Serena: IDE-Grade Code Navigation and Editing for AI Agents (GitHub, Scanned)

Serena is an MCP server that gives AI coding agents the tools an IDE gives a developer. Instead of reading whole files and editing by line numbers or search and replace, the agent can find a symbol, list a file's outline, find every reference to a function, rename it across the project, or replace a function body by name. It works with Claude Code, Codex, Gemini CLI, OpenCode, Cursor, VS Code and JetBrains assistants, Claude Desktop and other MCP clients.

Under the hood it drives language servers, the same engines that power code intelligence in VS Code, and supports more than 40 languages, from Python, TypeScript, Go, Rust and Java to C#, Kotlin, Swift, Haskell and Lean 4. On large codebases that saves the agent a lot of reading, and fewer tokens spent on finding code means more left for the actual task. It also keeps per-project memories for long-running work.

There is an optional paid JetBrains plugin that swaps the language servers for your JetBrains IDE and adds moves, inlining and type hierarchies; the free language server backend covers find, outline, references, rename and symbol edits. Some languages need their language server or toolchain installed separately, and the README asks you not to install Serena from MCP marketplaces, whose commands are often out of date.

• Repository: github.com/oraios/serena
• Licence: custom (Other)
• Language: Python. Stars: 30.7K. Forks: 2,089. Last push: Oct 26, 2026.
• Scan: safe, Oct 26, 2026, commit 3ecf6eb

Who it is for

Developers using Claude Code, Codex or another MCP-capable agent on medium to large codebases, who want the agent to navigate and refactor by symbol rather than by text.

Getting started

1. Install with uv (the only prerequisite)

uv tool install -p 3.13 serena-agent

2. Initialise and check the setup

serena init

Then add Serena to your MCP client with the launch command from the clients page of the documentation at oraios.github.io/serena; each client (Claude Code, Codex, Claude Desktop, IDEs) has its own instructions.

Safety scan

We cloned oraios/serena at commit 3ecf6eb on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• No secrets, no committed binaries and no bare-IP URLs across 1,192 files, about 120,000 lines of them Python.
• Four pattern hits: three curl | sh lines in the Dockerfile, which install nvm, uv and Rust from their official installers when you build the container, and one in src/solidlsp/language_servers/lean4_language_server.py, an error message that tells you how to install the Lean toolchain yourself.
• Many of the hosts in the code (GitHub releases, NuGet, HashiCorp, Eclipse, JetBrains, the VS Code marketplace) are where Serena fetches language servers for particular languages on first use. Those are third-party binaries running with your permissions.
• uv.lock pins 213 packages with 87 known advisories (9 critical, 40 high), notably in Pillow, GitPython and anyio. The other 35 sit in the Angular and Svelte test projects under test/resources, which are sample code for tests and never installed.
• Eight workflows, 23 third-party actions pinned to tags rather than commits, none using pull_request_target. CodeQL enabled, contributing guide and CLA present; no security policy or Dependabot.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: Python 120.1K, Markdown 10.8K, YAML 3,502, JavaScript 2,639, CSS 1,974, JSON 1,807.

Questions

Is Serena free?

Yes. The Serena application is GPL-3.0-or-later and its SolidLSP language server layer is MIT, so the installed package as a whole is GPL. The optional JetBrains plugin backend is a paid product with a free trial; the default language server backend costs nothing.

Which AI coding tools work with Serena?

Any MCP client. The documentation covers Claude Code, Codex, Gemini CLI, OpenCode, Claude Desktop, VS Code, Cursor and JetBrains assistants, and it can also run as an HTTP server you point a client at.

Does Serena send my code anywhere?

Serena itself works locally: it runs language servers on your machine and returns results to your agent. Your code reaches a model only through the agent you connect it to, under that agent's own terms.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.