io.github.Siddhukaushik/slimdex-mcp
NPM · SLIMDEX-MCP · SCANNED SEP 24
Narrow code retrieval for agents: outlines, symbol context, dep graph, persistent memory.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 38 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability75
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3954 tokens (~131/item across 30 items; 30 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
- Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage86
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 59% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "memory_delete" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 31 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.Siddhukaushik/slimdex-mcp server?
io.github.Siddhukaushik/slimdex-mcp runs locally as an npm package, launched with npx -y slimdex-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · slimdex-mcp
claude mcp add siddhukaushik-slimdex-mcp -- npx -y slimdex-mcp
{
"mcpServers": {
"siddhukaushik-slimdex-mcp": {
"command": "npx",
"args": [
"-y",
"slimdex-mcp"
]
}
}
} {
"servers": {
"siddhukaushik-slimdex-mcp": {
"command": "npx",
"args": [
"-y",
"slimdex-mcp"
]
}
}
} codex mcp add siddhukaushik-slimdex-mcp -- npx -y slimdex-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"siddhukaushik-slimdex-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"slimdex-mcp"
],
"enabled": true
}
}
} openclaw mcp add siddhukaushik-slimdex-mcp --command npx --arg -y --arg slimdex-mcp
mcp_servers:
siddhukaushik-slimdex-mcp:
command: "npx"
args: ["-y", "slimdex-mcp"] {
"McpServers": {
"siddhukaushik-slimdex-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"slimdex-mcp"
]
}
}
} assistant mcp add siddhukaushik-slimdex-mcp -t stdio -c npx -a -y slimdex-mcp
{
"mcpServers": {
"siddhukaushik-slimdex-mcp": {
"command": "npx",
"args": [
"-y",
"slimdex-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 23 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 22 Sept 26 −3
- Stability: pass → 0.80 functional
- 21 Sept 26 0
- Stability: 0.97 → pass security
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 −2
- Stability: pass → 0.83 functional
- 15 Sept 26 0
- Stability: 0.97 → pass security
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 24 Sept 2026 · Analysed npm/slimdex-mcp@1.0.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 96 packages
| Packages resolved | 96 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
batch Run several tool calls at once ~60
Execute multiple slimdex calls in one request to avoid per-call protocol overhead. Pass calls: [{ "tool": "find_definition", "args": { "name": "login" } }, ...]. Cannot nest batch inside itself.
| Name | Type | Req | Description |
|---|---|---|---|
| calls | array | yes | – |
No output schema declared.
No examples provided.
brief One-shot session onboarding brief ~110
CALL THIS FIRST in a fresh chat — including on a repo slimdex has never seen, where it builds the index itself rather than sending you to index_repo. One synthesized opener instead of stitching memory_list + recap yourself: what the repo is, where recent sessions were digging (automatic journal), and each saved conclusion CHECKED against the current index so stale ones are flagged (✓ live, ⚠ may be stale).
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Journaled calls to summarize for the focus section (default 200). |
No output schema declared.
No examples provided.
changed_files What changed, and which symbols it touched ~116
Summarize the working-tree diff (or a diff against `base`) as changed files with +added/-deleted counts AND the enclosing functions/classes each hunk lands in — the blast radius, without pulling the patch into context. The cheap way to start a session on a dirty repo. Requires a git checkout.
| Name | Type | Req | Description |
|---|---|---|---|
| base | string | – | Ref to diff against (e.g. 'main', 'HEAD~3'). Omit for working tree vs HEAD. |
| limit | integer | – | Max files to list (default 30). |
No output schema declared.
No examples provided.
context_pack One-call task context bundle ~182
Understand a whole topic in ONE call instead of ~10: give a natural-language query ('how does auth work') and slimdex runs the exploration itself — BM25-ranks the symbols, shows how their files connect (import graph, one hop), includes the top few bodies, all under a char budget. Saves the round-trips AND keeps ten separate results out of the transcript. Orient with this; drop to get_symbol_context / read_lines for exact source.
| Name | Type | Req | Description |
|---|---|---|---|
| bodies | integer | – | How many top symbols to include full bodies for (default 3). |
| budget | integer | – | Soft char cap on the whole pack (default 6000). |
| query | string | yes | The topic to understand, in words — 'how does login work', 'the indexing pipeline'. |
| symbols | integer | – | How many ranked symbols to list (default 8). |
No output schema declared.
