Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.Siddhukaushik/slimdex-mcp

NPM · SLIMDEX-MCP · SCANNED SEP 24

Narrow code retrieval for agents: outlines, symbol context, dep graph, persistent memory.

Available components

0 this week 79 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 31 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability75
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 3954 tokens (~131/item across 30 items; 30 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
  • Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage86
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 59% of tool parameters carry a description.Partial
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "memory_delete" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 31 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the io.github.Siddhukaushik/slimdex-mcp server?

io.github.Siddhukaushik/slimdex-mcp runs locally as an npm package, launched with npx -y slimdex-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · slimdex-mcp

# add to Claude Code
claude mcp add siddhukaushik-slimdex-mcp -- npx -y slimdex-mcp
// .cursor/mcp.json
{
  "mcpServers": {
    "siddhukaushik-slimdex-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "slimdex-mcp"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "siddhukaushik-slimdex-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "slimdex-mcp"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add siddhukaushik-slimdex-mcp -- npx -y slimdex-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "siddhukaushik-slimdex-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "slimdex-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add siddhukaushik-slimdex-mcp --command npx --arg -y --arg slimdex-mcp
# ~/.hermes/config.yaml
mcp_servers:
  siddhukaushik-slimdex-mcp:
    command: "npx"
    args: ["-y", "slimdex-mcp"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "siddhukaushik-slimdex-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "slimdex-mcp"
      ]
    }
  }
}
# add to Vellum
assistant mcp add siddhukaushik-slimdex-mcp -t stdio -c npx -a -y slimdex-mcp
// mcp.json
{
  "mcpServers": {
    "siddhukaushik-slimdex-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "slimdex-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 23 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.

  • 22 Sept 26 −3
    • Stability: pass → 0.80 functional
  • 21 Sept 26 0
    • Stability: 0.97 → pass security
  • 20 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 18 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.

  • 16 Sept 26 −2
    • Stability: pass → 0.83 functional
  • 15 Sept 26 0
    • Stability: 0.97 → pass security
  • 14 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 24 Sept 2026 · Analysed npm/slimdex-mcp@1.0.1

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 96 packages
Packages resolved 96
Stale 31
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 30 exposed · ~3,599 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
batch ~60

Execute multiple slimdex calls in one request to avoid per-call protocol overhead. Pass calls: [{ "tool": "find_definition", "args": { "name": "login" } }, ...]. Cannot nest batch inside itself.

NameTypeReqDescription
callsarrayyes–

No output schema declared.

No examples provided.

brief ~110

CALL THIS FIRST in a fresh chat — including on a repo slimdex has never seen, where it builds the index itself rather than sending you to index_repo. One synthesized opener instead of stitching memory_list + recap yourself: what the repo is, where recent sessions were digging (automatic journal), and each saved conclusion CHECKED against the current index so stale ones are flagged (✓ live, ⚠ may be stale).

NameTypeReqDescription
limitinteger–Journaled calls to summarize for the focus section (default 200).

No output schema declared.

No examples provided.

changed_files ~116

Summarize the working-tree diff (or a diff against `base`) as changed files with +added/-deleted counts AND the enclosing functions/classes each hunk lands in — the blast radius, without pulling the patch into context. The cheap way to start a session on a dirty repo. Requires a git checkout.

NameTypeReqDescription
basestring–Ref to diff against (e.g. 'main', 'HEAD~3'). Omit for working tree vs HEAD.
limitinteger–Max files to list (default 30).

No output schema declared.

No examples provided.

context_pack ~182

Understand a whole topic in ONE call instead of ~10: give a natural-language query ('how does auth work') and slimdex runs the exploration itself — BM25-ranks the symbols, shows how their files connect (import graph, one hop), includes the top few bodies, all under a char budget. Saves the round-trips AND keeps ten separate results out of the transcript. Orient with this; drop to get_symbol_context / read_lines for exact source.

NameTypeReqDescription
bodiesinteger–How many top symbols to include full bodies for (default 3).
budgetinteger–Soft char cap on the whole pack (default 6000).
querystringyesThe topic to understand, in words — 'how does login work', 'the indexing pipeline'.
symbolsinteger–How many ranked symbols to list (default 8).

No output schema declared.

No examples provided.

dep_graph ~137

Query the internal import graph. mode=imports: what a file imports. mode=dependents: what imports it. mode=mermaid: a diagram — pass root (+depth, default 2) to walk outward from one file instead of dumping the whole graph, or scope to a path prefix. Run before refactoring a shared module.

