registry / klypix-mcp / 1.21.0

klypix-mcp@1.21.0

An open, local-first, agent-neutral canvas file your AI reads and writes over MCP — works with Claude, Cursor, Cline, any model.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 447 KB of source, external domains: klypix.com, registry.npmjs.org

Source & flagged code

3 flagged

src/klypix-core.mjsView file

Lines 1-28javascript

1// klypix-core — the protocol-neutral engine behind every KLYPIX agent face.

2//

3// All vault operations (list / read / search / create / append / insights /

4// connect / cross-project search) live here as pure-ish async functions that

5// return a protocol-neutral result:

6//

7// { blocks: Block[], isError?: boolean, file?: { name, buffer }, struct? }

8//

9// where Block is { kind:'text', text } or { kind:'image', data(base64), mime, name }.

10//

Source & flagged code

3 flagged · loading source

src/klypix-core.mjsView file

158let t; L159: try { t = await import('@huggingface/transformers'); } L160: catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/klypix-core.mjsView on unpkg · L158

8// L9: // where Block is { kind:'text', text } or { kind:'image', data(base64), mime, name }. L10: // ... L53: export function resolveVault(explicit) { L54: return path.resolve(explicit || process.env.KLYPIX_VAULT || path.join(os.homedir(), 'Documents')); L55: } ... L264: const ext = p.split('.').pop().toLowerCase(); L265: blocks.push({ kind: 'image', data: b64, mime: IMG_MIME[ext] || 'image/png', name: p }); L266: included++;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/klypix-core.mjsView on unpkg · L8

bin/klypix-mcp.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = klypix-mcp@1.20.1 matchedIdentity = npm:a2x5cGl4LW1jcA:1.20.1 similarity = 0.688 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/klypix-mcp.mjsView on unpkg

Findings

1 High3 Medium5 Low

HighPrevious Version Dangerous Deltabin/klypix-mcp.mjs

MediumDynamic Requiresrc/klypix-core.mjs

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptosrc/klypix-core.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Lines 138-178javascript

138 while (fs.existsSync(path.join(vault, `${name}.klypix`))) name = `${base} ${++n}`;

139 return `${name}.klypix`;

140}

141

142// ── On-device semantic memory (shared, lazy, self-healing) ───────────────────

143// Embeddings run INSIDE the long-lived host process, 100% local: transformers.js

144// (WASM) + a 23MB MiniLM model cached under ~/.claude/project-brain/hf-cache on

145// first use. Per-brain vectors are cached incrementally (content-hashed per

146// card). Everything degrades to lexical scoring gracefully: no lib, no model, no

147// network → search still works.

148const PB_DIR = path.join(os.homedir(), '.claude', 'project-brain');

149const EMB_DIR = path.join(PB_DIR, 'embeddings');

150const sha1 = (s) => crypto.createHash('sha1').update(s).digest('hex');

151let embedderPromise = null;

152export function getEmbedder(log = () => {}) {

153 if (!embedderPromise) {

154 embedderPromise = (async () => {

155 // Dual-path: (1) bare specifier — npx/npm installs ship the lib;

156 // (2) ~/.claude/project-brain/semantic — where KLYPIX's one-click

157 // "semantic memory" install places it for the bundled server.

158 let t;

159 try { t = await import('@huggingface/transformers'); }

160 catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/klypix-core.mjsView on unpkg · L158

161 // The optional dep ships dist/transformers.node.mjs on v4 (Node build) and

162 // dist/transformers.mjs on older lines — try both so a correct one-click

163 // install resolves regardless of version.

164 const base = path.join(PB_DIR, 'semantic', 'node_modules', '@huggingface', 'transformers', 'dist');

165 let lastErr;

166 for (const f of ['transformers.node.mjs', 'transformers.mjs']) {

167 try { t = await import(new URL('file:///' + path.join(base, f).replace(/\\/g, '/')).href); lastErr = null; break; }

168 catch (e) { lastErr = e; }

169 }

170 if (!t) throw lastErr;

171 }

172 t.env.cacheDir = path.join(PB_DIR, 'hf-cache');

173 return await t.pipeline('feature-extraction', 'Xenova/all-MiniLM-L6-v2', { dtype: 'q8' });

174 })().catch(e => { log('semantic unavailable (lexical fallback):', e?.message || e); return null; });

175 }

176 return embedderPromise;

177}

178async function embedTexts(pipe, texts) {