io.github.giancarloerra/socraticode
NPM · SOCRATICODE · SCANNED SEP 21
MCP server for enterprise local codebase indexing, semantic search, and code dependency graphs.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 63 of 200 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (AGPL-3.0-only).Pass
- Actively maintained (last published 4 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability82
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 2621 tokens (~100/item across 26 items; 26 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
- Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "codebase_remove" implies "remove" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 26 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.giancarloerra/socraticode MCP server?
io.github.giancarloerra/socraticode runs locally as an npm package, launched with npx -y socraticode. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · socraticode
claude mcp add giancarloerra-socraticode -- npx -y socraticode
{
"mcpServers": {
"giancarloerra-socraticode": {
"command": "npx",
"args": [
"-y",
"socraticode"
]
}
}
} {
"servers": {
"giancarloerra-socraticode": {
"command": "npx",
"args": [
"-y",
"socraticode"
]
}
}
} codex mcp add giancarloerra-socraticode -- npx -y socraticode
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"giancarloerra-socraticode": {
"type": "local",
"command": [
"npx",
"-y",
"socraticode"
],
"enabled": true
}
}
} openclaw mcp add giancarloerra-socraticode --command npx --arg -y --arg socraticode
mcp_servers:
giancarloerra-socraticode:
command: "npx"
args: ["-y", "socraticode"] {
"McpServers": {
"giancarloerra-socraticode": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"socraticode"
]
}
}
} assistant mcp add giancarloerra-socraticode -t stdio -c npx -a -y socraticode
{
"mcpServers": {
"giancarloerra-socraticode": {
"command": "npx",
"args": [
"-y",
"socraticode"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 21 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 20 Sept 26 −3
- Stability: pass → 0.80 functional
- 19 Sept 26 0
- Stability: 0.97 → pass security
- 18 Sept 26 +1
- Package version: 1.0.1 → 1.14.0 functional
- 17 Sept 26 +15
- Malware scan: unverified → pass ▲ security
- 16 Sept 26 −14
- Stability: 0.87 → unverified ▼ security
- Malware scan: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. functional
- Package version: 1.13.3 → 1.14.0 functional
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 −3
- Stability: pass → 0.80 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Analysed npm/socraticode@1.14.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 200 packages
| Packages resolved | 200 |
|---|---|
| Deprecated | 1 |
| Stale | 45 |
| No linked repository | 17 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
codebase_about ~44
Display information about SocratiCode — what it is, its tools and how to use it. Use this to get a quick overview of the MCP tools and their purpose.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
codebase_context ~88
List all context artifacts defined in .socraticodecontextartifacts.json — database schemas, API specs, infra configs, architecture docs, etc. Shows each artifact's name, description, path, and index status. Use this to discover what project knowledge is available beyond source code.
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | – | Absolute path to the project directory. If omitted, uses the current working directory. |
No output schema declared.
No examples provided.
codebase_context_index ~71
Index or re-index all context artifacts defined in .socraticodecontextartifacts.json. Chunks and embeds artifact content into the vector database for semantic search. Usually not needed — codebase_context_search auto-indexes on first use.
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | – | Absolute path to the project directory. |
No output schema declared.
No examples provided.
codebase_context_remove ~58
Remove all indexed context artifacts for a project from the vector database. Blocked while indexing is in progress — use codebase_stop or wait for the operation to finish first.
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | yes | Absolute path to the project directory. |
No output schema declared.
No examples provided.
codebase_context_search ~202
Semantic search across context artifacts (database schemas, API specs, infra configs, etc.) defined in .socraticodecontextartifacts.json. Auto-indexes on first use and auto-detects stale artifacts. Use this to find relevant infrastructure or domain knowledge.
| Name | Type | Req | Description |
|---|---|---|---|
| artifactName | string | – | Filter search to a specific artifact by name (e.g. 'database-schema'). Omit to search across all artifacts. |
| limit | number | – | Maximum number of results to return. Default: 10. |
| minScore | number | – | Minimum RRF score threshold (0-1). Results below this are filtered out. Default: 0.10 (override globally via SEARCH_MIN_SCORE env var). Set to 0 to disable filtering. |
| projectPath | string | – | Absolute path to the project directory. |
| query | string | yes | Natural language search query (e.g. 'tables related to billing', 'authentication endpoints', 'deployment resource limits'). |
No output schema declared.
No examples provided.
codebase_flow ~140
Trace the EXECUTION FLOW forward from an entry point — what does this code call into? With NO args, returns a ranked list of auto-detected entry points (orphans with outgoing calls, conventional names like main(), framework routes, tests). With an entrypoint argument, returns the call tree.
| Name | Type | Req | Description |
|---|---|---|---|
| depth | number | – | Maximum DFS depth (default 5, max 10). |
| entrypoint | string | – | Symbol name to trace from. Omit to list auto-detected entry points. |
| file | string | – | Optional file hint to disambiguate the symbol. |
| projectPath | string | – | Absolute path to the project directory. |
No output schema declared.
