github TypeScript analyzed e26901c

plur-ai/plur

github

Shared memory for AI agents

maintainer
plur-ai
licence
Apache-2.0
first seen
2026-06-23
last seen
2026-09-18
releases · 30d
6
short id

Drift inferred · capture-to-capture

tool count over time

06-23 23:15 08-11 23:55 now
10t
12t
15t
capabilities 15 tools
transport stdio · http verified reported listed in the official MCP registry counts 15 tools · 0 res · 0 prompts permission surface via README inference

tools

  • plur_capture

    Record an event — incident, resolution, session milestone

  • plur_feedback

    Rate relevance (trains quality over time)

  • plur_forget

    Retire a memory (activation decays, eventually pruned)

  • plur_ingest

    Extract engrams from text automatically

  • plur_inject_hybrid

    Select engrams for current task within token budget

  • plur_learn

    Store a correction, preference, or convention

  • plur_learn_batch

    Store many engrams in one call (batch dedup + per-item failure isolation)

  • plur_outbox

    Inspect (and retry) team writes queued while their store was unreachable

  • plur_recall

    Retrieve relevant memories — hybrid (BM25 + embeddings) by default; mode:"keyword" for BM25-only

  • plur_receipt

    Counted, local report of what your memory retrieved for you

  • plur_rescope

    Move an existing engram to another scope — personal → team, or back

  • plur_session_scope

    Change the session's default write scope mid-session

  • plur_status

    Check system health and engram counts

  • plur_sync

    Sync via git. personal remotes mirror everything (use a private repo); shared remotes receive only shared-scope, non-private engrams

  • plur_timeline

    Query episode history by time, agent, or channel

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit e26901c · analyzer v33 · 12h ago