NameTypeReqDescription
depthinteger–mermaid: import hops to follow from root (default 2).
modestringyes–
rootstring–mermaid: start file to walk out from (BFS).
scopestring––
targetstring––

No output schema declared.

No examples provided.

digest_get ~66

Return the stored architecture cheat-sheet plus a freshness verdict: covered files that changed since it was written are flagged as reasons it may be out of date. Read it early to understand the system without re-exploring; if flagged stale, re-read the changed areas and digest_save an update.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

digest_save ~122

Store a compact 'how this repo works' cheat-sheet — modules, flows, entry points, conventions — so future sessions read a page instead of re-exploring. `covers` (the paths it summarizes) lets later sessions be told when a covered file changed. Overwrites the previous one. Save the why and the shape, not a symbol list.

NameTypeReqDescription
coversarray–Repo-relative paths/dirs this digest summarizes (omit = whole repo).
textstringyesThe digest prose — compact, the architecture and flows, not a file dump.

No output schema declared.

No examples provided.

find_definition ~112

Look up a symbol name in the index; return definition site(s) as path:line:col + kind. Heuristic. Paged: the total is always exact, `limit`/`offset` control how many are printed, `pathPrefix` scopes them.

NameTypeReqDescription
kindstring––
limitinteger–Max sites to print (default 50).
namestringyes–
offsetinteger––
pathPrefixstring–Only definitions under this path.

No output schema declared.

No examples provided.

find_references ~90

Whole-word textual search for a symbol, returned as path:line:col with the enclosing function/class. Counts every occurrence, including repeats on one line. Not scope-aware, so may include unrelated same-named identifiers. Supports pathPrefix, limit and offset.

NameTypeReqDescription
limitinteger––
namestringyes–
offsetinteger––
pathPrefixstring––

No output schema declared.

No examples provided.

find_tests ~115

Which references to a symbol live in TEST files: 'if I change calculateTax, which tests catch a break' — run exactly those, not the whole suite. Nothing covering it is surfaced as risk BEFORE you edit. Detected by path convention (*.test.*, *.spec.*, __tests__/, test_*.py …) or an indexed describe/it title. Textual, so same caveat as find_references.

NameTypeReqDescription
limitinteger––
namestringyes–
pathPrefixstring––

No output schema declared.

No examples provided.

get_context ~145

ONE call for what would take several: definition, signature, callers/references (attributed to their enclosing symbol — heuristic), imports, dependents. Sections are OPT-IN via `include` (default definition,signature,callers,imports); add 'body' for full source, 'dependents' for reverse deps. Bounded by callerLimit and maxChars with explicit truncation.

NameTypeReqDescription
callerLimitinteger–Max callers to list (default 12).
includearray–Which sections to return. Omit for the default set.
maxCharsinteger–Hard cap on response size (default 12000).
namestringyes–

No output schema declared.

No examples provided.

get_file_skeleton ~73

Structural skeleton of a file: every declaration's signature with its indentation preserved and bodies replaced by ' … {line}'. Turns a 2,000-line file into a readable map for a fraction of the tokens. Use this before any full read of a file over ~300 lines.

NameTypeReqDescription
pathstringyes–

No output schema declared.

No examples provided.

get_symbol_context ~234

Return ONLY the body of a symbol (function/class/method) plus a few context lines — not the whole file. Give a name (resolved via the index), several `names` at once, or an explicit path+line. This is the biggest per-lookup token saver. When a skeleton showed you WHERE the functions are, pull their bodies with names:[...] here — do NOT fall back to reading the whole file for a handful of bodies.

NameTypeReqDescription
afterinteger––
beforeinteger––
lineinteger–Definition line (use with path).
maxLinesinteger–Cap each returned span (default 200); tail elided with a notice.
namestring–Symbol name to resolve via the index.
namesarray–Several symbol names in one call — one bounded body each. The narrow alternative to a whole-file read.
pathstring–File path (use with line instead of name).
pathPrefixstring–Restrict name resolution to files under this prefix — disambiguates a duplicated name in ONE call.

No output schema declared.

No examples provided.

index_repo ~89

Build or refresh the persistent code index (symbols + imports). Only files whose mtime changed are re-parsed, so re-run it liberally, like `git fetch`, before trusting a search. Honors <root>/.slimdex.json (ignoreDirs/extensions/exclude/maxFileBytes) and reports config problems instead of ignoring them.

NameTypeReqDescription
forceboolean–Ignore cache and reparse everything.

No output schema declared.

