MCP Observatory
1m ago Tracked 55,861 Last 1m ago 24h 2,736
github JavaScript analyzed 1c1bbe3 deep scan unknown

LH8PPL/claude-memory-kit

github

Persistent per-project memory for Claude Code, Kiro & Cursor - plain markdown committed with your code, captured prompt-free, auto-injected at session start, recalled by meaning (local semantic search, zero API). Cross-project persona, cited recall, searchable session history.

maintainer
LH8PPL
licence
MIT
first seen
2026-06-11
last seen
2026-07-15
releases · 30d
0
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged committed secret in LH8PPL/claude-memory-kit
  2. HIGH code analysis flagged committed secret in LH8PPL/claude-memory-kit
  3. HIGH code analysis flagged committed secret, dynamic code execution in LH8PPL/claude-memory-kit
  4. HIGH code analysis flagged committed secret in LH8PPL/claude-memory-kit
  5. HIGH code analysis flagged committed secret in LH8PPL/claude-memory-kit
  6. HIGH code analysis flagged committed secret in LH8PPL/claude-memory-kit
  7. HIGH code analysis flagged committed secret in LH8PPL/claude-memory-kit
  8. HIGH code analysis flagged committed secret in LH8PPL/claude-memory-kit
  9. HIGH code analysis flagged committed secret in LH8PPL/claude-memory-kit
  10. HIGH code analysis flagged committed secret in LH8PPL/claude-memory-kit
  11. HIGH code analysis flagged committed secret in LH8PPL/claude-memory-kit
  12. HIGH code analysis flagged committed secret in LH8PPL/claude-memory-kit
capabilities 0 tools
transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 1c1bbe3 · analyzer v33 · 5d ago

skills & prompt files 12

danger signals9

code evidence vv0.5.3 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 446

filesystem 296

  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/bin/cmk-capture-turn.mjs :16 import { existsSync } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/bin/cmk-inject-context.mjs :17 import { existsSync } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/bin/cmk-precompact.mjs :20 import { existsSync } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/anti-pattern.mjs :29 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/audit-log.mjs :24 import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/auto-extract.mjs :50 } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/auto-persona.mjs :41 import { readFileSync, writeFileSync, appendFileSync, mkdirSync, existsSync, readdirSync } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/backfill.mjs :30 import { existsSync, readFileSync, writeFileSync, readdirSync } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/bullet-lookup.mjs :14 import { existsSync, readFileSync } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/capture-prompt.mjs :27 import { existsSync, mkdirSync, appendFileSync, readFileSync } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/capture-turn.mjs :62 } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/claude-md.mjs :50 } from 'node:fs';
show 28 more
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/codex-transcript.mjs :23 import { existsSync, readFileSync } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/compaction-state.mjs :37 } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/compress-session.mjs :35 } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/compressor.mjs :32 import { writeFileSync, mkdtempSync, rmSync } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/config-core.mjs :24 import { mkdirSync, writeFileSync } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/conflict-queue.mjs :49 } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/cooldown.mjs :23 } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/daily-distill.mjs :27 } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/decisions-journal.mjs :32 import { existsSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/deletion-propagation.mjs :38 import { existsSync, readFileSync, readdirSync } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/doctor-repair.mjs :45 import { appendFileSync, mkdirSync } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/doctor.mjs :42 } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/expectations.mjs :19 import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/fact-store.mjs :72 import { existsSync, readFileSync, readdirSync } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/feedback-screen.mjs :39 import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/forget.mjs :15 } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/graduation.mjs :19 import { unlinkSync } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/health-log.mjs :51 import { closeSync, existsSync, mkdirSync, openSync, appendFileSync, fstatSync, readSync } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/import-anthropic-memory.mjs :32 } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/import-claude-md.mjs :27 import { existsSync, readFileSync } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/import-sessions.mjs :60 } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/index-db.mjs :47 import { mkdirSync } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/index-rebuild.mjs :45 import { existsSync, readFileSync, statSync } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/index.mjs :14 import { readFileSync } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/inject-context.mjs :32 } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/install-agent.mjs :18 import { existsSync, readFileSync, unlinkSync } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/install-kind.mjs :10 import { existsSync, readFileSync } from 'node:fs';
  • fs LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/install-kiro.mjs :31 import { existsSync, readFileSync, rmSync } from 'node:fs';

256 more not shown — this panel samples each group; the count above is the real total.

