Rune MCP server

Read from the package source without running it. The installed server may list more.

• rune_explain

  Given a fact or derived-conclusion id (as returned by other rune_ tools), return the full evidence trail: the raw fact(s) it's based on, file, line, and matched source text.

• rune_get_experience

  Get the history of past task attempts recorded for this project: what was tried, whether it succeeded or failed, and why. This is raw history, not verified rules -- use rune_get_memory for trusted, approved conventions.

• rune_get_file_dependencies

  Get the internal (relative-import) dependency list for a given file path, as recorded in the understanding graph.

• rune_get_memory

  Get durable project-specific knowledge Rune has recorded: conventions, required commands, known pitfalls. Each entry has a status (proposed/approved/rejected) and confidence score -- only 'approved' entries should be treated as trusted; 'proposed' entries are unverified and should be treated as a hint, not a fact.

• rune_get_overview

  Get a high-level architecture summary of the software: detected stack, component count, route count. Start here.

• rune_get_security_findings

  Get all security findings Rune has detected in this project: exposed secrets, dangerous shell execution, risky CI/CD workflow permissions, and typosquat-shaped dependencies. Use this before merging a PR or reviewing a codebase for security risk -- this is the single call that answers 'are there security concerns in this repo.' Every finding cites file, line, matched evidence, severity, and confide

• rune_list_components

  List all React components Rune has identified, with file location and detection kind (function/class).

• rune_list_routes

  List all API/page routes Rune has identified across Express and Next.js (pages + app router).

• rune_rescan

  Re-scan the project from disk and refresh Rune's understanding graph. Call this after significant code changes if `rune watch` isn't already running in the background.

• rune_search

  Search facts and derived understanding by name, file path, or route path substring. Use this to find where something lives before reading files directly.

• Code scan21 source files scanned25/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitylocal package, no credentials required12/15
• Maintenancelast push 1 days ago15/15
• Maintainer identityregistry namespace matches repository owner6/10

Rune: common questions

Is Rune MCP server safe?

Yes, by our scan: it is graded A (89/100). Read the Rune safety report

How do I install Rune?

It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.

Does Rune need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is Rune maintained?

The last commit was in the last day (2026-09-20). The latest release is v0.3.0.

What can I use instead of Rune?

Servers from other publishers that do the same job: MCPProxy MCP server, Trent MCP server and SecHelix MCP server. Compare all Rune alternatives.