Cited, OSV-gated, injection-safe web briefs for coding agents. Verified, never raw web.
Cited, OSV-gated, injection-safe web briefs for coding agents. Verified, never raw web. Exposed over MCP by the voyager mcp server, that capability becomes something an assistant can invoke while it works, not something you go and do afterwards.
An AI coding agent that reaches the open internet gets a raw, unsigned, possibly-poisoned blob and feeds it straight into its own prompt. voyager sits in front of that: it turns a query into a cited, confidence-scored, OSV-gated, injection-hardened brief — the only surface your model ever sees.
Everything the assistant can do here goes through one of these:
check — is this package safe to use? Registry facts + OSV gate (fail-closed)Tier — SourceYou will need 2 environment variables: GITHUB_TOKEN, TAVILY_API_KEY. The server will not start without them, which is usually why the tools fail to appear on a first run. Keep credentials in your client's env block or a secrets manager rather than in a file you might commit.
Installation goes through your MCP client rather than a global install: point it at @dir-ai/voyager on npm and it is fetched when the client starts. The copy-paste blocks for Claude Desktop, Claude Code and Cursor are further down this page.
Among the developer tooling options, the useful question is rarely "what can it do" but "what does it cost you to run" — permissions, credentials, and how much of your context its toolset consumes. Voyager's toolset — check, Tier — is a fair guide to whether it matches your workflow. It is maintained by dir-ai; worth a glance at recent repository activity before you build anything load-bearing on it.
This entry was verified against Voyager's own documentation before publication; SyncDev keeps the directory reviewed rather than auto-generated.
| Tool | What it does |
|---|---|
| check | is this package safe to use? Registry facts + OSV gate (fail-closed) |
| Tier | Source |
## MCP server
```jsonc
// .mcp.json
{
"mcpServers": {
"voyager": { "command": "npx", "args": ["-y", "@dir-ai/voyager", "mcp"] }
}
}Configuration as documented by the project. Restart the client after saving.
| Variable | Description | Required |
|---|---|---|
| GITHUB_TOKEN | Credential the server authenticates with. | Yes |
| TAVILY_API_KEY | Credential the server authenticates with. | Yes |
Kill hallucinated APIs — version-accurate, up-to-date library documentation injected straight into context.
Microsoft's official browser automation server — drive a real browser through the accessibility tree, no screenshots needed.
GitHub's official server — repos, issues, pull requests, Actions and code security, straight from your assistant.
Issue tracking at the speed of conversation — Linear's official hosted server with OAuth and zero install.
Local repository surgery — status, diffs, commits, branches and history for any repo on disk.
Timezone sanity for AI — current time anywhere and correct conversions, without the model doing date math.