Knowledge bases and MCP
Ground reviews and answers in your internal docs with knowledge bases, and connect your own tools over MCP. Both Pro, both configured on your device.
Your repository is not the only thing worth grounding an answer in. Knowledge bases and MCP servers widen what DiffGuardian can draw on.
Both are available on Pro. On Basic they stay visible in Settings and open an upgrade prompt when you add one.
#Knowledge bases (RAG)
A knowledge base is a collection of documents DiffGuardian can retrieve from when reviewing or answering a question — internal design docs, architecture decision records, runbooks, API contracts, style guides.
There are three kinds, added from Settings → Knowledge bases:
| Kind | What it is |
|---|---|
| Local Vector | An on-device embeddings index built from a folder you choose. DiffGuardian walks the folder, chunks each file, embeds the chunks and stores the vectors in a local database. |
| Documents | A web-hosted documentation site, indexed by URL. |
| Vector DB | A pointer to an embeddings store you already run — Pinecone, Weaviate, Qdrant, Chroma, pgvector or another endpoint. DiffGuardian stores the endpoint, index and namespace, and queries it when a question needs it. |
Every knowledge base has a scope: either global (available everywhere) or attached to a single project. Use a global knowledge base for things that are true across your whole organisation, and a project knowledge base for anything specific to one repository.
Retrieved passages are supplied to the AI backend selected for the job, exactly like your code is. Three surfaces search your knowledge bases: an AI review, Ask, and Analyze Project.
#Embeddings and models
For a Local Vector knowledge base you choose the embedding backend and model when you create it — a local Ollama model, or OpenAI. Embeddings stay on your machine unless you deliberately pick a cloud embedding model. Changing the model later is a Re-embed job: it rebuilds every chunk with the new model, and queries wait until it finishes.
Each knowledge base has a Test me action that runs a sample query against it, so you can see what it actually returns before you rely on it in a review.
#Secrets are never indexed
While indexing a local folder, DiffGuardian scans each file for hardcoded secrets and skips any file that contains one, so a stray API key in a config file is never embedded or retrieved.
#MCP connections
The Model Context Protocol lets DiffGuardian call tools you control — an issue tracker, a documentation search, an error monitor — so the AI can pull in facts that live outside your repository.
A server definition records its name, the command or endpoint it is reached at, its scope (global or one project), which tools it exposes, and the names of the secrets it needs. The secret values themselves go into your operating system's credential store; the app materialises them only when it launches the server.
All of this lives on your device. DiffGuardian's servers do not hold your MCP configuration, do not proxy your MCP traffic, and do not run the servers for you. Nothing here is shared with your organisation or with us.
#The marketplace
Settings → MCP servers includes a small marketplace of curated starters, each with the command and required secret keys already filled in — you paste your own secrets and you are connected. It currently covers GitHub, Linear, Jira and Confluence (via Atlassian), Notion, Postgres, Sentry, and a sandboxed local filesystem server.
You can also add a server by hand, either through the form or by pasting raw JSON config. Test runs a local connection check against a server you have added.
#Turning tool calls on
Configuring a server does not by itself let the AI call it. The master switch is MCP tool calls in Settings → Features; servers stay configured either way.
With it on, an AI review opens a short-lived local session against your enabled, connected servers, offers their tools to the model, and closes the session when the review finishes. Only servers that run as a local command participate in that loop — a hosted server without a launch command is skipped.
#A note on credentials
Whatever you connect, the secret stays on your machine. Credentials for knowledge bases and MCP servers are encrypted in your operating system's credential store (the Keychain on macOS) and used only on your device — DiffGuardian's servers never receive them, and never receive the connection's shape either.