turath — cited ibaroh from the classical Islamic corpus, for AI agents

turath gives any AI agent read-only access to cited passages (ibaroh) from a corpus of 7,872 classical Arabic Islamic books (fiqh, usul, tafsir, hadith commentary, tasawuf, …), via the Sahifah API. Ask in Indonesian, English, Arabic, or mixed language; get back passages with their full citation (book, author, table-of-contents path, page/juz, madhhab, era) so the calling agent can quote responsibly.

Three ways to use it:

1. Claude Code plugin (recommended for Claude Code) — one command installs the /turath skill and registers the remote MCP connector.
2. Remote MCP server — connect any MCP client (Claude web, desktop, Code, or your own) to the hosted endpoint, or self-host this server.
3. /turath skill, copied by hand (in skills/turath/) — a dependency-light script that fetches ibaroh straight from the kitab, for setups where you'd rather not install a plugin.

Adab of naql (the ethic of transmission). This tool surfaces what the corpus indexed; it is not a substitute for checking the actual kitab. Always present a passage with its citation, verify a quotation against the primary source before relying on it, and where a ruling is contested among the fuqaha, say so rather than picking a side. Weighty matters belong to qualified scholars, not a search tool.

---

Getting an API key

Every request is authenticated with a read-only, revocable API key (bm_…). Register at sahifah.online, then create a key from your API Keys dashboard (rate-limited per key; you can see usage and revoke any key there).

---

Option 1 — Claude Code plugin (recommended)

Inside Claude Code, install this repo as a plugin. It bundles both the /turath skill and the remote MCP connector, so a single install gives you the Python-script path and the MCP tools.

# 1. Add this repo as a plugin marketplace (once)
/plugin marketplace add dihannahdi/turath

# 2. Install the plugin
/plugin install turath@sahifah

Then set your key in the environment Claude Code runs in — the same SAHIFAH_API_KEY feeds both the skill and the bundled MCP connector:

export SAHIFAH_API_KEY=bm_your_key_here          # bash / zsh
$env:SAHIFAH_API_KEY = "bm_your_key_here"         # PowerShell

What you get after install:

• The /turath:turath skill — Claude reaches for it whenever you ask it to find, quote, or cite a passage from the corpus (or you invoke it explicitly).
• The turath MCP connector (from the bundled .mcp.json), pointing at https://sahifah.online/mcp and exposing the turath_search and get_ibaroh tools. Claude Code asks you to approve the MCP server on first use.

The MCP connector authenticates with Authorization: Bearer ${SAHIFAH_API_KEY} — the same env var as the skill. No key is written into the plugin or committed to the repo.

Update later with /plugin update turath; remove with /plugin uninstall turath.

---

Option 2 — Remote MCP server (any MCP client, or self-host)

Use the hosted endpoint

Add this as a custom MCP connector in your client:

https://sahifah.online/mcp

Provide your Sahifah key as the connection credential — either an Authorization: Bearer bm_… header or an X-Sahifah-Api-Key: bm_… header (whichever your MCP client supports). The key is never stored server-side; it is used only to authenticate that one request against the Sahifah API.

Tools exposed

Tool	Arguments	Returns
turath_search	query (string), max_results? (1–50), include_ai? (bool, default false), mutabar_only? (bool)	Cited passages relevant to the query — each with book, author, TOC path, page, madhhab, era, score, and a snippet.
get_ibaroh	book_id (int), toc_id (int)	The full passage text + complete citation for one search hit.

mutabar_only restricts results to mu'tabar (authoritative) kitab. include_ai is off by default — this server favors raw cited ibaroh over synthesized text.

Self-host

git clone https://github.com/dihannahdi/turath.git
cd turath
npm install
npm run build
node dist/index.js          # or: pm2 start ecosystem.config.cjs

Configuration (environment variables):

Variable	Default	Purpose
PORT	8799	Port the HTTP server listens on (loopback only).
SAHIFAH_API_BASE	https://sahifah.online	Upstream Sahifah API. Fixed per process — never taken from request input.
MCP_ALLOWED_HOSTS	(none)	Comma-separated public hostname(s) for DNS-rebinding protection, e.g. example.com,www.example.com. localhost/127.0.0.1 are always allowed.
MCP_RATE_LIMIT_PER_MIN	120	Per-IP request cap on POST /mcp.
SAHIFAH_API_KEY	(none)	Optional single-tenant fallback key, used only when a request carries no key of its own. Leave unset for multi-tenant use.

Security posture (by design):

• Binds to 127.0.0.1 only — put a reverse proxy (Apache/nginx/Caddy) in front for TLS and your public hostname. Never expose the port directly.
• API keys pass through per request; they are never logged, echoed, or persisted.
• Fixed upstream (no SSRF), request-body cap, 15s upstream timeout, per-IP rate limit, DNS-rebinding host validation, and error handlers that never dump request context.
• Run it as a non-root user in production.

Example reverse-proxy (Apache) snippet:

ProxyPreserveHost On
ProxyPass        /mcp/healthz http://127.0.0.1:8799/healthz
ProxyPassReverse /mcp/healthz http://127.0.0.1:8799/healthz
ProxyPass        /mcp http://127.0.0.1:8799/mcp flushpackets=on retry=0
ProxyPassReverse /mcp http://127.0.0.1:8799/mcp

Health check: GET /healthz → {"status":"ok","service":"turath-mcp"}.

---

Option 3 — the /turath skill, by hand

Prefer not to install a plugin? The skill is just a folder. Copy skills/turath/ — a SKILL.md plus a standard-library-only turath.py (no dependencies) — into your project's .claude/skills/turath/, then:

export SAHIFAH_API_KEY=bm_your_key_here          # bash / zsh
$env:SAHIFAH_API_KEY = "bm_your_key_here"         # PowerShell

python skills/turath/scripts/turath.py search "hukum zakat fitrah dengan uang" --max 10
python skills/turath/scripts/turath.py ibaroh <book_id> <toc_id>

The key is read from the environment only — never written to disk. Each result ends with a reminder to verify the quotation against its source.

---

The corpus

Sahifah is a fully offline, domain-specific cross-lingual retrieval system: rule-based Indonesian/English → Arabic query translation, BM25 (Tantivy) lexical search over ~3.4M table-of-contents entries and ~6.6M passages, an embedding reranker, mu'tabar weighting in the NU/Shafi'i tradition, and an optional LLM synthesizer with a quote-integrity check. Answers on the site are reviewed by ulama through a tashih workflow. See sahifah.online/tentang.

License

MIT — see LICENSE.

---

"العلم نور" — knowledge is light.