npm analyzed 7.2.3

wyrm-mcp

v7.2.3

npm

Local-first persistent memory for AI agents over MCP. Ground truths, negative learning (recorded failures block repeats), decision causality, hybrid recall, live memory streams, run-attributed fleet memory — a structured SQLite memory on your machine, no

maintainer: ghost.protocol
license: UNLICENSED
first seen: 2026-06-15
last seen: 2026-06-23
releases · 30d: 57
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals npm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v7.2.3 · analyzer v20 · 2d ago

skills & prompt files 9

code evidence v7.2.3 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

filesystem 6

fs package/scripts/hooks/wyrm-session-capture.mjs :17 import { readFileSync, existsSync } from 'node:fs';
fs package/scripts/hooks/wyrm-session-prune.mjs :20 import { readFileSync } from 'node:fs';
fs package/scripts/hooks/wyrm-session-rehydrate.mjs :19 import { readFileSync } from 'node:fs';
fs package/scripts/hooks/wyrm-tool-call-trace.mjs :18 import { readFileSync } from 'node:fs';
fs package/scripts/postinstall.cjs :15 const fs = require('fs');
fs package/scripts/preinstall.cjs :30 const fs = require('fs');

shell / exec 18

shell package/dist/agent-daemon.js :1 import{spawn as E}from"child_process";import{existsSync as l,readFileSync as g,writeFileSync as I,statSync as w,openSync as M,closeSync as h,renameSync as v,unlinkSync as f,mkdirSync as O}from"fs";imp
shell package/dist/audit.js :1 import{createHash as g,createPrivateKey as w,createPublicKey as c,sign as $,verify as y}from"crypto";import{readFileSync as R}from"fs";import{getActor as I}from"./handlers/boundary.js";import{resolveA
shell package/dist/autoconfig.js :1 import{existsSync as u,readFileSync as p,writeFileSync as f,mkdirSync as k,copyFileSync as J,chmodSync as B}from"fs";import{homedir as m,platform as I}from"os";import{join as n,dirname as y,resolve as
shell package/dist/cloud-sync.js :1 import{spawn as D}from"child_process";import{existsSync as a,readFileSync as p,writeFileSync as k,statSync as g,mkdirSync as N,openSync as E,closeSync as b,unlinkSync as v,renameSync as A}from"fs";imp
shell package/dist/database.js :1 import k from"better-sqlite3";import{existsSync as u,mkdirSync as b,readdirSync as D,statSync as y,writeFileSync as L}from"fs";import{homedir as I}from"os";import{join as d,basename as A,resolve as M,
shell package/dist/handlers/companion.js :1 import{TOOL_ANNOTATIONS as l}from"../tool-annotations.js";import{injectSystemPrompt as h}from"../autoconfig.js";import{buildPeerBuddyReply as g}from"../buddy.js";import{getCapabilities as f,renderCapa
shell package/dist/harvest.js :1 import{execFileSync as m}from"child_process";import{readFileSync as h,existsSync as g}from"fs";import{join as p}from"path";import{createHash as x}from"crypto";const $=["README.md","CLAUDE.md","AGENTS.
shell package/dist/mcp-client.js :1 import{spawn as h}from"child_process";const m=300*1e3,g=10,f=3e4;class _{db;opts;clients=new Map;maintenance;constructor(e,t={}){this.db=e,this.opts=t,this.maintenance=setInterval(()=>this.reapIdle(),
shell package/dist/replication-daemon.js :1 import{spawn as b}from"child_process";import{existsSync as h,readFileSync as j,writeFileSync as M,statSync as I,mkdirSync as _,openSync as N,closeSync as w,unlinkSync as k,renameSync as U}from"fs";imp
shell package/dist/statusline.js :1 import{existsSync as C,mkdirSync as I,unlinkSync as x,writeFileSync as k,realpathSync as M}from"fs";import{join as S}from"path";import{homedir as h}from"os";import{createServer as $,createConnection a
shell package/dist/vault.js :1 import{createCipheriv as X,createDecipheriv as Q,randomBytes as d,scryptSync as U,timingSafeEqual as Z}from"node:crypto";import{existsSync as o,readFileSync as u,writeFileSync as R,mkdirSync as T,chmo
shell package/dist/wyrm-cli.js :2 import{join as oe,dirname as ae}from"path";import{homedir as Ee}from"os";import{existsSync as ce,readFileSync as V}from"fs";import{fileURLToPath as le}from"url";import{spawnSync as B}from"child_proces
shell package/dist/wyrm-ui.js :2 import{spawn as s}from"child_process";const n=parseInt(process.env.WYRM_HTTP_PORT??"3333",10)||3333,i="127.0.0.1",o=`http://${i}:${n}`;async function a(){try{return(await fetch(`${o}/health`,{signal:A
shell package/scripts/hooks/wyrm-session-capture.mjs :18 import { spawnSync } from 'node:child_process';
shell package/scripts/hooks/wyrm-session-prune.mjs :21 import { spawnSync } from 'node:child_process';
shell package/scripts/hooks/wyrm-session-rehydrate.mjs :20 import { spawnSync } from 'node:child_process';
shell package/scripts/hooks/wyrm-tool-call-trace.mjs :19 import { spawnSync } from 'node:child_process';
shell package/scripts/preinstall.cjs :33 const cp = require('child_process');

