Rag Retriever — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Rag Retriever (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A lightweight, local-first document retrieval engine that mounts to an agent as an MCP tool. Drop files in; the agent searches them and answers with its own LLM. There is no LLM in here — this is only the "front half" of RAG (extract → chunk → embed → store + similarity search).
your agent (owns the LLM)
│ calls MCP tool: search("question")
▼
rag-retriever ──► extract ─► chunk ─► embed ─► LanceDB
▲ │
└────────── returns relevant passages ◄────────┘
│
agent reads passages → answers with its own LLMBuilt from the same proven pieces as Open Notebook (file extraction + bge-m3 embeddings + vector search), minus the heavyweight backend, UI, and answer/podcast generation you don't need.
full control of reasoning, prompts, and cost.
fastembed) runs entirely offline, no server.API (SiliconFlow) with one env var — no code change.
cd rag-retriever
uv sync
cp .env.example .env # then pick your embedding backend.env)RAG_EMBED_BACKEND | What it uses | Notes |
|---|---|---|
local (default) | fastembed (ONNX, in-process) | 100% offline, no server, heavier first install |
ollama | local Ollama daemon | ollama serve + ollama pull bge-m3 |
openai | OpenAI-compatible API (e.g. SiliconFlow) | needs RAG_OPENAI_API_KEY; text leaves the machine |
⚠️ Index-time and query-time must use the same backend + model. Changing the model means re-indexing everything.
uv run rag-retriever index "C:\path\to\docs" # a file or a whole folder
uv run rag-retriever search "什么是表见代理" -k 5
uv run rag-retriever list
uv run rag-retriever statsRun uv run rag-retriever-mcp (stdio). Register it with your MCP client. For Claude Code, add to your MCP config:
{
"mcpServers": {
"rag-retriever": {
"command": "uv",
"args": ["run", "--directory", "D:\\Vibe Coding Items\\rag-retriever", "rag-retriever-mcp"]
}
}
}Tools exposed: index_path, search, list_sources, stats.
pdf, docx, pptx, xlsx, html, md, txt, csv, json, epub (via markitdown). Scanned / image-only PDFs need an OCR engine (tesseract) installed separately; without it they extract empty and are reported as skipped.
rag_retriever/
config.py # env-driven config; picks the embedding backend
extract.py # file -> text (markitdown)
chunk.py # token-based chunking with overlap
embed.py # local | ollama | openai-compatible backends
store.py # LanceDB vector store (embedded, no server)
pipeline.py # ingest + search orchestration (no LLM)
server.py # MCP server (agent-facing)
cli.py # manual CLI~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.