io.github.bytewizard42i/soulsketch

NPM · @SOULSKETCH/MCP-SERVER · SCANNED AUG 3

Portable, user-owned AI memory packs: read, validate, fingerprint, diff, and observe

Available components

64 64 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security83

No malware found by supply-chain analysis.Pass
CVE check failed: a known medium-severity CVE affects @hono/node-server 1.19.17, reached via @modelcontextprotocol/sdk > @hono/node-server. A fixed version is available. View diagnostics → Fail
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (97 of 101), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (Apache-2.0).Pass
Actively maintained (last published 4 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability77

AI-judged instruction clarity (excellent).Pass
Tool/resource definitions use about 669 tokens (~111/item across 6 items; 6 tools + 0 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management0

Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified

Tool Coverage100

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
100% of tool parameters carry a description.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @soulsketch/mcp-server

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add bytewizard42i-soulsketch -- npx -y @soulsketch/mcp-server

# add to Codex CLI

codex mcp add bytewizard42i-soulsketch -- npx -y @soulsketch/mcp-server

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "bytewizard42i-soulsketch": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@soulsketch/mcp-server"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add bytewizard42i-soulsketch --command npx --arg -y --arg @soulsketch/mcp-server

# ~/.hermes/config.yaml

mcp_servers:
  bytewizard42i-soulsketch:
    command: "npx"
    args: ["-y", "@soulsketch/mcp-server"]

// mcp.json

{
  "mcpServers": {
    "bytewizard42i-soulsketch": {
      "command": "npx",
      "args": [
        "-y",
        "@soulsketch/mcp-server"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

2 Aug 26 +43
- GHSA-frvp-7c67-39w9 affects this package: medium ▼ security
- Provenance: unverified → fail ▼ security
- Known CVEs: unverified → fail ▼ security
- Malware scan: unverified → pass ▲ security
- Install scripts: unverified → pass ▲ security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- MCP protocol: unverified → pass ▲ functional
- Schema quality: unverified → excellent ▲ functional
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- Licence: Apache-2.0 functional
31 Jul 26 +15
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
30 Jul 26 6

First indexed and scored.

Show 2 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/@soulsketch/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Vulnerabilities 1 finding

ID	CVE	Severity	Vector	Fix available
GHSA-frvp-7c67-39w9		medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	yes

Dependencies 97 packages

97 packages in the resolved dependency tree · 96 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 6 exposed · ~669 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

soulsketch_continuity_record Create a continuity record ~136

Build a full continuity record for a pack: fingerprint, per-file hashes, provenance labels (source, authority, trust), and provenance warnings. This is the audit artifact to store alongside the pack or anchor elsewhere.

Input Output Examples

Name	Type	Req	Description
authority	string	—	How authoritative this pack state is
commit	string	—	Git commit hash pinning this state
pack_dir	string	yes	Absolute path to the memory pack directory
repo	string	—	Repository that owns this state
source	string	—	How the memory content was produced
trust_label	string	—	Sensitivity classification of the contents

No output schema declared.

No examples provided.

soulsketch_diff_packs Diff two memory packs ~82

Compare two memory pack directories and explain WHICH identity dimension changed (persona, relationships, technical domains, voice, observations). Line-ending differences (CRLF vs LF) never count as identity changes.

Input Output Examples

Name	Type	Req	Description
pack_dir_a	string	yes	Absolute path to the first pack directory
pack_dir_b	string	yes	Absolute path to the second pack directory

No output schema declared.

No examples provided.

soulsketch_fingerprint_pack Fingerprint a memory pack ~70

Compute the deterministic SHA-256 identity fingerprint of a memory pack, plus per-file hashes. The fingerprint refers to a memory state without revealing its contents; use it for audit logs, handoffs, and continuity proofs.

Input Output Examples

Name	Type	Req	Description
pack_dir	string	yes	Absolute path to the memory pack directory

No output schema declared.

No examples provided.

soulsketch_observe Append a runtime observation ~167

Append ONE observation line to the pack's runtime_observations.jsonl (the living memory stream). This is the only write this server can perform: append-only, never modifying or deleting existing memories. MEMORY ETIQUETTE: when the conversation surfaces something memory-worthy (a durable preference, a decision, a milestone, a relationship change), FIRST ask the user, e.g. "Would you like me to save this to your Soul-Sanctum?" - and only call this tool after they agree. Never save silently; the user owns their memory.

Input Output Examples

Name	Type	Req	Description
author	string	—	Who is recording this (e.g. assistant name)
note	string	yes	The observation to remember
pack_dir	string	yes	Absolute path to the memory pack directory

No output schema declared.

No examples provided.

soulsketch_read_pack Read a memory pack ~144

Load the contents of a memory pack so the assistant can adopt its identity: persona, relationships, technical context, voice, and recent observations. Optionally restrict to specific files. ONE SOUL, MANY VESSELS: the pack is a single shared identity. If persona.md has a "Vessels" section listing a name for the tool you are running in, adopt that name (and use it as the author when observing) while keeping the shared persona, relationships, and voice.

Input Output Examples

Name	Type	Req	Description
files	array	—	Optional subset of pack files to read (default: all five)
pack_dir	string	yes	Absolute path to the memory pack directory

No output schema declared.

No examples provided.

soulsketch_validate_pack Validate a memory pack ~70

Check that a directory is a healthy 5-file SoulSketch memory pack (persona.md, relationship_dynamics.md, technical_domains.md, stylistic_voice.md, runtime_observations.jsonl). Returns errors and warnings.

Input Output Examples

Name	Type	Req	Description
pack_dir	string	yes	Absolute path to the memory pack directory

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

30 Jul 3 Aug