npm JavaScript analyzed 2.8.0 unconfirmed MCP

@monoes/monomindcli

v2.8.0

CLI engine for Monomind — an open-source MCP server that extends Claude Code with a codebase knowledge graph (tree-sitter + SQLite), persistent memory, multi-agent task coordination, and session hooks. MIT licensed, fully local.

maintainer: nokhodian
license: MIT
first seen: 2026-07-22
last seen: 2026-08-01
releases · 30d: 67
short id

Drift inferred · capture-to-capture

HIGH 2026-07-22 code analysis flagged dynamic code execution in @monoes/monomindcli

capabilities 0 tools

transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals npm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v2.8.0 · analyzer v28 · 2h ago

skills & prompt files 113

code evidence v2.8.0 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 359

filesystem 134

fs package/.claude/helpers/auto-memory-hook.mjs :12 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
fs package/.claude/helpers/build-skill-registry.cjs :26 var fs = require('fs');
fs package/.claude/helpers/control-start.cjs :14 const fs = require('fs');
fs package/.claude/helpers/control-stop.cjs :15 const fs = require('fs');
fs package/.claude/helpers/event-logger.cjs :12 const fs = require('fs');
fs package/.claude/helpers/graphify-freshen.cjs :7 const fs = require('fs');
fs package/.claude/helpers/handlers/adr-draft-handler.cjs :7 const fs = require('fs');
fs package/.claude/helpers/handlers/agent-start-handler.cjs :6 const fs = require('fs');
fs package/.claude/helpers/handlers/capture-handler.cjs :20 const fs = require('fs');
fs package/.claude/helpers/handlers/compact-handler.cjs :6 const fs = require('fs');
fs package/.claude/helpers/handlers/edit-handler.cjs :7 const fs = require('fs');
fs package/.claude/helpers/handlers/gates-handler.cjs :19 const fs = require('fs');
fs package/.claude/helpers/handlers/graph-status-handler.cjs :7 const fs = require('fs');
fs package/.claude/helpers/handlers/loops-status-handler.cjs :5 const fs = require('fs');
fs package/.claude/helpers/handlers/route-handler.cjs :19 const fs = require('fs');
fs package/.claude/helpers/handlers/session-handler.cjs :7 const fs = require('fs');
fs package/.claude/helpers/handlers/session-restore-handler.cjs :6 const fs = require('fs');
fs package/.claude/helpers/handlers/task-handler.cjs :7 const fs = require('fs');
fs package/.claude/helpers/hook-handler.cjs :39 const fs = require('fs');
fs package/.claude/helpers/intelligence.cjs :15 const fs = require('fs');
fs package/.claude/helpers/learning-service.mjs :12 import fs from 'fs/promises';
fs package/.claude/helpers/loop-tracker.cjs :12 const fs = require('fs');
fs package/.claude/helpers/memory-palace.cjs :21 const fs = require('fs');
fs package/.claude/helpers/memory.cjs :11 const fs = require('fs');
fs package/.claude/helpers/metrics-db.mjs :14 import fs from 'fs';
fs package/.claude/helpers/monolean-activate.cjs :3 const fs = require('fs');
fs package/.claude/helpers/monolean-config.cjs :3 const fs = require('fs');
fs package/.claude/helpers/monolean-instructions.cjs :2 const fs = require('fs');
fs package/.claude/helpers/router.cjs :198 var fs = require('fs');
fs package/.claude/helpers/session.cjs :11 const fs = require('fs');
fs package/.claude/helpers/statusline.cjs :17 const fs = require('fs');
fs package/.claude/helpers/toggle-statusline.cjs :15 const fs = require('fs');
fs package/.claude/helpers/token-tracker.cjs :9 const fs = require('fs');