No examples provided.
codebase_graph_build ~120
Build a dependency graph of the codebase using static analysis (ast-grep). Maps import/require/export relationships between files. Runs in the background — call codebase_graph_status to poll progress until complete.
| Name | Type | Req | Description |
|---|---|---|---|
| extraExtensions | string | – | Comma-separated list of additional file extensions to include in the graph (e.g. '.tpl,.blade'). Files with non-standard extensions are included as leaf nodes (dependency targets). Can also be set gl… |
| projectPath | string | – | Absolute path to the project directory. |
No output schema declared.
No examples provided.
codebase_graph_circular ~33
Find circular dependencies in the codebase.
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | – | Absolute path to the project directory. |
No output schema declared.
No examples provided.
codebase_graph_query ~69
Query the code dependency graph for a specific file. Returns what the file imports and what files depend on it.
| Name | Type | Req | Description |
|---|---|---|---|
| filePath | string | yes | Relative path of the file to query (e.g. 'src/index.ts'). |
| projectPath | string | – | Absolute path to the project directory. |
No output schema declared.
No examples provided.
codebase_graph_remove ~65
Remove a project's persisted code graph. Waits for any in-flight graph build to finish first. The graph can be rebuilt with codebase_graph_build or will be rebuilt automatically on the next codebase_index.
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | yes | Absolute path to the project directory. |
No output schema declared.
No examples provided.
codebase_graph_stats ~47
Get statistics about the code dependency graph: total files, edges, most connected files, orphan files, circular dependencies.
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | – | Absolute path to the project directory. |
No output schema declared.
No examples provided.
codebase_graph_status ~68
Check the status of the code dependency graph: build progress (if building), node/edge count, when it was last built, whether it's cached in memory. Use this to poll progress after calling codebase_graph_build.
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | – | Absolute path to the project directory. |
No output schema declared.
No examples provided.
codebase_graph_visualize ~281
Visualise the code dependency graph. Two modes: • mode="mermaid" (default) — returns a Mermaid diagram (text) colour-coded by language, circular deps highlighted. Best for inline rendering inside chat, GitHub, or editors that render Mermaid. • mode="interactive" — writes a self-contained HTML page (vendored Cytoscape.js + Dagre, works offline) and opens it in the user's default browser. Shows the file graph and, when a symbol graph is available and fits, a Symbols toggle with the symbol-level call graph. Interactions: click node for sidebar with imports/dependents/symbols list; right-click node to highlight its blast radius (reverse-transitive closure); live search; layout switcher (Dagre / force / concentric / breadth-first / grid / circle); PNG export. Use this when the user asks for a visual/interactive view, wants to explore visually, or needs a shareable diagram.
| Name | Type | Req | Description |
|---|---|---|---|
| mode | string | – | "mermaid" (default — text diagram) or "interactive" (browser-based explorer). |
| open | boolean | – | In interactive mode, whether to auto-open the browser. Default true. Set false to just get the file path (useful in headless environments). |
| projectPath | string | – | Absolute path to the project directory. |
No output schema declared.
No examples provided.
codebase_health ~37
Check the health of all infrastructure: Docker, Qdrant container, Ollama, and embedding model. Use this to diagnose setup issues.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
codebase_impact ~192
Impact Analysis — return the BLAST RADIUS for a file or symbol. Lists every file (and, where helpful, function) that could break if you change the target. Polymorphic on target: a path-like string ('src/foo.ts') triggers file-mode; a name-like string ('validateUser') triggers symbol-mode. Use this BEFORE refactoring, renaming, or deleting code to know what depends on it.
| Name | Type | Req | Description |
|---|---|---|---|
| depth | number | – | How many hops back to walk (default 3, max 10). |
| file | string | – | Optional file path to disambiguate the target symbol. |
| projectPath | string | – | Absolute path to the project directory. |
| symbolId | string | – | Exact symbol ID (e.g. 'src/foo.ts::validateUser#10') to disambiguate. |
| target | string | – | Target file path (relative) OR symbol name. |
No output schema declared.
No examples provided.
codebase_index ~126
Start indexing a codebase in the background. Returns immediately. Call codebase_status to poll progress until 100%. Do NOT search until indexing is complete. If already indexing, returns current progress.
| Name | Type | Req | Description |
|---|---|---|---|
| extraExtensions | string | – | Comma-separated list of additional file extensions to index beyond the built-in set (e.g. '.tpl,.blade,.hbs'). Useful for projects with non-standard file extensions. Can also be set globally via EXTR… |
| projectPath | string | – | Absolute path to the project directory. If omitted, uses the current working directory. |
No output schema declared.
