Commands and integrations
SourceVault's engine reaches your AI tools three ways: the Hermes plugin's slash commands, LLM-callable tools, and an MCP server any MCP client can attach to. The Hermes plugin and the machine API run over localhost with signed requests; the MCP server runs in-process over stdio.
Hermes slash commands
Deterministic commands that work reliably with any local model. Telegram uses underscore forms (/code_ask).
| Command | What it does |
|---|---|
/code-help | Command reference |
/code-status | Integration health check |
/code-repos | List indexed repos |
/code-sync <repo> | Fast-forward the repo mirror |
/code-read <repo> <path> | Read an exact file |
/code-search <repo> "query" [n] | Hybrid semantic + literal search |
/code-context <repo> "query" | Retrieve a compact context pack |
/code-ask <repo> ["retrieval query"] "question" [n] | Retrieve and answer with citations; the optional first string steers retrieval separately from the question |
/code-history <repo> "question" [n] | Search indexed commit history |
MCP tools
The MCP server exposes list_repos, search_codebase, read_repo_file, ask_codebase, list_provenance_alerts, and get_attestation, plus a sourcevault://policy resource that shows the active access policy. Set SOURCEVAULT_AGENT_TOKEN in the server's environment to run it under a named agent identity; the server refuses to start on an unknown or revoked token.
The sourcevault CLI
| Command | What it does |
|---|---|
sourcevault stack up|down|status | Start, stop, or inspect the local services |
sourcevault app [url] [--out <dir>] | Build a desktop app wrapper for the dashboard |
sourcevault agent mint|list|revoke | Manage named agent tokens; mint and revoke are audited |
sourcevault mcp | Run the stdio MCP server (what claude mcp add sourcevault -- sourcevault mcp registers) |
sourcevault audit export|verify | Export the hash-chained audit log for a SIEM (--format jsonl|cef|syslog --since --until --out) or print each month's chain verdict |
sourcevault report ai-activity | What AI read, wrote, and was stopped from over a period, as Markdown or JSON (--since --until --format md|json --out) |
sourcevault report usage | A counts-only summary of this install to paste to us if you want to (--days --format text|json --out) |
sourcevault tls-setup | Issue a local certificate and serve the dashboard over HTTPS |
npm run doctor | Diagnose an install |
npm run code-repos -- add|list|show|sync|reindex|cleanup | Manage indexed repositories from the shell |
npm run migrate-vectors -- --to sqlite | Move existing indexes between vector stores without re-embedding |
Install and configuration for the plugin live in its repository: sourcevault-code-tools. For models that handle structured tool use, the plugin also registers code_search, code_read_file, and code_history tools.
MCP server
The MCP server exposes the same engine to OpenClaw and any other MCP client, which get bounded, cited context instead of re-reading files. The server is local-only. Paired with a local-model client the whole loop runs offline; a cloud-backed client sends what it retrieves to its own vendor, by your choice. Setup, agent identity, and the full tool, resource, and prompt reference are on the MCP page.
Machine API
For your own tooling, the HMAC-signed endpoints (/api/search-codebase, /api/read-file, /api/history-search) accept signed JSON over localhost. The OpenAPI description ships with every install at /api-docs on your own server (the raw spec at /api-docs.json).