agentic_web_crawl
Fetch any URL and extract page content and SEO signals: title, meta description, Open Graph tags, canonical URL, robots directives, heading structure, word count, and link breakdown.
LABSCO SUMMARY
Reads your code locally, and asks before it writes to GitHub.
The split is what makes it usable: analysis, secret scanning and dependency auditing happen on the filesystem with no token at all, while anything that changes a repository — a pull request, an issue — returns a preview first and only executes when the same call is repeated with confirmation. Credentials go into the OS keyring through one setup call rather than sitting in a JSON config, which also means the same token works across every client on the machine.
What it is
A single server covering the jobs an agent needs around a codebase — local git and static analysis, GitHub reads and writes, vulnerability data, and process and log inspection — with credentials kept in the operating system keyring rather than in a config file.
What you get
- Local git history read directly from the repository — authors, frequency, recent changes and commit patterns, filtered by date range or author
- Python static analysis that flags unused imports, likely bugs, style violations and high-complexity functions without executing anything
- A secret and PII scan over local source: API keys, tokens, passwords and private keys, emails, SSNs and card numbers, plus missing .gitignore protections
- A dependency audit against the OSV vulnerability database covering Python, JavaScript, Go, Java and C++ manifests, reporting CVEs and outdated versions
- Code search by pattern across a local directory or a remote GitHub repository
- GitHub reads: a repository's metadata and structure, and any file at a given path and ref
- GitHub writes behind a confirmation step — pull requests opened and issues created, updated, closed or triaged, each returning a preview until you call it again with confirmed=true
- GitHub security data: code scanning alerts from CodeQL, Semgrep or another SAST tool, and Dependabot alerts with CVE id, severity, affected package and fix version
- Web work: any URL fetched with its title, meta description, Open Graph tags, canonical URL, robots directives, heading structure and link breakdown, and search through a SearXNG instance you run
- Local operations: whether a named service or port is up with its PID, and the last N lines of a log file with a filter applied
- A search over the server's own tools by keyword, tag or module, returning which connector each one needs
Requirements
Python 3.12 or newer; pip install agentic-store-mcp, then run agentic-store-mcp over stdio. Nothing is needed for the local tools — git history, linting, secret scanning and dependency audit read the filesystem. GitHub tokens are optional for public repositories and required for private ones; opening pull requests and managing issues needs repo scope, and the security alert tools need security_events or repo. Tokens are stored once through the configure tool into the system keyring and persist across sessions and clients. Web search needs a SearXNG instance running locally via docker compose. A bundled local web UI, started with agentic-store-webapp at http://localhost:8765, holds the connector keys and decides which tools are exposed to the client. MIT.
Setup effort
One command — pip install agentic-store-mcp --upgrade
USE CASES
01
Checking a repository for leaked secrets before it goes public
Scan source files for keys, tokens, passwords and personal data, and find out whether .gitignore is actually covering what it should.
02
Finding out what is vulnerable in your dependencies
Audit the manifests against OSV for known CVEs and outdated versions, then read GitHub's own Dependabot alerts for the fix versions it already found.
03
Reviewing Python before it goes to a human
Static analysis flags unused imports, likely bugs and functions that have grown too complex — nothing is executed to find them.
04
Opening a pull request from the assistant
The first call returns a preview of the pull request; a second call with confirmation actually opens it, so an agent cannot push a change you have not read.
05
Getting oriented in an unfamiliar repository
Read the repo's structure, language and contributors, pull a specific file by path, and look at who has been committing lately.
06
Debugging a dev server that just died
Check whether the process or port is actually up, then read the tail of its log file with a filter for the error you are chasing.
07
Researching without sending queries to a search vendor
Point it at your own SearXNG instance for results, then fetch a page and pull out its structure and SEO signals.