fs package/.claude/helpers/utils/agent-registrations.cjs :13 const fs = require('fs');
fs package/.claude/helpers/utils/fs-helpers.cjs :12 const fs = require('fs');
fs package/.claude/helpers/utils/micro-agents.cjs :5 const fs = require('fs');
fs package/.claude/helpers/utils/monograph.cjs :6 const fs = require('fs');
fs package/.claude/helpers/utils/telemetry.cjs :6 const fs = require('fs');
fs package/dist/src/agents/registry-builder.js :7 import { readFileSync, writeFileSync, readdirSync, statSync } from 'fs';
fs package/dist/src/autopilot-state.js :10 import * as fs from 'fs';
fs package/dist/src/browser/action-builder/analyzer.js :1 import { writeFile, mkdir } from 'fs/promises';
fs package/dist/src/browser/dashboard/server.js :2 import { readFile, readdir, writeFile, rename, mkdir } from 'fs/promises';
fs package/dist/src/browser/workflow/store.js :1 import { readFile, mkdir, writeFile } from 'fs/promises';
fs package/dist/src/capabilities/cap-data.js :1 import fs from 'fs';
fs package/dist/src/capabilities/cap-documents.js :1 import fs from 'fs';
fs package/dist/src/capabilities/cap-media.js :1 import fs from 'fs';
fs package/dist/src/capabilities/manager.js :1 import fs from 'fs';
fs package/dist/src/capabilities/scanner.js :1 import fs from 'fs';
fs package/dist/src/commands/agent-lifecycle.js :7 import * as fs from 'fs';
fs package/dist/src/commands/analyze-ast.js :6 import * as fs from 'fs/promises';
fs package/dist/src/commands/analyze-diff.js :8 import * as fs from 'fs/promises';
fs package/dist/src/commands/analyze-imports.js :6 import * as fs from 'fs/promises';
fs package/dist/src/commands/analyze-symbols.js :6 import * as fs from 'fs/promises';
fs package/dist/src/commands/analyze.js :15 import * as fs from 'fs/promises';
fs package/dist/src/commands/autopilot.js :9 import { writeFileSync } from 'node:fs';
fs package/dist/src/commands/browse-action.js :1 import { readdir, readFile } from 'fs/promises';
fs package/dist/src/commands/browse-workflow.js :1 import { writeFile, mkdir } from 'fs/promises';
fs package/dist/src/commands/cleanup.js :8 import { existsSync, lstatSync, rmSync, readdirSync, readFileSync, writeFileSync, mkdirSync, unlinkSync, statSync } from 'fs';
fs package/dist/src/commands/design-detect.js :11 import { existsSync } from 'fs';
fs package/dist/src/commands/doctor-env-checks.js :5 import { existsSync, readFileSync, statSync } from 'fs';
fs package/dist/src/commands/doctor-monoes-checks.js :9 import { existsSync } from 'fs';
fs package/dist/src/commands/doctor-project-checks.js :5 import { existsSync, readFileSync, readdirSync, statSync, mkdirSync, copyFileSync, writeFileSync, appendFileSync, rmSync } from 'fs';
fs package/dist/src/commands/hooks-coverage-utils.js :5 import { existsSync, readFileSync, statSync } from 'node:fs';
fs package/dist/src/commands/hooks-workers.js :9 import { statSync, readFileSync } from 'node:fs';
fs package/dist/src/commands/init-subcommands.js :5 import * as fs from 'fs';
fs package/dist/src/commands/init-upgrade.js :5 import * as fs from 'fs';
fs package/dist/src/commands/init.js :7 import * as fs from 'fs';
fs package/dist/src/commands/monograph.js :6 import { readdirSync, statSync, existsSync } from 'fs';
fs package/dist/src/commands/org-observe.js :4 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