No examples provided.
dep_graph Dependency graph query ~137
Query the internal import graph. mode=imports: what a file imports. mode=dependents: what imports it. mode=mermaid: a diagram — pass root (+depth, default 2) to walk outward from one file instead of dumping the whole graph, or scope to a path prefix. Run before refactoring a shared module.
| Name | Type | Req | Description |
|---|---|---|---|
| depth | integer | – | mermaid: import hops to follow from root (default 2). |
| mode | string | yes | – |
| root | string | – | mermaid: start file to walk out from (BFS). |
| scope | string | – | – |
| target | string | – | – |
No output schema declared.
No examples provided.
digest_get Read the repo architecture digest ~66
Return the stored architecture cheat-sheet plus a freshness verdict: covered files that changed since it was written are flagged as reasons it may be out of date. Read it early to understand the system without re-exploring; if flagged stale, re-read the changed areas and digest_save an update.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
digest_save Save the repo architecture digest ~122
Store a compact 'how this repo works' cheat-sheet — modules, flows, entry points, conventions — so future sessions read a page instead of re-exploring. `covers` (the paths it summarizes) lets later sessions be told when a covered file changed. Overwrites the previous one. Save the why and the shape, not a symbol list.
| Name | Type | Req | Description |
|---|---|---|---|
| covers | array | – | Repo-relative paths/dirs this digest summarizes (omit = whole repo). |
| text | string | yes | The digest prose — compact, the architecture and flows, not a file dump. |
No output schema declared.
No examples provided.
find_definition Find where a symbol is defined ~112
Look up a symbol name in the index; return definition site(s) as path:line:col + kind. Heuristic. Paged: the total is always exact, `limit`/`offset` control how many are printed, `pathPrefix` scopes them.
| Name | Type | Req | Description |
|---|---|---|---|
| kind | string | – | – |
| limit | integer | – | Max sites to print (default 50). |
| name | string | yes | – |
| offset | integer | – | – |
| pathPrefix | string | – | Only definitions under this path. |
No output schema declared.
No examples provided.
find_references Find references to a symbol (textual) ~90
Whole-word textual search for a symbol, returned as path:line:col with the enclosing function/class. Counts every occurrence, including repeats on one line. Not scope-aware, so may include unrelated same-named identifiers. Supports pathPrefix, limit and offset.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
| name | string | yes | – |
| offset | integer | – | – |
| pathPrefix | string | – | – |
No output schema declared.
No examples provided.
find_tests Which tests exercise a symbol ~115
Which references to a symbol live in TEST files: 'if I change calculateTax, which tests catch a break' — run exactly those, not the whole suite. Nothing covering it is surfaced as risk BEFORE you edit. Detected by path convention (*.test.*, *.spec.*, __tests__/, test_*.py …) or an indexed describe/it title. Textual, so same caveat as find_references.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
| name | string | yes | – |
| pathPrefix | string | – | – |
No output schema declared.
No examples provided.
get_context One-shot context brief for a symbol ~145
ONE call for what would take several: definition, signature, callers/references (attributed to their enclosing symbol — heuristic), imports, dependents. Sections are OPT-IN via `include` (default definition,signature,callers,imports); add 'body' for full source, 'dependents' for reverse deps. Bounded by callerLimit and maxChars with explicit truncation.
| Name | Type | Req | Description |
|---|---|---|---|
| callerLimit | integer | – | Max callers to list (default 12). |
| include | array | – | Which sections to return. Omit for the default set. |
| maxChars | integer | – | Hard cap on response size (default 12000). |
| name | string | yes | – |
No output schema declared.
