
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@winci/local-rag
Advanced tools
Semantic search for your codebase — local-first RAG MCP server with hybrid search, AST-aware chunking, and usage analytics
Persistent project memory for AI coding agents. One command to set up, nothing to maintain.
Your agent starts every session blind — it guesses filenames, greps for keywords, burns context reading irrelevant files, and forgets everything you discussed yesterday. On a real project, that meant 380K tokens per prompt and 12-second response times. After indexing with local-rag: 91K tokens, 3 seconds.
No API keys. No cloud. No Docker. Just bun and SQLite.
Find code by meaning, not filename.
"Where do we handle authentication errors?" doesn't map to any symbol name — but local-rag finds middleware/session-guard.ts anyway. Hybrid vector + BM25 search, boosted by dependency graph centrality. 100% recall across codebases up to 8.7K files.
Remember past sessions. Conversation transcripts are indexed in real time. Three days later, your agent can search for "why did we switch to JWT?" and get the exact discussion — no re-explaining.
Know what changed since last time.
git_context shows uncommitted changes and recent commits in one call, so agents don't propose edits that conflict with in-progress work.
Leave notes for future sessions.
annotate attaches persistent caveats to files or symbols — "known race condition", "blocked on auth rewrite" — that surface automatically in search results.
Mark decisions, not just code. Checkpoints capture milestones, direction changes, and blockers. Searchable across sessions so context doesn't evaporate.
Understand codebase structure.
Dependency graphs, reverse-dependency lookups, and find_usages show the blast radius before any refactor.
Generate a project wiki.
generate_wiki produces a structured, cross-linked markdown wiki — architecture docs, module pages, entity pages, guides, and Mermaid diagrams — all built from the semantic index. Supports incremental updates when source files change.
Expose documentation gaps. Analytics log every query locally — nothing leaves your machine. Zero-result and low-relevance queries reveal what's missing from your docs.
Works with any MCP-compatible agent or IDE. The init command auto-configures Claude Code, Cursor, Windsurf, JetBrains (Junie), and Copilot — but you can point any MCP client at the server manually.
Apple's bundled SQLite doesn't support extensions:
brew install sqlite
bunx @winci/local-rag init --ide claude # or: cursor, windsurf, copilot, jetbrains, all
This creates the MCP server config, editor rules, .rag/config.json, and .gitignore entry. Run with --ide all to set up every supported editor at once.
bunx @winci/local-rag demo
For deeper integration, local-rag is also available as a Claude Code plugin. In a Claude Code session:
/plugin marketplace add https://github.com/TheWinci/local-rag.git
/plugin install local-rag
The plugin adds SessionStart (context summary), PostToolUse (auto-reindex on edit), and SessionEnd (auto-checkpoint) hooks. No CLAUDE.md instructions needed — the plugin's built-in skill handles tool usage.
Benchmarked on four codebases with known expected files per query. Full details in BENCHMARKS.md.
| Codebase | Language | Files | Queries | Recall@10 | MRR | Zero-miss |
|---|---|---|---|---|---|---|
| local-rag (this project) | TypeScript | 97 | 20 | 100.0% | 0.651 | 0.0% |
| Express.js | JavaScript | 161 | 15 | 100.0% | 0.922 | 0.0% |
| Excalidraw | TypeScript | 676 | 20 | 100.0% | 0.366 | 0.0% |
| Kubernetes | Go | 8,691 | 20 | 100.0%* | 0.496 | 0.0%* |
*With config tuning. At default top-10, Recall is 80%. See BENCHMARKS.md for details.
Parse & chunk — Splits content using type-matched strategies: function/class boundaries for code (via tree-sitter across 24 languages), headings for markdown, top-level keys for YAML/JSON. Chunks that exceed the embedding model's token limit are windowed and merged.
Embed — Each chunk becomes a 384-dimensional vector using all-MiniLM-L6-v2 (in-process via Transformers.js + ONNX, no API calls). Vectors are stored in sqlite-vec.
Build dependency graph — Import specifiers and exported symbols are captured during AST chunking, then resolved to build a file-level dependency graph.
Hybrid search — Queries run vector similarity and BM25 in parallel, blended by configurable weight. Results are boosted by dependency graph centrality and path heuristics. read_relevant returns individual chunks with entity names and exact line ranges (path:start-end).
Watch & re-index — File changes are detected with a 2-second debounce. Changed files are re-indexed; deleted files are pruned.
Conversation & checkpoints — Tails Claude Code's JSONL transcripts in real time. Agents can create checkpoints at important moments for future sessions to search.
Annotations — Notes attached to files or symbols surface as [NOTE] blocks inline in read_relevant results.
Analytics — Every query is logged. Analytics surface zero-result queries, low-relevance queries, and period-over-period trends.
AST-aware chunking via bun-chunk with tree-sitter grammars:
TypeScript/JavaScript, Python, Go, Rust, Java, C, C++, C#, Ruby, PHP, Scala, Kotlin, Lua, Zig, Elixir, Haskell, OCaml, Dart, Bash/Zsh, TOML, YAML, HTML, CSS/SCSS/LESS
Also indexes: Markdown, JSON, XML, SQL, GraphQL, Protobuf, Terraform, Dockerfiles, Makefiles, and more. Files without a known extension fall back to paragraph splitting.
| Layer | Choice |
|---|---|
| Runtime | Bun (built-in SQLite, fast TS) |
| AST chunking | bun-chunk — tree-sitter grammars for 24 languages |
| Embeddings | Transformers.js + ONNX (in-process, no daemon) |
| Embedding model | all-MiniLM-L6-v2 (~23MB, 384 dimensions) — configurable |
| Vector store | sqlite-vec (single .db file) |
| MCP | @modelcontextprotocol/sdk (stdio transport) |
| Plugin | Claude Code plugin with skills + hooks |
All data lives in .rag/ inside your project — add it to .gitignore.
FAQs
Semantic search for your codebase — local-first RAG MCP server with hybrid search, AST-aware chunking, and usage analytics
The npm package @winci/local-rag receives a total of 0 weekly downloads. As such, @winci/local-rag popularity was classified as not popular.
We found that @winci/local-rag demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.