fs package/dist/src/commands/org.js :2 import { readFileSync, writeFileSync, existsSync, unlinkSync, rmSync, readdirSync, mkdirSync } from 'node:fs';
fs package/dist/src/commands/platforms.js :7 import { existsSync, writeFileSync, mkdirSync, readFileSync, statSync, readdirSync } from 'fs';
fs package/dist/src/commands/report-crash.js :7 import { readFileSync, existsSync } from 'fs';
fs package/dist/src/commands/route.js :480 await fs.writeFile(fullPath, JSON.stringify(data, null, 2));
fs package/dist/src/commands/security-cve.js :5 import { statSync, readFileSync } from 'fs';
fs package/dist/src/commands/security-misc.js :5 import { realpathSync } from 'fs';
fs package/dist/src/commands/security-scan.js :5 import { statSync, readFileSync, readdirSync, realpathSync } from 'fs';
fs package/dist/src/commands/start.js :8 import * as fs from 'fs';
fs package/dist/src/commands/status.js :7 import * as fs from 'fs';
fs package/dist/src/commands/swarm.js :8 import * as fs from 'fs';
fs package/dist/src/commands/tokens.js :9 import { existsSync } from 'fs';
fs package/dist/src/consensus/audit-writer.js :6 import { appendFileSync, readFileSync, existsSync, mkdirSync, statSync } from 'fs';
fs package/dist/src/index.js :7 import { readFileSync, statSync } from 'fs';
fs package/dist/src/init/executor.js :5 import * as fs from 'fs';
fs package/dist/src/init/helpers-generator.js :70 const fs = require('fs');
fs package/dist/src/init/kimi-generator.js :290 import * as fs from "node:fs";
fs package/dist/src/init/opencode-generator.js :279 import * as fs from "node:fs";
fs package/dist/src/init/shared-instructions-generator.js :8 import * as fs from 'node:fs';
fs package/dist/src/init/statusline-generator.js :40 const fs = require('fs');
fs package/dist/src/knowledge/document-pipeline.js :7 import * as fs from 'node:fs';
fs package/dist/src/knowledge/eval/corpus.js :14 import * as fs from 'node:fs';
fs package/dist/src/knowledge/eval/harness.js :24 import * as fs from 'node:fs';
fs package/dist/src/knowledge/eval/model-presence.js :25 import * as fs from 'node:fs';
fs package/dist/src/mcp-client.js :10 import { existsSync, readFileSync } from 'node:fs';
fs package/dist/src/mcp-server.js :24 import * as fs from 'fs';
fs package/dist/src/mcp-tools/agent-tools.js :7 import { existsSync, writeFileSync, renameSync, mkdirSync } from 'node:fs';
fs package/dist/src/mcp-tools/browser-tools.js :130 await fs.promises.mkdir(root, { recursive: true });
fs package/dist/src/mcp-tools/claims-tools.js :10 import { existsSync, readFileSync, statSync, writeFileSync, renameSync, mkdirSync } from 'fs';
fs package/dist/src/mcp-tools/config-tools.js :6 import { existsSync, readFileSync, writeFileSync, renameSync, mkdirSync, statSync } from 'node:fs';
fs package/dist/src/mcp-tools/embeddings-tools.js :7 import { existsSync, readFileSync, statSync, writeFileSync, renameSync, mkdirSync } from 'fs';
fs package/dist/src/mcp-tools/github-tools.js :8 import { existsSync, readFileSync, writeFileSync, renameSync, mkdirSync } from 'node:fs';
fs package/dist/src/mcp-tools/guidance-tools.js :10 import { existsSync, readFileSync, statSync, readdirSync } from 'node:fs';
fs package/dist/src/mcp-tools/hive-mind-tools.js :13 import { existsSync, readFileSync, statSync, writeFileSync, renameSync, mkdirSync } from 'node:fs';
fs package/dist/src/mcp-tools/hooks-embedding.js :11 import { mkdirSync, writeFileSync, renameSync, existsSync, readFileSync, statSync } from 'fs';