No examples provided.

install_hook ~198

Wire slimdex's write discipline into the CLIENT, which registering the MCP server cannot do — the protocol has no mechanism for a server to add a hook, so this is the one call that closes the gap. Writes a PreToolUse hook that speaks up ONLY when an edit re-sends 25+ lines that an indexed symbol actually covers, or a whole file over 12KB is read. Merges rather than clobbers, is idempotent, and prints exactly what changed. scope: claude-global (default, all your repos) | claude-local | claude-project | copilot-global (VS Code, all your repos) | copilot-project (.github/hooks, COMMITTED). Use uninstall:true to remove it.

NameTypeReqDescription
scopestring–Which config to write. Default claude-global; use copilot-global for a VS Code-only setup.
uninstallboolean–Remove the hook instead of adding it.

No output schema declared.

No examples provided.

memory_delete ~24

Remove one saved memory fact by its id.

NameTypeReqDescription
idstringyes–

No output schema declared.

No examples provided.

memory_get ~70

Full text of specific facts by id, with the provenance note of what was being examined when each was saved. The expansion half of the preview model: triage cheaply with brief/memory_list, expand only what you need.

NameTypeReqDescription
idsarrayyesFact ids from memory_list/brief/memory_search.

No output schema declared.

No examples provided.

memory_list ~89

Saved facts newest-first as PREVIEWS (id, date, tags, opening clause); memory_get ids:[…] expands the ones that matter, full:true dumps everything. Prefer brief as the opener — same previews, staleness-checked.

NameTypeReqDescription
fullboolean–Whole bodies instead of previews — costly on a large store.
limitinteger–Max facts (default 50).

No output schema declared.

No examples provided.

memory_save ~48

Save a durable note (decision, gotcha, TODO, location) to <root>/.slimdex/memory.json.

NameTypeReqDescription
tagsarray––
textstringyes–

No output schema declared.

No examples provided.

memory_search ~56

Find saved memory facts by substring and/or tag. Previews by default; memory_get expands one by id.

NameTypeReqDescription
fullboolean–Whole bodies instead of previews.
querystring––
tagstring––

No output schema declared.

No examples provided.

outline_file ~34

Compact outline of one file — declarations with line numbers, not the body. Orient before reading.

NameTypeReqDescription
pathstringyes–

No output schema declared.

No examples provided.

read_lines ~55

Read only lines [start..end] (1-indexed, inclusive) of a file. Cheaper than the whole file.

NameTypeReqDescription
endintegeryes–
pathstringyes–
startintegeryes–

No output schema declared.

No examples provided.

recap ~95

Prior activity from the server's own tool-call journal — most-examined files, most-looked-up symbols, recent searches. Needs NO prior memory_save; works even when the last session saved nothing. recap = where sessions looked, memory = what they concluded. Normally use brief (folds both in); reach here for the raw journal.

NameTypeReqDescription
limitinteger–How many recent journaled calls to summarize (default 200).

No output schema declared.

No examples provided.

replace_symbol ~487

Write a symbol by NAME — you never re-send the old body to locate the edit. Two modes: REPLACE (name/path+line plus body) overwrites an existing definition; INSERT (after:"X" or before:"X" plus body) adds a NEW symbol next to an existing one, which is what you want for 'add a method beside the related ones' — the anchor's own span comes from the index, so `after` means after its closing brace, not its signature line. Insert puts `body` in verbatim: indent it for the file, and include a leading/trailing newline if you want a blank line. range comes from the index; the file is SNAPSHOTTED first (.slimdex/snapshots), re-indexed after, and the new line span is reported so you don't re-read to verify. Safe to mix with ordinary edit tools: if the file moved under the index, a NAME is re-resolved against a fresh parse automatically (an explicit path+line still refuses, since that coordinate is yours). Ambiguous/unknown names are refused, never guessed. `body` = the complete replacement definition, indented for the file. `edits:[…]` applies several at once (one snapshot, one re-index); the batch is refused before any write if a target is ambiguous, two edits overlap, or a file isn't writable, and a write that fails mid-batch rolls the earlier files back and says so.

NameTypeReqDescription
afterstring–INSERT mode: add `body` as a NEW symbol immediately after this existing symbol's closing brace. Pin which occurrence with path + line when the name repeats inside one file (normal for CSS).
beforestring–INSERT mode: add `body` as a NEW symbol immediately before this existing symbol.
bodystring–The complete new definition, replacing the old one verbatim.
editsarray–Several replacements, applied atomically. Each entry takes name, or path+line, plus body.
lineinteger–Definition line (use with path).
namestring–Symbol to replace, resolved via the index.
pathstring–File path (use with line instead of name).
pathPrefixstring–Disambiguate the after/before anchor when the name exists in several files.

