Our grade: 4 checks
Based on public data, not a full audit. See how we grade. Something changed? Request a re-grade.
Community rating
- 5 0
- 4 2
- 3 5
- 2 9
- 1 3
Trust in production
- Trust it - 0%
- With caveats - 53%
- Wouldn't - 47%
32% would recommend this server
How reviewers scored it
- Setup & docs 2.4
- Auth experience 2.3
- Reliability 2.4
- Maintainer responsiveness 3.5
Why it got a C
Serena is Oraios AI's own open-source project (the oraios GitHub organisation; code is GPL-3.0-or-later, with the language-server layer under MIT). It runs on your machine as a local server (stdio, or HTTP you start yourself) and edits files in your project through language servers. It is in Anthropic's Claude plugin directory, and that plugin launches the latest code from the repo via uvx rather than a pinned version. Biggest deduction: there is no authentication, and in its full-toolset mode the agent can edit files and run shell commands (execute_shell_command); the README says agent harnesses like Claude Code typically disable those overlapping tools, and the Claude Code context turns the shell tool off. Past advisories were patched fast (all within a day or so of disclosure), but all three were code-execution paths: a repo-supplied pickle cache, template injection, and the dashboard via DNS rebinding. Only open projects you trust, and keep Serena on 2.0.0 or later. The dashboard starts by default on localhost port 24282.
How to connect
uv tool install -p 3.13 serena-agent; then in Claude Code: claude plugin install serena@claude-plugins-official (plugin runs uvx --from git+https://github.com/oraios/serena serena start-mcp-server)Is Serena MCP Server safe?
Is Serena MCP Server safe to use?
Serena MCP Server grades C (usable with care). There is no login: anything that can start or reach it gets its full access. It can run model-controlled code or uses a plaintext remote connection, so run it isolated with no credentials.
Does Serena MCP Server have known vulnerabilities?
Not in our current data: it has no open CVEs or advisories. We re-check as new ones are published.
Does Serena MCP Server support authentication?
No. It has no login of its own, so limit who and what can start it.
Alternatives in Developer Tools
- A Amplitude MCP ServerAmplitude's hosted MCP server for product analytics - search and query events, charts, dashboards, experiments, feature flags, cohorts and session replay, with OAuth sign-in and a separate EU endpoint.
- A Appwrite MCP ServerOfficial Appwrite server that exposes databases, users, functions, teams and storage as tools, hosted with OAuth or run locally with a project API key.
- A Atlassian Rovo MCP ServerOfficial hosted Atlassian server for Jira, Confluence, Jira Service Management, Compass, Bitbucket, Loom, Goals, Projects, and Teams, with OAuth 2.1 sign-in.
- A Better Stack MCP ServerOfficial hosted Better Stack server to read and manage incidents, monitors, status pages and on-call, and run SQL over your logs, spans and metrics, with OAuth or an API token.
- A Buildkite MCP ServerOfficial Buildkite server for pipelines, builds, jobs, logs, annotations, and Test Engine data, hosted or local.
Embed this badge
[](https://trustedmcp.io/servers/serena-mcp)<a href="https://trustedmcp.io/servers/serena-mcp"><img src="https://trustedmcp.io/badge/serena-mcp.svg" alt="TrustedMCP grade C" height="80"></a>Community reviews
Fine for a demo, not for prod
It works in a demo, but things got shaky under real use. Watch out for instructions hidden in the data it reads. I review actions before approving them.
Used for Looking up Serena data without leaving the editor
- Setup & docs 2/5
- Auth experience 3/5
- Reliability 2/5
- Maintainer responsiveness 3/5
Needs more maintenance love
It works in a demo, but things got shaky under real use. Nothing stops a misbehaving agent from using every tool it exposes, so I trimmed the tool list. I will check back in a few releases.
Used for Code review summaries for pull requests
- Setup & docs 1/5
- Auth experience 1/5
- Reliability 2/5
- Maintainer responsiveness 3/5
Solid core, fiddly setup
Works well enough for what I need. You can tell it is actively maintained, the rough edges keep getting fixed. Anything it pulls in I treat as untrusted, prompt injection through content is a real risk here. Nothing stops a misbehaving agent from using every tool it exposes, so I trimmed the tool list. Recommended, with sensible guardrails.
Used for Debugging sessions in Cursor
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Security story needs work
Not what I expected from the description. Anything it pulls in I treat as untrusted, prompt injection through content is a real risk here.
Used for Generating boilerplate from existing patterns
- Setup & docs 2/5
- Auth experience 3/5
- Reliability 2/5
- Maintainer responsiveness 3/5
Too much access for my comfort
Ran into problems pretty quickly. There is no auth layer, so whatever can reach it can use it. I keep it local only. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. For anything real I would look elsewhere.
