# io.github.bytewizard42i/soulsketch (npm · @soulsketch/mcp-server)

Portable, user-owned AI memory packs: read, validate, fingerprint, diff, and observe

- Trust score: 64/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@soulsketch/mcp-server`: 64/100 (this document), [markdown](https://verifymcp.io/servers/bytewizard42i-soulsketch/soulsketch-mcp-server.md), [page](https://verifymcp.io/servers/bytewizard42i-soulsketch/soulsketch-mcp-server)

## Channel facts

- Registry: `npm`
- Package: `@soulsketch/mcp-server`
- Version: `1.3.3`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects @hono/node-server 1.19.17, reached via @modelcontextprotocol/sdk > @hono/node-server. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (97 of 101), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 4 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 669 tokens (~111/item across 6 items; 6 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add bytewizard42i-soulsketch -- npx -y @soulsketch/mcp-server
```

### Codex

```bash
codex mcp add bytewizard42i-soulsketch -- npx -y @soulsketch/mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "bytewizard42i-soulsketch": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@soulsketch/mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add bytewizard42i-soulsketch --command npx --arg -y --arg @soulsketch/mcp-server
```

### Hermes

```yaml
mcp_servers:
  bytewizard42i-soulsketch:
    command: "npx"
    args: ["-y", "@soulsketch/mcp-server"]
```

### Other

```json
{
  "mcpServers": {
    "bytewizard42i-soulsketch": {
      "command": "npx",
      "args": [
        "-y",
        "@soulsketch/mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 64, +43)

- [security regression] GHSA-frvp-7c67-39w9 affects this package: medium
- [security regression] Provenance: unverified → fail
- [security regression] Known CVEs: unverified → fail
- [security improvement] Malware scan: unverified → pass
- [security improvement] Install scripts: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional] Licence: Apache-2.0

### 2026-07-31 (score 21, +15)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 6)

First indexed and scored.

## MCP tools (6)

### `soulsketch_validate_pack` (~70 tokens)

Validate a memory pack

Check that a directory is a healthy 5-file SoulSketch memory pack (persona.md, relationship_dynamics.md, technical_domains.md, stylistic_voice.md, runtime_observations.jsonl). Returns errors and warnings.

Input parameters:

- `pack_dir` (string, required): Absolute path to the memory pack directory

### `soulsketch_fingerprint_pack` (~70 tokens)

Fingerprint a memory pack

Compute the deterministic SHA-256 identity fingerprint of a memory pack, plus per-file hashes. The fingerprint refers to a memory state without revealing its contents; use it for audit logs, handoffs, and continuity proofs.

Input parameters:

- `pack_dir` (string, required): Absolute path to the memory pack directory

### `soulsketch_diff_packs` (~82 tokens)

Diff two memory packs

Compare two memory pack directories and explain WHICH identity dimension changed (persona, relationships, technical domains, voice, observations). Line-ending differences (CRLF vs LF) never count as identity changes.

Input parameters:

- `pack_dir_a` (string, required): Absolute path to the first pack directory
- `pack_dir_b` (string, required): Absolute path to the second pack directory

### `soulsketch_read_pack` (~144 tokens)

Read a memory pack

Load the contents of a memory pack so the assistant can adopt its identity: persona, relationships, technical context, voice, and recent observations. Optionally restrict to specific files. ONE SOUL, MANY VESSELS: the pack is a single shared identity. If persona.md has a "Vessels" section listing a name for the tool you are running in, adopt that name (and use it as the author when observing) while keeping the shared persona, relationships, and voice.

Input parameters:

- `files` (array): Optional subset of pack files to read (default: all five)
- `pack_dir` (string, required): Absolute path to the memory pack directory

### `soulsketch_observe` (~167 tokens)

Append a runtime observation

Append ONE observation line to the pack's runtime_observations.jsonl (the living memory stream). This is the only write this server can perform: append-only, never modifying or deleting existing memories. MEMORY ETIQUETTE: when the conversation surfaces something memory-worthy (a durable preference, a decision, a milestone, a relationship change), FIRST ask the user, e.g. "Would you like me to save this to your Soul-Sanctum?" - and only call this tool after they agree. Never save silently; the user owns their memory.

Input parameters:

- `author` (string): Who is recording this (e.g. assistant name)
- `note` (string, required): The observation to remember
- `pack_dir` (string, required): Absolute path to the memory pack directory

### `soulsketch_continuity_record` (~136 tokens)

Create a continuity record

Build a full continuity record for a pack: fingerprint, per-file hashes, provenance labels (source, authority, trust), and provenance warnings. This is the audit artifact to store alongside the pack or anchor elsewhere.

Input parameters:

- `authority` (string): How authoritative this pack state is
- `commit` (string): Git commit hash pinning this state
- `pack_dir` (string, required): Absolute path to the memory pack directory
- `repo` (string): Repository that owns this state
- `source` (string): How the memory content was produced
- `trust_label` (string): Sensitivity classification of the contents

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/bytewizard42i-soulsketch/soulsketch-mcp-server#diagnostics

## Score history

- 2026-08-03: 64
- 2026-08-02: 64
- 2026-08-01: 21
- 2026-07-31: 21
- 2026-07-30: 6

## Links

- npm package: https://www.npmjs.com/package/@soulsketch/mcp-server
- Socket report: https://socket.dev/npm/package/@soulsketch/mcp-server
- Repository: https://github.com/bytewizard42i/soulSketch
- Changelog RSS feed: https://verifymcp.io/servers/bytewizard42i-soulsketch/soulsketch-mcp-server/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/bytewizard42i-soulsketch/soulsketch-mcp-server/changelog.json
- HTML version of this page: https://verifymcp.io/servers/bytewizard42i-soulsketch/soulsketch-mcp-server