io.github.vshulcz/deja-vu
NPM · @VSHULCZ/DEJA-VU · SCANNED AUG 7
Local searchable memory over your coding-agent session histories, served back via MCP recall.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 0 of 6 dependencies flagged as unhealthy. View diagnostics → Pass
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability50
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 1073 tokens (~268/item across 4 items; 4 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management7
- Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage90
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 71% of tool parameters carry a description.Partial
Capabilities20
- Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28. See how to fix → Fail
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · @vshulcz/deja-vu
claude mcp add vshulcz-deja-vu -- npx -y @vshulcz/deja-vu
codex mcp add vshulcz-deja-vu -- npx -y @vshulcz/deja-vu
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"vshulcz-deja-vu": {
"type": "local",
"command": [
"npx",
"-y",
"@vshulcz/deja-vu"
],
"enabled": true
}
}
} openclaw mcp add vshulcz-deja-vu --command npx --arg -y --arg @vshulcz/deja-vu
mcp_servers:
vshulcz-deja-vu:
command: "npx"
args: ["-y", "@vshulcz/deja-vu"] {
"mcpServers": {
"vshulcz-deja-vu": {
"command": "npx",
"args": [
"-y",
"@vshulcz/deja-vu"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 7 Aug 26 +2
- Known CVEs: pass → unverified ▼ security
- Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
- Tool coverage: 100 → unverified ▼ functional
- Capabilities: fail → unverified ▼ functional
- Dependency health: 1.00 → unverified ▼ functional
- Stability: unverified → 0.07 ▲ functional
- Security disclosure: fail → pass ▲ functional
- Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. functional
- Package version: 0.16.7 → 0.16.8 functional
- 6 Aug 26 +20
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- MCP protocol: unverified → fail ▼ functional
- Tool coverage: unverified → 100 ▲ functional
- First check of Schema quality: fail functional
- First check of Schema quality: fail functional
- First check of Schema quality: good functional
- First check of Tool coverage: 71 functional
- 3 Aug 26 0
- Package version: 0.16.6 → 0.16.7 functional
- 2 Aug 26 +15
- Malware scan: unverified → pass ▲ security
- Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
- Capabilities: Protocol version not yet verified: we do not have a sandbox capture of the MCP handshake this version of the package performs yet. functional
- Tool coverage: Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet. functional
- Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. functional
- Package version: 0.16.5 → 0.16.6 functional
- 31 Jul 26 −5
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 0
- Tool coverage: Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet. functional
- Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. functional
- Package version: 0.16.1 → 0.16.4 functional
- Package version: 0.16.1 → 0.16.2 functional
- 29 Jul 26 0
- Schema quality: Schema quality not yet verified: our sandbox run of this package did not complete, so we have no schema to assess. functional
- Tool coverage: Tool coverage not yet verified: our sandbox run of this package did not complete, so we have no tool definitions to assess. functional
- 28 Jul 26 0
- Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. functional
- Tool coverage: Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet. functional
- Package version: 0.15.7 → 0.16.1 functional
- Package version: 0.15.7 → 0.16.0 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 7 Aug 2026 · Analysed npm/@vshulcz/[email protected]
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Dependencies 6 packages
| Packages resolved | 6 |
|---|---|
| Tree resolution | Complete |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
blame ~174
Before editing, refactoring, or deleting a file, find the prior sessions that discussed it so you know why it is shaped the way it is. Call whenever you are about to change a file, or when the user asks 'why is this like this', 'what was this for', 'is it safe to remove this'. Most specific mentions come first. This is session history across AI tools, not git blame — it explains intent and past decisions, not commit authorship. Give an absolute path, relative path, or bare filename.
| Name | Type | Req | Description |
|---|---|---|---|
| all | boolean | – | – |
| harness | string | – | – |
| limit | number | – | – |
| path | string | yes | Absolute, relative, or bare filename. |
| project | string | – | – |
| since | string | – | Age such as 30d or 24h. |
No output schema declared.
No examples provided.
recall ~468
Search the user's own past coding sessions across every AI tool they've used (Claude Code, Codex, Cursor, opencode, aider, gemini, and others) and return the best matches as dense text under ~4KB. Call this the moment the user implies work already happened — 'didn't we fix this before?', 'what was that error again', 'we already set this up', 'how did we solve X last time', 'what did we decide about Y' — and always before debugging an error or re-implementing something that might already exist. Query with the most specific token available: an exact error string, function name, file path, or flag (multiple words are ANDed). Do NOT use this for general knowledge or library/API docs — only this user's prior sessions. A result may carry a bracketed marker before its snippets — [this was tried and rejected], [a later decision replaced this], [marked stale — may no longer hold] — with the reason and the date. That is the user's own later judgement on that session: do not repeat a rejected approach, prefer the replacement over what it replaced, and treat stale results as needing confirmation before you act on them. An unmarked result carries no such judgement either way. Follow up with recall_context when one session looks right and you need its full story. Optionally filter by harness. When a result genuinely helps the task at hand — you reuse a fix, skip re-debugging, or confirm a prior decision — tell the user in one short line what deja-vu recalled and how you used it (e.g. "deja-vu recalled: we hit this JWT skew in March — reusing that fix"). Even a partial hint counts if it changed your approach. Say nothing about recalls that did not help.
| Name | Type | Req | Description |
|---|---|---|---|
| harness | string | – | Optional filter: claude, codex, opencode, aider, gemini, cursor, antigravity, grok or qwen. |
| limit | number | – | Max sessions to return (default 5). |
| offset | number | – | Skip this many ranked matches — page through results without re-ranking. |
| query | string | yes | Search terms; specific tokens (error strings, function names, flags) match best. Multiple words are ANDed. |
No output schema declared.
No examples provided.
recall_context ~232
Return a full markdown digest (~8KB) of the single best-matching prior session — problem, decisions, outcome — when a bare recall hit is not enough and you need the reasoning behind it. Use after recall, or directly when the user asks 'remind me how we handled X' or 'what was the whole story with Y'. Query terms are matched against transcript text, so use tokens likely to appear verbatim: an error string, function name, or flag. Not for browsing many sessions — use recall for that; this returns one deep digest. When a result genuinely helps the task at hand — you reuse a fix, skip re-debugging, or confirm a prior decision — tell the user in one short line what deja-vu recalled and how you used it (e.g. "deja-vu recalled: we hit this JWT skew in March — reusing that fix"). Even a partial hint counts if it changed your approach. Say nothing about recalls that did not help.
| Name | Type | Req | Description |
|---|---|---|---|
| harness | string | – | Optional harness filter. |
| query | string | yes | Search terms identifying the session to digest. |
No output schema declared.
No examples provided.
remember ~141
Store one durable decision or conclusion so a future session can recall it. Call right after a decision is settled, a tricky bug is resolved, or the user says 'remember this', 'note that for next time', 'don't forget we chose X'. Write a single self-contained fact (e.g. 'We use Postgres advisory locks for the job queue because Redis lost messages under load'). Do NOT store transcripts, routine conversation, or anything already obvious from the code. text is required; project defaults to notes.
| Name | Type | Req | Description |
|---|---|---|---|
| project | string | – | Optional project name; defaults to notes. |
| text | string | yes | A durable fact, decision, or conclusion to remember. |
No output schema declared.
No examples provided.