XERJ
Local AI search that auto-indexes any folder so coding agents pull the exact code they need instead of reading files one by one.
About
XERJ is a Rust-built, single-static-binary search engine aimed at one problem: agents burning tokens by reading files individually. One command auto-indexes code, docs, logs, and PDFs, then serves hybrid BM25 + kNN search, go-to-definition, and an agent memory namespace to coding agents over MCP and an installable skill.
Its headline use case is reference coding: point an agent at a task, have it clone and index the closest open-source repos, and reuse how they solved the problem before writing its own code. The project's own controlled study reports 2.7x fewer output tokens at the same solve rate — that figure is provider-reported, not independently replicated. The default embedder is lexical and fully offline; a neural embedder is opt-in.
What it can do
- Autoindex of code, docs, logs, and PDFs with one command
- Hybrid BM25 + kNN ranked passage search with file:line references
- Go-to-definition lookup with signatures
- Reference-coding workflow for reusing open-source solutions
- Agent memory namespace and `xerj gain` token-savings accounting
- Native MCP server and llms.txt for agent integration
Setup
- Install:
curl -fsSL https://xerj.org/get | sh(or hand-verified install from the README) - Start:
xerj --insecure --data-dir ./data &(local dev use) - Wire into your agent:
xerj init(sets up MCP + skill for Claude Code/Cursor) - Index a project:
xerj autoindex ~/my-project - Search:
xerj search "how do we rotate the WAL segment"
Prerequisites
A machine to run the binary on (single static binary, no JVM); a coding agent with MCP support for the agent integration. The `--insecure` flag disables TLS and API-key auth — meant for one user on a dev machine binding 127.0.0.1 only.
Use cases
Works with
Trust score — 5/10
Scored 7/10 (METRICS tier, metrics-v1). Evidence: ~7k stars, Apache-2.0, active development (pushed Oct 16 2026), CI, single static binary with documented security model, published case study with field reports. Docked for: (1) the 2.7x token-savings headline is a provider-run study with no independent replication; (2) the quickstart's `--insecure` flag disables TLS and auth, which is fine for a local dev loop but a sharp edge if misconfigured. License: Apache-2.0.
How the trust score is built
Full methodology →- Adoption · stars/downloads, log-scaled vs peers
- 7.0/10
- Maintenance · recency, releases, issue load
- 7.0/10
- Openness · license + docs
- 9.0/10
- Manual review · sanity read + red-flag check
- 6.0/10
- · 6,959 GitHub stars; 353 forks; GitHub daily trending
- · pushed 2026-10-16; CI; SECURITY_MODEL.md published; single static Rust binary
- · manual review: 2.7x token-savings headline is a provider-run study, unreplicated; quickstart --insecure flag disables TLS/auth
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.