shell / exec 93

  • shell LH8PPL-core-memory-kit-1c1bbe3/packages/cli/bin/cmk-precompact.mjs :18 import { spawn } from 'node:child_process';
  • shell LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/backfill.mjs :32 import { execFileSync } from 'node:child_process';
  • shell LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/capture-turn.mjs :65 import { spawn } from 'node:child_process';
  • shell LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/codex-backend.mjs :36 import { spawn as defaultSpawn } from 'node:child_process';
  • shell LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/compressor.mjs :30 import { spawn as defaultSpawn } from 'node:child_process';
  • shell LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/cursor-backend.mjs :35 import { spawn as defaultSpawn } from 'node:child_process';
  • shell LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/doctor-repair.mjs :44 import { spawnSync } from 'node:child_process';
  • shell LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/index-db.mjs :262 // pragma/exec ("file is not a database"). Close the handle before
  • shell LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/inject-context.mjs :33 import { spawn, spawnSync } from 'node:child_process';
  • shell LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/install-agent.mjs :19 import { spawnSync as defaultSpawnSync } from 'node:child_process';
  • shell LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/install.mjs :47 import { spawnSync } from 'node:child_process';
  • shell LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/kiro-backend.mjs :22 import { spawn as defaultSpawn } from 'node:child_process';
show 28 more
  • shell LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/mcp-procs.mjs :22 import { spawnSync } from 'node:child_process';
  • shell LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/native-binding.mjs :27 import { spawnSync } from 'node:child_process';
  • shell LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/platform-commands.mjs :142 * `spawn()` instead of a shell line. It still lives here because the concern is
  • shell LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/precompact.mjs :96 * contract unit-assertable without a real spawn (the lazyCompressSpawnDescriptor
  • shell LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/register-crons.mjs :31 import { spawnSync } from 'node:child_process';
  • shell LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/scheduler-state.mjs :50 import { spawnSync } from 'node:child_process';
  • shell LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/spawn-bin.mjs :18 // - POSIX: spawn(bin, args, {shell:false}) — Node resolves PATH directly and
  • shell LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/subcommands.mjs :91 import { spawnSync } from 'node:child_process';
  • shell LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/viewer.mjs :77 import { spawn } from 'node:child_process';
  • shell LH8PPL-core-memory-kit-1c1bbe3/plugin/bin/cmk-precompact.mjs :18 import { spawn } from 'node:child_process';
  • shell (weak) LH8PPL-core-memory-kit-1c1bbe3/scripts/bench-storage.mjs :190 const { execFileSync } = require('node:child_process');
  • shell (weak) LH8PPL-core-memory-kit-1c1bbe3/scripts/install-matrix-checksum.mjs :15 import { execSync } from 'node:child_process';
  • shell (weak) LH8PPL-core-memory-kit-1c1bbe3/scripts/lib/aged-corpus.mjs :46 import { spawnSync } from 'node:child_process';
  • shell (weak) LH8PPL-core-memory-kit-1c1bbe3/scripts/live-test.mjs :28 import { spawnSync } from 'node:child_process';
  • shell (weak) LH8PPL-core-memory-kit-1c1bbe3/scripts/live-verify-health-whisper.mjs :27 import { spawnSync } from 'node:child_process';
  • shell (weak) LH8PPL-core-memory-kit-1c1bbe3/scripts/live-verify-now-roll.mjs :21 import { spawnSync } from 'node:child_process';
  • shell (weak) LH8PPL-core-memory-kit-1c1bbe3/scripts/live-verify-viewer.mjs :21 import { spawn, spawnSync } from 'node:child_process';
  • shell (weak) LH8PPL-core-memory-kit-1c1bbe3/scripts/live-verify.mjs :37 import { spawnSync } from 'node:child_process';
  • shell (weak) LH8PPL-core-memory-kit-1c1bbe3/scripts/parity-check.mjs :8 import { spawnSync } from 'node:child_process';
  • shell (weak) LH8PPL-core-memory-kit-1c1bbe3/scripts/stress-test.mjs :55 import { spawn, spawnSync } from 'node:child_process';
  • shell (weak) LH8PPL-core-memory-kit-1c1bbe3/scripts/test-file.mjs :26 import { spawnSync } from 'node:child_process';
  • shell (weak) LH8PPL-core-memory-kit-1c1bbe3/scripts/validate-maintainer-name-confined.mjs :28 import { execFileSync } from 'node:child_process';
  • shell (weak) LH8PPL-core-memory-kit-1c1bbe3/scripts/validate-pack-completeness.mjs :31 import { execFileSync, execSync } from 'node:child_process';
  • shell (weak) LH8PPL-core-memory-kit-1c1bbe3/scripts/validate-spawn-discipline.mjs :18 // 2. For each line matching a spawn call (`spawn(`, `spawnSync(`,
  • shell (weak) LH8PPL-core-memory-kit-1c1bbe3/tests/cli-approve-permission.test.js :14 import { spawnSync } from 'node:child_process';
  • shell (weak) LH8PPL-core-memory-kit-1c1bbe3/tests/cli-backfill.test.js :25 import { execFileSync } from 'node:child_process';
  • shell (weak) LH8PPL-core-memory-kit-1c1bbe3/tests/cli-capture-prompt.test.js :26 import { spawnSync } from 'node:child_process';
  • shell (weak) LH8PPL-core-memory-kit-1c1bbe3/tests/cli-capture-turn.test.js :28 import { spawnSync } from 'node:child_process';

