rm-rf-prod/GroundTruth-MCP

GroundTruth is a self-hosted MCP server and command-line tool. Models write code from what they were trained on, so they still wrap components in forwardRef after React 19 made ref a regular prop, call cookies() synchronously after Next.js made it async, and emit @tailwind directives that Tailwind v4 replaced with @import "tailwindcss". GroundTruth gives the agent the library's own documentation at request time: it reads llms.txt, the docs site as markdown, or the GitHub repository, ranks the sections that answer the question, and checks that the answer covers the topic before returning it. It also audits your source with 107+ patterns and links every finding to the current fix. It runs on your machine. No account, no API key, no rate limit of its own.
---
Install (60 seconds)
Requires Node.js 24 or newer.
**Claude Code**
**Cursor, Claude Desktop, Windsurf** and other clients that use an mcpServers block (.cursor/mcp.json, claude_desktop_config.json, ~/.codeium/windsurf/mcp_config.json):
**VS Code** (.vscode/mcp.json):
Any other MCP client: run npx -y @groundtruth-mcp/gt-mcp@latest as a stdio server.
**Command line** (same tools, no MCP client needed):
@latest makes npx pick up new releases on the next session start. When a newer version exists, tool responses carry a one-line notice (GT_NO_UPDATE_CHECK=1 turns the check off).
Optional: GitHub token
GroundTruth reads READMEs, release notes, migration guides and code examples from GitHub. Without a token GitHub allows 60 requests per hour. A token with no extra scopes raises that to 5,000 and enables code search in gt_examples.
In a JSON config, add "env": { "GT_GITHUB_TOKEN": "ghp_yourtoken" } next to args.
---
What you get
Fourteen tools. Each does one job, and each is also a CLI command.
| Tool | CLI | What it does |
|---|---|---|
| gt_dispatch | ask | Routes a plain request ("use gt for drizzle migrations") to the right tool and arguments |
| gt_resolve_library | resolve | Finds a library by name; falls back to npm, PyPI, crates.io and Go modules |
| gt_get_docs | docs | Live docs for one topic; also accepts a docs URL |
| gt_best_practices | bp | Patterns, anti-patterns and configuration guidance for a library |
| gt_auto_scan | scan | Reads your manifest and fetches best practices for each dependency |
| gt_search | search | Any topic without a library: OWASP, MDN, web.dev, W3C, AI provider docs, Google APIs |
| gt_audit | audit | Scans source files and reports issues at file:line with links to the fix |
| gt_changelog | changelog | Release notes before you upgrade |
| gt_compat | compat | Browser and runtime support from MDN browser-compat-data and caniuse |
| gt_compare | compare | Two or three libraries side by side |
| gt_examples | examples | Real-world code from GitHub |
| gt_migration | migrate | Migration guides and breaking changes between versions |
| gt_batch_resolve | batch | Resolves up to 20 libraries in one call |
| gt_snippets | snippets | Ranked code snippets per library and version, cached on disk |
The server also exposes 2 MCP resources (library-registry, library-docs) and 8 prompts (audit-my-project, upgrade-check, best-practices-scan, compare-libraries, security-check, migration-guide, find-examples, dependency-audit).
You don't need the tool names. Ask in plain language:
Or call tools directly:
gt_audit
Walks your project, runs 107+ patterns across 18 categories, reports each issue at file:line, then fetches the fix from the authoritative source.
| Category | What it checks |
|---|---|
| security | XSS, SQL injection, command injection, SSRF, path traversal, hardcoded credentials, CORS wildcard |
| accessibility | Missing alt text, onClick on div, icon-only buttons, inputs without labels, outline: none |
| react | forwardRef (React 19), useFormState renamed, index as key, conditional hooks |
| nextjs | Sync cookies/headers/params (Next.js 16), Tailwind v3 directives, missing metadata |
| typescript | any type, non-null assertions, @ts-ignore, floating Promises |
| performance | Missing lazy loading, useEffect data fetching, missing Suspense boundaries |
| layout | CLS-causing images, 100vh on mobile, missing font-display |
| node | console.log in production, sync fs ops, unhandled callbacks |
| python | SQL injection via f-string, eval/exec, subprocess shell=True, pickle.loads |
| Also | mobile, css, vue, svelte, angular, testing, seo, i18n, api |