Octocode — Watchlist | MCP100 Index

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Dated implementation activity and relevant MCP role justify continued Radar monitoring.

Reviewed Oct 9, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Semantic and graph-based codebase understanding

What we know

Rust-based structural code intelligence with semantic search, tree-sitter graph traversal and optional LSP tools served via MCP.

Maintenance / activity evidence

GitHub REST repository pushed_at 2026-10-08T16:55:56Z for Muvon/octocode

Tracking evidence observed Oct 9, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Index/search local repository Complete write authority is not verified.
Local filesystem permission; provider API key only for configured remote embeddings
Sensitive access: Source code, Symbol/dependency structure

Broad repository read access; consider embedding-provider data flow
Local workspace indexing and optional embedding providers: review file inclusion, gitignore assumptions, and outbound transfer of chunks before public recommendation.
Repo indexing reads local source code; optional cloud embeddings can transmit code chunks.
Unknown vulnerabilities and client-side tool approvals were not exhaustively evaluated.

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

482 repository stars

Stars observed Oct 9, 2026.

Repository total for Muvon/octocode.

All limitations / Review context

At the next review, has this exact implementation gained new releases, changed setup/security scope, or become suitable for Shortlist?

No verified blocker to PUBLIC RADAR TRACKING within the bounded first-party evidence reviewed; material permissions and mitigations are explicitly disclosed.

Broad repository read access; consider embedding-provider data flow
Local workspace indexing and optional embedding providers: review file inclusion, gitignore assumptions, and outbound transfer of chunks before public recommendation.
Repo indexing reads local source code; optional cloud embeddings can transmit code chunks.
Index/search local repository
Local filesystem permission; provider API key only for configured remote embeddings
Depends on configured local process, connected account and remote APIs; review first-party privacy terms for any hosted component.
Sensitive access: Source code, Symbol/dependency structure
Complete write authority is not verified.
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Unknown vulnerabilities and client-side tool approvals were not exhaustively evaluated.
Write actions/tool inventory not confirmed against exact tool documentation; listed action classes remain illustrative or context-dependent. Empty inventory does not establish read-only.
Needs local repository access
Optional embeddings providers may send code-derived text externally
Indexing/storage uses local disk
No independent release lifecycle audit; do not claim precise activity date.

Original activity observations

GitHub REST repository pushed_at 2026-10-08T16:55:56Z for Muvon/octocode

Technical identity

github.com/Muvon/octocode

Exact implementation source: https://github.com/Muvon/octocode ↗
Reviewed resource type: MCP Server
Repository identity: Muvon/octocode

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 9, 2026 · Latest source observation Oct 9, 2026

GitHub repository ↗
muvon/octocode
Recorded repository material and project history.

Setup · Watchlist

Install & Agents

Claude Code

Publisher instructions with a documented client setup path.

Source evidence observed Oct 12, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Use the publisher-documented command or connection method below; complete the prerequisites and client configuration before expecting a usable MCP connection.
cargo install octocode
claude mcp add octocode -- octocode mcp --path /path/to/your/project
brew install muvon/tap/octocode
Configure / authenticate
Publisher instructions
Publisher offers Homebrew, universal install script and source install. For MCP client JSON, command octocode with args [mcp,--path,/your/project].
Advanced configuration · claude desktop json
{ "mcpServers": { "octocode": { "args": [ "mcp", "--path", "/path/to/your/project" ], "command": "octocode" } } }
Check connection
Suggested check
Use /mcp inside Claude Code to confirm octocode tools are discovered. Ensure the registered --path argument points to the real checkout; a working cargo binary alone is not evidence of a valid project index. Client registration check: `claude mcp get octocode` (checks registration; inspect tools/read-only calls separately to verify authenticated service access).
Remove / uninstall / revoke
MCP100 setup guide
Remove the matching MCP configuration from the client. This does not uninstall the local package or revoke provider credentials. Client disconnect (claude-code, only if registered using the name `octocode`): `claude mcp remove octocode`. This unregisters the client entry; it does not uninstall packages or revoke remote service credentials.
claude mcp remove octocode
cargo uninstall octocode

Official Documentation & Sources

What it does

Rust-based structural code intelligence with semantic search, tree-sitter graph traversal and optional LSP tools served via MCP.

Capability: Developer Tools
Resource type: MCP Server
Best fit: Semantic and graph-based codebase understanding

Representative uses

Search code semantically
Explore call/import graph
Find symbol definition
Inspect references and signatures

Limitations

Needs local repository access
Optional embeddings providers may send code-derived text externally
Indexing/storage uses local disk
Broad repository read access; consider embedding-provider data flow
No independent release lifecycle audit; do not claim precise activity date.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Local filesystem permission; provider API key only for configured remote embeddings
Permissions: Index/search local repository
Data handling: Depends on configured local process, connected account and remote APIs; review first-party privacy terms for any hosted component.
Cost: unknown
Risk and cautions: Broad repository read access; consider embedding-provider data flow

Access scope and cautions

Write actions: Not verified
Sensitive access: Source code Symbol/dependency structure
Risk level: moderate
Security notes: Local workspace indexing and optional embedding providers: review file inclusion, gitignore assumptions, and outbound transfer of chunks before public recommendation. Repo indexing reads local source code; optional cloud embeddings can transmit code chunks.

The reviewed evidence does not establish the complete write authority of this MCP. Consult the unresolved evidence before granting write access.

FAQ

Based on reviewed evidence as of 2026-10-09. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Search code semantically; Explore call/import graph; Find symbol definition; Inspect references and signatures.

What setup and authentication are documented?

Recorded installation/entrypoint step: octocode mcp --path /path/to/project. Recorded transport: stdio. Prerequisites: Compatible MCP client. Client notes: Source docs and package may evolve; install according to confirmed release. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: Local filesystem permission; provider API key only for configured remote embeddings

Can it modify data or perform write operations?

Not verified. The available evidence does not establish the complete write authority. Recorded permission context: Index/search local repository

What data-handling boundary should I consider?

Depends on configured local process, connected account and remote APIs; review first-party privacy terms for any hosted component. Recorded sensitive-access context: Source code; Symbol/dependency structure.

What limitations and risks should I check before use?

Broad repository read access; consider embedding-provider data flow. Needs local repository access. Optional embeddings providers may send code-derived text externally. Indexing/storage uses local disk. No independent release lifecycle audit; do not claim precise activity date. Local workspace indexing and optional embedding providers: review file inclusion, gitignore assumptions, and outbound transfer of chunks before public recommendation. Repo indexing reads local source code; optional cloud embeddings can transmit code chunks. Unknown vulnerabilities and client-side tool approvals were not exhaustively evaluated.