Used for Scripting routine maintenance tasks
- Setup & docs 1/5
- Auth experience 1/5
- Reliability 1/5
- Maintainer responsiveness 4/5
Too much access for my comfort
Gave it a fair shot over two weeks. There is no auth layer, so whatever can reach it can use it. I keep it local only. Anything it pulls in I treat as untrusted, prompt injection through content is a real risk here. Not something I would put in production yet.
Used for Automating release notes
- Setup & docs 2/5
- Auth experience 1/5
- Reliability 2/5
- Maintainer responsiveness 3/5
Mixed feelings after two weeks
Mostly reliable, with the odd timeout. Anything it pulls in I treat as untrusted, prompt injection through content is a real risk here. You can tell it is actively maintained, the rough edges keep getting fixed. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. I would use it in prod, but only with a human approving writes.
Used for Code review summaries for pull requests
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 2/5
- Maintainer responsiveness 5/5
Set it up once, forgot about it
I use this almost daily. Nothing stops a misbehaving agent from using every tool it exposes, so I trimmed the tool list. Keep permissions tight and it is a good tool.
Used for Letting a coding agent open and triage issues
- Setup & docs 5/5
- Auth experience 3/5
- Reliability 5/5
- Maintainer responsiveness 4/5
Too many sharp edges
I wanted to like this one. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent.
Used for Automating release notes
- Setup & docs 2/5
- Auth experience 2/5
- Reliability 3/5
- Maintainer responsiveness 3/5
Earned a permanent spot in my config
Been running this for about a month now. You can tell it is actively maintained, the rough edges keep getting fixed.
Used for CI failure investigation
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 3/5
- Maintainer responsiveness 5/5
Not ready for anything that matters
Gave it a fair shot over two weeks. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. No access control at all, it runs with my permissions. Fine on my laptop, not on a shared box. Keeping it to local experiments for now.
Used for Letting a coding agent open and triage issues
- Setup & docs 2/5
- Auth experience 2/5
- Reliability 3/5
- Maintainer responsiveness 3/5
Capable but needs guardrails
It does the job, but it took some tweaking. Releases come often and the changelog is clear. Watch out for instructions hidden in the data it reads. I review actions before approving them. Nothing stops a misbehaving agent from using every tool it exposes, so I trimmed the tool list.
Used for Debugging sessions in Cursor
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 2/5
- Maintainer responsiveness 3/5
Promising, a bit raw
Useful tool, though I would not hand it to a junior unsupervised. Updates land regularly, and nothing broke when I upgraded.
Used for Onboarding new devs with an agent that answers repo questions
- Setup & docs 4/5
- Auth experience 2/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Fine for a demo, not for prod
Setup was rough and the result was flaky. No access control at all, it runs with my permissions. Fine on my laptop, not on a shared box. Anything it pulls in I treat as untrusted, prompt injection through content is a real risk here. For anything real I would look elsewhere.
Used for Scripting routine maintenance tasks
- Setup & docs 2/5
- Auth experience 2/5
- Reliability 2/5
- Maintainer responsiveness 3/5
Struggled to get it stable
I wanted to like this one. Watch out for instructions hidden in the data it reads. I review actions before approving them. For anything real I would look elsewhere.
Used for Pairing with Claude Code on a monorepo
- Setup & docs 2/5
- Auth experience 3/5
- Reliability 1/5
- Maintainer responsiveness 3/5
Decent, not set-and-forget
Some tools are great, a couple feel half finished. No access control at all, it runs with my permissions. Fine on my laptop, not on a shared box. Anything it pulls in I treat as untrusted, prompt injection through content is a real risk here.
Used for Onboarding new devs with an agent that answers repo questions
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 5/5
Went back to calling the API directly
Not what I expected from the description. Watch out for instructions hidden in the data it reads. I review actions before approving them. No access control at all, it runs with my permissions. Fine on my laptop, not on a shared box. Not something I would put in production yet.
Used for Pairing with Claude Code on a monorepo
- Setup & docs 1/5
- Auth experience 2/5
- Reliability 1/5
- Maintainer responsiveness 2/5
Struggled to get it stable
Ran into problems pretty quickly. Watch out for instructions hidden in the data it reads. I review actions before approving them. Updates land regularly, and nothing broke when I upgraded. No access control at all, it runs with my permissions. Fine on my laptop, not on a shared box. Keeping it to local experiments for now.
Used for Internal developer assistant
- Setup & docs 2/5
- Auth experience 1/5
- Reliability 2/5
- Maintainer responsiveness 3/5
Would not run this unattended
Setup was rough and the result was flaky. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. Anything it pulls in I treat as untrusted, prompt injection through content is a real risk here. I will check back in a few releases.
Used for Keeping project tickets in sync with code changes
- Setup & docs 1/5
- Auth experience 2/5
- Reliability 1/5
- Maintainer responsiveness 4/5
Write a review
Ran this server? Tell other teams how it went. You get one review per server. We email you a link to confirm it, then an editor checks it before it goes up. We never show your email.