No examples provided.
codebase_list_projects ~25
List all projects that have been indexed (have collections in Qdrant).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
codebase_prune ~158
Inventory stored project identities and their resources. Report-only by default. Applying requires an exact identity, the confirmation token from a fresh inventory, and an acknowledgement that no other host is writing to it; path absence on this host is advisory, not proof of abandonment.
| Name | Type | Req | Description |
|---|---|---|---|
| acknowledgeNoRemoteWriters | boolean | – | Required with apply. Locks on this host cannot see another host sharing the same Qdrant; true states that none is writing to this identity. |
| apply | boolean | – | Delete the selected identity only when true. Omit for the report-only inventory. |
| confirmationToken | string | – | Opaque token returned for that identity by codebase_prune. |
| identity | string | – | Exact identity returned by codebase_prune. |
No output schema declared.
No examples provided.
codebase_remove ~64
Remove a project's codebase index entirely from the vector database. Safely stops the file watcher, cancels any in-progress indexing/update (with drain), and waits for any in-flight graph build before deleting.
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | yes | Absolute path to the project directory. |
No output schema declared.
No examples provided.
codebase_search ~245
Semantic search across an indexed codebase. Only use after codebase_index is complete (check codebase_status first). Returns relevant code chunks matching a natural language query.
| Name | Type | Req | Description |
|---|---|---|---|
| fileFilter | string | – | Filter results to a specific file path (relative). |
| includeLinked | boolean | – | When true, also search across linked projects defined in .socraticode.json or SOCRATICODE_LINKED_PROJECTS env var. Results include a project label showing which project each result came from. Default… |
| languageFilter | string | – | Filter results to a specific language (e.g. 'typescript', 'python'). |
| limit | number | – | Maximum number of results to return. Default: 10 (override globally via SEARCH_DEFAULT_LIMIT env var). |
| minScore | number | – | Minimum RRF score threshold (0-1). Results below this are filtered out. Default: 0.10 (override globally via SEARCH_MIN_SCORE env var). Set to 0 to disable filtering. |
| projectPath | string | – | Absolute path to the project directory. |
| query | string | yes | Natural language search query (e.g. 'authentication middleware', 'database connection setup'). |
No output schema declared.
No examples provided.
codebase_status ~55
Check index status: chunk count, indexing progress (%), last completed operation, file watcher state. Call after codebase_index to poll until 100% complete.
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | – | Absolute path to the project directory. |
No output schema declared.
No examples provided.
codebase_stop ~66
Gracefully stop an in-progress indexing operation. The current batch will finish and checkpoint, preserving all progress. Re-run codebase_index to resume from where it left off.
| Name | Type | Req | Description |
|---|---|---|---|
| projectPath | string | – | Absolute path to the project directory. If omitted, uses the current working directory. |
No output schema declared.
No examples provided.
codebase_symbol ~90
360° view of a symbol: definition, kind, callers, callees, confidence levels. Use to understand a function or class before changing it.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | – | Optional file hint to disambiguate when the name is not unique. |
| name | string | yes | Symbol name (e.g. 'validateUser'). |
| projectPath | string | – | Absolute path to the project directory. |
No output schema declared.
No examples provided.
codebase_symbols ~99
List symbols in a file, or search by name across the project. Use to discover what exists before drilling into a single symbol with codebase_symbol.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | – | Relative file path — list all symbols in this file. |
| limit | number | – | Maximum results (default 200). |
| projectPath | string | – | Absolute path to the project directory. |
| query | string | – | Substring to match against symbol names project-wide. |
No output schema declared.
No examples provided.
codebase_update ~87
Incrementally update an existing codebase index. Only re-indexes changed files. Runs synchronously. Use it to refresh a manual/off snapshot, or whenever an immediate catch-up is needed.
| Name | Type | Req | Description |
|---|---|---|---|
| extraExtensions | string | – | Comma-separated list of additional file extensions to index (e.g. '.tpl,.blade'). |
| projectPath | string | – | Absolute path to the project directory. |
No output schema declared.
No examples provided.
codebase_watch ~91
Start/stop watching a project directory for file changes and automatically update the index. When starting, first runs an incremental update to catch up, then watches for changes. SOCRATICODE_WATCHER=manual allows explicit starts only; off rejects starts.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | start/stop watching, or get status of watchers. |
| projectPath | string | – | Absolute path to the project directory. |
No output schema declared.
No examples provided.
What is the io.github.giancarloerra/socraticode MCP server?
io.github.giancarloerra/socraticode is an MCP server listed in the public MCP registry as io.github.giancarloerra/socraticode. MCP server for enterprise local codebase indexing, semantic search, and code dependency graphs. This page covers its npm package (socraticode).
Is the io.github.giancarloerra/socraticode MCP server safe to use?
io.github.giancarloerra/socraticode scores 82 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.giancarloerra/socraticode MCP server expose?
io.github.giancarloerra/socraticode exposes 26 tools: codebase_index, codebase_update, codebase_remove, codebase_prune, codebase_stop, and 21 more. Their descriptions and schemas cost roughly 2,621 tokens of context every time the server is loaded.
Is the io.github.giancarloerra/socraticode MCP server still maintained?
io.github.giancarloerra/socraticode is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.giancarloerra/socraticode MCP server under?
io.github.giancarloerra/socraticode declares the AGPL-3.0-only licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.