# io.github.vshulcz/deja-vu (npm · @vshulcz/deja-vu)

Local searchable memory over your coding-agent session histories, served back via MCP recall.

- Trust score: 61/100 (medium)
- Change this week: +37
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-07

## Components

- npm · `@vshulcz/deja-vu`: 61/100 (this document), [markdown](https://verifymcp.io/servers/vshulcz-deja-vu/vshulcz-deja-vu.md), [page](https://verifymcp.io/servers/vshulcz-deja-vu/vshulcz-deja-vu)

## Channel facts

- Registry: `npm`
- Package: `@vshulcz/deja-vu`
- Version: `0.16.8`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-07.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 0 of 6 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 48/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 0 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 50/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 1073 tokens (~268/item across 4 items; 4 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 7/100
  - Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 90/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 71% of tool parameters carry a description.
- **Capabilities**: 20/100
  - Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add vshulcz-deja-vu -- npx -y @vshulcz/deja-vu
```

### Codex

```bash
codex mcp add vshulcz-deja-vu -- npx -y @vshulcz/deja-vu
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "vshulcz-deja-vu": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@vshulcz/deja-vu"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add vshulcz-deja-vu --command npx --arg -y --arg @vshulcz/deja-vu
```

### Hermes

```yaml
mcp_servers:
  vshulcz-deja-vu:
    command: "npx"
    args: ["-y", "@vshulcz/deja-vu"]
```

### Other

```json
{
  "mcpServers": {
    "vshulcz-deja-vu": {
      "command": "npx",
      "args": [
        "-y",
        "@vshulcz/deja-vu"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-07 (score 61, +2)

- [security regression] Known CVEs: pass → unverified
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Capabilities: fail → unverified
- [functional regression] Dependency health: 1.00 → unverified
- [functional improvement] Stability: unverified → 0.07
- [functional improvement] Security disclosure: fail → pass
- [functional] Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional] Package version: 0.16.7 → 0.16.8

### 2026-08-06 (score 59, +20)

- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional regression] MCP protocol: unverified → fail
- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: good
- [functional] First check of Tool coverage: 71

### 2026-08-03 (score 39, 0)

- [functional] Package version: 0.16.6 → 0.16.7

### 2026-08-02 (score 39, +15)

- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional] Capabilities: Protocol version not yet verified: we do not have a sandbox capture of the MCP handshake this version of the package performs yet.
- [functional] Tool coverage: Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet.
- [functional] Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional] Package version: 0.16.5 → 0.16.6

### 2026-07-31 (score 24, −5)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 29, 0)

- [functional] Tool coverage: Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet.
- [functional] Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional] Package version: 0.16.1 → 0.16.4
- [functional] Package version: 0.16.1 → 0.16.2

### 2026-07-29 (score 29, 0)

- [functional] Schema quality: Schema quality not yet verified: our sandbox run of this package did not complete, so we have no schema to assess.
- [functional] Tool coverage: Tool coverage not yet verified: our sandbox run of this package did not complete, so we have no tool definitions to assess.

### 2026-07-28 (score 29, 0)

- [functional] Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional] Tool coverage: Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet.
- [functional] Package version: 0.15.7 → 0.16.1
- [functional] Package version: 0.15.7 → 0.16.0

## MCP tools (4)

### `recall` (~468 tokens)

Search the user's own past coding sessions across every AI tool they've used (Claude Code, Codex, Cursor, opencode, aider, gemini, and others) and return the best matches as dense text under ~4KB. Call this the moment the user implies work already happened — 'didn't we fix this before?', 'what was that error again', 'we already set this up', 'how did we solve X last time', 'what did we decide about Y' — and always before debugging an error or re-implementing something that might already exist. Query with the most specific token available: an exact error string, function name, file path, or flag (multiple words are ANDed). Do NOT use this for general knowledge or library/API docs — only this user's prior sessions. A result may carry a bracketed marker before its snippets — [this was tried and rejected], [a later decision replaced this], [marked stale — may no longer hold] — with the reason and the date. That is the user's own later judgement on that session: do not repeat a rejected approach, prefer the replacement over what it replaced, and treat stale results as needing confirmation before you act on them. An unmarked result carries no such judgement either way. Follow up with recall_context when one session looks right and you need its full story. Optionally filter by harness. When a result genuinely helps the task at hand — you reuse a fix, skip re-debugging, or confirm a prior decision — tell the user in one short line what deja-vu recalled and how you used it (e.g. "deja-vu recalled: we hit this JWT skew in March — reusing that fix"). Even a partial hint counts if it changed your approach. Say nothing about recalls that did not help.

