Koma Core MCP

io.github.swnotmetalPublished by GitHub account swnotmetalv0.1.1Updated Oct 24, 2026

Protected RAG storage — agents discover public metadata, content only by access token.

The publisher's own server: core.blue

VerifiedSTDIODesktop onlyKnowledge & MemorySecurity & Monitoring

Overview

AI-generated overview

A local MCP server exposing Koma Core's protected RAG storage, letting assistants search a public document index and fetch content by access tier.

What you can do
Search the public document index with optional category, tag and limit filters, returning metadata such as display name, category, tags, access tier and preview only, never content or tokens. Retrieve a document's full content by source ID, provided the supplied user tier meets or exceeds the document's tier. Work against three seeded demo documents spanning public, premium and enterprise tiers.
When to use it
Useful for trying out or demonstrating a tiered retrieval model where discovery of documents is public but content access is gated by access level. Suited to prototyping an agent workflow over protected RAG storage rather than production document management.
Requirements
Runs locally over stdio, installed from the npm package koma-core-mcp (for example via npx), so Node.js is needed. Optionally set the KOMA_MASTER_KEY environment variable for token derivation; a demo key is used if unset. No account or authentication is declared.
Before you install
The README states this is an in-memory reference implementation with no persistence and a demo master key, so it is not production-ready. The KOMA_MASTER_KEY secret is used for token derivation and should be a real 32-byte-minimum value if used beyond demos. Access control relies on the userTier value supplied to retrieve_doc, so tier checks are only as trustworthy as the caller.

Installation

In SourceWeft

  1. Open Koma Core MCP in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Koma Core MCP

Expose Koma Core's protected RAG storage as MCP tools for AI agents.

bash
npm install koma-core-mcp

What it demonstrates

Discovery ≠ Authorization. Agents can search the public index, but retrieve private content only with the correct access tier.

ToolWhat it doesAccess
search_docsSearch the public index — returns metadata, never contentPublic
retrieve_docFetch full content by source IDRequires userTier ≥ document tier

Setup

bash
# Optional: set a master key for token derivation (default is a demo key)export KOMA_MASTER_KEY=your-32-byte-minimum-secret

Claude Desktop

json
{  "mcpServers": {    "koma-core": {      "command": "npx",      "args": ["-y", "koma-core-mcp"]    }  }}

Tools

search_docs

  • category (optional) — filter by category
  • tag (optional) — filter by tag
  • limit (optional) — max results

Returns metadata only: displayName, category, tags, accessTier, preview. No content, no token.

retrieve_doc

  • sourceId (required) — the document source ID from search_docs
  • userTier (required) — public | premium | enterprise

Returns full content only if userTier ≥ the document's tier.

Seed Data

Three demo documents are ingested on startup:

sourceIdTier
guide-getting-startedpublic
api-referencepremium
internal-architectureenterprise

Security Boundary

This is an in-memory reference implementation — no persistence, demo master key. For production, implement the DatabaseAdapter interface against a real database and provide a real master key. See koma-core's README for the full security boundary.

Source: packages/koma-core-mcp/README.md at commit d31b9f6

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Core integrations

core.blue

blue.coreOfficial publisher

Remote MCP endpoint for core.blue's private per-customer agent memory "houses": read its manual, try a sandbox, get pricing and recommendations, and request a…

Streamable HTTPWeb executable
Knowledge & Memory10 toolsNov 4, 2026

Brevio Core

Published by GitHub account Brevio-Ventures

Local code-rule scanner for coding agents: scan diffs or files, explain rules, apply safe fixes, and turn a fix into a guard, with no model call.

STDIODesktop only
Developer Tools11 toolsNov 8, 2026

brain-core

Published by GitHub account xy-claude

Local MCP server that gives a Claude Code agent persistent memory across sessions, stored as markdown files plus a SQLite and vector index on your disk.

STDIODesktop only
Files & StorageNot validated · the package did not installNov 7, 2026

Scovant Core

Published by GitHub account Scovant

Passive AI-agent readiness scan of a website: robots, llms.txt, JSON-LD, MCP discovery, security.

STDIODesktop only
AI & MLNot validated yetNov 3, 2026

ProofCore

Published by GitHub account ProofCore-Protocol

Zero-Auth Cryptographic Notarization & Evidence Layer on TON Blockchain for AI Agents.

Streamable HTTPWeb executable
AI & ML4 toolsNov 3, 2026