Madar MCP server
io.github.mohanagy/madar·v0.40.0-beta.1·19 starsAuthenticated local evidence paths for JavaScript and TypeScript coding agents.
19 stars106 downloads/wk
Reviews
Write oneNobody has reviewed Madar yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Madar tools (1)
write = sends, deletes, buys or postsRead from the package source without running it. The installed server may list more.
retrieveReturn the smallest deterministic evidence path for a TypeScript or JavaScript codebase question.
Public scan report
scanner v0.1.9 · 2026-09-24 · same rubric, same numbers if you re-run it
- Code scan87 source files scanned25/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancelast push 4 days ago15/15
- Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
How Madar compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 92/100
- higher than 95% of 48,255 servers
- Tools
- 1
- the typical server has 7
- Tools that change things
- 0%
- typical: 0%. Fewer write tools means less an agent can break
- GitHub stars
- 19
- more than 91% of 28,688 servers
- Downloads a week
- 106
- more than 64% of 12,191 servers with a package
What its tools let an agent do: 1 read
Install Madar in Claude Code, Cursor or VS Code
Runs npx -y @lubab/madar on your machine. Read the scan report first; the gateway never runs local packages.
claude mcp add madar -- npx -y @lubab/madar
What the publisher says
From the Madar repository's README, as published. We do not edit it. Read it on GitHub
Madar
Give your coding agent the repo context it needs before it starts searching.
Madar builds a local graph of your TypeScript or Node.js repository and turns the current question into a small, task-aware context pack. Claude Code, Codex, Cursor, Copilot, Gemini, Aider, and OpenCode can start from relevant files, symbols, snippets, and relationships instead of rediscovering the repository from scratch.
- Start smaller: give the agent likely entrypoints and runtime paths before broad search.
- Stay local: graph generation does not upload your source code or require a cloud service.
- Stay current: installed MCP profiles refresh the graph as the active workspace changes.
Try It in 60 Seconds
Install Madar with Node.js 20 or newer, then run it inside your repository:
npm install -g @lubab/madar
cd your-repository
madar try "how does authentication work?"madar try builds or reuses the local graph, prints a human-readable first result, and recommends the next agent-install command. It does not modify your source code.
For a concrete example, Madar's included password-reset workspace contains this path:
account-routes.ts
-> PasswordResetService.requestPasswordReset()
-> userRepository.saveResetToken()
-> enqueueResetEmailJob()
-> sendPasswordResetEmail()That is the kind of focused starting path Madar gives an agent before it decides whether any additional file inspection is necessary.
Connect Your Agent
Choose the agent you use. For Claude Code:
madar claude install
madar doctor
madar statusAfter installing a profile, run madar doctor and madar status. The agent can then ask Madar for context when you use normal prompts such as:
How does authentication work?
Why does this endpoint return 403?
Where is the report generated?
What breaks if I change this service?
Add telemetry to this flow.Madar supports these project-local installers:
Installer details are in the CLI and MCP reference. Step-by-step setup and smoke tests are in the agent quickstarts.
After upgrading Madar, rerun your agent's install command to refresh its managed profile. Older profiles may lack automatic refresh or Codex's longer startup window.
Codex installs create a workspace-scoped MCP block with longer startup and tool timeouts. Madar stays available during initial reconciliation; graph-backed calls become available once the graph is ready.
Starting with 0.31.3, a graph-backed call made while Madar is starting, pending, or reconciling returns a structured retryable response. The agent should retry the same Madar request after the suggested delay instead of bypassing Madar or running generation manually. A dead refresh owner is recovered automatically; only failed, incomplete, or policy-mismatched graph states ask for repair.
What Changes for the Agent
Without Madar, a coding agent often begins with broad filename searches, repeated reads, and guesses about which route, service, or handler owns the task.
With Madar, the first pass can include:
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Madar: common questions
- Is Madar MCP server safe?
- Yes, by our scan: it is graded A (92/100). Read the Madar safety report
- How do I install Madar?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does Madar need an API key?
- Not as far as the registry entry and our scan can tell: no credentials are declared or required.
- Is Madar maintained?
- The last commit was 45 days ago (2026-09-20). The latest release is v0.40.0-beta.1.
- How does Madar compare with other MCP servers?
- safety score 92/100 (higher than 95% of 48,255 servers); tools 1 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.