skills & prompt files 19

danger signals3

code evidence vv0.20.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 781

filesystem 280

  • fs (weak) plur-ai-plur-e26901c/benchmark/micro.ts :20 import * as fs from 'fs'
  • fs (weak) plur-ai-plur-e26901c/examples/01-basic-store-recall.ts :13 import { mkdtempSync, rmSync } from 'node:fs'
  • fs (weak) plur-ai-plur-e26901c/examples/02-mcp-integration.ts :16 import { mkdtempSync, rmSync } from 'node:fs'
  • fs (weak) plur-ai-plur-e26901c/examples/03-scope-filtering.ts :11 import { mkdtempSync, rmSync } from 'node:fs'
  • fs plur-ai-plur-e26901c/packages/claw/src/setup.ts :1 import { readFileSync, writeFileSync, existsSync, mkdirSync, renameSync } from 'node:fs'
  • fs plur-ai-plur-e26901c/packages/claw/src/system-prompt.ts :1 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs'
  • fs (weak) plur-ai-plur-e26901c/packages/claw/test/cli.test.ts :2 import { mkdtempSync, rmSync } from 'node:fs'
  • fs (weak) plur-ai-plur-e26901c/packages/claw/test/context-engine.test.ts :2 import { mkdtempSync, rmSync } from 'fs'
  • fs (weak) plur-ai-plur-e26901c/packages/claw/test/pr1-scope-routing.test.ts :10 import { mkdtempSync, rmSync } from 'fs'
  • fs (weak) plur-ai-plur-e26901c/packages/claw/test/setup.test.ts :2 import { mkdtempSync, readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs'
  • fs (weak) plur-ai-plur-e26901c/packages/claw/test/telemetry-wiring.test.ts :2 import { existsSync, readFileSync, readdirSync } from 'node:fs'
  • fs (weak) plur-ai-plur-e26901c/packages/claw/test/version-parity.test.ts :2 import { readFileSync } from 'node:fs'
show 28 more
  • fs (weak) plur-ai-plur-e26901c/packages/cli/scripts/copy-skills.mjs :17 import { cp, mkdir, readdir, stat } from 'fs/promises'
  • fs plur-ai-plur-e26901c/packages/cli/src/antigravity-hooks.ts :1 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs'
  • fs plur-ai-plur-e26901c/packages/cli/src/codex-hooks.ts :1 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs'
  • fs plur-ai-plur-e26901c/packages/cli/src/commands/audit.ts :3 import { readdirSync, readFileSync, statSync } from 'fs'
  • fs plur-ai-plur-e26901c/packages/cli/src/commands/doctor.ts :2 import { existsSync, readFileSync, realpathSync, statSync, accessSync, constants } from 'fs'
  • fs plur-ai-plur-e26901c/packages/cli/src/commands/hook-codex-session-end.ts :1 import { unlinkSync } from 'fs'
  • fs plur-ai-plur-e26901c/packages/cli/src/commands/hook-correction-detect.ts :1 import { readSync } from 'fs'
  • fs plur-ai-plur-e26901c/packages/cli/src/commands/hook-cursor-guard.ts :1 import { existsSync } from 'fs'
  • fs plur-ai-plur-e26901c/packages/cli/src/commands/hook-cursor-post-tool.ts :1 import { existsSync, writeFileSync, statSync } from 'fs'
  • fs plur-ai-plur-e26901c/packages/cli/src/commands/hook-inject.ts :1 import { existsSync, writeFileSync, readFileSync, appendFileSync, mkdirSync, readSync, statSync, readdirSync, unlinkSync } from 'fs'
  • fs plur-ai-plur-e26901c/packages/cli/src/commands/hook-learn-check.ts :1 import { readSync, readFileSync, writeFileSync, mkdirSync, existsSync, appendFileSync, statSync, renameSync, unlinkSync } from 'fs'
  • fs plur-ai-plur-e26901c/packages/cli/src/commands/hook-observe.ts :1 import { mkdirSync, appendFileSync, readSync } from 'fs'
  • fs plur-ai-plur-e26901c/packages/cli/src/commands/hook-revert-detect.ts :1 import { readSync } from 'fs'
  • fs plur-ai-plur-e26901c/packages/cli/src/commands/hook-session-end.ts :1 import { readSync, readFileSync, existsSync, unlinkSync, mkdirSync } from 'fs'
  • fs plur-ai-plur-e26901c/packages/cli/src/commands/hook-session-guard.ts :1 import { readSync, existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs'
  • fs plur-ai-plur-e26901c/packages/cli/src/commands/hook-session-mark.ts :1 import { readSync, writeFileSync } from 'fs'
  • fs plur-ai-plur-e26901c/packages/cli/src/commands/import.ts :12 import { readFileSync } from 'fs'
  • fs plur-ai-plur-e26901c/packages/cli/src/commands/init-remote.ts :1 import { existsSync, readFileSync, writeFileSync, appendFileSync } from 'fs'
  • fs plur-ai-plur-e26901c/packages/cli/src/commands/init.ts :1 import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync, cpSync, readdirSync } from 'fs'
  • fs plur-ai-plur-e26901c/packages/cli/src/commands/login.ts :1 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs'
  • fs plur-ai-plur-e26901c/packages/cli/src/commands/migrate.ts :2 import { existsSync } from 'fs'
  • fs plur-ai-plur-e26901c/packages/cli/src/cursor-hooks.ts :1 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs'
  • fs plur-ai-plur-e26901c/packages/cli/src/lib/agy-hook-io.ts :1 import { readFileSync, writeFileSync, existsSync, statSync, readdirSync, unlinkSync, openSync, readSync, closeSync, fstatSync } from 'fs'
  • fs plur-ai-plur-e26901c/packages/cli/src/lib/codex-hook-io.ts :1 import { readSync, readFileSync, mkdirSync, writeFileSync, existsSync, statSync, lstatSync, chmodSync, readdirSync, unlinkSync } from 'fs'
  • fs plur-ai-plur-e26901c/packages/cli/src/lib/cursor-hook-io.ts :1 import { readSync, mkdirSync, writeFileSync, appendFileSync, statSync, readdirSync, unlinkSync } from 'fs'
  • fs plur-ai-plur-e26901c/packages/cli/src/lib/plur-configured.ts :1 import { existsSync, readFileSync, realpathSync } from 'fs'
  • fs plur-ai-plur-e26901c/packages/cli/src/mcp-config.ts :1 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs'
  • fs plur-ai-plur-e26901c/packages/cli/src/opencode-config.ts :1 import { existsSync, lstatSync, readFileSync, realpathSync } from 'fs'

