Serena

Name: Serena
Author: oraios

serena-agent · by oraios

A powerful toolkit for coding, providing semantic retrieval and editing capabilities.

30.6k 3 tools GitHub PyPI

No known CVEs

MIT license

Actively maintained

Last commit 1d ago

Works with most clients

Transport: stdio

3 tools · ~126 tok

Grade A · 0.1% of 200K ctx

MCPpedia last refreshed this data 23h ago

Edit this pageView history

Serena is an MCP server that a powerful toolkit for coding, providing semantic retrieval and editing capabilities. Its tool list has not been published yet over stdio, requires no API key, and scores 91/100 on MCPpedia's security, maintenance and efficiency rubric.

Developer Tools

Step 1

Install in your client

Config is the same across clients - only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "serena": {
      "args": [
        "-p",
        "3.13",
        "--from",
        "git+https://github.com/oraios/serena",
        "serena",
        "start-mcp-server"
      ],
      "command": "uvx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/serena)](https://mcppedia.org/s/serena)

Read me

What Serena does

A powerful toolkit for coding, providing semantic retrieval and editing capabilities.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked - your result helps other developers.

uvx 'serena-agent' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Scored, not listed

Why this score

Five weighted categories - click any category to see the underlying evidence.

Score breakdown

91/100across 5 weighted dimensions

How we score →

0255075100

−9

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

1 fixed

CVE-2026-49471high · fixedCVSS 8.3

Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE

### Summary Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port (TCP 24282, hardcoded as `0x5EDA` in `constants.py`). The server has no authentication, no CSRF protection, and no Host header validation. A DNS rebinding attack allows a malicious webpage to reach this API from any browser and write arbitrary content to the agent's persistent memory store — which the agent reads and acts on autonomously. Combined with `execute_shell_command` (enabled b

Affected: >= 0Fixed in 1.5.2source →

Inventory

Tools (3)

Click any tool to inspect its schema.

~126 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience - it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Serena safe to use?: Serena has no known CVEs as of the latest MCPpedia security scan. Authentication requirements were not detected automatically - check the project's documentation before connecting in a shared environment. Licensed under MIT.
How do I install Serena?: Serena supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can Serena do?: Serena provides 3 tools: find_symbol, find_referencing_symbols, insert_after_symbol. See the full tools list on the server page for descriptions and parameters.
What AI clients work with Serena?: Serena is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.
Is Serena actively maintained?: Serena is actively maintained - last commit was 1 day ago. It has 30,568 GitHub stars.

Similar servers

Others in developer-tools

View all →

XcodeBuildMCP97

XcodeBuildMCP provides tools for Xcode project management, simulator management, and app utilities.

6.5k 2

XcodeBuildMCP97

XcodeBuildMCP provides tools for Xcode project management, simulator management, and app utilities.

6.5k 1

io.github.signerlabs/shipswift96

40+ production-ready SwiftUI recipes for building full-stack iOS apps via MCP.

3.2k 3

Mcp Gitlab96

MCP server for using the GitLab API

2.1k 12

MCP Security Weekly

Get CVE alerts and security updates for Serena and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

{ "mcpServers": { "serena": { "args": [ "-p", "3.13", "--from", "git+https://github.com/oraios/serena", "serena", "start-mcp-server" ], "command": "uvx" } } }

Frequently Asked Questions

Is Serena safe to use?

Serena has no known CVEs as of the latest MCPpedia security scan. Authentication requirements were not detected automatically - check the project's documentation before connecting in a shared environment. Licensed under MIT.

How do I install Serena?

Serena supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What can Serena do?

Serena provides 3 tools: find_symbol, find_referencing_symbols, insert_after_symbol. See the full tools list on the server page for descriptions and parameters.

What AI clients work with Serena?

Serena is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.

Is Serena actively maintained?

Serena is actively maintained - last commit was 1 day ago. It has 30,568 GitHub stars.