registry / klypix-mcp / 1.18.1

klypix-mcp@1.18.1

An open, local-first, agent-neutral canvas file your AI reads and writes over MCP — works with Claude, Cursor, Cline, any model.

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 404 KB of source, external domains: klypix.com, registry.npmjs.org

Source & flagged code

2 flagged

src/klypix-core.mjsView file

Lines 1-28javascript

1// klypix-core — the protocol-neutral engine behind every KLYPIX agent face.

2//

3// All vault operations (list / read / search / create / append / insights /

4// connect / cross-project search) live here as pure-ish async functions that

5// return a protocol-neutral result:

6//

7// { blocks: Block[], isError?: boolean, file?: { name, buffer }, struct? }

8//

9// where Block is { kind:'text', text } or { kind:'image', data(base64), mime, name }.

10//

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/klypix-core.mjsView on unpkg · L8

11// Two thin faces sit on top and never duplicate this logic:

12// - bin/klypix-mcp.mjs — maps blocks → MCP content blocks (the MCP server)

13// - bin/klypix-a2a.mjs — maps blocks → A2A Parts + returns `file` as a FilePart

14//

15// This file imports ONLY the pure format library (src/klypix-format.mjs) plus

16// Node built-ins, so it is safe to load from any process with no MCP/A2A/SDK in

17// the loop. It mutates nothing it isn't asked to (search/read never write).

19import fs from 'fs';

20import os from 'os';

21import path from 'path';

22import crypto from 'crypto';

23import { z } from 'zod';

24import {

25 parseKlypix, buildKlypix, buildKlypixMap, appendToKlypix, structToMarkdown,

26 brainInsights, insightsToMarkdown, addBrainConnections, proposeStructuralConnections, atomicWrite,

27 findUnrecordedMigrations, captureIntoBrain, tidyBrain, noteToCaptureInput,

28 selectGardenCandidates, applyGarden, detectContradictions,

Lines 137-177javascript

137 while (fs.existsSync(path.join(vault, `${name}.klypix`))) name = `${base} ${++n}`;

138 return `${name}.klypix`;

139}

140

141// ── On-device semantic memory (shared, lazy, self-healing) ───────────────────

142// Embeddings run INSIDE the long-lived host process, 100% local: transformers.js

143// (WASM) + a 23MB MiniLM model cached under ~/.claude/project-brain/hf-cache on

Source & flagged code

2 flagged · loading source

src/klypix-core.mjsView file

157let t; L158: try { t = await import('@huggingface/transformers'); } L159: catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/klypix-core.mjsView on unpkg · L157

8// L9: // where Block is { kind:'text', text } or { kind:'image', data(base64), mime, name }. L10: // ... L52: export function resolveVault(explicit) { L53: return path.resolve(explicit || process.env.KLYPIX_VAULT || path.join(os.homedir(), 'Documents')); L54: } ... L263: const ext = p.split('.').pop().toLowerCase(); L264: blocks.push({ kind: 'image', data: b64, mime: IMG_MIME[ext] || 'image/png', name: p }); L265: included++;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/klypix-core.mjsView on unpkg · L8

Findings

3 Medium5 Low

MediumDynamic Requiresrc/klypix-core.mjs

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptosrc/klypix-core.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

src/klypix-core.mjsView file

Lines 1-28javascript

1// klypix-core — the protocol-neutral engine behind every KLYPIX agent face.

2//

3// All vault operations (list / read / search / create / append / insights /

4// connect / cross-project search) live here as pure-ish async functions that

5// return a protocol-neutral result:

6//

7// { blocks: Block[], isError?: boolean, file?: { name, buffer }, struct? }

8//

9// where Block is { kind:'text', text } or { kind:'image', data(base64), mime, name }.

10//

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/klypix-core.mjsView on unpkg · L8

11// Two thin faces sit on top and never duplicate this logic:

12// - bin/klypix-mcp.mjs — maps blocks → MCP content blocks (the MCP server)

13// - bin/klypix-a2a.mjs — maps blocks → A2A Parts + returns `file` as a FilePart

14//

15// This file imports ONLY the pure format library (src/klypix-format.mjs) plus

16// Node built-ins, so it is safe to load from any process with no MCP/A2A/SDK in

17// the loop. It mutates nothing it isn't asked to (search/read never write).

19import fs from 'fs';

20import os from 'os';

21import path from 'path';

22import crypto from 'crypto';

23import { z } from 'zod';

24import {

25 parseKlypix, buildKlypix, buildKlypixMap, appendToKlypix, structToMarkdown,

26 brainInsights, insightsToMarkdown, addBrainConnections, proposeStructuralConnections, atomicWrite,

27 findUnrecordedMigrations, captureIntoBrain, tidyBrain, noteToCaptureInput,

28 selectGardenCandidates, applyGarden, detectContradictions,

Lines 137-177javascript

137 while (fs.existsSync(path.join(vault, `${name}.klypix`))) name = `${base} ${++n}`;

138 return `${name}.klypix`;

139}

140

141// ── On-device semantic memory (shared, lazy, self-healing) ───────────────────

142// Embeddings run INSIDE the long-lived host process, 100% local: transformers.js

143// (WASM) + a 23MB MiniLM model cached under ~/.claude/project-brain/hf-cache on