Install
$ agentstack add mcp-mathews-tom-archex ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
archex
[](https://github.com/Mathews-Tom/archex/actions/workflows/ci.yml) [](https://pypi.org/project/archex/) [](https://pypi.org/project/archex/) [](LICENSE)
[](assets/archex-banner.svg)
Verified local code context for agents.
AI coding agents usually start by opening a file, following an import, checking a type definition, and backtracking through the repo until the context window is partly spent before the real task starts. archex does that retrieval and structural expansion up front and returns a ranked, token-budgeted context bundle plus a receipt that records what was included, what was skipped, and whether the bundle is complete enough to act on.
It runs locally, uses deterministic retrieval and analysis, and does not require hosted inference or an API key. The v0.13 line adds stronger benchmark trust surfaces, bundle-only evaluator support, and default 4-bit TurboQuant vector storage for local vector indexes.
Start: [30-second quickstart](#30-second-quickstart) · [MCP and Claude Code](#mcp-and-claude-code) · [Python API](#python-api) · [Local metrics](docs/LOCALMETRICS.md) · [Compatibility matrix](docs/CLIENTCOMPATIBILITYMATRIX.md) · [Installation trust contract](docs/INSTALLATIONTRUST_CONTRACT.md) · [Security policy](SECURITY.md)
Quick links: [Proof bar](#proof-bar) · [Fast paths](#fast-paths) · [What archex returns](#what-archex-returns) · [Use it your way](#use-it-your-way) · [Trust and operations](#trust-and-operations) · [Measured results](#measured-results) · [Advanced workflows](#advanced-workflows) · [Installation details](#installation-details) · [Language support](#language-support) · [Development](#development) · [Documentation map](#documentation-map)
[](assets/archex-infographic-landscape.svg)
[Watch the explainer](assets/archex-explainer.mp4) · [Open banner SVG](assets/archex-banner.svg) · [Open infographic SVG](assets/archex-infographic-landscape.svg) · [Read the measured comparison](docs/ARCHEXVSCOCOINDEX.md)
Proof bar
| Safe-to-act signals | Surfaces | Language coverage | Public evidence | | --- | --- | --- | --- | | Query/scout receipts expose freshness, index revision, skipped candidates, omitted edges, completeness, and next action | CLI, MCP, Python API, Docker, Claude Code skill | 25 declared language IDs with explicit full vs chunk-only tiers | C1 public comparison, raw-ripgrep/read baseline, bundle-only evaluator lane, and TurboQuant A/B measurement with 7.07× mean vector .npz compression |
archex does not ask the downstream agent to trust ranking alone. Every query/scout receipt explains what was returned, what was skipped, whether freshness was current, and whether the bundle is complete enough to act on.
Fast paths
| If you are evaluating... | Start here | Why | | --- | --- | --- | | Agent workflows | archex doctor, then archex scout "question" --budget 1000 --format json | Checks local trust first, then returns a compact map, a receipt summary, and exact fetch handles. | | Claude Code or MCP | [MCP and Claude Code](#mcp-and-claude-code) | Stdio MCP server, optional warm --watch, additive top-level receipts, and an in-repo skill that teaches doctor → scout → fetch. | | Python applications | [Python API](#python-api) | Deterministic query(), analyze(), compare(), and receipt-bearing bundles. | | Benchmark proof | [Measured results](#measured-results) and [archex vs. cocoindex-code](docs/ARCHEXVSCOCOINDEX.md) | Same-task C1 report, raw-ripgrep/read baseline, bundle-only evaluator reports, required-file trust gates, and TurboQuant storage/recall evidence. | | Installation and clients | [Compatibility matrix](docs/CLIENTCOMPATIBILITYMATRIX.md) | Client bootstrap paths for Claude Code, Codex, Pi, OpenCode, Cursor, and oh-my-pi (omp); global/user scope by default, --dry-run previews. |
30-second quickstart
uv tool install archex
archex doctor
archex query "How does authentication work?" --format xml
archex doctor reports whether the local index, grammar support, model cache, MCP registration, and .archex/ state are healthy. Repo-local commands default to the current working directory. If the repo has not been initialized yet:
archex init
archex index
archex query "How does authentication work?" --format xml
What archex returns
archex returns a context bundle plus receipt, not an answer. The downstream agent or model still does the reasoning; archex decides which code, symbols, dependencies, and type context belong in the prompt, then records why that bundle is safe or incomplete.
User:
token = extract_bearer(request)
claims = verify_jwt(token)
return load_user(claims.sub)
]]>
auth.tokens.verify_jwt
pyjwt
The bundle carries ranked chunks, import context, referenced type definitions, dependency edges, token counts, and provenance. Use --format json or --format markdown when XML is not the right downstream envelope.
