This profile is part of our MCP server directory, within The MCP Guide. Profiles are checked against each vendor's own documentation. Need a server built? See MCP development.
The Sourcegraph MCP server lets an AI agent search, read and navigate code across every repository indexed by your Sourcegraph instance. It runs on your Sourcegraph instance itself, published by Sourcegraph, and adds history search and the Deep Search agent.
Checked against: Sourcegraph MCP server docs on 28 October 2026. eSEOspace did not install or test this server.
Key Takeaways
- Sourcegraph announced the MCP server as generally available on 25 February 2026.
- It lives at
/.api/mcpon your instance, with/.api/mcp/alland/.api/mcp/deepsearchas alternate endpoints. - The docs list 16 tools for files, search, code navigation, history and agents.
- Sign-in uses OAuth 2.0 (including Dynamic Client Registration) or a Sourcegraph access token, with an
mcpscope. - Sourcegraph says the MCP server is "Supported on Enterprise plans."
At a glance
| Item | Detail |
|---|---|
| Publisher | Sourcegraph |
| Official? | Yes |
| Hosting | Remote URL on your Sourcegraph instance (Cloud or self-hosted) |
| Transport | HTTP |
| Sign-in | OAuth 2.0 or Sourcegraph access token (mcp scope) |
| Read or write | Read (search and navigation); Deep Search creates conversations |
| Price | Enterprise plans; no separate MCP price listed |
| Source code | Not linked from Sourcegraph's MCP docs |
| Status | Generally available (changelog, 25 February 2026) |
What it can do
Sourcegraph's docs list these tools:
- Files and repos:
read_file,list_files,list_repos,list_refs - Search:
keyword_search,nls_search,evaluator - Navigation:
go_to_definition,find_references - History:
commit_search,diff_search,compare_revisions,get_contributor_repos - Agents:
code_finder,deepsearch,deepsearch_read
The three endpoints expose different sets:
| Endpoint | What it offers |
|---|---|
/.api/mcp | Core search, repository, history and Deep Search reading tools (default) |
/.api/mcp/all | Full tool suite |
/.api/mcp/deepsearch | Deep Search agent tools only |
deepsearch starts new Deep Search conversations and is only on /all and /deepsearch. code_finder usage is metered against your instance's entitlement and returns an error when the quota runs out.
How to connect it
Sourcegraph's GA changelog gives these commands. Replace the host with your instance:
claude mcp add --transport http sg https://sourcegraph.example.com/.api/mcpamp mcp add sg https://sourcegraph.example.com/.api/mcpFor Cursor, add an mcpServers entry with the endpoint URL to ~/.cursor/mcp.json. Codex users should set scopes = ["mcp"] in config.toml to avoid an invalid_scope error. Clients using Dynamic Client Registration, such as Claude Code with --transport http, get the mcp scope automatically.
The changelog says the server is included in Sourcegraph Cloud and Sourcegraph self-hosted 7.0.
Security notes
Sourcegraph gives admins real control:
- On/off switch. Set
mcp.enabledtofalse, and the MCP endpoints return404. - Tool blocklist.
mcp.tools.disabledremoves named tools from all endpoints. Calls to them are rejected. - Role-based access. Users need the
MCP#ACCESSpermission. The built-in User role has it by default, but admins can remove it and grant it through a custom role. - Repository permissions. MCP access is separate from repo permissions, so users only read repositories they already have access to.
- Client control. Admins can turn off Dynamic Client Registration to allow only approved OAuth clients.
The MCP project's security best practices also cover risks such as token passthrough, confused deputy attacks and scope minimization.
Code search can surface secrets committed to repositories. Read secrets and credential leakage and MCP OAuth misconfigurations, and see the MCP Security Center.
Alternatives
- GitHub MCP Server for search within GitHub repositories plus issues and pull requests.
- GitLab MCP server, which includes
searchandsemantic_search. - Context7 MCP server for public library documentation instead of your own code.
Next step
If you run Sourcegraph Enterprise, start with the default /.api/mcp endpoint and decide whether Deep Search should be on. Our guide on how to choose MCP servers helps you weigh it, and the MCP server directory lists other developer tools.
Frequently asked questions
Which Sourcegraph plans include the MCP server?
Sourcegraph's docs say it is supported on Enterprise plans. The GA changelog says it is included in Sourcegraph Cloud and self-hosted 7.0.
What is the difference between the three endpoints?
/.api/mcp is the default with core search, history and Deep Search reading tools. /.api/mcp/all has every tool, and /.api/mcp/deepsearch has only the Deep Search agent tools.
Can admins turn off Deep Search?
Yes. Admins can add deepsearch to mcp.tools.disabled. It is also absent from the default /.api/mcp endpoint.
Does the MCP server bypass repository permissions?
No. Sourcegraph says users can only read repositories they already have access to, and they also need the MCP#ACCESS permission.
