reed-mcp

Your assistant reads your private documents. Nothing leaves the machine.

An MCP server that puts reed — a local-first RAG service with audited citations — behind four read-only tools, so any MCP host can answer from your own documents.

The problem

Connecting an assistant to your documents normally means uploading them somewhere. For a law firm, a clinic or anyone under GDPR, that is not a deployment detail — it is the reason the project does not happen.

The pieces to avoid it already exist: local models, local vector stores, RAG services that run on a laptop. What was missing is the join. An assistant that can use a local index needs a tool interface, and a RAG service that answers in prose is the wrong shape — the host already has a model, and a better one. What it needs is evidence.

Related MCP server: rag-retriever-mcp

Constraints

• Nothing leaves the machine. The host spawns this server over stdio; the server talks to reed over loopback. There is no telemetry, no analytics and no third-party host in the request path.

• The host's model writes the answer. reed-mcp returns ranked passages with filenames, pages and scores. Attribution is the point: an answer nobody can check is worse than no answer.

• Read-only. No upload, no replace, no delete. A tool that cannot destroy anything needs no confirmation dialog and no trust.

• Consumer hardware. A laptop, a 4B model, no GPU cluster.

Architecture

flowchart LR
    H["MCP host<br/>(Claude Desktop, Claude Code)"] -->|stdio| M["reed-mcp"]
    M -->|"HTTP, loopback"| R["reed"]
    R --> Q[("Qdrant<br/>hybrid index")]
    R --> O["Ollama<br/>local models"]
    M -.->|"evidence + citations"| H

Two decisions carry the design.

A separate process, not a reed subcommand. reed is single-node by design: one process per registry and active index. Importing it as a library while reed serve is running is exactly what that model forbids, so reed-mcp is a client, and reed's HTTP surface is the contract between them.

search before ask. reed_search returns evidence and stops; the host's model writes the answer and cites it. reed_ask runs reed's own local model instead, which costs seconds rather than milliseconds — worth it when a fully local generation is the requirement, wasteful when the host was going to write the answer anyway. This is why reed grew POST /v1/search: retrieval without generation did not exist, and without it every lookup paid for an answer the caller would discard.

Tools

Results

Measured end to end — a real MCP session over stdio, a real reed, a real index — on an Apple M5 (32 GB) running reed 0.5.1 with EmbeddingGemma and qwen3.5:4b through Ollama. 30 searches and 5 asks after a warm-up call:

The gap is the whole argument for search: retrieval is thirty times cheaper than generation, and the host already has a model.

On egress, the honest claim is architectural rather than measured: the only host reed-mcp opens a connection to is REED_MCP_URL, and its runtime dependencies are httpx and the MCP SDK. Independent verification is a job for a tool built for it — that measurement will be added when egress-audit exists rather than asserted here.

Run it

You need a running reed 0.5.0 or newer (/v1/search first shipped there; 0.5.1+ recommended) and uv.

Claude Code:

claude mcp add reed -- uvx reed-mcp

Claude Desktop, in claude_desktop_config.json:

{
  "mcpServers": {
    "reed": {
      "command": "uvx",
      "args": ["reed-mcp"]
    }
  }
}

Then ask your assistant something your documents answer. It will search, quote and cite.

Configuration

Environment variables only — never tool arguments, so nothing sensitive can be elicited through the tool channel:

Security model

• Retrieved text is data, not instructions. Excerpts reach the host's model as quoted document content, and every tool description says so. reed audits citations on its side. Neither can semantically sanitise a document: index what you trust, and treat a corpus anyone can write to as untrusted input.

• Credentials never touch the tool channel. They arrive through the process environment and are never logged.

• Nothing here can modify your corpus. All four tools are annotated read-only, and the server implements no write path.

Development

uv sync
uv run pytest
uv run ruff check . && uv run mypy

The unit suite is hermetic — reed is stubbed at the HTTP layer. The end-to-end suite is not, and that is the point: it launches this package the way a host does and drives it against a real reed. CI runs it against the published reed image, pinned by digest.

REED_MCP_E2E_URL=http://localhost:8000 uv run pytest e2e

Mocks proved the wiring and missed the bug that mattered — a client bound to an event loop that had already closed, which broke every tool call in every real host while the unit suite stayed green. The e2e suite exists because of it.

License

Apache-2.0.