Rag Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Rag Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A smart proxy server for the Model Context Protocol (MCP) that aggregates multiple downstream MCP servers and provides Natural Language Search capabilities over their tools.
The gateway acts as a single entry point for an MCP client (like Claude Desktop or an Agent), allowing it to discover and use tools from a wide array of connected servers using semantic queries instead of exact naming matching.
The system is built on a modular "Gateway" architecture designed for high discoverability and robust connection management.
graph TD
Client[MCP Client] <-->|Stdio| Gateway[RAG MCP Gateway]
subgraph "Internal Components"
Gateway --> ConnectionManager
Gateway --> Indexer
Gateway --> Retriever
subgraph "Indexing Pipeline"
Indexer --> Discovery[Tool Discovery]
Discovery --> Enrichment[LLM Enrichment]
Enrichment --> Embedding[Vector Embedding]
Embedding --> Orama[(Orama DB)]
Enrichment --> Gemini[Google Gemini API]
end
subgraph "Retrieval Pipeline"
Retriever --> Search[Parallel Dense/Sparse Search]
Search --> RRF[RRF Fusion]
RRF --> Rerank[Cross-Encoder Reranking]
Rerank --> Model[Transformers.js]
Search --> Orama
end
end
subgraph "Downstream Servers"
ConnectionManager <-->|Stdio| ServerA[Local Process]
ConnectionManager <-->|SSE / HTTP| ServerB[Remote Server]
ConnectionManager <-->|Docker| ServerC[Containerized Tool]
endstop and rm) before startup to avoid name conflicts.listTools from all clients. git clone <repository-url>
cd rag-mcp npm install npm run buildThe gateway is configured using a config.json file in the root directory. You can copy the example file to start:
cp config.example.json config.jsonconfig.json StructureDefine your downstream servers in the mcpServers object:
{
"mcpServers": {
"weather": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-weather"]
},
"filesystem": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-filesystem", "./allowed-dir"]
},
"remote-server": {
"transport": "sse",
"url": "http://localhost:3000/sse"
}
}
}You can configure the gateway using the following environment variables. These can be set in your OS or passed via the env object in your Claude Desktop configuration.
| Variable | Description | Default |
|---|---|---|
GEMINI_API_KEY | Required for Enrichment. API Key for Google Generative AI. | - |
RAG_MCP_BASE_DIR | Base directory for all relative paths. | process.cwd() |
RAG_MCP_CONFIG_PATH | Path to the downstream servers config file. | BASE_DIR/config.json |
RAG_MCP_DB_PATH | Path to the Orama persistence folder. | BASE_DIR/data/orama_db |
RAG_MCP_LOG_PATH | Path to the debug log file. | BASE_DIR/rag-mcp.log |
RAG_MCP_LOGGING_ENABLED | Set to true to enable debug logging to the log file. | false |
RAG_MCP_REBUILD_INDEX | Set to true to force a full re-index on every startup. | false |
RAG_MCP_SEARCH_THRESHOLD | Minimum relevance score (0.0 to 1.0) for search results. | 0.85 |
RAG_MCP_EMBEDDING_MODEL | Required if Dense enabled. Transformers.js model for generating vector embeddings. | - |
RAG_MCP_RERANKING_MODEL | Required if Reranker enabled. Transformers.js model for second-stage reranking. | - |
RAG_MCP_GENERATIVE_MODEL | Required if LLM enabled. Google Gemini model for tool enrichment. | - |
RAG_MCP_ENABLE_LLM | Enable LLM enrichment (summaries and questions) during indexing. | false |
RAG_MCP_ENABLE_DENSE | Enable semantic vector search (Dense retrieval). | true |
RAG_MCP_ENABLE_SPARSE | Enable full-text keyword search (Sparse retrieval). | true |
RAG_MCP_ENABLE_RERANKER | Enable the cross-encoder reranking stage. | true |
You can run the server directly using ts-node:
# Set your API key first (Windows PowerShell)
$env:GEMINI_API_KEY="your-key-here"
npm run devTo use this gateway with Claude Desktop, edit your config file:
Windows: %APPDATA%\Claude\claude_desktop_config.json Mac/Linux: ~/Library/Application Support/Claude/claude_desktop_config.json
Add the gateway to the mcpServers list:
{
"mcpServers": {
"rag-gateway": {
"command": "node",
"args": ["C:/path/to/rag-mcp/dist/src/server.js"],
"env": {
"GEMINI_API_KEY": "your-key-here",
"RAG_MCP_LOGGING_ENABLED": "true"
}
}
}
}Note: Always use absolute paths for the command and arguments when configuring Claude Desktop.
Once connected, the Gateway exposes two primary tools to the client:
search_tool(query: string, limit?: number)This is the discovery mechanism. The Agent should call this first when it doesn't know which tool to use.
query: "I need to check the weather in London", limit: 3limit matching tool schemas (default is 10).execute_tool(tool_name: string, arguments: object)This is the execution mechanism.
tool_name: "weather_get_current", arguments: { city: "London" }This project includes a suite of verification scripts in the tests/ directory to validate different components without needing a full MCP client.
Use ts-node to run specific test scenarios:
Simulates a client connecting to the gateway and running searches.
npx ts-node tests/verify_gateway.tsChecks if tools are correctly added, updated, or removed from the vector index when downstream servers change.
npx ts-node tests/verify_index_sync.tsTests the connection managers handling of Stdio and SSE connections.
npx ts-node tests/verify_transports.tsSince the server communicates over Stdio, standard output (console.log) is reserved for the protocol.
rag-mcp.log in the project root (must enable RAG_MCP_LOGGING_ENABLED=true).rag-mcp/
├── src/
│ ├── server.ts # Gateway Entry Point (Stdio Server)
│ ├── indexer.ts # Tool Discovery & Enrichment Logic
│ ├── retriever.ts # Hybrid Search & Reranking Pipeline
│ ├── connection_manager.ts # Transport Management (Stdio/SSE/Docker)
│ ├── vector_store.ts # Orama DB Wrapper (Dense/Sparse)
│ ├── models.ts # Transformer.js Model Management
│ └── llm.ts # Gemini API Integration
├── data/ # Local Database & Persistence
├── tests/ # Verification Scripts
├── config.json # Downstream Servers Configuration
└── rag-mcp.log # Debug Logs (if enabled)GEMINI_API_KEY. Use an environment variable or a secure secret manager.process.env plus any specific env defined in config.json to the child process. Be mindful of sensitive variables../data directory. Ensure this directory is protected.config.json are running and accessible.rag-mcp.log for connection errors (ensure RAG_MCP_LOGGING_ENABLED=true).refresh_index() tool to force a scan.RAG_MCP_ENABLE_LLM=true and provide a GEMINI_API_KEY. Tools with poor descriptions need LLM enrichment to be discoverable via natural language.RAG_MCP_SEARCH_THRESHOLD. A lower value (e.g., 0.7) returns more candidates but may include irrelevant results.stop and rm containers with the same serverId on startup to avoid name conflicts. Ensure the system user has permissions to execute these commands.~/.cache/huggingface (or equivalent) directory.The source code for RAG MCP Gateway is licensed under the [ISC License](https://www.isc.org/licenses/)
This project utilizes several high-quality models and libraries that are subject to their own licenses:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.