Server data from the Official MCP Registry
AI assistant with RAG, web search, filesystem and memory. MCP sub-agent for Claude Code.
AI assistant with RAG, web search, filesystem and memory. MCP sub-agent for Claude Code.
Vectora is an AI assistant MCP server with reasonable security practices but several concerns. The codebase properly manages API keys through environment variables and avoids hardcoding credentials. However, there are notable issues: broad subprocess execution capabilities without input sanitization in terminal tools, potential path traversal risks in file operations, missing rate limiting on API calls, and overly permissive error handling that could leak sensitive information. The permissions are appropriate for the stated RAG/coding use case, but the implementation has gaps in input validation and security controls. Supply chain analysis found 16 known vulnerabilities in dependencies (1 critical, 10 high severity). Package verification found 1 issue.
3 files analyzed · 26 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
This plugin requests these system permissions. Most are normal for its category.
Set these up before or after installing:
Environment variable: GOOGLE_API_KEY
Environment variable: COHERE_API_KEY
Environment variable: TAVILY_API_KEY
Environment variable: OPENAI_API_KEY
Environment variable: ANTHROPIC_API_KEY
Environment variable: LANGSMITH_API_KEY
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-brunosrz-vectora": {
"env": {
"COHERE_API_KEY": "your-cohere-api-key-here",
"GOOGLE_API_KEY": "your-google-api-key-here",
"OPENAI_API_KEY": "your-openai-api-key-here",
"TAVILY_API_KEY": "your-tavily-api-key-here",
"ANTHROPIC_API_KEY": "your-anthropic-api-key-here",
"LANGSMITH_API_KEY": "your-langsmith-api-key-here"
},
"args": [
"vectora-agent"
],
"command": "uvx"
}
}
}From the project's GitHub README.
Vectora is an open-source AI assistant (Apache 2.0) built for developers — local-first, self-hosted, and designed to run as a powerful sub-agent inside any MCP-compatible orchestrator (Claude Code, Claude Desktop, Paperclip, VS Code extensions).
At its core, Vectora solves the knowledge gap problem: LLMs don't know your codebase, your docs, or the latest versions of your stack. Vectora bridges that gap with RAG (Retrieval-Augmented Generation) — ingest your docs once, and every AI interaction becomes contextually aware.
Every message enters through a single entry point and is routed by the Orchestrator to the right specialized agent:
START
└─► orchestrator (responds inline OR delegates with task_query)
├─► [respond] → END
├─► [search] → search → search_tools → process_retrieval ↻ → END
├─► [coder] → coder → coder_tools ↻ → END
└─► [rag_subgraph] → rag_subgraph → orchestrator (synthesis) → END
| Agent | Responsibility | Tools |
|---|---|---|
| orchestrator | Primary LLM agent — responds directly OR delegates with an explicit task description | create_artifact, save_memory, get_memory, delete_memory |
| search | Web research, real-time info, builds knowledge base via cascading embeddings | web_search, fetch_url, vector_search |
| coder | File operations, terminal commands, code generation | file_read, file_edit, file_write, grep, list_dir, terminal |
When the orchestrator routes to rag, a dedicated subgraph runs the full retrieval pipeline before synthesis:
rag_retrieve (vector_search)
└─► rag_decide (score threshold)
├─► rag_inject (score ≥ 0.7 — high confidence, inject directly)
├─► rag_rerank (score 0.4–0.7 — rerank with Cohere before inject)
└─► rag_websearch (score < 0.4 — fall back to web + auto-embed results)
Results are injected as a SystemMessage into context. The Orchestrator then synthesizes the final answer inline, without a separate agent hop.
Agents explicitly call create_artifact to persist structured documents (plans, specs, guides, architecture decisions) to ~/.vectora/artifacts/{session_id}/ as Markdown files. The tool returns structured metadata (path, title, type, session_id, timestamp) that the Orchestrator can reference in future turns.
After any web_search or fetch_url call, process_retrieval automatically queues the results for embedding into LanceDB — fire-and-forget, no blocking. Your vector store grows passively as you use web search.
Vectora uses Cohere for embeddings (embed-multilingual-v3.0) and reranking (rerank-multilingual-v3.0). It offers a generous free tier with first-class LangChain integration.
Get your key: https://dashboard.cohere.com/api-keys
Vectora uses Tavily for real-time web search and URL content extraction. It offers a generous free tier optimized for AI agents.
Get your key: https://app.tavily.com/
| Provider | Free Tier | Get Key |
|---|---|---|
| Google Gemini ✅ Recommended | Yes | aistudio.google.com |
| Cohere | Yes | dashboard.cohere.com |
| Ollama (local) | No cost | ollama.ai |
| OpenAI | Paid | platform.openai.com |
| Anthropic | Paid | console.anthropic.com |
Install Vectora globally with uv:
uv tool install vectora-agent
On first run, the setup wizard will ask for your API keys and write them to ~/.vectora/.env.
vectora # starts chat (wizard runs automatically if no keys found)
To connect Vectora as an MCP sub-agent for Claude Code or Claude Desktop, add to your .mcp.json:
{
"mcpServers": {
"Vectora": {
"command": "vectora",
"args": ["mcp-server"]
}
}
}
Use this when you want Vectora running on a server and accessible from multiple machines or orchestrators via SSE.
