What rune does
The rune MCP server analyzes a project without changing its files. It parses supported source files into facts, records where each fact came from, and builds conclusions that retain links to those facts. Questions return ranked findings with file-and-line citations, snippets, and confidence information.
The analysis covers JavaScript and TypeScript constructs such as imports, calls, React components and hooks, Express routes, Next.js routes, and Vue components. It also handles shell, Lua, TOML, YAML, JSON, and Markdown. Security checks include hardcoded secrets, risky shell execution, GitHub Actions workflow issues, and dependency issues.
The server stores scan data in a .rune/ directory inside the project. Its operation is read-only: it observes and reports on the codebase rather than modifying project files.
How it works
An initial scan creates the project graph. Each recorded fact includes a source path, line number, code excerpt, and confidence level. Derived conclusions reference the fact identifiers that support them. When a question arrives, Rune retrieves relevant facts, forms and ranks hypotheses, and checks those hypotheses against the current files.
The rune_agent tool first performs a no-model triage pass. That pass decides whether the retrieved evidence is sufficient or whether the question needs deeper reasoning. A deeper pass can be enabled with deep: true, or forced with force: true; this is the part that may call a configured language model.
For model-written explanations, Rune sends only the evidence selected for the question, limited to as many as 40 short code snippets. It verifies each generated statement against the retrieved material and removes unsupported, uncited, or incorrectly quoted statements. This checks grounding against the supplied evidence, not whether the model interpreted that evidence correctly.
Setup and configuration
Install on Linux x64 or macOS Apple Silicon with the project’s install script. Windows users can download the Windows x64 executable from the latest release. The installer verifies a SHA-256 checksum and places the binary in ~/.local/bin.
Start the MCP endpoint by configuring a client with the executable and the serve command, followed by an absolute project path. A typical configuration uses rune serve /absolute/path/to/your-project.
The rune MCP server does not require a model key for MCP tool calls because the connected client supplies its own model. Command-line explanations can use Anthropic, OpenAI, an OpenAI-compatible endpoint, or Ollama. Relevant settings include ANTHROPIC_API_KEY, OPENAI_API_KEY, RUNE_LLM_BASE_URL, RUNE_LLM_MODEL, and RUNE_LLM_DEBUG. Use evidence-only mode or a local model when code should not be sent to an external provider.
Tools and capabilities
The MCP interface provides 13 tools. Named examples include:
rune_agent for evidence-based agent investigationsrune_search for searching project knowledgerune_explain for tracing a fact to its supporting evidencerune_verify_fact for checking an individual factrune_check_drift for identifying changes since scanningrune_list_routes for route informationrune_get_security_findings for security results
The command-line interface also supports scanning or rebuilding the graph, watching files for changes, serving MCP, explaining fact IDs, verifying stored facts, and maintaining project notes or experience logs.
Limitations and notes
Results are strongest for JavaScript, TypeScript, shell, Lua, and configuration formats. Other programming languages currently receive thinner analysis. The graph can become stale after files change; use the watch or verify functionality, or rescan the project.
Add .rune/ to .gitignore if the generated scan data should remain local. Binaries are unsigned, and there are no prebuilt binaries for Intel Macs or Linux ARM. Model explanations depend on the selected model and may still misread correctly retrieved evidence. The server currently understands software projects; support for other source types is planned rather than available now.