No examples provided.
get_file_skeleton File skeleton (bodies elided) ~73
Structural skeleton of a file: every declaration's signature with its indentation preserved and bodies replaced by ' … {line}'. Turns a 2,000-line file into a readable map for a fraction of the tokens. Use this before any full read of a file over ~300 lines.
| Name | Type | Req | Description |
|---|---|---|---|
| path | string | yes | – |
No output schema declared.
No examples provided.
get_symbol_context Surgical symbol snippet(s) ~234
Return ONLY the body of a symbol (function/class/method) plus a few context lines — not the whole file. Give a name (resolved via the index), several `names` at once, or an explicit path+line. This is the biggest per-lookup token saver. When a skeleton showed you WHERE the functions are, pull their bodies with names:[...] here — do NOT fall back to reading the whole file for a handful of bodies.
| Name | Type | Req | Description |
|---|---|---|---|
| after | integer | – | – |
| before | integer | – | – |
| line | integer | – | Definition line (use with path). |
| maxLines | integer | – | Cap each returned span (default 200); tail elided with a notice. |
| name | string | – | Symbol name to resolve via the index. |
| names | array | – | Several symbol names in one call — one bounded body each. The narrow alternative to a whole-file read. |
| path | string | – | File path (use with line instead of name). |
| pathPrefix | string | – | Restrict name resolution to files under this prefix — disambiguates a duplicated name in ONE call. |
No output schema declared.
No examples provided.
index_repo Index / refresh the repository ~89
Build or refresh the persistent code index (symbols + imports). Only files whose mtime changed are re-parsed, so re-run it liberally, like `git fetch`, before trusting a search. Honors <root>/.slimdex.json (ignoreDirs/extensions/exclude/maxFileBytes) and reports config problems instead of ignoring them.
| Name | Type | Req | Description |
|---|---|---|---|
| force | boolean | – | Ignore cache and reparse everything. |
No output schema declared.
No examples provided.
install_hook Install the PreToolUse hook ~198
Wire slimdex's write discipline into the CLIENT, which registering the MCP server cannot do — the protocol has no mechanism for a server to add a hook, so this is the one call that closes the gap. Writes a PreToolUse hook that speaks up ONLY when an edit re-sends 25+ lines that an indexed symbol actually covers, or a whole file over 12KB is read. Merges rather than clobbers, is idempotent, and prints exactly what changed. scope: claude-global (default, all your repos) | claude-local | claude-project | copilot-global (VS Code, all your repos) | copilot-project (.github/hooks, COMMITTED). Use uninstall:true to remove it.
| Name | Type | Req | Description |
|---|---|---|---|
| scope | string | – | Which config to write. Default claude-global; use copilot-global for a VS Code-only setup. |
| uninstall | boolean | – | Remove the hook instead of adding it. |
No output schema declared.
No examples provided.
memory_delete Delete a memory fact ~24
Remove one saved memory fact by its id.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
memory_get Read saved facts in full ~70
Full text of specific facts by id, with the provenance note of what was being examined when each was saved. The expansion half of the preview model: triage cheaply with brief/memory_list, expand only what you need.
| Name | Type | Req | Description |
|---|---|---|---|
| ids | array | yes | Fact ids from memory_list/brief/memory_search. |
No output schema declared.
No examples provided.
memory_list List memory ~89
Saved facts newest-first as PREVIEWS (id, date, tags, opening clause); memory_get ids:[…] expands the ones that matter, full:true dumps everything. Prefer brief as the opener — same previews, staleness-checked.
| Name | Type | Req | Description |
|---|---|---|---|
| full | boolean | – | Whole bodies instead of previews — costly on a large store. |
| limit | integer | – | Max facts (default 50). |
No output schema declared.
No examples provided.
memory_save Persist a memory fact ~48
Save a durable note (decision, gotcha, TODO, location) to <root>/.slimdex/memory.json.
| Name | Type | Req | Description |
|---|---|---|---|
| tags | array | – | – |
| text | string | yes | – |
No output schema declared.