17 tools
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
agentic_web_search
Search the web using a self-hosted SearXNG instance. Returns ranked results with title, URL, and snippet. Requires SearXNG running locally (docker compose up -d).
analyze_commits
Analyzes local git commit history — authors, frequency, recent changes, and commit patterns. No API key required; reads directly from the local git repository. Use when: user asks about who committed what, recent changes, commit history, activity patterns, or wants to understand how a local repo has evolved. Scope: local git repository only — no network access. Run git commands via subprocess. Not for: remote GitHub repo metadata (use get_repo_info), fetching remote files (use get_file), or searching code patterns (use search_code).
code_scanning_alerts
Retrieves GitHub code scanning alerts (SARIF findings) for a repository — results from tools like CodeQL, Semgrep, or other SAST tools integrated via GitHub Actions. Requires GitHub connector token with 'security_events' or 'repo' scope. Use when: user asks about code scanning results, CodeQL findings, SARIF alerts, or GitHub Actions security scan results on a remote repo. Scope: remote GitHub API only — requires GITHUB_TOKEN. Not for: local secret scanning (use repo_scanner), Dependabot package vulnerabilities (use dependabot_alerts), or local dependency auditing (use dependency_audit).
configure
Sets, retrieves, or removes API tokens for any service connector using the system keyring. Run once per service — credentials persist across sessions and MCP clients. Use when: user needs to save a GitHub token, OpenAI key, or any other API credential for use by other tools. Scope: local machine keyring (or ~/.config/agentic-store/tokens.json fallback on headless systems). Not for: listing available tools (use tool_search) or testing if a connection works (use the webapp connector test).
create_pr
Opens a pull request in a GitHub repository. Always returns a preview first — call with confirmed=false (default) to review, then confirmed=true to execute. Requires GitHub connector token with 'repo' scope. Use when: user wants to open a pull request to merge a branch into a target branch. Scope: remote GitHub API — write operation, requires token. Not for: creating issues (use manage_issue), pushing commits (use local git), or reviewing existing PRs (use get_repo_info).
dependabot_alerts
Retrieves Dependabot vulnerability alerts for a GitHub repository. Shows CVE IDs, severity, affected package, and available fix versions. Requires GitHub connector with a token that has 'security_events' or 'repo' scope. Use when: user asks about Dependabot alerts, GitHub security tab findings, vulnerable dependencies in a remote GitHub repo. Scope: remote GitHub API only — requires GITHUB_TOKEN. Not for local project scanning. Not for: scanning a local project for vulnerable deps (use dependency_audit), local secret scanning (use repo_scanner), or GitHub code scanning SARIF findings (use code_scanning_alerts).
dependency_audit
Checks third-party packages for known CVEs and outdated versions using the OSV vulnerability database. Supports Python (requirements.txt, pyproject.toml, Pipfile), JavaScript (package.json), Go (go.mod), Java (pom.xml, build.gradle), and C++ (conanfile, vcpkg.json). No API key required. Use when: user asks about vulnerable packages, CVEs, supply chain risk, or outdated dependencies. Scope: local project directory — reads dependency files on disk. Not for: secrets leaked in source code (use repo_scanner), code quality issues (use python_lint_checker), or GitHub Dependabot alerts from a remote repo (use dependabot_alerts).
get_file
Fetches the content of a specific file from a GitHub repository. Token optional for public repos; required for private repos. Use when: user wants to read a known file from a GitHub repo by its path — e.g. 'show me the README', 'get the handler.py from owner/repo'. Scope: remote GitHub file fetch only. Requires knowing the exact file path. Not for: searching for files by pattern (use search_code), local file reading (use standard file tools), or repo structure overview (use get_repo_info).
get_repo_info
Fetches metadata and structure of a GitHub repository — description, language, stars, forks, branches, topics, and top contributors. Token optional for public repos. Use when: user asks for an overview of a GitHub repo, wants to understand its structure, or needs branch/contributor information. Scope: remote GitHub API. Token optional for public repos, required for private repos. Not for: fetching file contents (use get_file), searching code (use search_code), or analyzing local git history (use analyze_commits).
