Narsil MCP

What it is

A single ~30MB Rust binary that indexes your repositories with tree-sitter and exposes deep code understanding over MCP: symbol extraction and navigation, several kinds of search, control and data flow analysis, type inference, security scanning and supply-chain auditing. Nothing leaves your machine, and indexing runs in parallel across all cores.

What you get

• Symbol navigation across 32 languages — find definitions and references, analyse imports and dependents, fuzzy-search the workspace, read a module's export map — find_symbols, get_symbol_definition, find_references, workspace_symbol_search, get_export_map
• Four search strategies rather than one: keyword with relevance ranking, BM25, hybrid rank fusion, and similarity to a snippet or a symbol — search_code, semantic_search, hybrid_search, find_similar_code, find_similar_to_symbol
• Call graph analysis behind --call-graph: who calls a function, what it calls, the path between two functions, cyclomatic and cognitive complexity, and the most connected hotspots — get_call_graph, get_callers, get_callees, find_call_path, get_complexity, get_function_hotspots
• Control and data flow: basic blocks and branches, unreachable code, reaching definitions, variables used before initialisation, and assignments never read — get_control_flow, find_dead_code, get_reaching_definitions, find_uninitialized, find_dead_stores
• Type inference for Python, JavaScript and TypeScript without running mypy or tsc, including taint flow enhanced by the inferred types — infer_types, check_type_errors, get_typed_taint_flow
• Security analysis in two layers — taint tracking that traces user input to a sink, and a rules engine covering OWASP Top 10 2021, CWE Top 25, crypto and secrets — find_injection_vulnerabilities, trace_taint, get_taint_sources, scan_security, check_owasp_top10, check_cwe_top25, explain_vulnerability, suggest_fix
• Supply chain work: SBOM in CycloneDX, SPDX or JSON, known-vulnerability checks against the OSV database, licence compliance analysis, and safe upgrade paths — generate_sbom, check_dependencies, check_licenses, find_upgrade_path
• Git history behind --git: blame, file history, recent changes, churn-and-complexity hotspots, contributors, and the commits that changed a specific symbol — get_blame, get_hotspots, get_symbol_history, get_modified_files
• Neural semantic search behind --neural, which finds similar code even when the names differ, and detects Type-3/4 semantic clones — neural_search, find_semantic_clones
• Circular import detection and an incremental Merkle-tree change status — get_import_graph, find_circular_imports, get_incremental_status

Requirements

A binary, from Homebrew, Scoop, cargo install narsil-mcp, npm install -g narsil-mcp, Nix, or the one-line install script. Building from source needs Rust 1.70 or later, and on Windows the Visual Studio Build Tools with C++ desktop development. Point it at repositories with --repos, repeated per repository. Several tool families are behind CLI flags — --git, --call-graph, --lsp, --remote, --neural, --persist, --watch, --streaming — and one is behind a build feature as well: --graph only works if the binary was built with --features graph, which the default binary is not, so SPARQL and Code Context Graph tools need a source build. Neural search with the api backend uses Voyage AI or OpenAI embeddings; the ONNX backend runs the model locally. Dual-licensed MIT or Apache-2.0.

Setup effort

One command — npm install -g narsil-mcp

Tools you get

88 tools named in the project's documentation.

Requires

narsil-mcp on PATH