence
Dated attributable implementation activity/usage not verified
Write actions/tool inventory not confirmed against exact tool documentation; listed action classes remain illustrative or context-dependent. Empty inventory does not establish read-only.
First-run model download requires internet
Index stored locally
BASE_DIR must restrict source file scope
No independent release lifecycle audit; do not claim precise activity date.

Original activity observations

Exact GitHub repository pushed_at 2026-10-07T20:19:32Z

Technical identity

github.com/shinpr/mcp-local-rag

Exact implementation source: https://github.com/shinpr/mcp-local-rag ↗
Reviewed resource type: MCP Server
Repository identity: shinpr/mcp-local-rag

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 9, 2026 · Latest source observation Oct 9, 2026

GitHub repository ↗
shinpr/mcp-local-rag
Recorded repository material and project history.

Setup · Watchlist

Install & Agents

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
MCP Local RAG indexes files inside an explicitly selected base directory.
publisher setup entry · Publisher instructions · Review before use
```
npx -y mcp-local-rag
```
publisher setup or prerequisite · Publisher instructions
claude mcp add local-rag --scope user --env BASE_DIR=/absolute/path/to/your/documents -- npx -y mcp-local-rag
Configure / authenticate
MCP100 setup guide
Set BASE_DIR to approved absolute documents path. This command both registers and starts the local MCP server when the client runs it.
Previously reviewed prerequisites / client guidance: Requires Node 22+.
Previously reviewed prerequisites / client guidance: initial embedding model download needs internet.
Check connection
Suggested check
Use publisher's `npx mcp-local-rag status` for index status; verify tool discovery separately.
Remove / uninstall / revoke
Publisher instructions
If registered with the documented name, `claude mcp remove local-rag` removes Claude Code's MCP registration. Remove optional agent skills separately; do not delete the local indexed documents without an explicit decision.
Client unregistration, program uninstall, persistent-data deletion, and credential revocation must be treated separately.
Remove client registration · Claude Code only · Publisher instructions
claude mcp remove local-rag

Official Documentation & Sources

What it does

Node-based local MCP for PDF/DOCX/Markdown/text indexing, embedding and hybrid semantic/keyword search.

Capability: Files & Knowledge
Resource type: MCP Server
Best fit: Local hybrid retrieval for private documents

Representative uses

Ingest private docs
Search by exact and semantic terms
Read indexed content
Inspect index

Limitations

First-run model download requires internet
Index stored locally
BASE_DIR must restrict source file scope
BASE_DIR acts as file access boundary; first-run model download is external
No independent release lifecycle audit; do not claim precise activity date.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: No account/API key for local operation
Permissions: Write local search index; read documents
Data handling: Depends on configured local process, connected account and remote APIs; review first-party privacy terms for any hosted component.
Cost: unknown
Risk and cautions: BASE_DIR acts as file access boundary; first-run model download is external

Access scope and cautions

Write actions: Not verified Write local search index; read documents
Sensitive access: Private file content Search queries
Risk level: moderate
Security notes: BASE_DIR and local file ingestion determine scope; first-run model downloads can make network requests. File system limited to BASE_DIR; rejects symlink escapes; no built-in auth for multi-user deployment; local index may be written.

The reviewed evidence does not establish the complete write authority of this MCP. Consult the unresolved evidence before granting write access.

FAQ

Based on reviewed evidence as of 2026-10-09. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Ingest private docs; Search by exact and semantic terms; Read indexed content; Inspect index.

What setup and authentication are documented?

Recorded installation/entrypoint step: npx -y mcp-local-rag. Recorded transport: stdio. Recorded environment-variable notes: BASE_DIR. No configuration values are supplied here. Prerequisites: Compatible MCP client. Client notes: Source docs and package may evolve; install according to confirmed release. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: No account/API key for local operation

Can it modify data or perform write operations?

Not verified. The available evidence does not establish the complete write authority. The partial inventory lists: Write local search index; read documents. Recorded permission context: Write local search index; read documents

What data-handling boundary should I consider?

Depends on configured local process, connected account and remote APIs; review first-party privacy terms for any hosted component. Recorded sensitive-access context: Private file content; Search queries.

What limitations and risks should I check before use?

BASE_DIR acts as file access boundary; first-run model download is external. First-run model download requires internet. Index stored locally. BASE_DIR must restrict source file scope. No independent release lifecycle audit; do not claim precise activity date. BASE_DIR and local file ingestion determine scope; first-run model downloads can make network requests. File system limited to BASE_DIR; rejects symlink escapes; no built-in auth for multi-user deployment; local index may be written. Unknown vulnerabilities and client-side tool approvals were not exhaustively evaluated.