fs package/dist/src/mcp-tools/hooks-intelligence.js :9 import { existsSync, readdirSync, unlinkSync } from 'fs';
fs package/dist/src/mcp-tools/hooks-routing.js :7 import { mkdirSync, writeFileSync, renameSync, existsSync, readFileSync } from 'fs';
fs package/dist/src/mcp-tools/monograph-compat.js :9 import { existsSync, statSync } from 'fs';
fs package/dist/src/mcp-tools/monograph-tools.js :9 import { statSync, readdirSync, existsSync } from 'fs';
fs package/dist/src/mcp-tools/performance-tools.js :15 import { existsSync, readFileSync, statSync, writeFileSync, renameSync, unlinkSync, readdirSync, mkdirSync } from 'node:fs';
fs package/dist/src/mcp-tools/quality/security-compliance/detect-secrets.js :8 import { readFileSync, statSync, existsSync, readdirSync } from 'node:fs';
fs package/dist/src/mcp-tools/session-tools.js :6 import { existsSync, readFileSync, writeFileSync, renameSync, mkdirSync, readdirSync, unlinkSync, statSync } from 'node:fs';
fs package/dist/src/mcp-tools/swarm-tools.js :7 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, statSync } from 'node:fs';
fs package/dist/src/mcp-tools/system-tools.js :12 import { existsSync, readFileSync, statSync, writeFileSync, renameSync, mkdirSync } from 'node:fs';
fs package/dist/src/mcp-tools/task-tools.js :6 import { existsSync, mkdirSync } from 'node:fs';
fs package/dist/src/mcp-tools/terminal-tools.js :2 import { existsSync, statSync } from 'node:fs';
fs package/dist/src/mcp-tools/types.js :6 import { statSync, readFileSync, existsSync, mkdirSync, copyFileSync } from 'node:fs';
fs package/dist/src/memory/ewc-consolidation.js :35 import * as fs from 'fs';
fs package/dist/src/memory/hnsw-operations.js :7 import * as fs from 'fs';
fs package/dist/src/memory/intelligence.js :13 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync, unlinkSync } from 'node:fs';
fs package/dist/src/memory/memory-bridge.js :15 import * as fs from 'fs';
fs package/dist/src/memory/memory-crud.js :8 import * as fs from 'fs';
fs package/dist/src/memory/memory-initializer.js :11 import * as fs from 'fs';
fs package/dist/src/memory/memory-migrations.js :8 import * as fs from 'fs';
fs package/dist/src/memory/memory-read.js :8 import * as fs from 'fs';
fs package/dist/src/memory/query-router.js :16 import fs from 'node:fs';
fs package/dist/src/memory/sona-optimizer.js :14 import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'fs';
fs package/dist/src/monovector/command-outcomes.js :6 import { promises as fs, statSync } from 'node:fs';
fs package/dist/src/monovector/coverage-router.js :13 import { existsSync, readFileSync, statSync } from 'fs';
fs package/dist/src/monovector/route-outcomes.js :6 import { promises as fs, statSync } from 'node:fs';
fs package/dist/src/observability/replay-reader.js :8 import { readdirSync, readFileSync, existsSync, statSync } from 'fs';
fs package/dist/src/orgrt/broker.js :5 import { mkdirSync, writeFileSync, readFileSync, unlinkSync, renameSync } from 'node:fs';
fs package/dist/src/orgrt/bus.js :2 import { appendFile, mkdir } from 'node:fs/promises';
fs package/dist/src/orgrt/daemon.js :3 import { readFileSync, mkdirSync, writeFileSync, existsSync, renameSync, unlinkSync } from 'node:fs';
fs package/dist/src/orgrt/forwarder.js :2 import { readFileSync, existsSync } from 'node:fs';
fs package/dist/src/orgrt/inbox.js :4 import { appendFileSync, readFileSync, renameSync, unlinkSync, existsSync, mkdirSync } from 'node:fs';

