arabold/docs-mcp-server

Review signals: 1 connection review, 201 known vulnerability.

Reviewed as expected for a test run: resolver address lookups that send no data.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 8 distinct locations. 3 attributed processes.

OSV reports a known vulnerability in this dependency version. 40 distinct locations. 201 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The CLI indexes and searches without a running server: Real input produced the expected result: The zebra-quartz-marker option enables the widget cache.

  Source: The CLI indexes and searches without a running server, which suits scripts and coding agents.

  Input: search of the locally scraped mylib library for zebra-quartz-marker

  Expected: the indexed sentence is returned

  Command: npx -y @arabold/docs-mcp-server@latest --store-path <guest-path> search mylib zebra-quartz-marker --output yaml --telemetry=false

  Observed: The zebra-quartz-marker option enables the widget cache. score: 0.0000019642857142857144 mimeType: text/markdown sourceMimeType: text/markdown

• Works with any MCP client over stdio: Real input produced the expected result: The zebra-quartz-marker option enables the widget cache.

  Source: Works with any MCP client, over stdio or Streamable HTTP.

  Input: {"tool": "search_docs", "arguments": {"library": "mylib", "query": "zebra-quartz-marker"}}

  Expected: the indexed sentence is returned by the MCP tool

  Command: npx -y @arabold/docs-mcp-server@latest --protocol stdio --store-path <guest-path> tools/call {"tool": "search_docs", "arguments": {"library": "mylib", "query": "zebra-quartz-marker"}}

  Observed: The zebra-quartz-marker option enables the widget cache.\n"}], "isError": false}

Examples

• Search the indexed documentation from the command line: command completed successfully

  Source: README.md Command Line section

  Input: search mylib zebra-quartz-marker --output yaml

  Expected: YAML result containing the indexed sentence

  Command: npx -y @arabold/docs-mcp-server@latest --store-path <guest-path> search mylib zebra-quartz-marker --output yaml --telemetry=false

  Observed: - url: file://<guest-path> content: |- # Guide The zebra-quartz-marker option enables the widget cache. score: 0.0000019642857142857144 mimeType: text/markdown sourceMimeType: text/markdown

• Fetch one page as Markdown without indexing it: command completed successfully

  Source: README.md Command Line section

  Input: fetch-url file://<guest-path>

  Expected: Markdown page containing the sentence

  Command: npx -y @arabold/docs-mcp-server@latest fetch-url file://<guest-path> --telemetry=false

  Observed: # Guide The zebra-quartz-marker option enables the widget cache.

Local or hosted: local

Index a local Markdown folder with the documented scrape command, then search it and read it back through the documented CLI, fetch-url, and the stdio MCP search_docs tool

