Narsil-MCP - Comprehensive Code Intelligence MCP Server

Narsil-MCP - Comprehensive Code Intelligence MCP Server

Research Date: January 26, 2026 Source URL: https://narsilmcp.com/ GitHub Repository: https://github.com/postrv/narsil-mcp npm Package: https://www.npmjs.com/package/narsil-mcp Crates.io: https://crates.io/crates/narsil-mcp Version at Research: v1.3.1 License: Apache-2.0 / MIT (dual-licensed)

Overview

Narsil-MCP is a Rust-powered MCP (Model Context Protocol) server providing AI assistants with deep code intelligence through 90 specialized tools. It supports 32 programming languages with features including symbol extraction, semantic search, call graph analysis, security scanning (OWASP/CWE), taint analysis, SBOM generation, and neural embeddings.

Core Value Proposition: Privacy-first, local-only code intelligence that transforms AI assistants into powerful code analysis tools without sending data to external services.

Problem Addressed

Key Statistics (as of January 26, 2026)

Key Features

Code Intelligence (Core)

• Symbol Extraction: Functions, structs, classes, enums, traits, interfaces across 32 languages
• Semantic Search: BM25 ranking with Tantivy full-text search engine
• Hybrid Search: Combined BM25 + TF-IDF with reciprocal rank fusion
• Call Graph Analysis: Function relationships, callers/callees, call paths, hotspot detection
• Control Flow Graphs: Basic blocks and branch analysis
• Data Flow Analysis: Variable definitions, uses, reaching definitions
• Dead Code Detection: Unreachable code blocks and dead stores
• Type Inference: Built-in inference for Python, JavaScript, TypeScript without external tools

Neural Semantic Search (Optional --neural flag)

• Embedding-Based Search: Find similar code using Voyage AI or OpenAI embeddings
• Semantic Clone Detection: Find Type-3/4 semantic clones of functions
• Backends: API mode (Voyage AI, OpenAI, custom endpoints) or local ONNX models
• Model Support: voyage-code-2, OpenAI embeddings, custom models

Security Analysis

• Taint Analysis: Source-to-sink tracking for SQL injection, XSS, command injection, path traversal
• OWASP Top 10: Comprehensive vulnerability scanning
• CWE Top 25: Most dangerous software weaknesses detection
• Secret Detection: API keys, passwords, tokens, private keys
• 111 Security Rules: YAML-based rules for crypto, secrets, IaC (Terraform, CloudFormation, Kubernetes)
• Language-Specific Rules: Go, Java, C#, Kotlin, Bash, Ruby, PHP, TypeScript

Supply Chain Security

• SBOM Generation: CycloneDX, SPDX, JSON formats
• Dependency Vulnerability Checking: OSV database integration
• License Compliance: Audit licenses for legal compliance
• Upgrade Path Finder: Safe upgrade paths for vulnerable dependencies

Knowledge Graph (v1.3.0+ with --graph flag)

• SPARQL Queries: Execute SPARQL SELECT/ASK queries against code RDF graph (Oxigraph)
• Code Context Graph (CCG): 12 tools for standardized AI-consumable codebase representations
  • L0 Manifest: ~1-2KB JSON-LD repository identity
  • L1 Architecture: ~10-50KB JSON-LD modules and API
  • L2 Symbol Index: ~100-500KB N-Quads gzipped
  • L3 Full Detail: ~1-20MB N-Quads gzipped
• Triple-Heart Model: Tiered access control (public/authenticated/private)

Git Integration (with --git flag)

• Git blame, file history, commit diffs
• Hotspot detection (high churn + complexity)
• Contributors analysis
• Symbol history tracking

Additional Features

• LSP Integration: Hover info, go-to-definition, precise types
• Remote Repository Support: GitHub repository cloning and API access
• Incremental Indexing: Merkle tree-based change detection
• Streaming Responses: Real-time results for large repos
• WASM Build: Browser execution for educational platforms
• Visualization Frontend: Interactive call graphs with HTTP server

Supported Languages (32)

Technical Architecture

+-----------------------------------------------------------------+
|                         MCP Server                               |
|  +-----------------------------------------------------------+  |
|  |                   JSON-RPC over stdio                      |  |
|  +-----------------------------------------------------------+  |
|                              |                                   |
|  +---------------------------v-------------------------------+  |
|  |                   Code Intel Engine                        |  |
|  |  +------------+ +------------+ +------------------------+  |  |
|  |  |  Symbol    | |   File     | |    Search Engine       |  |  |
|  |  |  Index     | |   Cache    | |  (Tantivy + TF-IDF)    |  |  |
|  |  | (DashMap)  | | (DashMap)  | +------------------------+  |  |
|  |  +------------+ +------------+                              |  |
|  |  +------------+ +------------+ +------------------------+  |  |
|  |  | Call Graph | |  Taint     | |   Security Rules       |  |  |
|  |  |  Analysis  | |  Tracker   | |   Engine               |  |  |
|  |  +------------+ +------------+ +------------------------+  |  |
|  +-----------------------------------------------------------+  |
|                              |                                   |
|  +---------------------------v-------------------------------+  |
|  |                Tree-sitter Parser                          |  |
|  |  +------+ +------+ +------+ +------+ +------+             |  |
|  |  | Rust | |Python| |  JS  | |  TS  | | Go   | ... (32)    |  |
|  |  +------+ +------+ +------+ +------+ +------+             |  |
|  +-----------------------------------------------------------+  |
|                              |                                   |
|  +---------------------------v-------------------------------+  |
|  |                Repository Walker                           |  |
|  |           (ignore crate - respects .gitignore)             |  |
|  +-----------------------------------------------------------+  |
+-----------------------------------------------------------------+