list_processes
Checks whether specific services are currently running on the local machine — by process name or port. Returns running status, PID, and port for Docker, Redis, Postgres, Node, and any named service. Use when: you need to verify a dev server, database, or container runtime is up before running commands or tests. Scope: local machine only. Reads /proc or uses pgrep/lsof — no network calls. Not for: reading log output (use tail_system_logs), starting or stopping services, or checking remote hosts.
manage_issue
Creates, updates, closes, or triages issues in a GitHub repository. Always returns a preview first — call with confirmed=false (default) to review, then confirmed=true to execute. Requires GitHub connector token with 'repo' scope. Use when: user wants to create a bug report, update an issue title/body, add labels, assign someone, or close an issue on GitHub. Scope: remote GitHub API — write operation, requires token. Not for: creating pull requests (use create_pr), reading issue lists (use get_repo_info), or local git operations.
python_lint_checker
Static analysis for Python files — detects unused imports, likely bugs, style violations, and high-complexity functions. No code is executed. Use when: user asks to lint, review, check quality, or find bugs in Python code. Scope: Python files only (.py). Local files — no network access. Not for: other languages, package vulnerabilities (use dependency_audit), or secrets in files (use repo_scanner).
repo_scanner
Scans local source files for leaked secrets (API keys, tokens, passwords, private keys), PII (emails, SSNs, credit cards), and missing .gitignore protections. Works on any language — scans file content, not package metadata. Use when: user asks about hardcoded credentials, leaked tokens, .env exposure, or PII in source files. Scope: local directory — no network access, no GitHub API. Not for: package vulnerabilities (use dependency_audit), code quality issues (use python_lint_checker), or GitHub code scanning findings from a remote repo (use code_scanning_alerts).
search_code
Searches for code patterns across files in a local directory or a remote GitHub repository. Local mode requires no token; GitHub mode uses the GitHub connector (optional for public repos). Use when: user wants to find where a function, class, variable, or pattern is used across a codebase — locally or on GitHub. Scope: local directory walk (no token) OR GitHub code search API (token optional for public repos). Not for: fetching a specific known file (use get_file), analyzing commit history (use analyze_commits), or finding security issues (use repo_scanner).
tail_system_logs
Reads the last N lines of a local log file — ideal for debugging runtime errors from dev servers, npm run dev, uvicorn, or any process that writes to a file. Use when: a process errored and you need to see recent log output, you're tailing a dev server log, or you want to check system/application logs without leaving the agent session. Scope: local filesystem only. Read-only. Any file the current user can read. Not for: streaming live log output (returns a snapshot), checking if a process is running (use list_processes), or reading structured log files as JSON (returns raw lines).
tool_search
Searches the available MCP tools by keyword, tag, or module. Returns tool names, descriptions, connector requirements, and capability tags. Useful for discovering which tool to use for a task. Use when: user asks what tools are available, which tool handles a specific task, or which tools require API keys. Scope: reads the local tool registry — no network access. Not for: executing tools (call the tool directly), configuring credentials (use configure), or managing MCP client config (use the webapp).
BEFORE YOU INSTALL
What to know first
Tools you get
17 tools when we connected; the project documents 31. The 14 memory tools, such as memory_write and token_optimizer, are the ones not exposed. Which tools load is set in the MCP Hub GUI or through environment variables; agentic-store-mcp --list shows the current set.
INSTALLATION
Connect your client
Server setup
TERMINAL
pip install agentic-store-mcp --upgradeMCP Clients
Claude Desktop, Cursor, Windsurf
JSON
{
"mcpServers": {
"agentic-store-mcp": {
"command": "agentic-store-mcp",
"args": []
}
}
}VS Code
VS CODE · JSON
{
"servers": {
"agentic-store-mcp": {
"command": "agentic-store-mcp",
"args": []
}
}
}Claude Code
CLAUDE CODE · TERMINAL
claude mcp add agentic-store-mcp "agentic-store-mcp"
