Labsco
MCP SERVER

Octocode MCP

by bgauryy ↗

Research code across GitHub and your own disk — search and read files, walk PRs and issues, follow commit ranges, and jump through a language server — with every byte scanned for secrets first.

Code Intelligence & Repository Indexing
Summary
Everything the model reads is scanned for secrets on the way in and on the way out.

That is the unusual claim here and it is specific: over 300 provider credential patterns plus JWTs, private keys, bearer tokens, connection strings and high-entropy strings, applied to local reads and GitHub and npm responses alike — with masked values surfacing a warning so the agent knows something was removed.

What it is

An agentic research platform that works as both an MCP server and a CLI. GitHub search and read tools come on by default; local filesystem tools, repository cloning and LSP navigation are switched on by flags.

What you get
  • GitHub: `ghSearchCode` (up to 5 parallel queries), `ghGetFileContent` for a whole file or a line range, `ghViewRepoStructure`, `ghSearchRepos`, `ghSearchPullRequests` with deep-read of files, patches, comments and reviews, `ghSearchIssues`, and `ghSearchCommits` which also compares two refs
  • Opt-in GitHub tools: `ghListReleases`, `ghSearchDiscussions` and `ghCloneRepo` for sparse local checkouts
  • Local: `localSearchCode` with a structural AST mode, `localViewStructure`, `localFindFiles`, `localGetFileContent`, and `localFindDeadCode` for likely-unreferenced exports found by whole-repository reachability analysis
  • `npmSearch` for package lookup that returns the source repository, which is the handoff back into the GitHub tools
  • `lspGetSemantics` for typed navigation — definition, references, callers, callees, call hierarchy, hover, document symbols, type definition, implementation, workspace symbol, supertypes, subtypes and diagnostics
  • Token knobs on nearly everything: `concise:true` returns path and title only, and `minify` sets file-read density to `symbols`, `standard` or `none`
Requirements

GitHub-backed tools need authentication, and any one method is enough: `npx octocode auth login` for browser OAuth with credentials stored encrypted on disk, an existing `gh auth login` token which is read automatically, or a personal access token in `OCTOCODE_TOKEN`, `GH_TOKEN` or `GITHUB_TOKEN` with the `repo`, `read:user` and `read:org` scopes. How many tools register depends on the surface: 8 on MCP with no flags, 14 with `ENABLE_LOCAL=true`, 15 adding `ENABLE_CLONE=true`, and 17 once `ENABLE_TOOLS` allowlists the two opt-in GitHub tools — those two need both their own flag and the allowlist, because either alone leaves them unregistered. The CLI registers 15 by default and 17 with the two extra flags. Local reads are bounded to the engine's allowed roots, symlinks are resolved and re-validated against them, and known secret-bearing files return a redacted error rather than contents.

Setup effort

One command plus a key — npx octocode install --ide cursor, then supply credentials