Codebase Onboarding Engineer

Name: Codebase Onboarding Engineer
Availability: InStock
Author: Kata Team

Explains an unfamiliar codebase the way a senior engineer would — read-only, no write access at all.

Software Development Dev Productivity & Project Ops Documentation & Knowledge @katateam

Before you connect: what this agent would do

A preview derived from this agent’s definition — not a live run. Nothing runs and no key is sent until you connect. FindAgent runs it on the hosted connection.

Tools it can use (5)

list_directoryRead-only
List the contents of a directory in the repository, to establish its shape.
Reaches: api.github.com
Uses your GitHub token.
get_fileRead-only
Fetch the raw contents of one file.
Reaches: api.github.com
Uses your GitHub token.
get_repo_treeRead-only
Fetch the full file tree of a branch in one call, for orientation on a large repository.
Reaches: api.github.com
Uses your GitHub token.
search_codeRead-only
Search code in the repository to answer who calls something or where it is configured.
Reaches: api.github.com
Uses your GitHub token.
list_recent_commitsRead-only
List recent commits touching a path, to see what is actively changing and why.
Reaches: api.github.com
Uses your GitHub token.

Credentials it will ask for (1)

GitHub token
Only ever sent to: api.github.com

Safety rails that guard it

Every result is scanned for leaked secrets and prompt-injection before it reaches you — a check no agent can turn off.
These personal details are removed from your input before the agent sees them: Credit card, IBAN, National ID.
A request larger than 200,000 characters is rejected before it runs.
get_fileRate limited to 600/hour.Safe to retry automatically if a run is interrupted.
search_codeRate limited to 200/hour.Safe to retry automatically if a run is interrupted.
get_repo_treeRate limited to 120/hour.Safe to retry automatically if a run is interrupted.
list_directoryRate limited to 600/hour.Safe to retry automatically if a run is interrupted.
list_recent_commitsRate limited to 300/hour.Safe to retry automatically if a run is interrupted.

How FindAgent keeps agents safe

Run locally

This MCP server runs on your own machine — FindAgent only points you at it. Run the command below, then add it to your MCP client. Nothing is hosted or proxied on our side.

terminal

npx -y @findagent/mcp run

Add it to your MCP client

Paste this into your client config (e.g. claude_desktop_config.json or a Cursor mcp.json), then restart the client.

mcp client config

{
  "mcpServers": {
    "codebase-onboarding-engineer": {
      "command": "npx",
      "args": [
        "-y",
        "@findagent/mcp",
        "run"
      ]
    }
  }
}

What you'll need — and where to get it

This agent will ask you for the following. You enter them when you connect — they're encrypted and never shared with the creator.

GitHub token
A fine-grained personal access token with Contents: read and Metadata: read only. This agent never writes, so do not grant it write access to anything — read-only is the whole point.
Create a personal access token in GitHub (Settings → Developer settings → Personal access tokens) scoped to what the agent needs.
Paste the value as a single line.
Only sent to: api.github.com

Requirements

This server requires authentication — see the description for how to get a key.

Get this agent

Free

Add the hosted gateway to Claude, ChatGPT, Cursor or any MCP client. Nothing installs on your machine.

https://mcp.findagent.cloud/agents/codebase-onboarding-engineer

View setup

What we can prove

Ships no executable code. FindAgent’s trusted runtime performs only the actions this agent declares — nothing it wrote runs on your machine or ours.
Any key you connect is bound to its destination — it is only ever sent to api.github.com, and is dropped if a request tries to redirect it elsewhere.
Every result is scanned for leaked secrets and prompt-injection before it reaches you — a check no listing can turn off.
Its tools only read data — none of them create, change, or delete anything.
Passed an automated security scan and a human review before it could be published.

These are facts derived from the manifest, not a score and not a badge.

Agent details