53 more not shown — this panel samples each group; the count above is the real total.

network 5

  • net LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/semantic-backend.mjs :704 // Over-fetch (D-72: ~3×) so post-filters (tier/trust/since) don't
  • net LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/version-drift.mjs :118 * @param {Function} [args.fetcher] — injectable fetch (tests)
  • net LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/viewer.mjs :73 import { createServer } from 'node:http';
  • net (weak) LH8PPL-core-memory-kit-1c1bbe3/scripts/live-verify-viewer.mjs :23 import { request as httpRequest } from 'node:http';
  • net (weak) LH8PPL-core-memory-kit-1c1bbe3/tests/cli-viewer.test.js :32 import { request as httpRequest, Agent as HttpAgent } from 'node:http';

database 8

  • db LH8PPL-core-memory-kit-1c1bbe3/packages/cli/src/index-db.mjs :46 import Database from 'better-sqlite3';
  • db (weak) LH8PPL-core-memory-kit-1c1bbe3/scripts/bench-storage.mjs :30 import BetterDatabase from 'better-sqlite3';
  • db (weak) LH8PPL-core-memory-kit-1c1bbe3/tests/cli-anchor-edges.test.js :21 import Database from 'better-sqlite3';
  • db (weak) LH8PPL-core-memory-kit-1c1bbe3/tests/cli-index-db.test.js :25 import Database from 'better-sqlite3';
  • db (weak) LH8PPL-core-memory-kit-1c1bbe3/tests/cli-search.test.js :22 import Database from 'better-sqlite3';
  • db (weak) LH8PPL-core-memory-kit-1c1bbe3/tests/cli-semantic-backend.test.js :19 import Database from 'better-sqlite3';
  • db (weak) LH8PPL-core-memory-kit-1c1bbe3/tests/cli-semantic-vec-mapping.test.js :33 import Database from 'better-sqlite3';
  • db (weak) LH8PPL-core-memory-kit-1c1bbe3/tests/fixtures/hold-index-write-lock.mjs :6 import Database from 'better-sqlite3';

install hooks 2

  • prepack LH8PPL-core-memory-kit-1c1bbe3/packages/cli/package.json :31 node ../../scripts/prepublish-copy-template.mjs
  • prepublishOnly LH8PPL-core-memory-kit-1c1bbe3/packages/cli/package.json :32 node ../../scripts/prepublish-copy-template.mjs

declared dependencies 3

  • @huggingface/transformers@^4.2.0
  • @vitest/coverage-v8@^4.1.10
  • vitest@^4.1.10

obfuscation 1

  • dynamic require()/import() LH8PPL-core-memory-kit-1c1bbe3/tests/cli-doctor-repair.test.js :553 const { runRepairs } = await import(${JSON.stringify(pathToFileURL(join(repoRoot, 'packages/cli/src/doctor-repair.mjs')).href)});

perm:untrusted 1

  • untrusted (weak) LH8PPL-core-memory-kit-1c1bbe3/tests/cli-viewer.test.js :1018 html = await (await fetch(base)).text();

transport_posture 1

  • network-listening, binds all interfaces, no auth detected LH8PPL-core-memory-kit-1c1bbe3/tests/cli-viewer.test.js :2862 await runView({ host: '0.0.0.0', project: projectRoot }, undefined, {