cd <guest-path> && ls -la && id -u && cat /etc/os-release | head -3 && python3 --version && ls /inputs 2>/dev/null; git --version 2>/dev/null; node --version 2>/dev/null; npm --version 2>/dev/null
cd <guest-path> && cat README.md | head -250
cd <guest-path> && cat .nvmrc; git init -q 2>&1; git remote add origin https://github.com/arabold/docs-mcp-server 2>&1; git fetch --depth 1 origin 715c0777a34b14b474f786ee2deef1cd8ec2c00d 2>&1 | tail -3; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git log --oneline -1; sudo -n true && echo SUDO_OK; which node npm docker
cd <guest-path> && sed -n 1,80p docs/setup/installation.md
export NODE_USE_ENV_PROXY=1; (curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - && sudo apt-get install -y nodejs) > /tmp/node_install.log 2>&1; echo rc=$?; tail -5 /tmp/node_install.log; node --version; npm --version
cd <guest-path> && grep -n -i "telemetry" docs/infrastructure/telemetry.md | head -30; echo ----; grep -n -i "local\|file://\|folder" docs/guides/basic-usage.md | head -40
cd <guest-path> && grep -n -i "ALLOWED_ROOTS\|allowedRoots" docs/setup/configuration.md | head; echo ----; grep -n -i "search_docs\|list_libraries\|scrape_docs\|fetch_url\|tool" docs/guides/mcp-clients.md | head -40; echo ----; grep -n -i "stdio" docs/guides/mcp-clients.md | head -20
mkdir -p <guest-path> && printf '# Guide\n\nThe zebra-quartz-marker option enables the widget cache.\n' > <guest-path> && cd /tmp && export DOCS_MCP_TELEMETRY=false NODE_USE_ENV_PROXY=1 DOCS_MCP_SCRAPER_SECURITY_FILE_ACCESS_ALLOWED_ROOTS=<guest-path> && timeout 600 npx -y @arabold/docs-mcp-server@latest --version 2>&1 | tail -5; echo rc=$?; npx -y @arabold/docs-mcp-server@latest --help 2>&1 | head -60
cd /tmp && export DOCS_MCP_TELEMETRY=false DOCS_MCP_SCRAPER_SECURITY_FILE_ACCESS_ALLOWED_ROOTS=<guest-path> && timeout 900 npx -y @arabold/docs-mcp-server@latest --store-path <guest-path> scrape mylib file://<guest-path> --telemetry=false 2>&1 | grep -v "npm notice" | tail -25; echo rc=${PIPESTATUS[0]}
cd /tmp && export DOCS_MCP_TELEMETRY=false && timeout 300 npx -y @arabold/docs-mcp-server@latest --store-path <guest-path> search mylib "zebra-quartz-marker widget cache" --output yaml --telemetry=false 2>&1 | grep -v "npm notice" | tail -40; echo rc=${PIPESTATUS[0]}
cd /tmp && export DOCS_MCP_TELEMETRY=false DOCS_MCP_SCRAPER_SECURITY_FILE_ACCESS_ALLOWED_ROOTS=<guest-path> && timeout 300 npx -y @arabold/docs-mcp-server@latest fetch-url file://<guest-path> --telemetry=false 2>&1 | grep -v "npm notice"; echo rc=${PIPESTATUS[0]}; cd <guest-path> && grep -rn -i "cron\|setInterval\|node-schedule\|--once\|--now\|webhook" src --include=*.ts | grep -v test | head -20; grep -rn -i "cron\|schedule" README.md docs/setup/configuration.md | head
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"mcp","argv":["npx","-y","@arabold/docs-mcp-server@latest","--protocol","stdio","--store-path","<guest-path>"],"cwd":"/tmp","tool":"search_docs","arguments":{"library":"mylib","query":"zebra-quartz-marker"},"env":{"DOCS_MCP_TELEMETRY":"false"},"expected_text":"The zebra-quartz-marker option enables the widget cache."}
EOF
cat > .coldpass/claims.json <<'EOF'
[
{"kind":"claim","claim":"The CLI indexes and searches without a running server","source":"The CLI indexes and searches without a running server, which suits scripts and coding agents.","input":"search of the locally scraped mylib library for zebra-quartz-marker","expected":"the indexed sentence is returned","probe_kind":"cli","argv":["npx","-y","@arabold/docs-mcp-server@latest","--store-path","<guest-path>","search","mylib","zebra-quartz-marker","--output","yaml","--telemetry=false"],"stdin":"","expected_text":"The zebra-quartz-marker option enables the widget cache.","cwd":"/tmp"},
{"kind":"claim","claim":"Works with any MCP client over stdio","source":"Works with any MCP client, over stdio or Streamable HTTP.","input":"search_docs tool call for zebra-quartz-marker in mylib","expected":"the indexed sentence is returned by the MCP tool","probe_kind":"mcp","argv":["npx","-y","@arabold/docs-mcp-server@latest","--protocol","stdio","--store-path","<guest-path>"],"tool":"search_docs","arguments":{"library":"mylib","query":"zebra-quartz-marker"},"env":{"DOCS_MCP_TELEMETRY":"false"},"expected_text":"The zebra-quartz-marker option enables the widget cache.","cwd":"/tmp"}
]
EOF
cat > .coldpass/examples.json <<'EOF'