240 more not shown — this panel samples each group; the count above is the real total.

shell / exec 74

  • shell (weak) plur-ai-plur-e26901c/docs/demo/mcp-call.mjs :14 import { spawn } from 'node:child_process'
  • shell plur-ai-plur-e26901c/packages/cli/src/commands/doctor.ts :1 import { spawn } from 'child_process'
  • shell plur-ai-plur-e26901c/packages/cli/src/commands/init.ts :2 import { execFileSync } from 'child_process'
  • shell plur-ai-plur-e26901c/packages/cli/src/commands/login.ts :334 const { spawn } = await import('child_process')
  • shell plur-ai-plur-e26901c/packages/cli/src/commands/ui.ts :6 import { spawn } from 'node:child_process'
  • shell plur-ai-plur-e26901c/packages/cli/src/global-install.ts :1 import { exec } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/audit-engrams.test.ts :5 import { execSync } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/capture.test.ts :5 import { execSync } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/config-clobber-1059.test.ts :5 import { execSync } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/doctor.test.ts :5 import { execSync } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/embedder-probe.test.ts :5 import { execSync } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/feedback.test.ts :5 import { execSync } from 'child_process'
show 28 more
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/forget-namespaced.test.ts :41 import { spawn } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/forget.test.ts :5 import { execSync } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/global-install.test.ts :7 import { exec } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/helpers/built-cli.ts :4 * The suites here drive a real binary — `spawn('node', [CLI, ...])` against
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/helpers/spawn.ts :23 import { spawnSync } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/hook-cursor-guard.test.ts :5 import { execSync } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/hook-cursor-post-tool.test.ts :5 import { execSync } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/hook-cursor-session-start.test.ts :5 import { execSync } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/hook-cursor-stop.test.ts :5 import { execSync } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/hook-remote-recall.test.ts :23 import { spawn } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/import.test.ts :5 import { execSync } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/init-cursor.test.ts :5 import { execSync } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/init-remote.test.ts :16 import { spawn } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/init-skills.test.ts :18 import { execSync } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/init-telemetry.test.ts :23 import { execSync } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/init.test.ts :5 import { execSync } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/inject.test.ts :5 import { execSync } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/known-flags.test.ts :13 import { execFileSync } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/learn-provenance-flags.test.ts :16 import { execFileSync } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/learn.test.ts :5 import { execSync } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/list.test.ts :5 import { execSync } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/login.test.ts :22 import { spawn } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/mcp-entry-read.test.ts :57 // spawn(cmd, undefined) and spawn(cmd, []) differ; callers should not have
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/packs.test.ts :5 import { execSync } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/readonly-commands.test.ts :5 import { execSync, execFile } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/recall.test.ts :5 import { execSync } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/rerank-eval.test.ts :15 import { execSync } from 'child_process'
  • shell (weak) plur-ai-plur-e26901c/packages/cli/test/rescope.test.ts :10 import { execSync } from 'child_process'

34 more not shown — this panel samples each group; the count above is the real total.

