MCP.Market

Rune MCP server

by thecolourfoundation·io.github.thecolourfoundation/rune·v0.5.1·9 stars

Evidence-backed codebase understanding with file:line citations, for AI clients over MCP.

B75/100grade B
What users say
No reviews yet
Be the first
Safety scan
B75/100

full report

Adoption
New

9 stars

Reviews

Write one

Nobody has reviewed Rune yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Rune tools

No tool declarations could be read from the package source. They show once the server is installed.

Public scan report

scanner v0.1.10 · 2026-10-30 · same rubric, same numbers if you re-run it

no findings
  • –Code scanpackage could not be scannedn/a
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 31 days ago12/15
  • Maintainer identityregistry namespace matches repository owner6/10
Overall 75/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Rune compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
75/100
higher than 45% of 48,243 servers
GitHub stars
9
more than 87% of 28,706 servers

Release history: 2 versions in the registry since 2026-08-28, latest 2026-09-21, typically one every 24 days.

Install Rune in Claude Code, Cursor or VS Code

The registry entry has no remote endpoint or installable package.

What the publisher says

From the Rune repository's README, as published. We do not edit it. Read it on GitHub

Rune

Ask questions about a codebase. Rune finds the evidence, your own AI model explains it, and every statement is checked against the code before you see it.

Install

Linux (x64) and macOS (Apple Silicon):

curl -fsSL https://raw.githubusercontent.com/thecolourfoundation/rune/main/install.sh | sh

Windows: download rune-windows-x64.exe from the latest release and run it from a terminal.

The installer verifies a SHA-256 checksum and puts rune in ~/.local/bin.

Use

cd your-project rune "how does routing work"

The first run scans the project (a few seconds). Rune prints ranked findings with file:line evidence, then your model writes a short explanation from that evidence. Any statement that cites evidence Rune didn't retrieve, or quotes text that isn't there, is dropped and counted.

rune explain shows the evidence trail behind any fact, and rune verify checks the stored understanding against the code as it is now.

Bring your own model

Rune has no model of its own. Point it at yours with environment variables:

# Anthropic (early support) export ANTHROPICAPIKEY=your-key

# OpenAI or any OpenAI-compatible API export OPENAIAPIKEY=your-key export RUNELLMMODEL=model-name

# Local model with Ollama (no key, nothing leaves your machine) export RUNELLMBASEURL=http://localhost:11434/v1 export RUNELLM_MODEL=model-name

If no model is configured, Rune prints the evidence, then setup help, and exits with code 2. Add --evidence-only to skip the model entirely. Set RUNELLMDEBUG=1 to see the model's raw reply and why any statement was dropped.

What leaves your machine

Only the evidence for your question goes to the model provider you configured: up to 40 short code snippets, never the whole project. Rune prints how many it is sending before it sends them. Use --evidence-only, or a local model, to send nothing.

Use it from an AI client (MCP)

Rune is an MCP server. Point any MCP client at it:

{"command": "rune", "args": ["serve", "/absolute/path/to/your-project"]}

The client gets tools such as runeagent, runesearch, runeexplain, runeverifyfact and runecheck_drift, with file, line and snippet citations. No key is needed here: the client's own model is the model.

Good to know

  • Rune is read-only. It observes and reports; it never modifies your project.
  • Best on JavaScript/TypeScript, shell, Lua, and config files. Other languages get thinner results for now.
  • Explanation quality depends on your model. Small local models write plain, short explanations.
  • Rune saves its scan in .rune/ inside your project. Add .rune/ to your .gitignore.
  • Binaries are unsigned, so macOS or Windows may show a security warning. There is no prebuilt binary yet for Intel Macs or Linux on ARM.

Run rune --help for all commands. More detail: Docs.md.

License

MIT

Nothing above is checked by us. What we check is on the safety report.

Grade history

  • 2026-10-30downgradeA → Bscore 75

Rune: common questions

Is Rune MCP server safe?
Mostly: it is graded B (75/100). Read the Rune safety report
Does Rune need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Rune maintained?
The last commit was 36 days ago (2026-09-30). The latest release is v0.5.1.
How does Rune compare with other MCP servers?
safety score 75/100 (higher than 45% of 48,243 servers); github stars 9 (more than 87% of 28,706 servers). Full comparison.