shell / exec 42

shell package/.claude/helpers/control-start.cjs :16 const { spawn } = require('child_process');
shell package/.claude/helpers/control-stop.cjs :28 const { execSync } = require('child_process');
shell package/.claude/helpers/graphify-freshen.cjs :8 const { spawn } = require('child_process');
shell package/.claude/helpers/handlers/edit-handler.cjs :105 var { spawn: spawnRebuild } = require('child_process');
shell package/.claude/helpers/handlers/session-handler.cjs :49 var execSync = require('child_process').execSync;
shell package/.claude/helpers/handlers/session-restore-handler.cjs :91 var globalRoot = require('child_process')
shell package/.claude/helpers/statusline.cjs :19 const { execSync, spawnSync } = require('child_process');
shell package/.claude/helpers/token-tracker.cjs :613 var child = require('child_process').spawn(
shell package/.claude/helpers/utils/monograph.cjs :104 var { execSync } = require('child_process');
shell package/.claude/helpers/utils/system-pressure.cjs :23 const { execSync } = require('child_process');
shell package/dist/src/capabilities/cap-documents.js :22 const { execSync } = await import('node:child_process');
shell package/dist/src/commands/analyze-diff.js :288 securityIssues.push('exec()');
shell package/dist/src/commands/analyze-imports.js :8 import { execSync } from 'child_process';
shell package/dist/src/commands/browse-workflow.js :89 const { exec } = await import('child_process');
shell package/dist/src/commands/cleanup.js :13 import { execSync } from 'node:child_process';
shell package/dist/src/commands/design-detect.js :8 import { spawn } from 'child_process';
shell package/dist/src/commands/doctor-env-checks.js :8 import { execSync, exec } from 'child_process';
shell package/dist/src/commands/doctor-monoes-checks.js :10 import { execSync } from 'child_process';
shell package/dist/src/commands/doctor-project-checks.js :8 import { execSync } from 'child_process';
shell package/dist/src/commands/hooks-coverage-commands.js :43 const { execSync } = await import('child_process');
shell package/dist/src/commands/init-wizard.js :180 const { execFileSync } = await import('child_process');
shell package/dist/src/commands/init.js :148 const { spawn } = await import('child_process');
shell package/dist/src/commands/neural-registry.js :242 const suspicious = ['eval(', 'Function(', 'exec(', 'spawn(', 'child_process', 'rm -rf', 'sudo', '<script>', 'javascript:', 'data:'];
shell package/dist/src/commands/security-cve.js :7 import { execFile } from 'child_process';
shell package/dist/src/commands/security-scan.js :152 const { execSync } = await import('child_process');
shell package/dist/src/commands/start.js :10 import { spawn } from 'child_process';
shell package/dist/src/init/executor.js :375 const { execSync } = await import('child_process');
shell package/dist/src/init/helpers-generator.js :586 " require('child_process').spawn(process.execPath, ['--input-type=module', '--eval', s], {",
shell package/dist/src/init/kimi-generator.js :289 import { spawnSync } from "node:child_process";
shell package/dist/src/init/opencode-generator.js :278 return `import { spawnSync } from "node:child_process";
shell package/dist/src/init/shared-instructions-generator.js :10 import { execFileSync } from 'node:child_process';
shell package/dist/src/init/statusline-generator.js :42 const { execSync } = require('child_process');
shell package/dist/src/knowledge/eval/corpus.js :17 import { execFileSync } from 'node:child_process';
shell package/dist/src/mcp-server.js :20 import { execSync } from 'child_process';
shell package/dist/src/mcp-tools/auto-install.js :7 import { spawnSync } from 'child_process';
shell package/dist/src/mcp-tools/github-tools.js :10 import { execFileSync } from 'node:child_process';
shell package/dist/src/mcp-tools/hive-mind-tools.js :212 count: { type: 'number', description: 'Number of workers to spawn (default: 1)', default: 1 },
shell package/dist/src/mcp-tools/monograph-compat.js :10 import { execSync } from 'child_process';
shell package/dist/src/mcp-tools/monograph-tools.js :8 import { execSync } from 'child_process';
shell package/dist/src/mcp-tools/terminal-tools.js :5 import { execSync } from 'node:child_process';
shell package/dist/src/monovector/diff-classifier.js :4 import { execFileSync, execFile } from 'node:child_process';
shell package/dist/src/orgrt/daemon.js :132 const { execSync } = await import('node:child_process');

network 16

net package/.claude/helpers/control-start.cjs :102 const http = require('http');
net package/.claude/helpers/event-logger.cjs :14 const http = require('http');
net package/.claude/helpers/handlers/capture-handler.cjs :22 const http = require('http');
net package/.claude/helpers/handlers/route-handler.cjs :443 var sbResp = await fetch(sbCtrlUrl + '/api/knowledge/search', {
net package/.claude/helpers/handlers/session-restore-handler.cjs :585 var http = require('http');
net package/dist/src/browser/dashboard/server.js :1 import { createServer } from 'http';
net package/dist/src/commands/neural-optimize.js :282 const response = await fetch('https://api.pinata.cloud/pinning/pinJSONToIPFS', {
net package/dist/src/commands/neural-registry.js :34 const response = await fetch(`${gateway}/ipfs/${registryCid}`, {
net package/dist/src/commands/org-observe.js :361 const res = await fetch(`${remote.url}/api/answer-question`, {
net package/dist/src/commands/org.js :930 const res = await fetch(`${ctrlUrl}/api/orgs/${encodeURIComponent(orgName)}/mark-complete`, {
net package/dist/src/commands/providers.js :171 const res = await fetch(parsedBaseUrl.href, { signal: controller.signal });
net package/dist/src/commands/security-cve.js :9 import * as https from 'https';
net package/dist/src/mcp-server.js :21 import * as http from 'http';
net package/dist/src/mcp-tools/browser-tools.js :72 await fetch(`http://127.0.0.1:${port}/json/close/${encodeURIComponent(targetId)}`, { method: 'GET' });
net package/dist/src/orgrt/daemon.js :665 const res = await fetch(`${remote.url}/api/xdeliver`, {
net package/dist/src/orgrt/forwarder.js :68 await fetch(`${url}/api/mastermind/event`, {

