ghSearchCodeLABSCO SUMMARY
Everything the model reads is scanned for secrets on the way in and on the way out.
That is the unusual claim here and it is specific: over 300 provider credential patterns plus JWTs, private keys, bearer tokens, connection strings and high-entropy strings, applied to local reads and GitHub and npm responses alike — with masked values surfacing a warning so the agent knows something was removed.
What it is
An agentic research platform that works as both an MCP server and a CLI. GitHub search and read tools come on by default; local filesystem tools, repository cloning and LSP navigation are switched on by flags.
What you get
- GitHub:
ghSearchCode(up to 5 parallel queries),ghGetFileContentfor a whole file or a line range,ghViewRepoStructure,ghSearchRepos,ghSearchPullRequestswith deep-read of files, patches, comments and reviews,ghSearchIssues, andghSearchCommitswhich also compares two refs - Opt-in GitHub tools:
ghListReleases,ghSearchDiscussionsandghCloneRepofor sparse local checkouts - Local:
localSearchCodewith a structural AST mode,localViewStructure,localFindFiles,localGetFileContent, andlocalFindDeadCodefor likely-unreferenced exports found by whole-repository reachability analysis npmSearchfor package lookup that returns the source repository, which is the handoff back into the GitHub toolslspGetSemanticsfor typed navigation — definition, references, callers, callees, call hierarchy, hover, document symbols, type definition, implementation, workspace symbol, supertypes, subtypes and diagnostics- Token knobs on nearly everything:
concise:truereturns path and title only, andminifysets file-read density tosymbols,standardornone
Requirements
GitHub-backed tools need authentication, and any one method is enough: npx octocode auth login for browser OAuth with credentials stored encrypted on disk, an existing gh auth login token which is read automatically, or a personal access token in OCTOCODE_TOKEN, GH_TOKEN or GITHUB_TOKEN with the repo, read:user and read:org scopes. How many tools register depends on the surface: 8 on MCP with no flags, 14 with ENABLE_LOCAL=true, 15 adding ENABLE_CLONE=true, and 17 once ENABLE_TOOLS allowlists the two opt-in GitHub tools — those two need both their own flag and the allowlist, because either alone leaves them unregistered. The CLI registers 15 by default and 17 with the two extra flags. Local reads are bounded to the engine's allowed roots, symlinks are resolved and re-validated against them, and known secret-bearing files return a redacted error rather than contents.
Setup effort
One command plus a key — npx octocode install --ide cursor, then supply credentials
USE CASES
01
Understanding how someone else solved a problem
Search code across GitHub by owner, path, filename and extension — up to five queries in parallel — then read only the region of the file that matched.
02
Reviewing a pull request you did not write
Deep-read one PR: its files, patches, comments, reviews and commits, rather than reconstructing the discussion from the diff.
03
Navigating your own codebase semantically
Callers, callees, call hierarchy and type definitions come from installed language servers, so the answer is what the compiler thinks rather than what a regex found.
04
Finding code nobody calls anymore
Whole-repository reachability analysis surfaces likely-unreferenced exports and dead-code clusters, optionally anchored to the entrypoints you name.
05
Keeping a research session inside the context budget
Ask for concise listings when you only need paths, and set file reads to a symbol skeleton rather than full text until you know which file matters.
06
Going from a package name to its source
npm lookup returns the repository, which is the handoff into code search and file reads on the real implementation.
17 tools
Listed in project docs. Your client may show a different list.
ghGetFileContentghViewRepoStructureghSearchReposghSearchPullRequestsghSearchIssuesghSearchCommitsghListReleasesghSearchDiscussionsghCloneRepolocalSearchCodelocalViewStructurelocalFindFileslocalFindDeadCodelocalGetFileContentnpmSearchlspGetSemanticsBEFORE YOU INSTALL
What to know first
Tools you get
17 tools named in the project's documentation.
Requires
- npx on PATH
- OCTOCODE_TOKEN in your environment
- GH_TOKEN in your environment
- GITHUB_TOKEN in your environment
INSTALLATION
Connect your client
Server setup
TERMINAL
npx octocode install --ide cursorMCP Clients
Cursor
CURSOR · JSON
{
"mcpServers": {
"octocode": {
"command": "npx",
"args": [
"-y",
"octocode-mcp@latest"
]
}
}
}The configuration on this page does not set OCTOCODE_TOKEN, GH_TOKEN and GITHUB_TOKEN; the project's instructions set them with an export line. That line reaches only programs started from the same terminal, so to supply them, start your client or the server from that terminal.
VS Code
VS CODE · TERMINAL
npx octocode install --ide vscodeClaude Code
CLAUDE CODE · TERMINAL
claude mcp add-json octocode --scope user '{"command":"npx","type":"stdio","args":["octocode-mcp@latest"]}'The configuration on this page does not set OCTOCODE_TOKEN, GH_TOKEN and GITHUB_TOKEN; the project's instructions set them with an export line. That line reaches only programs started from the same terminal, so to supply them, start your client or the server from that terminal.
Windsurf
WINDSURF · TERMINAL
npx octocode install --ide windsurfAny MCP client
ANY MCP CLIENT · JSON
{
"mcpServers": {
"octocode": {
"command": "npx",
"type": "stdio",
"args": [
"octocode-mcp@latest"
]
}
}
}The configuration on this page does not set OCTOCODE_TOKEN, GH_TOKEN and GITHUB_TOKEN; the project's instructions set them with an export line. That line reaches only programs started from the same terminal, so to supply them, start your client or the server from that terminal.