Input parameters:

- `harness` (string): Optional filter: claude, codex, opencode, aider, gemini, cursor, antigravity, grok or qwen.
- `limit` (number): Max sessions to return (default 5).
- `offset` (number): Skip this many ranked matches — page through results without re-ranking.
- `query` (string, required): Search terms; specific tokens (error strings, function names, flags) match best. Multiple words are ANDed.

### `recall_context` (~232 tokens)

Return a full markdown digest (~8KB) of the single best-matching prior session — problem, decisions, outcome — when a bare recall hit is not enough and you need the reasoning behind it. Use after recall, or directly when the user asks 'remind me how we handled X' or 'what was the whole story with Y'. Query terms are matched against transcript text, so use tokens likely to appear verbatim: an error string, function name, or flag. Not for browsing many sessions — use recall for that; this returns one deep digest. When a result genuinely helps the task at hand — you reuse a fix, skip re-debugging, or confirm a prior decision — tell the user in one short line what deja-vu recalled and how you used it (e.g. "deja-vu recalled: we hit this JWT skew in March — reusing that fix"). Even a partial hint counts if it changed your approach. Say nothing about recalls that did not help.

Input parameters:

- `harness` (string): Optional harness filter.
- `query` (string, required): Search terms identifying the session to digest.

### `blame` (~174 tokens)

Before editing, refactoring, or deleting a file, find the prior sessions that discussed it so you know why it is shaped the way it is. Call whenever you are about to change a file, or when the user asks 'why is this like this', 'what was this for', 'is it safe to remove this'. Most specific mentions come first. This is session history across AI tools, not git blame — it explains intent and past decisions, not commit authorship. Give an absolute path, relative path, or bare filename.

Input parameters:

- `all` (boolean)
- `harness` (string)
- `limit` (number)
- `path` (string, required): Absolute, relative, or bare filename.
- `project` (string)
- `since` (string): Age such as 30d or 24h.

### `remember` (~141 tokens)

Store one durable decision or conclusion so a future session can recall it. Call right after a decision is settled, a tricky bug is resolved, or the user says 'remember this', 'note that for next time', 'don't forget we chose X'. Write a single self-contained fact (e.g. 'We use Postgres advisory locks for the job queue because Redis lost messages under load'). Do NOT store transcripts, routine conversation, or anything already obvious from the code. text is required; project defaults to notes.

Input parameters:

- `project` (string): Optional project name; defaults to notes.
- `text` (string, required): A durable fact, decision, or conclusion to remember.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/vshulcz-deja-vu/vshulcz-deja-vu#diagnostics

## Score history

- 2026-08-07: 61
- 2026-08-06: 59
- 2026-08-05: 39
- 2026-08-04: 39
- 2026-08-03: 39
- 2026-08-02: 39
- 2026-08-01: 24
- 2026-07-31: 24
- 2026-07-30: 29
- 2026-07-29: 29
- 2026-07-28: 29
- 2026-07-27: 29
- 2026-07-26: 29

## Links

- npm package: https://www.npmjs.com/package/@vshulcz/deja-vu
- Socket report: https://socket.dev/npm/package/@vshulcz/deja-vu
- Repository: https://github.com/vshulcz/deja-vu
- Changelog RSS feed: https://verifymcp.io/servers/vshulcz-deja-vu/vshulcz-deja-vu.xml
- Changelog JSON feed: https://verifymcp.io/servers/vshulcz-deja-vu/vshulcz-deja-vu.json
- HTML version of this page: https://verifymcp.io/servers/vshulcz-deja-vu/vshulcz-deja-vu