Key Implementation Details:

• Rust-native: Single binary (~30MB), memory-safe, blazingly fast
• Tree-sitter Powered: Incremental parsing with 2 GiB/s throughput
• Parallel Processing: Rayon-based parallel indexing using all cores
• Lock-free Data Structures: DashMap for concurrent symbol/file access
• Tantivy Search: High-performance full-text search with BM25 ranking

Performance Benchmarks

Parsing Throughput (Apple M1)

Search Latency

End-to-End Indexing

Installation

Package Managers

# Homebrew (macOS/Linux)
brew tap postrv/narsil && brew install narsil-mcp

# npm (All platforms)
npm install -g narsil-mcp

# Cargo (All platforms)
cargo install narsil-mcp

# Scoop (Windows)
scoop bucket add narsil https://github.com/postrv/scoop-narsil
scoop install narsil-mcp

# Nix
nix run github:postrv/narsil-mcp -- --repos ./my-project

One-Line Install Scripts

# macOS/Linux
curl -fsSL https://raw.githubusercontent.com/postrv/narsil-mcp/main/install.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/postrv/narsil-mcp/main/install.ps1 | iex

MCP Configuration Examples

Claude Code (.mcp.json in project root)

{
  "mcpServers": {
    "narsil-mcp": {
      "command": "narsil-mcp",
      "args": ["--repos", ".", "--git", "--call-graph"]
    }
  }
}

Cursor (.cursor/mcp.json)

{
  "mcpServers": {
    "narsil-mcp": {
      "command": "narsil-mcp",
      "args": ["--repos", ".", "--git", "--call-graph"]
    }
  }
}

VS Code Copilot (.vscode/mcp.json)

{
  "servers": {
    "narsil-mcp": {
      "command": "narsil-mcp",
      "args": ["--repos", ".", "--git", "--call-graph"]
    }
  }
}

Tool Categories (90 Total)

Configuration System (v1.1.0+)

Presets for Token Optimization

Automatic Editor Detection

Narsil-MCP automatically detects the editor from the MCP initialize request and applies optimal presets.

Configuration Priority

CLI flags > Environment vars > Project config (.narsil.yaml) > User config (~/.config/narsil-mcp/config.yaml) > Defaults

Relevance to Claude Code Development

Direct Applications

1. Enhanced Code Intelligence: Drop-in MCP server provides 90 tools for deep codebase understanding
2. Security Auditing: Built-in vulnerability scanning without external tools
3. Supply Chain Analysis: SBOM generation and license compliance for production deployments
4. Token Optimization: Configurable presets reduce context window usage by up to 61%

Patterns Worth Adopting

1. Preset System: Tool filtering based on editor/use-case for context window efficiency
2. Multi-Source Configuration: CLI > Env > Project > User config priority
3. AST-Aware Chunking: Tree-sitter based chunking preserves syntactic boundaries
4. Hybrid Search: Combining BM25 + TF-IDF with reciprocal rank fusion
5. Incremental Indexing: Merkle tree change detection for large repos

Integration Opportunities

1. Claude Code Plugin Available: /plugin install github:postrv/narsil-mcp/narsil-plugin
2. Complements Existing Tools: Adds security analysis, call graphs, supply chain features
3. Code Context Graph: CCG export format could standardize codebase representations
4. Ralph Automation Integration: Works with Ralph for autonomous code development workflows

Comparison with Alternatives

References

1. Official Website: https://narsilmcp.com/ (accessed 2026-01-26)
2. GitHub Repository: https://github.com/postrv/narsil-mcp (accessed 2026-01-26)
3. CHANGELOG: https://github.com/postrv/narsil-mcp/blob/main/CHANGELOG.md (accessed 2026-01-26)
4. Configuration Guide: https://github.com/postrv/narsil-mcp/blob/main/docs/configuration.md
5. Installation Guide: https://github.com/postrv/narsil-mcp/blob/main/docs/INSTALL.md
6. Neural Search Documentation: https://github.com/postrv/narsil-mcp/blob/main/docs/neural-search.md
7. Claude Code Integration Playbook: https://github.com/postrv/narsil-mcp/blob/main/docs/playbooks/integrations/claude-code.md
8. npm Package: https://www.npmjs.com/package/narsil-mcp
9. Crates.io: https://crates.io/crates/narsil-mcp

Freshness Tracking

Change Detection Indicators:

• Monitor GitHub releases for version changes (rapid development: 94 commits in ~1 month)
• Check CHANGELOG.md for new features and breaking changes
• Review tool count changes (currently 90 tools)
• Track star growth as adoption indicator (early project, high potential)
• Verify security rule count and language support expansion