No examples provided.
memory_search Search saved memory ~56
Find saved memory facts by substring and/or tag. Previews by default; memory_get expands one by id.
| Name | Type | Req | Description |
|---|---|---|---|
| full | boolean | – | Whole bodies instead of previews. |
| query | string | – | – |
| tag | string | – | – |
No output schema declared.
No examples provided.
outline_file Outline a file (signatures only) ~34
Compact outline of one file — declarations with line numbers, not the body. Orient before reading.
| Name | Type | Req | Description |
|---|---|---|---|
| path | string | yes | – |
No output schema declared.
No examples provided.
read_lines Read a line range ~55
Read only lines [start..end] (1-indexed, inclusive) of a file. Cheaper than the whole file.
| Name | Type | Req | Description |
|---|---|---|---|
| end | integer | yes | – |
| path | string | yes | – |
| start | integer | yes | – |
No output schema declared.
No examples provided.
recap What previous sessions did (automatic) ~95
Prior activity from the server's own tool-call journal — most-examined files, most-looked-up symbols, recent searches. Needs NO prior memory_save; works even when the last session saved nothing. recap = where sessions looked, memory = what they concluded. Normally use brief (folds both in); reach here for the raw journal.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | How many recent journaled calls to summarize (default 200). |
No output schema declared.
No examples provided.
replace_symbol Replace a symbol's body by name (write) ~487
Write a symbol by NAME — you never re-send the old body to locate the edit. Two modes: REPLACE (name/path+line plus body) overwrites an existing definition; INSERT (after:"X" or before:"X" plus body) adds a NEW symbol next to an existing one, which is what you want for 'add a method beside the related ones' — the anchor's own span comes from the index, so `after` means after its closing brace, not its signature line. Insert puts `body` in verbatim: indent it for the file, and include a leading/trailing newline if you want a blank line. range comes from the index; the file is SNAPSHOTTED first (.slimdex/snapshots), re-indexed after, and the new line span is reported so you don't re-read to verify. Safe to mix with ordinary edit tools: if the file moved under the index, a NAME is re-resolved against a fresh parse automatically (an explicit path+line still refuses, since that coordinate is yours). Ambiguous/unknown names are refused, never guessed. `body` = the complete replacement definition, indented for the file. `edits:[…]` applies several at once (one snapshot, one re-index); the batch is refused before any write if a target is ambiguous, two edits overlap, or a file isn't writable, and a write that fails mid-batch rolls the earlier files back and says so.
| Name | Type | Req | Description |
|---|---|---|---|
| after | string | – | INSERT mode: add `body` as a NEW symbol immediately after this existing symbol's closing brace. Pin which occurrence with path + line when the name repeats inside one file (normal for CSS). |
| before | string | – | INSERT mode: add `body` as a NEW symbol immediately before this existing symbol. |
| body | string | – | The complete new definition, replacing the old one verbatim. |
| edits | array | – | Several replacements, applied atomically. Each entry takes name, or path+line, plus body. |
| line | integer | – | Definition line (use with path). |
| name | string | – | Symbol to replace, resolved via the index. |
| path | string | – | File path (use with line instead of name). |
| pathPrefix | string | – | Disambiguate the after/before anchor when the name exists in several files. |
No output schema declared.
No examples provided.
repo_map High-level repo map ~115
Birds-eye overview: top directories with file counts, total lines, and symbol counts. Pass `path` to drill into one directory and list its largest files (with `top` to cap the list) — the bridge between orienting at the directory level and picking a file to skeleton. Start every session here.
| Name | Type | Req | Description |
|---|---|---|---|
| depth | integer | – | – |
| path | string | – | Drill into this directory and list files instead of directories. |
| top | integer | – | With `path`: how many files to list (default 20). |
No output schema declared.