network 31

  • net (weak) plur-ai-plur-e26901c/benchmark/micro.ts :180 const r = await fetch(`${baseUrl}/chat/completions`, {
  • net plur-ai-plur-e26901c/packages/cli/src/commands/doctor.ts :775 const res = await fetch(`https://registry.npmjs.org/${pkg}/latest`, {
  • net plur-ai-plur-e26901c/packages/cli/src/commands/init-remote.ts :283 const r = await fetch(probeUrl, {
  • net plur-ai-plur-e26901c/packages/cli/src/commands/login.ts :209 const r = await fetch(url, {
  • net plur-ai-plur-e26901c/packages/cli/src/commands/tensions.ts :8 const response = await fetch(`${baseUrl.replace(/\/$/, '')}/chat/completions`, {
  • net plur-ai-plur-e26901c/packages/cli/src/commands/ui-server.ts :12 import { isIPv6 } from 'node:net'
  • net (weak) plur-ai-plur-e26901c/packages/cli/test/adapter-remote-recall.test.ts :21 import { createServer, type Server } from 'http'
  • net (weak) plur-ai-plur-e26901c/packages/cli/test/hook-inject-trust.test.ts :22 import { createServer, type Server } from 'http'
  • net (weak) plur-ai-plur-e26901c/packages/cli/test/init-remote.test.ts :17 import { createServer, type Server } from 'http'
  • net (weak) plur-ai-plur-e26901c/packages/cli/test/login.test.ts :20 import { createServer, type Server } from 'http'
  • net (weak) plur-ai-plur-e26901c/packages/cli/test/readonly-commands.test.ts :7 import { createServer, type Server } from 'http'
  • net (weak) plur-ai-plur-e26901c/packages/cli/test/tensions-lifecycle.test.ts :7 import { createServer, type Server } from 'http'
show 19 more
  • net (weak) plur-ai-plur-e26901c/packages/cli/test/tensions.test.ts :7 import { createServer, type Server } from 'http'
  • net (weak) plur-ai-plur-e26901c/packages/cli/test/ui-host.test.ts :25 import { request } from 'node:http'
  • net (weak) plur-ai-plur-e26901c/packages/cli/test/ui-server.test.ts :49 const res = await fetch(`${h.url}/`)
  • net plur-ai-plur-e26901c/packages/core/probe/p07-outbox-flush.ts :14 import * as http from 'http'
  • net plur-ai-plur-e26901c/packages/core/src/embedders/openai.ts :145 res = await opts.fetch(ENDPOINT, {
  • net plur-ai-plur-e26901c/packages/core/src/packs.ts :56 response = await fetch(url)
  • net plur-ai-plur-e26901c/packages/core/src/store/remote-store.ts :312 * `fetch()` resolves when response HEADERS arrive, so the timer this used to
  • net plur-ai-plur-e26901c/packages/core/src/version-check.ts :90 // issuing a duplicate fetch (refresh-on-read + the periodic re-check can
  • net (weak) plur-ai-plur-e26901c/packages/core/test/helpers/pack-stub-server.ts :30 import { createServer, type Server, type IncomingMessage, type ServerResponse } from 'http'
  • net (weak) plur-ai-plur-e26901c/packages/core/test/helpers/stub-server.ts :50 import { createServer, type Server, type IncomingMessage, type ServerResponse } from 'http'
  • net (weak) plur-ai-plur-e26901c/packages/core/test/meta/real-extraction.test.ts :56 const response = await fetch('https://api.anthropic.com/v1/messages', {
  • net (weak) plur-ai-plur-e26901c/packages/core/test/remote-integration.test.ts :7 * codes, and the actual fetch() code path in RemoteStore.
  • net (weak) plur-ai-plur-e26901c/packages/core/test/remote-write-contract.test.ts :24 import { createServer, type Server } from 'http'
  • net (weak) plur-ai-plur-e26901c/packages/core/test/set-pinned-remote.test.ts :20 import { createServer, type Server } from 'http'
  • net plur-ai-plur-e26901c/packages/mcp/src/tools.ts :13 const response = await fetch(`${baseUrl.replace(/\/$/, '')}/chat/completions`, {
  • net (weak) plur-ai-plur-e26901c/packages/mcp/test/helpers/stub-server.ts :9 import { createServer, type Server, type IncomingMessage, type ServerResponse } from 'http'
  • net plur-ai-plur-e26901c/packages/ui/src/server.ts :18 import { createServer, type Server } from 'node:http'
  • net (weak) plur-ai-plur-e26901c/packages/ui/test/host-policy.test.ts :25 import { request } from 'node:http'
  • net (weak) plur-ai-plur-e26901c/packages/ui/test/server.test.ts :2 import { request } from 'node:http'