network 10

net package/dist/auto-capture.js :14 JSON:`;function f(t){const n=t.match(/\[[\s\S]*\]/);if(!n)return[];let r;try{r=JSON.parse(n[0])}catch{return[]}if(!Array.isArray(r))return[];const s=[],e=new Set;for(const a of r){if(!a||typeof a!="ob
net package/dist/cloud-backup.js :1 import{createReadStream as D,createWriteStream as z,statSync as H,existsSync as l,copyFileSync as T,unlinkSync as N,readFileSync as W,writeFileSync as G,renameSync as v}from"fs";import{createGzip as q
net package/dist/cloud/client.js :1 import{readFileSync as w,writeFileSync as g,existsSync as S,mkdirSync as b,chmodSync as E,unlinkSync as O}from"node:fs";import{join as y}from"node:path";import{homedir as T}from"node:os";const k=proce
net package/dist/daemon-writer.js :2 `)}catch{}}}function D(e,n){if(!c.has(e)&&c.size>=I){const i=c.keys().next().value;i!==void 0&&c.delete(i)}c.set(e,n)}function S(e){const n=c.get(e);return n===void 0?null:Date.now()>=n.expiresAt?(c.d
net package/dist/providers/embedding-provider.js :1 class c{name="local-hash";model="hash-384";dimensions=384;async embed(t){const e=new Float32Array(this.dimensions),o=t.toLowerCase().split(/\s+/);for(let a=0;a<o.length;a++){const n=o[a];for(let i=0;i
net package/dist/sub-agent.js :35 `).all(...s!=null?[n,s]:[n]);for(const o of e){const m=`[symbol ${o.language}:${o.kind}] ${o.symbol} @ ${o.file_path}:${o.line}`;if(!a("symbol",m))break}}catch{}const _=Object.entries(r).map(([n,e])=>
net package/dist/ui-dashboard.js :276 const r = await fetch(path, { signal: ctrl.signal });
net package/dist/version-check.js :15 `).run(new Date().toISOString(),t,c?1:0)}function d(e,t){const c=l=>l.split(".").map(f=>parseInt(f,10)),[r,n,s]=c(e),[a,o,i]=c(t);return[r,n,s,a,o,i].some(l=>Number.isNaN(l))?0:r!==a?r<a?-1:1:n!==o?n<
net package/dist/wyrm-cli.js :64 \xA9 2026 Ghost Protocol (Pvt) Ltd \xB7 Proprietary \xB7 https://wyrm.ghosts.lk`)),console.log(d.dim(" Licensed under the Wyrm Terms of Service. No open-source license is granted."))}async function B
net package/dist/wyrm-ui.js :2 import{spawn as s}from"child_process";const n=parseInt(process.env.WYRM_HTTP_PORT??"3333",10)||3333,i="127.0.0.1",o=`http://${i}:${n}`;async function a(){try{return(await fetch(`${o}/health`,{signal:A

