Your docs stay home. Your AI still reads them.

1. You have a pile of Word, Excel and PDF files.
2. Roost sits on them and answers over MCP and REST.
3. Nothing leaves. We traced it: 0 connections.

Choose your platform Download Roost · about 16 MiB

One static binary. No telemetry, no update checks, no model downloads.

Nothing leaves. Not even a little.

Don’t take a cartoon bird’s word for it. Here’s a toy to play with, and the real test to run.

Tries: 0
Connections made: 0

Go on. Try to send it.

This toy is a joke. The strace test next to it isn’t.

The build checks. egress_test.go fails if our code makes outbound calls anywhere outside one opt-in package.
The binary gets traced. make e2e runs the real thing under strace through indexing, serving and stdio. It made 0 network connections, across 52 passing checks.
The trace gets tested too. With embeddings on, the same trace does see connections, and only to the endpoint you configured.

Check it yourself, from a source checkout

make e2e   # needs strace, curl, openssl, python3

The one exception: semantic search sends document text to an embeddings service you choose. It’s off by default and only connects to private addresses unless you override that. Read SECURITY.md.

Quick on most searches. Honest about the slow ones.

50,000 files, 300,000 chunks, one ordinary 6-core i5. These are median times.

A rare word 21 ms
Two words 21 ms 95th percentile: 146 ms
A six-word question 320 ms 95th percentile: 880 ms
A word in nearly every chunk 710 ms 95th percentile: 1 s

That’s the worst case. We show it anyway.

The whole corpus indexed in 1m58s, peaking at 46 MB of memory. It was plain text, so real Office and PDF files will take longer. Search time grows with the number of matching chunks.

Search a pretend pile of documents

2 passages found.

Project Heron board deck.pptx slide 7
Acquisition timeline: due diligence closes in March and signing is targeted for April.
M&A checklist.xlsx sheet Legal
Acquisitions over five million need board approval before the term sheet.

All invented, and this toy runs in your browser. The real thing is BM25 with stemming, phrases and prefixes, and it names the page, slide, sheet or heading too.

Speaks MCP. And REST, for everything else.

Same token, same access rules and same audit log either way. Every tool is read-only, so an agent can look but can’t touch.

list_collectionsWhat can this token read?
search_documentsRanked snippets, filtered by collection, type, path or date.
list_documentsBrowse files, including ones Roost couldn’t read, and why.
get_document_infoMetadata and an outline of sections.
read_documentA whole document or one section, in pages.

For quack, a terminal coding agent from the same author.

MCP in quack

# ~/.config/quack/mcp.d/roost.tomlurl = "https://roost.internal:8484/mcp"headers = { Authorization = { env = "ROOST_TOKEN", format = "Bearer {}" } }[tools]auto_approve = ["list_*", "search_*", "get_*", "read_*"]

So why not use something else?

You might! These are good projects, built for individual developers and their code and notes. Roost is for office files and a roomful of people.

Feature	Roost	ctxd	alcove
Outbound calls	None by default, traced with strace	None mentioned; local by default	Optional model download at setup
Word, Excel, PowerPoint	Yes	No, text files only	Not listed
PDF	Yes, built in	No, binaries are excluded	Yes, best with pdftotext installed
Separate access per user	Yes, per token and collection	Scoped tokens, not multi-tenant	On its roadmap
Log of every access	Yes	Not listed	Not listed
MCP	HTTP and stdio	Yes, HTTP and a stdio bridge	Yes, HTTP API is now its main route
What you run	One static binary	Python 3.11 or 3.12, plus ripgrep	A Rust binary
Semantic search	Opt-in, needs your own embeddings service	No, by design	Built in, after a model download of about 90 MB
Indexes source code	No	Some: .py, .ts and .tsx only	Yes, with tree-sitter
Pulls from URLs on request	No	Not listed	Not listed

Checked against each project’s README and docs in November 2026. “Not listed” means they don’t mention it, not that it can’t be done.

The boring bits, done properly.

Tokens that mean it: Each token sees only the collections you granted. The filter runs inside the SQL query, and a file you can’t see looks exactly like one that doesn’t exist.
An audit log with teeth: Every access is logged. If the log can’t be written, the request is refused.
Files are treated as hostile: Parsers run in limited child processes. A nasty PDF kills one worker, not the server.
Answers you can check: Every result names the page, slide, sheet or heading it came from.
Tests that were tested: We broke 17 security controls on purpose. The test suite caught all 17.

Things Roost can’t do. Yet.

It can’t

Read scanned PDFs. There’s no OCR yet.
Read old .doc, .xls or .ppt files. Convert them first.
Read email attachments.
Do SSO. Authentication is by API token.
Run on more than one node.
Follow NTFS or SharePoint permissions. Access is per collection.
Encrypt its index. Put it on an encrypted volume.

We haven’t tested

MCP client apps, including Claude Code. We used the official Go MCP client, raw JSON-RPC and curl.
Running on Windows and macOS. The binaries compile but haven’t been run.
Real NFS and SMB shares.
The Docker image, which hasn’t been built yet.

Anything Roost can’t read shows up in roost status. It never drops a file silently.

Still here? Grab the binary.

No installer, no sign-up, no account. One file on a machine inside your network.

Choose your platform Download Roost · about 16 MiB

SHA-256 checksums · Full docs · Air-gapped? make offline-bundle packages the source with every dependency.

Quick start, Linux and macOS

mv roost-* roost && chmod +x roostcp roost.example.toml roost.toml# set data_dir and collections in roost.toml./roost token create --name alice --collections legal,hr./roost serve

Download roost.example.toml first, it isn’t inside the binary. Save the token, it’s shown only once.