No output schema declared.

No examples provided.

repo_map ~115

Birds-eye overview: top directories with file counts, total lines, and symbol counts. Pass `path` to drill into one directory and list its largest files (with `top` to cap the list) — the bridge between orienting at the directory level and picking a file to skeleton. Start every session here.

NameTypeReqDescription
depthinteger––
pathstring–Drill into this directory and list files instead of directories.
topinteger–With `path`: how many files to list (default 20).

No output schema declared.

No examples provided.

search_code ~182

Search indexed files; return path:line:col + the matching line (+ optional caret highlight). Every occurrence on a line counts, and the reported total is exact unless the scan cap trips (then it says so). Page with limit and either offset or the opaque cursor from a previous call. Vendor/build dirs are already excluded. Use pathPrefix to scope; for symbols prefer find_definition/find_references.

NameTypeReqDescription
cursorstring–Opaque token from a previous call's 'next cursor' to fetch the next page.
highlightboolean––
ignoreCaseboolean––
limitinteger–Max matches to return (default 20).
offsetinteger–Skip this many matches. Ignored if cursor is given.
pathPrefixstring––
patternstringyes–
regexboolean––

No output schema declared.

No examples provided.

search_intent ~119

Know WHAT the code does but not its name: a words query ranked over every indexed symbol by BM25 on tokenized names (camelCase/snake_case), kinds and filenames — 'validate user email' surfaces validateEmail / emailValidator. Matches WORDING, not meaning. Exact/partial name → search_symbols; literal string → search_code.

NameTypeReqDescription
limitinteger–Top matches to return (default 10).
querystringyesWhat the code does, in words — 'parse the config file', 'retry a failed request'.

No output schema declared.

No examples provided.

search_symbols ~116

Find indexed symbols whose name matches a query, ranked exact > prefix > substring > subsequence. Use this when you half-remember a name ("something like handleAuth") — it reads only the index, never the files, so it is far cheaper and far less noisy than search_code for finding a declaration.

NameTypeReqDescription
kindstring–Filter by kind: function, class, method, interface, type, …
limitinteger–Default 25.
pathPrefixstring––
querystringyes–

No output schema declared.

No examples provided.

snapshot ~66

Copy every uncommitted file into .slimdex/snapshots/<timestamp>/ as insurance against accidental resets. Also runs automatically (at most hourly) when index_repo sees a dirty tree; newest 10 kept. Defeats a stray `git checkout .`; does NOT replace committing.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

stats ~194

Per-tool call counts and response sizes recorded to <root>/.slimdex/stats.json. Reported in characters, not tokens — char/4 estimates are unreliable across tokenizers, so this measures what it can measure honestly. Use it to see which tool is actually producing your context, and to tune limits. Counters are CUMULATIVE across every session on this repo until reset. To measure ONE task: call checkpoint:true when you start, then session:true when you finish — the server is long-lived, so session:true alone means 'since the server booted', which can span several chats.

NameTypeReqDescription
checkpointboolean–Zero the session tally only (all-time history untouched). Call at the start of a task.
resetboolean–Clear ALL counters, including the repo's all-time history.
sessionboolean–Report what this process recorded since it started, or since the last checkpoint.

No output schema declared.

No examples provided.

Common questions

What is the io.github.Siddhukaushik/slimdex-mcp server?

io.github.Siddhukaushik/slimdex-mcp is listed in the public MCP registry as io.github.Siddhukaushik/slimdex-mcp. Narrow code retrieval for agents: outlines, symbol context, dep graph, persistent memory. This page covers its npm package (slimdex-mcp).

Is the io.github.Siddhukaushik/slimdex-mcp server safe to use?

io.github.Siddhukaushik/slimdex-mcp scores 79 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 24 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.Siddhukaushik/slimdex-mcp server expose?

io.github.Siddhukaushik/slimdex-mcp exposes 30 tools: index_repo, snapshot, outline_file, read_lines, search_code, and 25 more. Their descriptions and schemas cost roughly 3,599 tokens of context every time the server is loaded.

Is the io.github.Siddhukaushik/slimdex-mcp server still maintained?

io.github.Siddhukaushik/slimdex-mcp is still listed as active in the MCP registry. We last reached this channel on 24 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.Siddhukaushik/slimdex-mcp server under?

io.github.Siddhukaushik/slimdex-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.