
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
kiri-mcp-server
Advanced tools
Intelligent code context extraction for LLMs via Model Context Protocol
KIRI is an MCP server that provides intelligent code context extraction from Git repositories. It indexes your codebase into DuckDB and exposes semantic search tools for LLMs.
npm install -g kiri-mcp-server
Or use npx without installation.
Edit ~/.claude/mcp.json:
{
"mcpServers": {
"kiri": {
"command": "kiri",
"args": ["--repo", ".", "--db", ".kiri/index.duckdb", "--watch"]
}
}
}
KIRI automatically indexes your repository on first startup.
Other MCP clients: See Setup Guide for Codex CLI and other configurations.
| Tool | Purpose | Example |
|---|---|---|
context_bundle | Find relevant code for a task | goal: "auth token refresh bug" |
files_search | Search files by keywords | query: "handler" |
snippets_get | Read specific code sections | path: "src/server/handlers.ts" |
deps_closure | Analyze dependencies | direction: "inbound" |
semantic_rerank | Refine search results | candidates: [...] |
Full documentation: Tools Reference
| Language | Extensions | Parser |
|---|---|---|
| TypeScript | .ts, .tsx | TypeScript Compiler API |
| Swift | .swift | tree-sitter-swift |
| PHP | .php | tree-sitter-php |
| Java | .java | tree-sitter-java |
| Dart | .dart | Dart Analysis Server |
| Rust | .rs | tree-sitter-rust |
Other languages are indexed but use full-file snippets instead of symbol extraction.
# Delete and rebuild
rm -rf .kiri/
# Restart MCP client - KIRI will automatically reindex
{
"env": { "KIRI_DAEMON_READY_TIMEOUT": "480" }
}
rm -f .kiri/index.duckdb.sock.lock
pkill -f "kiri.*daemon"
More issues: See full troubleshooting guide below.
git clone https://github.com/CAPHTECH/kiri.git
cd kiri
pnpm install
pnpm run build
pnpm run test
pnpm run dev # HTTP server on :8765
Guidelines: See AGENTS.md for development standards.
| Document | Description |
|---|---|
| Setup Guide | Installation and MCP client configuration |
| Tools Reference | Complete MCP tools documentation |
| Configuration | Environment variables and advanced settings |
| Architecture | System design and data flow |
| Data Model | Database schema details |
| Search & Ranking | Search algorithms |
| API Reference | Complete API documentation |
| Authoring Docs | Writing metadata-rich documentation |
See CHANGELOG.md for release notes.
Recent highlights:
Problem: "Daemon did not become ready within X seconds"
Solutions:
KIRI_DAEMON_READY_TIMEOUT=480, Codex CLI: startup_timeout_sec = 480)cat .kiri/index.duckdb.daemon.logkiri --repo . --db .kiri/index.duckdb --port 8765# Verify installation
npm list -g kiri-mcp-server
# Re-link
npm link kiri-mcp-server
# Or use npx
npx kiri-mcp-server@latest --repo . --db .kiri/index.duckdb
git ls-files | wc -l.gitignore.kiri/denylist.yml:patterns:
- "**/*.min.js"
- "**/vendor/**"
# Use pnpm link, not npm link
rm -rf node_modules pnpm-lock.yaml
pnpm install --frozen-lockfile
pnpm rebuild duckdb
pnpm run build
pnpm link --global
pkill -f "kiri.*daemon"
rm -f .kiri/index.duckdb.sock.lock .kiri/index.duckdb.sock
kiri --repo . --db .kiri/index.duckdb --full
.kiri/index.duckdb.daemon.logDEBUG=kiri:*MIT License - See LICENSE.
Built with Model Context Protocol, DuckDB, and tree-sitter.
Status: v0.25.6 (Beta) - Production-ready for MCP clients
FAQs
KIRI context extraction platform
We found that kiri-mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.