mcp-local-rag
Local-first RAG server for developers. Semantic + keyword search for code and technical docs. Works with MCP or CLI. Fully private, zero setup.
No outside reports on file
This is a local-only tool with reasonable privacy, but still needs careful permission management and monitoring since it reads your files and runs on your computer.
Based on public adoption and transparency signals as of Oct 21, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesReads & writes local foldersREVIEW
- Command executionNo shell command runner notedLOW
- Network reachLocal or standard API callsLOW
- CredentialsNo API token requiredLOW
- Package sourcenpm (mcp-local-rag)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
npx -y mcp-local-ragEverything known
We found nothing about this project in the sources we read (last checked 2026-10-30). That does not mean it has no problems.
0 incidents · 0 advisories · 0 news articles · 0 community threads · checked 2026-10-30
Popularity grade: B (from public signals such as stars and downloads, not a code review). Graded 2026-10-21.
Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-10-30.
About MCP Local Rag
This tool lets you search through your own code and technical documents locally using both semantic search (meaning-based) and keyword search. It works as a private server that connects to AI agents through MCP (a standard protocol) or command line, keeping all data on your machine.
Who it’s for
Developers who want to quickly find information in their codebase or documentation without sending data to the cloud. Teams that need privacy and don't want to set up complex infrastructure.
Alternatives
- Local Claude with files — Use Claude Desktop's built-in file context for smaller documents
- Elasticsearch — More powerful but needs more setup; good for larger teams
- Milvus — Open-source vector database for semantic search on your hardware
- Ollama with llamaindex — Combine local LLMs with indexing tools for full privacy
Setup
Check these steps against the project’s own instructions before running anything.
Install via npm: npm install -g mcp-local-rag or npx mcp-local-rag. For Claude Desktop integration, add to your claude_desktop_config.json mcpServers section with the appropriate command. Follow the project's README for detailed configuration steps.
Why this grade
Signal-based grade (4/7 points): listed in several sources, public source code. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 426
- Weekly npm downloads
- 4.6k
- Listing last refreshed
- 2026-10-30
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Risks to watch for
- Data indexing: The tool reads and processes all files you point it at; malicious or misleading file names or content could confuse the search results
- Local execution: Running any code tool locally means it accesses your filesystem with the same permissions as your user account
- Dependency chain: Like all npm packages, it depends on other libraries that could be compromised or outdated
- Search injection: Carefully crafted prompts or document content might trick the semantic search into returning wrong results
- Performance impact: Indexing large codebases uses CPU and memory on your machine
How to lower the risk
Least-privilege permissions
- Run it under a user account with access only to the code and docs you need searched
- Don't use your main admin account for this tool
Network isolation
- Keep the MCP server local only; don't expose it to public networks
- Use firewall rules to block external connections if available
Monitoring
- Check which files it's indexing; verify they're the ones you intended
- Watch for unexpected CPU or memory spikes during indexing
Red flags to watch for
- Searches returning results from files you didn't add
- The tool requesting access to system folders or other users' directories
- Unsigned or unverified npm package updates
Questions
How do I install MCP Local Rag?
Install MCP Local Rag with npm install mcp-local-rag or run it directly with npx -y mcp-local-rag. For agent integration and configuration flags, see the documentation at github.com/shinpr/mcp-local-rag. Pin an exact version and pass --ignore-scripts if you want to block post-install hooks.
Are there security reports about MCP Local Rag?
No reports found for this package in our research (last checked 2026-10-30). MCP Local Rag currently holds Grade B (Some risk signals) based on public adoption and transparency signals. Key risk areas to watch include data indexing, local execution, dependency chain.
Is MCP Local Rag actively maintained?
MCP Local Rag has 426 GitHub stars and 4.6k weekly npm downloads. Our directory data was last refreshed on 2026-10-30. Check recent commit activity, release tags, and open issues at github.com/shinpr/mcp-local-rag before pinning it in production.
What are alternatives to MCP Local Rag?
Notable alternatives to MCP Local Rag include Local Claude with files (Use Claude Desktop's built-in file context for smaller documents), Elasticsearch (More powerful but needs more setup), Milvus (Open-source vector database for semantic search on your hardware), Ollama with llamaindex (Combine local LLMs with indexing tools for full privacy). You can also compare MCP Local Rag side by side with other skills in the Related tools section on this page.
README badge and team notes
Maintain or use MCP Local Rag? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/shinpr-mcp-local-rag)HTML embed:
<a href="https://agentarmorhq.com/skills/shinpr-mcp-local-rag"><img src="https://agentarmorhq.com/api/badge/shinpr-mcp-local-rag" alt="AgentArmorHQ Risk Grade for MCP Local Rag" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "shinpr-mcp-local-rag"Share with your security lead
Need sign-off to use mcp-local-rag? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: mcp-local-rag
- **Listing URL:** https://agentarmorhq.com/skills/shinpr-mcp-local-rag
- **Type:** AI agent skill
- **Risk Grade:** Grade B (Some risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 426 GitHub stars, 4.6k weekly npm downloads
#### Permission & Blast-Radius Signals
- **Local files:** Reads & writes local folders
- **Command execution:** No shell command runner noted
- **Network reach:** Local or standard API calls
- **Credentials:** No API token required
- **Package source:** npm (mcp-local-rag)
#### Recommended Hardened Setup
- **Command:** `npx -y --ignore-scripts mcp-local-rag`
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 21, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- AI agent skill
- Publisher
- shinpr
- Source code
- github.com/shinpr/mcp-local-rag
- Install command
- npm install mcp-local-rag
- Est. context load
- ~63 tokens idle · ~450 tokens when active (on-demand skill)
- Popularity
- 426 GitHub stars, 4.6k weekly npm downloads
- Last updated
- 2026-10-30
- Last graded
- 2026-10-21
Community
Discussions for MCP Local Rag
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude