Octocode MCP - AI Context Platform
NPM · OCTOCODE-MCP · SCANNED SEP 20
AI code research platform. Search, analyze, and extract insights from any GitHub repository.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 82 of 250 dependencies flagged as unhealthy (2 deprecated). View diagnostics → Partial
Provenance & Transparency23
- Repository check failed: the declared repository URL redirects; it must resolve directly. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 13 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability72
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2982 tokens (~596/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
- Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 5 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 6 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
How do I install the Octocode MCP - AI Context Platform server?
Octocode MCP - AI Context Platform runs locally as an npm package, launched with npx -y octocode-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · octocode-mcp
claude mcp add bgauryy-octocode-mcp -- npx -y octocode-mcp
{
"mcpServers": {
"bgauryy-octocode-mcp": {
"command": "npx",
"args": [
"-y",
"octocode-mcp"
]
}
}
} {
"servers": {
"bgauryy-octocode-mcp": {
"command": "npx",
"args": [
"-y",
"octocode-mcp"
]
}
}
} codex mcp add bgauryy-octocode-mcp -- npx -y octocode-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"bgauryy-octocode-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"octocode-mcp"
],
"enabled": true
}
}
} openclaw mcp add bgauryy-octocode-mcp --command npx --arg -y --arg octocode-mcp
mcp_servers:
bgauryy-octocode-mcp:
command: "npx"
args: ["-y", "octocode-mcp"] {
"McpServers": {
"bgauryy-octocode-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"octocode-mcp"
]
}
}
} assistant mcp add bgauryy-octocode-mcp -t stdio -c npx -a -y octocode-mcp
{
"mcpServers": {
"bgauryy-octocode-mcp": {
"command": "npx",
"args": [
"-y",
"octocode-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 −2
- Stability: pass → 0.80 functional
- 18 Sept 26 0
- Stability: 0.97 → pass security
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 +2
- CVE-2026-82562 no longer affects this package ▲ security
- CVE-2026-82417 no longer affects this package ▲ security
- Known CVEs: fail → pass ▲ security
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 −3
- Stability: pass → 0.80 functional
- 11 Sept 26 +1
- Stability: 0.97 → pass security
- 9 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/octocode-mcp@7.0.9
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 250 packages
| Packages resolved | 250 |
|---|---|
| Deprecated | 2 |
| Stale | 80 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
githubGetFileContent ~486
FILE READER - Read file contents with smart extraction PARAMS: See schema for parameter details PURPOSE: Read file contents using patterns, line ranges, or full file mode USE_WHEN: Have file path | After githubSearchCode/githubViewRepoStructure discovery AVOID: Unknown location - search first WORKFLOW: Step 1: Discovery (githubSearchCode/githubViewRepoStructure) Step 2: Read (matchString or line range) Step 3: Explore related patterns STRATEGY (choose based on what you know): - matchString: Know function/class/pattern name → start here [most efficient] - startLine + endLine: Know location from prior search → precise extraction - fullContent: Need entire file → use ONLY for small files (<500KB) OPTIMIZATION: - Start lean: Single matchString query first - If related context needed: Bulk queries for multiple files (e.g., auth.ts + user.ts + session.ts in parallel) GOTCHAS: - minified=true breaks JSON/YAML formatting → use minified=false for config files - matchString returns empty if no matches → try broader pattern or use fullContent - Files >500KB: MUST use matchString or line ranges, fullContent will truncate NEXT_STEP: hasResults → githubSearchCode for related patterns empty → githubSearchCode/githubViewRepoStructure to locate file EXAMPLES: matchString="validateUser", matchStringContextLines=20 # BEST: targeted read startLine=1, endLine=100 # Line range fullContent=true # Full file queries=[{path:"a.ts",matchString:"fn1"},{path:"b.ts",matchString:"fn2"}] # Bulk path="config.json", fullContent=true, minified=false # Config file, keep formatting GUARDS: config? - minified=false | know pattern? - matchString | large file? - use line range | efficiency? - prefer startLine/endLine over fullContent, justify range in reasoning
| Name | Type | Req | Description |
|---|---|---|---|
| queries | array | yes | Research queries for githubGetFileContent (1-3 queries per call for optimal resource management). Review schema before use for optimal results |
No output schema declared.
No examples provided.
githubSearchCode ~570
CODE SEARCH - Search file content or filenames/paths PARAMS: See schema for parameter details PURPOSE: Search file contents for code patterns or search file/directory names USE_WHEN: Know patterns | Need discovery AVOID: Broad terms | No owner/repo (rate limits) WORKFLOW: Step 1: Discovery (match="path") - Find files [fastest, most token efficient] Step 2: (Optional) Use githubViewRepoStructure to understand structure when exploring unfamiliar repos Step 3: Detailed (match="file", limit=5) - Get matches with context Step 4: Read (githubGetFileContent matchString) - Full content STRATEGY: - match="path": Fast discovery, returns paths only - match="file": Detailed search, returns text_matches[] with context - Always scope: owner/repo to avoid rate limits OPTIMIZATION: - Start lean: Know exact term? → Single specific query (e.g., "authenticate") - Uncertain about terms? → Bulk query with variants upfront (e.g., [{keywordsToSearch:["auth"]}, {keywordsToSearch:["authenticate"]}, {keywordsToSearch:["credential"]}]) - Semantic variants: "auth"→"authorization"/"authenticate"/"credential", "config"→"configuration"/"settings"/"options" GOTCHAS: - match="file" without limit = token explosion - No owner/repo = rate limits - text_matches show exact locations → copy match text into githubGetFileContent matchString for precise extraction NEXT_STEP: hasResults → githubGetFileContent matchString for full context empty → githubViewRepoStructure or broaden search EXAMPLES: match="path", keywordsToSearch=["auth"] # Fast: find files with "auth" in path owner="facebook", repo="react", keywordsToSearch=["useState"] # Content search path="src/api", extension="ts", keywordsToSearch=["export", "function"] # Precise queries=[{keywordsToSearch:["termExample"],match:"path"},{keywordsToSearch:["patternExample"],match:"file",limit:5}] # Bulk: combine discovery + detailed search keywordsToSearch=["validateUser"], match="file", limit=5 # Detail…
| Name | Type | Req | Description |
|---|---|---|---|
| queries | array | yes | Research queries for githubSearchCode (1-3 queries per call for optimal resource management). Review schema before use for optimal results |
No output schema declared.
No examples provided.
githubSearchPullRequests ~497
PR SEARCH - Search or fetch PRs PARAMS: See schema for parameter details PURPOSE: Get PRs with metadata, discussions, and diffs USE_WHEN: PR context | Implementation research | Review merged changes AVOID: Current code → githubGetFileContent | Code patterns → githubSearchCode WORKFLOW: Step 1: Discover (prNumber or filters) Step 2: Analyze (withComments/withContent) Step 3: Compare (githubGetFileContent for current) STRATEGY: - prNumber: Direct fetch [fastest] when you know PR number - Search: Filter by state/author/labels/dates for discovery - withContent/withComments: Start without them, add only when needed - limit: Use 3 for initial scan, 5-10 for comprehensive review OPTIMIZATION: - Start lean: Know PR number? → prNumber (fastest, most direct) - Searching? → Start with limit=3, no withContent/withComments - Need details? → Sequential: analyze metadata first, then fetch with withContent=true if relevant - Multiple PRs: Bulk queries (e.g., [{prNumber:123}, {prNumber:456}, {prNumber:789}]) GOTCHAS: - merged=true needs state="closed" - prNumber ignores other filters - label accepts string or array for OR matching NEXT_STEP: hasResults → githubGetFileContent for current | githubSearchCode for patterns empty → Broaden filters or change state EXAMPLES: prNumber=123 # FASTEST state="open", limit=5 # Recent state="closed", merged=true, withContent=true # Implementation research author="username", state="closed", merged=true # Expert contributions query="auth", match=["title","body"], limit=3 # Text search queries=[{prNumber:123},{prNumber:456}] # Bulk GUARDS: implementation? - withContent=true | discussion? - withComments=true | production? - merged=true
| Name | Type | Req | Description |
|---|---|---|---|
| queries | array | yes | Research queries for githubSearchPullRequests (1-3 queries per call for optimal resource management). Review schema before use for optimal results |
No output schema declared.
No examples provided.