No examples provided.
search_code Compact code search ~182
Search indexed files; return path:line:col + the matching line (+ optional caret highlight). Every occurrence on a line counts, and the reported total is exact unless the scan cap trips (then it says so). Page with limit and either offset or the opaque cursor from a previous call. Vendor/build dirs are already excluded. Use pathPrefix to scope; for symbols prefer find_definition/find_references.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | Opaque token from a previous call's 'next cursor' to fetch the next page. |
| highlight | boolean | – | – |
| ignoreCase | boolean | – | – |
| limit | integer | – | Max matches to return (default 20). |
| offset | integer | – | Skip this many matches. Ignored if cursor is given. |
| pathPrefix | string | – | – |
| pattern | string | yes | – |
| regex | boolean | – | – |
No output schema declared.
No examples provided.
search_intent Find code by intent (BM25, no embeddings) ~119
Know WHAT the code does but not its name: a words query ranked over every indexed symbol by BM25 on tokenized names (camelCase/snake_case), kinds and filenames — 'validate user email' surfaces validateEmail / emailValidator. Matches WORDING, not meaning. Exact/partial name → search_symbols; literal string → search_code.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Top matches to return (default 10). |
| query | string | yes | What the code does, in words — 'parse the config file', 'retry a failed request'. |
No output schema declared.
No examples provided.
search_symbols Fuzzy symbol name search ~116
Find indexed symbols whose name matches a query, ranked exact > prefix > substring > subsequence. Use this when you half-remember a name ("something like handleAuth") — it reads only the index, never the files, so it is far cheaper and far less noisy than search_code for finding a declaration.
| Name | Type | Req | Description |
|---|---|---|---|
| kind | string | – | Filter by kind: function, class, method, interface, type, … |
| limit | integer | – | Default 25. |
| pathPrefix | string | – | – |
| query | string | yes | – |
No output schema declared.
No examples provided.
snapshot Snapshot uncommitted work ~66
Copy every uncommitted file into .slimdex/snapshots/<timestamp>/ as insurance against accidental resets. Also runs automatically (at most hourly) when index_repo sees a dirty tree; newest 10 kept. Defeats a stray `git checkout .`; does NOT replace committing.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
stats Tool usage and response-size accounting ~194
Per-tool call counts and response sizes recorded to <root>/.slimdex/stats.json. Reported in characters, not tokens — char/4 estimates are unreliable across tokenizers, so this measures what it can measure honestly. Use it to see which tool is actually producing your context, and to tune limits. Counters are CUMULATIVE across every session on this repo until reset. To measure ONE task: call checkpoint:true when you start, then session:true when you finish — the server is long-lived, so session:true alone means 'since the server booted', which can span several chats.
| Name | Type | Req | Description |
|---|---|---|---|
| checkpoint | boolean | – | Zero the session tally only (all-time history untouched). Call at the start of a task. |
| reset | boolean | – | Clear ALL counters, including the repo's all-time history. |
| session | boolean | – | Report what this process recorded since it started, or since the last checkpoint. |
No output schema declared.
No examples provided.
What is the io.github.Siddhukaushik/slimdex-mcp server?
io.github.Siddhukaushik/slimdex-mcp is listed in the public MCP registry as io.github.Siddhukaushik/slimdex-mcp. Narrow code retrieval for agents: outlines, symbol context, dep graph, persistent memory. This page covers its npm package (slimdex-mcp).
Is the io.github.Siddhukaushik/slimdex-mcp server safe to use?
io.github.Siddhukaushik/slimdex-mcp scores 79 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 24 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.Siddhukaushik/slimdex-mcp server expose?
io.github.Siddhukaushik/slimdex-mcp exposes 30 tools: index_repo, snapshot, outline_file, read_lines, search_code, and 25 more. Their descriptions and schemas cost roughly 3,599 tokens of context every time the server is loaded.
Is the io.github.Siddhukaushik/slimdex-mcp server still maintained?
io.github.Siddhukaushik/slimdex-mcp is still listed as active in the MCP registry. We last reached this channel on 24 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.Siddhukaushik/slimdex-mcp server under?
io.github.Siddhukaushik/slimdex-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.