Zvec Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Zvec Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This repository contains a local MCP bridge that indexes project source files into a Zvec vector database and exposes semantic search through MCP tools.
The current implementation is a stdio-based MCP server that:
.zvec/knowledge.db inside the project root;Xenova/all-MiniLM-L6-v2;From the repository root:
npm installRun the bridge directly:
PROJECT_ROOT=/absolute/path/to/your/project node zvec-mcp-bridge.jsIf PROJECT_ROOT is not provided, the bridge uses the current working directory.
This bridge is not tied to Google Antigravity specifically; it works with any MCP-compatible client that can launch a stdio process.
{
"mcpServers": {
"zvec-project-knowledge": {
"command": "node",
"args": ["/absolute/path/to/zvec-mcp-bridge.js"],
"env": {
"PROJECT_ROOT": "/absolute/path/to/your/project"
}
}
}
}The bridge indexes these file extensions:
.js, .jsx, .ts, .tsx.kt, .erl, .hrl.py, .go, .java, .cs, .rb, .php.cpp, .c, .h, .hpp, .rs, .swift, .scalaIt skips common config and lock files such as package.json, package-lock.json, tsconfig.json, vite.config.*, and similar files. It also ignores generated or dependency-heavy directories like node_modules, .git, dist, build, .cache, .next, and .vscode.
search_project_knowledgeSearches the local Zvec knowledge base for relevant code snippets.
Input:
query (required): a natural-language search requestexclude_paths (optional): path substrings to exclude from resultsinclude_paths (optional): path substrings that must be present in resultsBehavior:
topk: 15;initialize_project_knowledgeInitializes the knowledge base and indexes the project contents.
Input:
force_rebuild (optional): if true, clears the existing index before re-indexingindex_fileIndexes or refreshes a single file immediately.
Input:
file_path (required): relative or absolute path to the fileget_knowledge_statusReturns current database status information such as:
text_content, file_path, and language;code_embedding.A useful example prompt for the LLM can be taken from AGENTS.md.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.