Loading npm security reports…
Local-first memory and rules layer for AI coding agents — MCP server and CLI.
Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/index.jsView on unpkg · L112A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/cli.jsView on unpkg · L8977Source writes installer persistence such as shell profile or service configuration.
dist/cli.jsView on unpkg · L97Package source references dynamic require/import behavior.
dist/local-api.jsView on unpkg · L1Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/index.jsView on unpkg · L112Source writes installer persistence such as shell profile or service configuration.
dist/cli.jsView on unpkg · L97Package source references dynamic require/import behavior.
dist/local-api.jsView on unpkg · L1A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/cli.jsView on unpkg · L8977