Small receipt example:
{
"receipt": {
"freshness": "clean",
"index_revision": "3d8b0c…",
"token_budget": { "requested": 12000, "consumed": 6132 },
"returned_total": 12,
"skipped_total": 23,
"included_edges_total": 9,
"omitted_edges_total": 17,
"context_complete": "incomplete",
"context_complete_reason": "dependency_frontier_cut",
"recommended_next_action": "fetch_skipped_candidate",
"returned_context": [
{
"handle": "chunk:src/auth/middleware.py::authenticate#function",
"file_path": "src/auth/middleware.py",
"start_line": 42,
"end_line": 78,
"score": 0.9312
}
],
"skipped_candidates": [
{ "file_path": "src/auth/session.py", "reason": "below_threshold" }
]
}
}
Use [CONTEXTRECEIPTS](docs/CONTEXTRECEIPTS.md) for the full field contract.
Why archex is different
Agents usually explore repositories by opening one file, following imports, checking type definitions, and backtracking. That burns context before the real task starts. archex performs local retrieval and structural expansion first: BM25F, optional local vector/SPLADE signals, graph expansion with edge confidence, type-definition packing, and intent-routed token budgets.
Repository → repo-local index → intent routing → retrieval → graph/type expansion → token-budgeted bundle → agent / MCP client
archex is a selection and assembly layer. Compression tools can shrink the final bundle later, but compressed irrelevant context is still irrelevant. For the vector index itself, v0.13 enables 4-bit TurboQuant storage by default when vector retrieval is turned on: same measured recall/MRR on the current corpus, about seven times smaller vector artifacts, and self-describing compatibility with older unquantized .npz files.
Use it your way
CLI
archex query "Where is cache invalidation handled?" --format xml
archex scout "How does authentication flow through this repo?" --budget 1000 --format json
archex index --quantize-vectors --quantize-bits 4 --allow-remote-code
archex graph export --output .archex/archgraph.json
archex graph neighbors src/auth/middleware.py --graph .archex/archgraph.json --format markdown
archex symbol 'symbol:src/auth/middleware.py::authenticate#function'
MCP and Claude Code
Install the MCP extra and register the stdio server:
uv tool install "archex[mcp]"
{
"mcpServers": {
"archex": { "command": "archex", "args": ["mcp"] }
}
}
Install the client config (global/user scope by default; pass a SOURCE path or --scope project for a repo-local install). Add --dry-run to preview the exact target and config without writing:
archex install-client claude-code # global, writes immediately
archex install-client claude-code --dry-run # preview only, no changes
archex install-client claude-code . --scope project
For warm local sessions, keep the MCP process alive and optionally watch the repo:
archex mcp --watch --watch-path .
archex is a first-class install-client target for Claude Code, Codex, Cursor, OpenCode, Pi, and oh-my-pi (omp → ~/.omp/agent/mcp.json). Registration alone is not enough: harnesses with on-demand tool discovery surface a registered server's tools only after the agent activates them, and agent guidance that names only the CLI never produces MCP calls. Append the ready-to-paste guidance prompt to a global or repo-specific agent file so agents reach for the MCP tools first:
archex install-client omp --agent-file ~/.omp/agent/AGENTS.md
archex metrics then reports a CLI-vs-MCP surface split so you can see whether agents actually route context through archex. The [compatibility matrix](docs/CLIENTCOMPATIBILITYMATRIX.md) explains the registration → surfacing → invocation distinction.
The in-repo Claude Code skill lives at [skills/archex/](skills/archex/). Its /archex command runs archex doctor, initializes/indexes when needed, scouts first for broad questions, then fetches exact symbol: or chunk: handles before a larger bundle query.
Exact install, MCP, Docker, cache, uninstall, and trust semantics are documented in the [installation trust contract](docs/INSTALLATIONTRUSTCONTRACT.md). Client-specific config targets and bootstrap paths live in the [compatibility matrix](docs/CLIENTCOMPATIBILITYMATRIX.md).
Local usage metrics are off by default. If a user explicitly enables them with archex metrics enable, ARCHEX_USAGE_METRICS=on, or the persisted metrics setting, archex writes a machine-local ledger at ~/.archex/usage.sqlite. That ledger records anonymous counters only: tool name, category, token counts, file count, repo-local random ID, freshness, and index revision. It does not store query text, file paths, symbols, handles, rendered outputs, prompt bodies, remote URLs, org names, or repo names in event rows. archex metrics summary reports two labeled savings numbers: savings versus a full-file paste (tokens_saved = max(full_file_tokens - returned, 0), where full_file_tokens is the true per-file token cost of the returned files, not an inflated chunk sum) and savings versus a realistic targeted read (the matched line ranges plus a small context window — the conservative counterfactual). Both baselines are derived from the index, so the metrics path re-reads no file and calls no model. Whole-repo avoided tokens are demoted below the savings lines and labeled an upper-bound/context figure, not savings.
Important boundary: archex ships with no telemetry by default. Optional local metrics are separate from telemetry, stay on the machine, and require explicit enablement. Detailed traces remain a second explicit opt-in on top of metrics enablement. The exact calculation rules, privacy boundary, and controls live in [LOCALMETRICS](docs/LOCALMETRICS.md).
archex metrics is the control surface:
archex metrics enable
archex metrics
archex metrics export --output usage.json
archex metrics delete --all
archex metrics trace enable
ARCHEX_USAGE_METRICS=on archex query "Where is auth handled?"