secrets 11

secrets package/dist/cloud-sync-entrypoint.js :1 import{WyrmCloudBackup as r}from"./cloud-backup.js";import{CloudSyncDaemon as t,DEFAULT_INTERVAL_MS as _,DEFAULT_KEEP_COUNT as p,DEFAULT_DB_PATH as R}from"./cloud-sync.js";async function E(){const e=N
secrets package/dist/context-build-budgeted.js :1 import{applyBudget as w,resolveBudget as v}from"./token-budget.js";import{score as p}from"./context-ranking.js";function S(g){const{groundTruths:b,scaffoldLib:h,memory:y,toolAnalytics:$,sessionSeen:u,
secrets package/dist/handlers/companion.js :16 `)}]}}},{name:"wyrm_capabilities",description:"Use to learn what your memory system can actually do - feature inventory, why each matters, runtime state, and which tool to reach for. Call at session s
secrets package/dist/handlers/intelligence.js :5 - Total uses: ${t.reuse_count} (\u2705 ${t.reuse_success_count} / \u274C ${t.reuse_failure_count})`}]}}},{name:"wyrm_context_build",description:"Use to build a compact context brief for the current ta
secrets package/dist/handlers/resources.js :1 import{getCapabilities as f,renderCapabilityBriefing as y}from"../capabilities.js";import{decodeCursor as g}from"../keyset.js";const o="wyrm://",c="application/json",l="text/markdown",T=["truths","fai
secrets package/dist/index.js :2 import{Server as _t}from"@modelcontextprotocol/sdk/server/index.js";import{StdioServerTransport as yt}from"@modelcontextprotocol/sdk/server/stdio.js";import{CallToolRequestSchema as dt,GetPromptReques
secrets package/dist/providers/embedding-provider.js :1 class c{name="local-hash";model="hash-384";dimensions=384;async embed(t){const e=new Float32Array(this.dimensions),o=t.toLowerCase().split(/\s+/);for(let a=0;a<o.length;a++){const n=o[a];for(let i=0;i
secrets package/dist/repl-guard.js :1 import{isIP as p}from"node:net";const w=15e3,E=4*1024*1024;function f(o){const t=o.toLowerCase().replace(/^\[|\]$/g,"").replace(/\.$/,"");if(!t||t==="localhost"||t.endsWith(".localhost")||t.endsWith("
secrets package/dist/sub-agent.js :37 `),u=t.model_override?.split(":")??[],_=u[0],n=u[1],e=t.ollama_url??process.env.OLLAMA_URL??w,o=t.openai_api_key??process.env.OPENAI_API_KEY;let m=null,y="none";const $=_==="openai"?["openai","ollama"
secrets package/dist/vault.js :1 import{createCipheriv as X,createDecipheriv as Q,randomBytes as d,scryptSync as U,timingSafeEqual as Z}from"node:crypto";import{existsSync as o,readFileSync as u,writeFileSync as R,mkdirSync as T,chmo
secrets package/dist/wyrm-cli.js :67 Database size: ${u.dbSize}`))}finally{n.close()}}async function Je(l){const{positional:i,flags:e}=x(l),s=i[0]??"status",{createVectorStore:r}=await import("./vectors.js"),n={provider:e.provider??proce

install hooks 3

preinstall package/package.json :32 node scripts/preinstall.cjs
postinstall package/package.json :33 node scripts/postinstall.cjs
prepublishOnly package/package.json :45 npm run build

declared dependencies 13

@modelcontextprotocol/sdk@^1.0.0
@scure/bip39@^2.2.0
better-sqlite3@^12.10.0
@types/better-sqlite3@^7.6.13
@types/jest@^30.0.0
@types/node@^22.19.19
@typescript-eslint/eslint-plugin@^8.60.0
@typescript-eslint/parser@^8.60.0
esbuild@^0.28.1
eslint@^10.4.0
jest@^30.4.2
ts-jest@^29.4.11
typescript@^5.9.3

obfuscation 1

dynamic require()/import() package/dist/wyrm-cli.js :118 --last <N> Number of git commits to import (default: 20)

perm:untrusted 1

untrusted package/dist/wyrm-cli.js :66 Waiting for approval\u2026 (Ctrl-C to cancel)`));const r=(e.interval??3)*1e3,t=Date.now()+(e.expires_in??600)*1e3;let n="";for(;Date.now()<t;){await new Promise(c=>setTimeout(c,r));try{const m=await(a