secrets 10

  • secrets (weak) plur-ai-plur-e26901c/benchmark/micro.ts :173 const apiKey = process.env.OPENROUTER_API_KEY ?? process.env.OPENAI_API_KEY
  • secrets plur-ai-plur-e26901c/packages/cli/src/commands/tensions.ts :29 const openrouterKey = process.env.OPENROUTER_API_KEY
  • secrets plur-ai-plur-e26901c/packages/core/src/embedders/openai.ts :93 const key = process.env.OPENAI_API_KEY
  • secrets (weak) plur-ai-plur-e26901c/packages/core/test/embedder-default.test.ts :34 const originalKey = process.env.OPENAI_API_KEY
  • secrets (weak) plur-ai-plur-e26901c/packages/core/test/meta/real-extraction.test.ts :49 const apiKey = process.env.ANTHROPIC_API_KEY
  • secrets (weak) plur-ai-plur-e26901c/packages/core/test/openai-embedder-hardening.test.ts :32 const originalKey = process.env.OPENAI_API_KEY
  • secrets (weak) plur-ai-plur-e26901c/packages/core/test/remote-smoke.test.ts :38 const TOKEN = process.env.PLUR_REMOTE_TEST_TOKEN
  • secrets (weak) plur-ai-plur-e26901c/packages/core/test/remote-store-live.test.ts :16 const TOKEN = process.env.PLUR_REMOTE_TEST_TOKEN
  • secrets plur-ai-plur-e26901c/packages/mcp/src/tools.ts :499 const openaiKey = process.env.OPENAI_API_KEY
  • secrets (weak) plur-ai-plur-e26901c/packages/mcp/test/tensions.test.ts :292 process.env.OPENAI_API_KEY = 'env-test-key'

database 8

  • db (weak) plur-ai-plur-e26901c/packages/cli/test/import.test.ts :68 const Database = require('better-sqlite3')
  • db plur-ai-plur-e26901c/packages/core/src/importers/gp-engram.ts :50 Database = require('better-sqlite3')
  • db plur-ai-plur-e26901c/packages/core/src/storage-indexed.ts :24 Database = require('better-sqlite3')
  • db (weak) plur-ai-plur-e26901c/packages/core/test/importers.test.ts :187 const Database = require('better-sqlite3')
  • db (weak) plur-ai-plur-e26901c/packages/core/test/pr1-indexed-migration.test.ts :18 try { Database = require('better-sqlite3'); hasSqlite = true } catch {}
  • db (weak) plur-ai-plur-e26901c/packages/core/test/read-side-scope-visibility.test.ts :30 try { require('better-sqlite3'); hasSqlite = true } catch {}
  • db (weak) plur-ai-plur-e26901c/packages/core/test/scope-pushdown.test.ts :32 try { require('better-sqlite3'); hasSqlite = true } catch { /* optional dep */ }
  • db (weak) plur-ai-plur-e26901c/packages/core/test/storage-indexed.test.ts :12 require('better-sqlite3')

install hooks 1

  • postinstall plur-ai-plur-e26901c/packages/claw/package.json :28 node dist/setup.js 2>/dev/null || true

declared dependencies 5

  • @types/node@25.5.0
  • tsup@^8.5.1
  • typescript@^6.0.2
  • vite@^7.3.5
  • vitest@^4.1.1

obfuscation 1

  • dynamic require()/import() plur-ai-plur-e26901c/packages/core/test/injection-dedup.test.ts :139 const { Plur } = require(${JSON.stringify(path.join(process.cwd(), 'packages/core/dist/index.js'))});

perm:untrusted 1

  • untrusted (weak) plur-ai-plur-e26901c/packages/cli/test/ui-server.test.ts :61 const html = await (await fetch(`${h.url}/?q=pnpm&mode=all`)).text()

transport_posture 1

  • network-listening, binds all interfaces, no auth detected plur-ai-plur-e26901c/packages/cli/test/ui-host.test.ts :249 const p = planViewer({ host: '0.0.0.0', allowHosts: [] })