Evaluation record · mcp-server-serena

Serena MCP

v1.5.3

Oraios AI

MCPcoding-agentlanguage-serversemantic-coderefactoring

Strong

About This MCP

Open-source semantic coding toolkit from Oraios AI that turns any MCP-capable agent into an IDE-grade coding assistant. Uses language servers (LSP) for symbol-level code navigation and editing — find_symbol, find_referencing_symbols, precise symbol edits, plus refactoring tools (rename/move/inline) — with project memory and shell execution across 40+ languages. An optional paid JetBrains-plugin backend adds interactive debugging. High-privilege local tooling: full filesystem and shell access.

Last Evaluated: July 9, 2026

Official Website

Trust Vector Analysis

Dimension Breakdown

🚀Performance & Reliability

symbol resolution accuracy

Accuracy testing of symbol resolution and reference finding against IDE ground truth in multi-file projects

Evidence

Serena README — Symbol lookup and reference finding are backed by real language servers (LSP), giving compiler-grade accuracy for find_symbol and find_referencing_symbols across many supported languages

highVerified: 2026-07-09

operation success rate

Hands-on testing of symbolic read/edit operations across project states

Evidence

Serena tool suite — Symbol-level editing operations (insert/replace at symbol granularity) succeed reliably when the language server has indexed the project; failures cluster around partially-indexed or syntactically broken code

mediumVerified: 2026-07-09

language server stability

Review of reported language-server issues and stress testing on large repositories

Evidence

Serena issue tracker — Stability varies by language server implementation; large projects can hit slow startup indexing, and some language servers occasionally require restart — a known operational caveat

mediumVerified: 2026-07-09

error recovery

Error-path testing including LSP crashes, unindexed files, and invalid edits

Evidence

Serena implementation — Tool failures return descriptive errors; language servers can be restarted via tooling, and the onboarding/memory system helps agents re-establish context after failures

mediumVerified: 2026-07-09

large project handling

Token-efficiency and navigation testing on repositories with 100k+ lines

Evidence

Serena design documentation — Symbol-level navigation reads only relevant code instead of whole files, keeping token usage low on large codebases — a key advantage over grep/read-based agents

mediumVerified: 2026-07-09

🛡️Security

shell execution risk

Capability analysis of shell execution tooling and its abuse potential under prompt injection

Evidence

Serena tool suite — execute_shell_command runs arbitrary shell commands with the user's privileges — effectively a full local code-execution surface; can be disabled via tool configuration/modes but is enabled in typical agent setups

highVerified: 2026-07-09

filesystem access risk

Analysis of file read/write tool boundaries and project-scoping enforcement

Evidence

Serena project configuration — Read/write access across the activated project directory, including config files and anything reachable by relative paths; project activation provides scoping but enforcement is application-level, not sandboxed

highVerified: 2026-07-09

sandboxing isolation

Review of process isolation, privilege boundaries, and available containment options

Evidence

Serena runtime model — Runs as a local Python process (uvx/uv) with no OS-level sandbox; combined with shell execution, a hijacked agent inherits the full local user privilege. Containerized deployment is possible but not the default

highVerified: 2026-07-09

credential exposure risk

Analysis of secret-reachability via file and shell tools

Evidence

Serena architecture — Server itself requires no credentials, but filesystem and shell access mean local secrets (.env files, SSH keys, tokens) are readable if the agent is steered to do so

mediumVerified: 2026-07-09

unauthorized action risk

Authorization boundary analysis of write and execution tools, including available mode-based restrictions

Evidence

MCP security guidance — Code edits and shell commands can alter or destroy local state and reach the network; Serena's modes/contexts can restrict tool availability, and host-level approval remains the main guardrail for destructive actions

mediumVerified: 2026-07-09

🔒Privacy & Compliance

code exposure

Data flow analysis of tool outputs to the LLM provider

Evidence

MCP data flow architecture — Symbol contents, file excerpts, and shell output are sent to the LLM provider as tool results; symbol-level reads expose less code per call than whole-file approaches but private code still leaves the machine

highVerified: 2026-07-09

sensitive data protection

Privacy controls assessment of file-content handling

Evidence

Serena repository — No built-in secret detection or redaction; .env files, keys, and credentials in the project tree can be read and forwarded to the LLM if requested

mediumVerified: 2026-07-09

local data control

Review of local execution model, memory storage, and data residency

Evidence

Serena architecture — Fully local operation: no hosted backend, no vendor telemetry; project memories are stored as plain local files (.serena directory) the user can inspect and delete

highVerified: 2026-07-09

third party data sharing

Data sharing pathway analysis

Evidence

Serena documentation — No data is sent to Oraios AI or any third party by the server itself; the only outbound data flow is tool results to the user's chosen LLM provider

