Search, navigation and analysis across every repository you own, through a web interface for people and an MCP server for agents. One binary and one config file. No database server, no search cluster, no message queue.
The web interface, the HTTP API and the MCP server are one surface, and every request through any of them meets the same authorisation decision.
Search, read files, follow definitions and references, map dependencies, list findings, rank hotspots. Every tool call is an HTTP API call, so an agent can never see more than the person it acts for.
Each key belongs to one person and one tool, is named when it is created, records when it was last used, and can be revoked on its own. Revoking the key in one editor leaves the others working.
MCP clients sign in through the browser session your people already have. Nothing to paste, and no shared deployment-wide key.
The searchcode process makes no outbound connection unless you configure one. Three things can configure one: a code-host connection, which you create and which names exactly one host; OTLP tracing, which is off by default; and a remote syslog audit sink, which is off by default. It never connects to the vendor under any circumstances, on any tier.
| Activation or registration | None. It runs from the moment you start it. |
|---|---|
| Licence check | Offline. The signature is verified inside the binary, on every edition. |
| Usage reporting | None. No ping, no counts of users or repositories, no hostnames. |
| Telemetry and update checks | None. |
| If it cannot reach us | Nothing changes, because it never tries. An air-gapped instance works the same as a connected one. |
| If the licence lapses | Everything keeps working through a grace period. After it, new indexing pauses until renewal, and search, the API, MCP, audit and access control carry on. |
The Helm chart generates its NetworkPolicy from the connections you declared, so you can compare what the process is allowed to reach with what you configured.
Set connections.egress: internal-only and a public code host is refused when the configuration loads, before anything is fetched.
searchcode decides who can see a repository from rules you write. It does not copy permissions from your code host.
Put searchcode behind the authenticating proxy you already run, such as oauth2-proxy, and it reads the user and their groups from it. Or use local accounts. Every edition gets both.
Grant identity groups a role on groups of repositories. Rules only add access, so the result never depends on their order. A repository someone cannot see answers “not found”, and is never counted in their results.
Ask why a person can see a repository and get the rules that granted it.
Every denial, credential change, tool call and admin action is recorded as JSON to a file, stdout or syslog. It cannot be switched off, on any edition.
Full-text search across every repository or one, with phrases, boolean operators, regular expressions and fuzzy matching. Facets by language, repository and technology narrow a broad query in one click.
Go to a definition or find references in one repository or across all of them. Ten languages are parsed for exact declarations, and every result says how sure it is.
Which repositories use a library, and at which version, across six ecosystems. A licence audit of what manifests state. Within a repository, which files import which, and which tests to run after a change.
Hotspots ranked by complexity and churn, files that change together, and whether complexity is rising or falling, repository by repository, over time.
Leaked credentials, insecure code patterns and code quality findings, each with a file and a line, and a CWE where one honestly applies.
Search, file view, blame, history and a repository tree, all rendered on the server. Permalinks pin a commit, so a link still points at the same code next year.
Connect GitHub or GitLab, including GitHub Enterprise Server and self-managed GitLab, and searchcode discovers the repositories and keeps up as they are added or removed. Any other git server works by URL over SSH or HTTPS, and so does a directory on disk.
Run it under systemd from a tarball, in a container with Docker Compose, or on Kubernetes with the Helm chart. No database server, search cluster or queue to run beside it. Linux, on Intel/AMD and ARM.
It serves the moment it starts, while a large estate is still cloning.
Prometheus metrics on their own port, a Grafana dashboard and alert rules in the box, and searchcode doctor to produce a support bundle that leaves out your secrets.
Put your own name, logo and colours on the interface.
The same pages that ship with the product, including the one listing what it does not do.
Trust: what it connects to, and why Security questionnaire, answered OWASP agentic applications mapping
Install on a VM with systemd Install with Helm Air-gapped install Sizing
What it does Which credential to use Instructions for your agents What each kind of source supports
Editions differ in the number of repositories and users, and in nothing else. No feature is gated by licence, and a lapsed licence never changes who can see what.
Want to run it on your own code? Get in touch and we will set you up.
Contact ben@boyter.org