bgauryy Octocode MCP server

• Searches GitHub code, repos and trees

  Finds code, repositories or a repository's file tree on GitHub. One call can carry up to five parallel searches, and each picks its type with an operation field.

  Try: “Find repos that implement an OAuth device flow in Go.”

  Network · ghSearch

• Reads a file from GitHub

  Reads a GitHub file as a whole, a line range, matching slices around a string, or in pages. It strips comments and blanks by default to save tokens.

  Try: “Show me lines 40 to 120 of src/auth.ts in vercel/next.js.”

  Network · ghGetFileContent

• Searches PRs, issues and commits

  Lists or searches pull requests, issues or commits in a repo, one operation per query.

  Try: “Find merged PRs that touched the auth middleware in this repo.”

  Network · ghSearchHistory

• Reads one PR, issue, commit or comparison

  Returns one pull request, issue or commit in detail, or compares two refs with ahead and behind counts.

  Try: “Show PR 4821 with its changed files and review comments.”

  Network · ghGetHistoryItem

• Finds npm packages and their repos

  Looks up npm packages by keyword and returns metadata plus the source repository so the assistant can move on to GitHub.

  Try: “Which npm package parses cron expressions, and where is its repo?”

  Network · npmSearch

• Searches your local code

  Searches your files by text, code structure, file names or directory tree. Matches come back with paths and line numbers.

  Try: “Find where authenticate is defined in this project.”

  Files · localSearch

• Reads a local file

  Reads a local file as an exact slice, a matching string, a line range or in pages, within the folders it is allowed to read.

  Try: “Show me the first 80 lines of src/server.ts.”

  Files · localGetFileContent

• Maps file dependencies

  Analyzes how files depend on each other, and reports paths, circular dependencies and candidates for dead code.

  Try: “Are there circular imports in this project?”

  Files · localAnalyzeGraph

• Navigates code like an editor

  Uses language servers for definitions, references, callers, callees, hover info, symbols and type checks.

  Try: “Find all callers of handleLogin.”

  Runs code · lspGetSemantics

Watch out for

• It can read files across your home folder

  Local reads are bounded to your home folder by default, not just the open project. Known secret files such as .env and .aws are blocked, and content is scanned for secrets. ALLOWED_PATHS only adds folders on top of home; the only documented way to shut local reads off is ENABLE_LOCAL=false (or DISABLE_TOOLS for single tools). github.com

• A GitHub token may unlock private repos

  The token scopes the README lists are repo, read:user and read:org. Use a fine-grained token limited to the repos you want researched. github.com

• It reuses your GitHub CLI login

  With no token set, it calls `gh auth token` and uses what the GitHub CLI holds. Sign out of gh or set a token if you do not want that. github.com

• It keeps a cache on disk

  API responses, sessions and cloned files go under ~/.octocode/tmp by default. Set OCTOCODE_STORAGE_MODE=memory to avoid persistent storage. github.com

• Cloning repositories is opt-in

  ghCloneRepo and directory fetches stay off until you set ENABLE_CLONE=true. They write a local copy of a repo. github.com

Security advisories