highVerified: 2026-07-09

👁️Trust & Transparency

documentation quality

Documentation completeness and accuracy review

Evidence

Serena README and docs — Detailed README covering installation (uvx/uv), client integration, modes/contexts, tool list, supported languages, and project onboarding; active changelog

highVerified: 2026-07-09

open source transparency

Source code and license review

Evidence

GitHub repository — Fully open source under MIT with no proprietary backend — the entire stack including language-server orchestration is auditable

highVerified: 2026-07-09

operation visibility

Logging and observability assessment including the built-in dashboard

Evidence

Serena tooling — All operations are explicit named tool calls visible in MCP host logs; an optional local dashboard/log window shows server activity, though shell command side effects are only as visible as their output

mediumVerified: 2026-07-09

project memory transparency

Review of memory persistence format, location, and influence on agent sessions

Evidence

Serena memory system — Project memories are human-readable markdown files stored in the repository's .serena directory — fully inspectable and editable, though persistent memories can silently shape future agent behavior if unreviewed

highVerified: 2026-07-09

⚙️Operational Excellence

ease of setup

Setup complexity assessment including language-server prerequisites

Evidence

Serena installation docs — One-liner via uvx serena (PyPI serena-agent), but requires Python/uv tooling plus per-language language servers; initial project indexing and onboarding add friction versus zero-config servers

highVerified: 2026-07-09

performance

Latency and token-efficiency benchmarking on indexed projects

Evidence

Serena design documentation — Symbol-level operations are fast after indexing and dramatically cheaper in tokens than whole-file reads; first-run language-server indexing on large projects can take minutes

mediumVerified: 2026-07-09

feature coverage

Feature completeness assessment against IDE-grade coding-agent needs

Evidence

Serena tool suite — Comprehensive coding toolkit: symbol search/references, symbol-level editing, refactoring (rename/move/inline), pattern search, file operations, shell execution, project memory, and onboarding — spanning 40+ languages via LSP, with an optional paid JetBrains-plugin backend adding interactive debugging

highVerified: 2026-07-09

community adoption

Adoption metrics and community-activity analysis

Evidence

GitHub API — ~26,300 stars as of 2026-07-09; widely adopted as a free, open-source way to add semantic code tools to Claude, and other MCP-capable agents

highVerified: 2026-07-09

maintenance activity

Commit frequency and release-cadence analysis

Evidence

GitHub repository activity — Very active development by Oraios AI with frequent releases (latest v1.5.3, 2026-05-26; 3,000+ commits), expanding language support, and responsive issue triage

highVerified: 2026-07-09

Strengths

+Language-server (LSP) backbone gives compiler-grade symbol navigation and references
+Symbol-level reading/editing slashes token usage on large codebases versus whole-file approaches
+Fully open source (MIT), fully local — no hosted backend, no telemetry, no API costs
+Project memory system persists codebase knowledge across sessions as inspectable markdown
+Broad language coverage (40+ languages) and active maintenance (~26.3k stars)
+Refactoring tools (rename/move/inline) and optional JetBrains-plugin backend with interactive debugging
+Modes/contexts allow restricting the tool surface, including disabling shell execution

Limitations

!Shell execution plus filesystem write access make it effectively full local code execution — high-privilege tooling that must be treated like granting terminal access
!No OS-level sandboxing by default; a prompt-injected agent inherits full user privileges
!No secret detection — local .env files, keys, and tokens are reachable and forwardable to the LLM
!Language-server stability and first-run indexing time vary by language and project size
!Setup requires Python/uv tooling and per-language language servers — more friction than npx-based servers
!Persistent project memories can silently steer future sessions if not reviewed

Metadata

license: MIT

supported platforms

0: macOS, Linux, Windows with Python 3.11+ (uv/uvx)

programming languages

0: Python

mcp version: 1.0

github repo: https://github.com/oraios/serena

github stars: 26300

latest release: v1.5.3 (2026-05-26)

package: serena-agent (PyPI)

api dependency: Local language servers (LSP) per language

authentication: None required (local operation)

first release: 2025-04

maintained by: Oraios AI

status: Active

privilege level: High - local filesystem write and shell command execution

transport types

0: stdio

1: sse

installation methods

0: uvx

1: uv

2: pip

3: docker

Use Case Ratings

code generation

Purpose-built for semantic coding: IDE-grade symbol navigation and precise edits make it one of the strongest free coding-agent toolkits

research assistant

Excellent for exploring and understanding large codebases via symbol-level navigation

education

Good for learning how real codebases are structured, though setup and privilege level need supervision

data analysis

Shell access enables running analysis scripts, but this is incidental rather than a designed capability