Detailed traces stay opt-in via archex metrics trace enable or ARCHEX_USAGE_TRACE=on. Traces remain local-only and still do not store source code or rendered outputs. Metrics code paths make no LLM calls, no hosted upload calls, and no background network calls in v1.
Python API
from archex import query
from archex.models import RepoSource
bundle = query(
RepoSource(local_path="."),
"Where is database connection pooling implemented?",
)
print(bundle.to_prompt(format="xml"))
analyze() returns an ArchProfile; compare() returns deterministic cross-repo dimension comparisons. LangChain and LlamaIndex retrievers ship as optional extras.
Docker
Two local-first images are built in CI:
Docker and warm-container MCP examples
# BM25-only, no torch
docker run --rm -v "$PWD:/workspace" -w /workspace ghcr.io/mathews-tom/archex:slim archex doctor
# Full local-embedding image with FastEmbed runtime
docker run --rm -v "$PWD:/workspace" -w /workspace ghcr.io/mathews-tom/archex:full archex query "Where is cache invalidation handled?" --strategy hybrid
Warm-container MCP pattern:
docker run -d --name archex-mcp -v "$PWD:/workspace" -w /workspace ghcr.io/mathews-tom/archex:slim sleep infinity
docker exec -i archex-mcp archex mcp
MCP client config for that container:
{
"mcpServers": {
"archex": {
"command": "docker",
"args": ["exec", "-i", "archex-mcp", "archex", "mcp"]
}
}
}
The mounted repository owns .archex/, so indexes survive container restarts and stay out of source control.
Trust and operations
| Surface | Contract | | --- | --- | | Security policy | Supported versions, disclosure workflow, no-telemetry posture, secret-handling guidance, and model remote-code policy live in [SECURITY](SECURITY.md). | | Context receipts | Field contract, freshness/completeness semantics, output surfaces, and benchmark linkage live in [CONTEXTRECEIPTS](docs/CONTEXTRECEIPTS.md). | | Compatibility matrix | Tested vs unverified clients, exact config shapes, bootstrap commands, and verification steps live in [CLIENTCOMPATIBILITYMATRIX](docs/CLIENTCOMPATIBILITYMATRIX.md). | | Installation trust contract | Exact CLI, MCP, Docker, skill, cache, network, freshness, benchmark, and uninstall semantics live in [INSTALLATIONTRUSTCONTRACT](docs/INSTALLATIONTRUSTCONTRACT.md). | | archex install-client | Client config writer for Claude Code, Codex, Pi, OpenCode, Cursor, and oh-my-pi (omp). Global/user scope by default; --dry-run previews without writing. | | archex doctor | Text/JSON diagnostics for index health, staleness, local model cache presence, grammar availability by tier, MCP registration, model security, and .archex/ disk usage. | | Repo-local .archex/ | Generated state: settings, metadata, SQLite index, optional vectors, graph artifacts, dogfood history. Keep it uncommitted. | | Local usage metrics | Calculation rules, privacy boundaries, default-off versus opt-in behavior, export/delete controls, and retention live in [LOCALMETRICS](docs/LOCALMETRICS.md). |
Measured results
The public C1 harness publishes the same external-repo comparison for archex, cocoindex-code (ccc), and a raw-ripgrep/read baseline. It records cold-start, warm latency, recall, precision, F1, token efficiency, required-file recall, missed-required-file rate, missed-required-task rate, all-required-present rate, receipt accuracy, and bundle-completion penalty tokens. The checked-in artifacts include those trust fields; receipt accuracy is n/a for the historical C1 run because those artifacts predate query receipt capture. Core retrieval benchmarks make no LLM calls.
See [archex vs. cocoindex-code](docs/ARCHEXVSCOCOINDEX.md) for the current published comparison and [Retrieval Default Decisions](docs/RETRIEVALDEFAULTDECISIONS.md) for the decision trail.
A broader competitive comparison is available with archex benchmark headtohead competitive --input benchmarks/headtohead/results --format markdown. It groups the same lanes by repo/task family and aggregate (no aggregate-only winner) and adds warm p50/p95 latency, region/line recall where labeled, compression ratio, and an operational table. The checked-in public artifact set now includes the benchmark-only archex candidate lanes (archex_query_compressed, archex_query_efficiency_packed) alongside archex, ccc, raw-ripgrep/read, and two Graphify follow-up lanes: graphify_build_plus_query (aggregate recall 0.70, required-file recall 0.70, cold-start 937 ms, warm p50/p95 165/184 ms) and graphify_query_warm (aggregate recall 0.70, required-file recall 0.70, cold-start 0 ms, warm p50/p95 168/207 ms). Graphify i
…
Source & license
This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: Mathews-Tom
- Source: Mathews-Tom/archex
- License: Apache-2.0
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.