
Threat Research
/Security News
Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.
@vymalo/lightbridge-code-intelligence-mcp
Advanced tools
Local-first MCP server giving coding agents repository-aware semantic and structural code retrieval.
A local-first Model Context Protocol server that gives coding agents repository-aware semantic and structural code retrieval. Index a checkout once, then ask it to find a symbol, walk callers and callees, explore a symbol's neighborhood, or search code by meaning.
Everything runs in one local process launched over stdio by the MCP host. There is no server to deploy, no daemon left running, and no database to install — the index is a single SQLite file in your user data directory. The only outbound network call the tool ever makes is to an optional embeddings endpoint, and only when semantic search needs one.
There is nothing to install first — point your host at the package with npx, passing --stdio and
the repository to index:
{
"mcpServers": {
"lci": {
"command": "npx",
"args": [
"-y",
"@vymalo/lightbridge-code-intelligence-mcp",
"--stdio",
"--root",
"/path/to/your/repo"
]
}
}
}
Then call lci_index once. Structural queries work as soon as it returns.
Requires Node.js 24 or newer. The Rust engine ships as a prebuilt native addon in
@vymalo/lightbridge-code-intelligence-native,
fetched automatically. Prebuilt binaries currently cover Linux x64 (glibc) and
Linux arm64 (glibc).
To avoid re-resolving the package on every launch, install it and use the binary as the command:
npm install -g @vymalo/lightbridge-code-intelligence-mcp
{
"mcpServers": {
"lci": {
"command": "lightbridge-code-intelligence-mcp",
"args": ["--stdio", "--root", "/path/to/your/repo"]
}
}
}
An MCP host launched from a desktop environment does not always inherit the PATH your shell has,
so if the host reports that the command cannot be found, give the absolute path that
which lightbridge-code-intelligence-mcp prints.
| Tool | What it does |
|---|---|
lci_index | Indexes or reindexes the repository. Returns once structural extraction completes; embeddings, if configured, keep building in the background. Never destroys the previously active index on failure. |
lci_index_status | Index lifecycle, freshness and statistics — state, whether it is usable, indexed vs current HEAD, and file/chunk/node/edge counts. |
lci_find_symbol | Finds structural symbols by name, label or path substring, case-insensitively. |
lci_get_callers | Direct callers of a node id — reverse call-graph edges. |
lci_get_callees | Direct callees of a node id — forward call-graph edges. |
lci_explore_symbol | A symbol's immediate neighborhood: nearby nodes and the call edges among them, out to a given caller/callee depth. |
lci_search | Semantic search over the index. Returns ranked chunks with source locations and node ids for follow-up structural exploration. Requires an embeddings endpoint. |
lci_find_symbol is the usual entry point: it returns node ids that the three graph tools take.
Semantic search needs an OpenAI-compatible embeddings endpoint. Without one the other six tools work
normally and lci_search reports that it is unavailable.
lightbridge-code-intelligence-mcp --stdio \
--root /path/to/repo \
--embedding-base-url https://your-endpoint/v1 \
--embedding-model text-embedding-3-small
Or in ~/.config/lci/config.json:
{
"embedding": {
"baseUrl": "https://your-endpoint/v1",
"model": "text-embedding-3-small",
"dimensions": 1536,
"auth": { "apiKey": "..." }
}
}
Rather than storing a key, embedding.auth.helper can name a command that prints headers on stdout,
which is re-run when the endpoint rejects the cached credentials.
Sources are merged lowest to highest precedence:
built-in defaults → ~/.config/lci/config.json → --config → LCI_CONFIG_CONTENT → --config-json → CLI flags
lightbridge-code-intelligence-mcp config show prints the resolved configuration with credentials
redacted, along with the repository identity and the database path it will use.
| Flag | Meaning |
|---|---|
--stdio | Start the MCP server on stdio (required to actually serve) |
--root <path> | Repository root to index (default: current directory) |
--config <path> | Load a JSON config file |
--config-json <json> | Inline JSON config, merged over --config |
--log-level <level> | error, warn, info, debug, trace (default: info) |
--embedding-base-url <url> | OpenAI-compatible embeddings endpoint; unset disables embeddings |
--embedding-model <name> | Embedding model name |
--embedding-dimensions <n> | Expected embedding vector size |
--database <path> | Override the SQLite database path |
By default {{dataDir}}/lci-mcp/{{repoKey}}/index.sqlite — your platform data directory, keyed by a
hash of the repository, so several checkouts never collide. --database overrides it.
The server refuses to index a root that resolves to a home directory or a filesystem root; pass
--root at a specific repository instead.
FAQs
Local-first MCP server giving coding agents repository-aware semantic and structural code retrieval.
We found that @vymalo/lightbridge-code-intelligence-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Threat Research
/Security News
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.

Threat Research
Malicious Firefox extensions mimic Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys, with one fetching its payload remotely.

Product
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.