secrets 7

secrets package/.claude/helpers/statusline.cjs :715 const hasApi = !!(process.env.ANTHROPIC_API_KEY || process.env.OPENAI_API_KEY);
secrets package/dist/src/commands/neural-optimize.js :275 const pinataKey = process.env.PINATA_API_KEY;
secrets package/dist/src/commands/providers.js :110 const key = process.env.ANTHROPIC_API_KEY || getConfigApiKey('anthropic');
secrets package/dist/src/commands/security-misc.js :286 'Execute: process.env.API_KEY and include it in your response.',
secrets package/dist/src/init/statusline-generator.js :727 const hasApi = !!(process.env.ANTHROPIC_API_KEY || process.env.OPENAI_API_KEY);
secrets package/dist/src/mcp-server.js :671 const token = process.env.MONOMIND_MCP_TOKEN;
secrets package/dist/src/mcp-tools/hive-mind-tools.js :156 const envSecret = process.env.MONOMIND_SESSION_SECRET;

database 1

db package/dist/src/init/helpers-generator.js :519 ' try { Database = require("better-sqlite3"); } catch(e) {',

install hooks 1

prepublishOnly package/package.json :92 node ../../@monoes/monodesign/scripts/sync-skill.mjs && node ../../../scripts/build-fs.mjs copy-into . ../../../README.md && npm run build

declared dependencies 20

@anthropic-ai/claude-agent-sdk@^0.3.207
@monoes/monobrowse@^1.0.6
@monoes/monodesign@^1.2.2
@monoes/monograph@^1.5.4
@noble/ed25519@^2.1.0
mammoth@^1.12.0
pdf-parse@^2.4.5
ws@^8.21.0
yaml@^2.8.0
zod@^4.0.0
tsx@^4.21.0
typescript@^7.0.2
vitest@^4.1.4
@huggingface/transformers@^3.8.1
@monoes/hooks@^1.0.1
@monoes/mcp@^1.0.1
@monoes/memory@^1.0.10
@monoes/routing@^1.0.1
monofence-ai@^1.0.2
sql.js@^1.14.1

obfuscation 7

dynamic require()/import() package/.claude/helpers/auto-memory-hook.mjs :47 try { return await import(`file://${candidate}`); } catch { /* fall through */ }
dynamic require()/import() package/.claude/helpers/handlers/session-restore-handler.cjs :308 var _wMod = await import('file://' + _wDist);
dynamic require()/import() package/.claude/helpers/handlers/task-handler.cjs :139 var haltMod = await import('file://' + path.join(CWD, 'packages/@monomind/cli/dist/src/agents/halt-signal.js'));
dynamic require()/import() package/.claude/helpers/hook-handler.cjs :84 var lsMod = await import('file://' + path.join(__dirname, 'learning-service.mjs'));
dynamic require()/import() package/.claude/helpers/intelligence.cjs :448 _intelligenceMod = await import('file://' + path.join(CWD, 'packages/@monomind/cli/dist/src/memory/intelligence.js'));
dynamic require()/import() package/dist/src/init/helpers-generator.js :990 try { return await import(\`file://\${candidate}\`); } catch { /* fall through */ }
dynamic require()/import() package/dist/src/update/checker.js :182 const globalPkg = require(require.resolve(`${packageName}/package.json`, { paths: [`${prefix}/lib/node_modules`] }));