Is io.github.maroondlabs/sourcebook safe to use?

io.github.maroondlabs/sourcebook has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.

How do I install io.github.maroondlabs/sourcebook?

io.github.maroondlabs/sourcebook supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What AI clients work with io.github.maroondlabs/sourcebook?

io.github.maroondlabs/sourcebook is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.

Is io.github.maroondlabs/sourcebook actively maintained?

io.github.maroondlabs/sourcebook is less actively maintained — last commit was 95 days ago. It has 3 GitHub stars.

io.github.maroondlabs/sourcebook

sourcebook

Live codebase intelligence for AI agents: conventions, blast radius, import graphs, git insights.

3 32/wk GitHub npm

No known CVEs

No license

Maintained

Last commit 95d ago

Works with most clients

Transport: stdio

0 tools

Grade F

MCPpedia last refreshed this data 20h ago

Edit this pageView history

AI / ML Analytics

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "sourcebook": {
      "args": [
        "-y",
        "sourcebook",
        "serve",
        "--dir",
        "/path/to/your/project"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-maroondlabs-sourcebook-maroondlabs)](https://mcppedia.org/s/io-github-maroondlabs-sourcebook-maroondlabs)

Read me

What io.github.maroondlabs/sourcebook does

Catches the files your AI agent forgot to change.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

npx -y 'sourcebook' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

25/100across 5 weighted dimensions

How we score →

0255075100

−75

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked sourcebook against OSV.dev.

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.maroondlabs/sourcebook safe to use?: io.github.maroondlabs/sourcebook has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.maroondlabs/sourcebook?: io.github.maroondlabs/sourcebook supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with io.github.maroondlabs/sourcebook?: io.github.maroondlabs/sourcebook is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.
Is io.github.maroondlabs/sourcebook actively maintained?: io.github.maroondlabs/sourcebook is less actively maintained — last commit was 95 days ago. It has 3 GitHub stars.

Similar servers

Others in ai-ml / analytics

View all →

Memory MCP Server96

Persistent memory using a knowledge graph

88.7k 5

Sequential Thinking MCP Server96

Dynamic problem-solving through sequential thought chains

88.7k 1

Gemini Cli95

An open-source AI agent that brings the power of Gemini directly into your terminal.

106.1k 8

Cli Core94

Lightweight core CLI surface for Claude Flow — memory + hooks commands only. Designed to load fast on cold npx cache (<5s) so plugin skills don't race the 30s MCP-startup timeout. The full @claude-flow/cli metapackage lazy-loads everything else on top of

65.3k 4

MCP Security Weekly

Get CVE alerts and security updates for io.github.maroondlabs/sourcebook and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

AI / ML Analytics

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "sourcebook": {
      "args": [
        "-y",
        "sourcebook",
        "serve",
        "--dir",
        "/path/to/your/project"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-maroondlabs-sourcebook-maroondlabs)](https://mcppedia.org/s/io-github-maroondlabs-sourcebook-maroondlabs)

Read me

What io.github.maroondlabs/sourcebook does

Catches the files your AI agent forgot to change.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

npx -y 'sourcebook' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

README

sourcebook

Catches the files your AI agent forgot to change.

A safety layer for code changes. sourcebook analyzes git diffs for completeness — flags files that should've been modified but weren't. Rules-based structural detection plus AI-powered semantic analysis. Zero false positives on clean diffs.

npx sourcebook init          # sets up Claude Code hooks + generates CLAUDE.md
npx sourcebook check         # check your current diff for missing files
npx sourcebook scan-history  # see what you've been missing

What It Catches

Your AI agent changed the handler. Did it update the test? The sibling module? The config that references the old value?

sourcebook checks your diff against the repo's actual structure:

Missing test files — source file changed, test file didn't
Sibling modules — files that import or are imported by what you changed
Co-change companions — files that historically change together in git commits
Hub file blast radius — you touched something with 50+ dependents

With --ai: cross-module semantic relationships, field renames that need migrations, stale validation logic.

Key Stats

Metric	Result
Completeness gate	100% accurate (30/30 diffs)
False positive rate	0% on clean diffs
Test file detection	73%
Sibling detection	71%
AI analysis cost	~$0.012/run

Four Surfaces

1. CLI

Run it on any diff. No setup required.

npx sourcebook check              # check staged/unstaged changes
npx sourcebook check --ai         # add AI semantic analysis (requires ANTHROPIC_API_KEY)
npx sourcebook check --quiet      # exit code only (for CI/scripts)
npx sourcebook check --branch main  # compare vs a branch

2. Claude Code Hooks

One command wires up pre-commit hooks. Agent edits a file, sourcebook checks the diff, agent sees what's missing — all before the commit lands.

npx sourcebook init   # generates CLAUDE.md + installs hooks

3. MCP Server

Published on the official MCP registry. Agents can query repo structure, blast radius, conventions, and co-change data on demand.

npx sourcebook serve

Add to your MCP client:

{
  "mcpServers": {
    "sourcebook": {
      "command": "npx",
      "args": ["-y", "sourcebook", "serve", "--dir", "/path/to/your/project"]
    }
  }
}

4. GitHub App (coming soon)

Automated completeness checks on every pull request. Join the waitlist.

Commands

Command	Description
`sourcebook check`	Analyze current diff for completeness
`sourcebook check --ai`	Add AI-powered semantic analysis (requires ANTHROPIC_API_KEY)
`sourcebook check --quiet`	Exit code only — 1 if findings, 0 if clean
`sourcebook check --json`	Structured JSON output
`sourcebook check --branch main`	Compare HEAD against a branch
`sourcebook check --threshold 0.9`	Custom co-change coupling threshold (0-1)
`sourcebook init`	Set up Claude Code hooks + generate CLAUDE.md/AGENTS.md
`sourcebook scan-history`	Retrospective scan of recent commits
`sourcebook hooks`	Install or check Claude Code hooks
`sourcebook truth`	Generate a Repo Truth Map (2.5D visualization)
`sourcebook serve`	Start MCP server
`sourcebook update`	Re-analyze while preserving manual edits
`sourcebook diff`	Show what would change (exit code 1 if changes found)
`sourcebook watch`	Auto-regenerate context files on source changes
`sourcebook ask <query>`	Query codebase knowledge in natural language

How It Works

Layer A — Rules-based (no LLM, <1 second)

Co-change analysis — mines git history for files that change together. If you touched auth.ts and it changes with session.ts in 88% of commits, sourcebook flags session.ts.
Test file detection

... View full README on GitHub

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

25/100across 5 weighted dimensions

How we score →

0255075100

−75

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked sourcebook against OSV.dev.

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.maroondlabs/sourcebook safe to use?: io.github.maroondlabs/sourcebook has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.maroondlabs/sourcebook?: io.github.maroondlabs/sourcebook supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with io.github.maroondlabs/sourcebook?: io.github.maroondlabs/sourcebook is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.
Is io.github.maroondlabs/sourcebook actively maintained?: io.github.maroondlabs/sourcebook is less actively maintained — last commit was 95 days ago. It has 3 GitHub stars.