Local (no domain):
cp .env.example .env
# Edit .env with your API keys
docker compose up -d
# SSE endpoint: http://localhost:8000/sse
VPS with Traefik (HTTPS + domain):
cp .env.example .env
# Edit .env with your API keys, VECTORA_DOMAIN and ACME_EMAIL
# Create the shared Traefik network if it doesn't exist yet
docker network create traefik-public
docker compose -f docker-compose.yml -f docker-compose.traefik.yml up -d
# SSE endpoint: https://vectora.yourdomain.com/sse
To connect from Claude Code or any MCP-compatible orchestrator:
{
"mcpServers": {
"Vectora": {
"url": "https://vectora.yourdomain.com/sse"
}
}
}
git clone https://github.com/brunosrz/vectora.git
cd vectora
uv sync
cp .env.example .env
# Edit .env with your API keys
uv run vectora
vectora [options] Start chat (resume last session for this directory)
vectora mcp-server Start MCP server (stdio)
vectora traces View observability traces
vectora sessions List all saved sessions
vectora config Show current configuration
vectora config --set KEY=VALUE Edit a setting
Options:
--model MODEL Switch LLM model (provider auto-detected). Persists.
--ollama Force Ollama provider (for arbitrary local model names)
--session ID Resume a specific session by 6-digit ID
--new Force a new session
--verbosity N Verbosity level 0–5 (0=silent, 5=debug panel). Persists.
--version Show version
| Command | Description |
|---|---|
/help | Show quick help |
/list | Show all commands |
/tools | List available tools |
/model | List or switch models |
/debug [0-5] | Set verbosity level (tool calls, routing decisions, log panel) |
/new | Start a new session |
/sessions | List all sessions |
/session <id> | Switch to a specific session |
/quit | Exit |
Input shortcuts: Enter sends, Alt+Enter or Shift+Enter adds a line break.
15 tools across 5 categories, always available to all agents:
| Category | Tools | Primary Agent |
|---|---|---|
| Web | web_search, fetch_url | search |
| RAG | vector_search, embedding, ingest_docs | search / RAG subgraph |
| Files | file_read, file_edit, file_write, grep, list_dir, terminal | coder |
| Artifacts | create_artifact | orchestrator |
| Memory | save_memory, get_memory, delete_memory | orchestrator / coder |
| MCP | call_mcp_tool | all |
All data is stored locally in ~/.vectora/:
~/.vectora/
├── .env # API keys (secrets — never commit)
├── settings.json # Runtime preferences (provider, model, verbosity)
├── data/
│ ├── vectora.db # Sessions, memories, LangGraph checkpoints (SQLite)
│ ├── embedding_queue.db # Async embedding queue (SQLite)
│ ├── traces.db # Internal observability spans (SQLite)
│ └── lancedb/ # Vector store for RAG (LanceDB)
├── artifacts/ # Auto-detected plans, specs, guides
│ └── {session_id}/
│ └── *.md
├── keys/ # Reserved for future key management
└── logs/
├── vectora.jsonl # Structured JSON logs
└── session_*.md # Exported session audit trails
Separation of concerns:
~/.vectora/.env — secrets (API keys). Never versioned.~/.vectora/settings.json — non-secret runtime preferences (active provider, model, verbosity, last session per directory). Managed by vectora config.| Layer | Technology |
|---|---|
| Language | Python 3.14+ managed by uv |
| Agent Framework | LangChain + LangGraph |
| Agent Pattern | Orchestrator + Specialized Workers (search / coder) + RAG Subgraph |
| Vector Store | LanceDB — file-based, zero-config |
| Embeddings | Cohere — embed-multilingual-v3.0 + rerank-multilingual-v3.0 |
| Persistence | SQLite via aiosqlite + LangGraph Checkpointer |
| Context Protocol | MCP via FastMCP |
| Terminal UI | Rich + prompt-toolkit |
| Observability | LangSmith (optional) |
API keys go in ~/.vectora/.env (created by the setup wizard) or a project-local .env:
# LLM Provider (auto-detected from available keys if not set)
LLM_PROVIDER=google-genai
GOOGLE_API_KEY=your_key_here
# Required: RAG embeddings + reranking
COHERE_API_KEY=your_key_here
# Required: Web search + URL extraction
TAVILY_API_KEY=your_key_here
# Optional: Tracing
LANGSMITH_TRACING=false
LANGSMITH_API_KEY=your_key_here
LANGSMITH_PROJECT=vectora
Runtime preferences (model, verbosity, session history) are managed in ~/.vectora/settings.json via vectora config or the /model and /debug chat commands — no need to touch .env for these.
Apache 2.0. See LICENSE.
Be the first to review this server!
by Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
by mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.
by Microsoft · Content & Media
Convert files (PDF, Word, Excel, images, audio) to Markdown for LLM consumption