githubSearchRepositories ~595
REPOSITORY SEARCH - Search repos by keywords/topics PARAMS: See schema for parameter details PURPOSE: Discover GitHub repositories. Gateway for codebase exploration. USE_WHEN: Starting research | Finding projects/libraries AVOID: Know repo name - go to githubViewRepoStructure | Need code patterns - use githubSearchCode WORKFLOW: Step 1: Discover (topicsToSearch or keywordsToSearch) Step 2: Explore (githubViewRepoStructure) Step 3: Search (githubSearchCode) Step 4: Read (githubGetFileContent) STRATEGY: - topicsToSearch: Most precise for curated topic tags - keywordsToSearch: Flexible search across name/desc/README - Always add stars filter for quality (e.g., stars=">1000") OPTIMIZATION: - Start lean: Know exact topic? → topicsToSearch with stars filter (e.g., topicsToSearch=["typescript"], stars=">1000") - Uncertain? → Bulk with variants: topics + keywords in parallel (e.g., [{topicsToSearch:["cli"]}, {keywordsToSearch:["command-line"]}]) - Semantic variants: "auth"→"authentication"/"oauth", "ai"→"machine-learning"/"llm" - Quality: stars=">1000" for production-ready, sort="stars" for popularity GOTCHAS: - topicsToSearch: use popular topics (e.g., "mcp", "react", "nextjs", "langchain") for best results - size filter uses KB not MB ("1000" = 1MB) - No filters = generic, low-quality results NEXT_STEP: hasResults → githubViewRepoStructure or githubSearchCode empty → Try semantic variants or broaden stars filter EXAMPLES: topicsToSearch=["typescript", "cli"], stars=">1000" # BEST: curated quality repos keywordsToSearch=["authentication", "jwt"], stars=">500" # Keyword search with quality owner="facebook", sort="stars", limit=10 # Org's popular repos keywordsToSearch=["react"], match=["name"], stars=">1000" # Name-only search created=">=2024-01-01", sort="updated", limit=5 # Recent active projects queries=[{topicsToSearch:["mcp"]},{keywordsToSearch:["mcp"]}] # Bulk parallel GUARDS: discovery? - topicsToSearch+s…
| Name | Type | Req | Description |
|---|---|---|---|
| queries | array | yes | Research queries for githubSearchRepositories (1-3 queries per call for optimal resource management). Review schema before use for optimal results |
No output schema declared.
No examples provided.
githubViewRepoStructure ~535
DIRECTORY EXPLORER - Understand codebase organization PARAMS: See schema for parameter details PURPOSE: Display directory structure with file sizes USE_WHEN: New codebase | Need structure overview AVOID: Know filename - use githubSearchCode | Need content - use githubGetFileContent WORKFLOW: Step 1: Overview (depth=1, path="") Step 2: Drill down (depth=2, path="src") Step 3: Search (githubSearchCode) Step 4: Read (githubGetFileContent) STRATEGY: - depth=1: Fast overview, see immediate files/folders - depth=2: Deeper view, includes subdirectories (slower) - path="": Start at root, then drill into specific dirs OPTIMIZATION: - Start lean: depth=1 for overview, only go depth=2 if structure unclear - Bulk queries: Explore key directories in parallel (e.g., [{path:"src"}, {path:"tests"}, {path:"docs"}]) - Use for discovery, then githubSearchCode for content GOTCHAS: - depth=2 on dirs with >50 subdirs = slow, stick to depth=1 - path format: "src/api" NOT "/src/api" (no leading slash) - Returns files[] and folders[], no content - Dirs with >100 items: result truncates at 100 → use githubSearchCode with path filter instead NEXT_STEP: hasResults → githubSearchCode or githubGetFileContent empty → Check parent or verify repo EXAMPLES: owner="facebook", repo="react", branch="main", path="", depth=1 # Root overview owner="facebook", repo="react", branch="main", path="src", depth=2 # Deep dive queries=[{owner:"facebook",repo:"react",branch:"main",path:""},{owner:"facebook",repo:"react",branch:"main",path:"src"}] # Bulk owner="facebook", repo="react", branch="main", path="packages/react-dom", depth=1 # Monorepo GUARDS: new? - depth=1, path="" | large? - depth=1 first | monorepo? - explore each package
| Name | Type | Req | Description |
|---|---|---|---|
| queries | array | yes | Research queries for githubViewRepoStructure (1-3 queries per call for optimal resource management). Review schema before use for optimal results |
No output schema declared.
No examples provided.
What is the Octocode MCP - AI Context Platform server?
Octocode MCP - AI Context Platform is listed in the public MCP registry as io.github.bgauryy/octocode-mcp. AI code research platform. Search, analyze, and extract insights from any GitHub repository. This page covers its npm package (octocode-mcp).
Is the Octocode MCP - AI Context Platform server safe to use?
Octocode MCP - AI Context Platform scores 75 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Octocode MCP - AI Context Platform server expose?
Octocode MCP - AI Context Platform exposes 5 tools: githubSearchCode, githubGetFileContent, githubViewRepoStructure, githubSearchRepositories, githubSearchPullRequests. Their descriptions and schemas cost roughly 2,683 tokens of context every time the server is loaded.
Is the Octocode MCP - AI Context Platform server still maintained?
Octocode MCP - AI Context Platform is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Octocode MCP - AI Context Platform server under?
Octocode MCP - AI Context Platform declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.