[
{"kind":"example","claim":"Search the indexed documentation from the command line","source":"README.md Command Line section","input":"search mylib zebra-quartz-marker --output yaml","expected":"YAML result containing the indexed sentence","argv":["npx","-y","@arabold/docs-mcp-server@latest","--store-path","<guest-path>","search","mylib","zebra-quartz-marker","--output","yaml","--telemetry=false"],"cwd":"/tmp","env":{"DOCS_MCP_TELEMETRY":"false"},"expected_text":"The zebra-quartz-marker option enables the widget cache."},
{"kind":"example","claim":"Fetch one page as Markdown without indexing it","source":"README.md Command Line section","input":"fetch-url file://<guest-path>","expected":"Markdown page containing the sentence","argv":["npx","-y","@arabold/docs-mcp-server@latest","fetch-url","file://<guest-path>","--telemetry=false"],"cwd":"/tmp","env":{"DOCS_MCP_TELEMETRY":"false","DOCS_MCP_SCRAPER_SECURITY_FILE_ACCESS_ALLOWED_ROOTS":"<guest-path>"},"expected_text":"The zebra-quartz-marker option enables the widget cache."}
]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README.md, docs/setup/installation.md, docs/guides/basic-usage.md and src/ for cron, schedule, --once, --now, loop or webhook triggers. None found: scrape, refresh and search run only when a user or agent invokes them. The only setInterval calls are internal keep-alive and heartbeat timers (src/services/mcpService.ts, src/pipeline/PipelineManager.ts), not documented product cycles.","checks":[]}
EOF
python3 -I -c "import json;[json.load(open('.coldpass/'+f)) for f in ['probe.json','claims.json','examples.json','cycles.json']];print('json ok')"; ls -la .coldpass
cd <guest-path> && <env-var>=<guest-path> timeout 1500 python3 -I <guest-path> --validate --replay 2>&1 | tail -80; echo rc=${PIPESTATUS[0]}
pgrep -af "docs-mcp-server" | grep -v pgrep || echo "no leftover server processes"; cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Index a local Markdown folder with the documented scrape command, then search it and read it back through the documented CLI, fetch-url, and the stdio MCP search_docs tool","operation_scope":"Offline, local file:// source only. Requires Node.js 22+ (installed 22.23.4) and npm 10.9.9. Telemetry off via DOCS_MCP_TELEMETRY=false and --telemetry=false. Store at <guest-path> npx @latest resolved to package version 3.3.0.","steps":["git init; git remote add origin https://github.com/arabold/docs-mcp-server; git fetch --depth 1 origin 715c0777a34b14b474f786ee2deef1cd8ec2c00d; git reset --mixed FETCH_HEAD","sudo NodeSource setup_22.x and apt-get install nodejs (README requires Node.js 22 or later)","npx -y @arabold/docs-mcp-server@latest --version","npx -y @arabold/docs-mcp-server@latest --store-path <guest-path> scrape mylib file://<guest-path> -> Successfully scraped 2 pages","npx -y @arabold/docs-mcp-server@latest --store-path <guest-path> search mylib zebra-quartz-marker --output yaml","npx -y @arabold/docs-mcp-server@latest fetch-url file://<guest-path>","npx -y @arabold/docs-mcp-server@latest --protocol stdio --store-path <guest-path> (MCP tools/call search_docs)","<env-var>=<guest-path> python3 -I <guest-path> --validate --replay -> valid true, replay PASS"],"deviations":["Node.js and npm were not present in the guest; installed Node 22 via NodeSource with sudo and apt. This is the README-required version.","Scraped a local file:// folder created at <guest-path> instead of a live documentation website, since the README documents local-folder indexing and this run was offline. Web and network scraping were not exercised.","Used cwd /tmp for all npx commands, as required for published packages.","Did not run the web UI, Docker, or an embedding provider; no API keys were used. The local-file workflow needed no headless-browser component.","MCP check used the stdio entry point, not the HTTP endpoint on localhost:6280."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None required for the tested path. Optional: pin the npx package version, since @latest currently resolves to 3.3.0, so runs are reproducible."}
EOF
python3 -I -c "import json;json.load(open('.coldpass/report.json'));print('report ok')"
cd <guest-path> && <env-var>=<guest-path> timeout 1500 python3 -I <guest-path> --validate --replay 2>&1 | python3 -I -c "import sys,json;d=json.loads(sys.stdin.read());print(d['valid'],d['problems'],d['replay']['status'])"