← Back to search

@tpsdev-ai/flair-mcp

GitHub Actions Scanned 8d ago

MCP server for Flair — persistent memory for Claude Code, Cursor, and any MCP client.

npm ↗
D
40 / 100

Versions

No versions found.

PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 11

memory_search
annotations: none low

Search memories by meaning. Understands temporal queries like

query string
memory_store
annotations: none low

Save information to persistent memory. Use for lessons, decisions, preferences, facts.

content string
memory_update
annotations: none low

Update an existing memory by ID. Dedup-bypassed — this is an intentional overwrite/version, not an ambiguous new write.

id string content string
memory_get
annotations: none low

Retrieve a specific memory by ID.

id string
memory_delete
annotations: none low

Delete a memory by ID.

id string
relationship_store
annotations: none low

Record that <subject> <predicate> <object> — an explicit entity-to-entity relationship triple

object string source string subject string validTo string predicate string validFrom string
bootstrap
annotations: none low

Get session context: soul + memories + predicted context. Run at session start. Pass subjects for predictive loading.

channel string surface string currentTask string
soul_set
annotations: none low

Set a personality or project context entry. Included in every bootstrap.

key string value string
soul_get
annotations: none low

Get a personality or project context entry.

key string
flair_workspace_set
annotations: none low

Set your agent

ref string task string label string phase string summary string provider string
flair_orgevent
annotations: none low

Publish an org-wide coordination event (claim/release/status) to the Office Space. Attributed to you from your signed identity — you cannot publish as another agent.

kind string scope string detail string summary string

Permissions 4

network medium
Server uses network capabilities via: fetch(), httpx, urllib
filesystem low
Server uses filesystem capabilities via: fs, fs sync ops, fs/promises, open(), os, path, pathlib, tempfile
shell high
Server uses shell capabilities via: child_process, execSync(), spawn(), spawnSync(), subprocess
env_vars low
Server uses env_vars capabilities via: os.environ, process.env

Scan Findings 106

low
Tool 'memory_search' has no annotations annotation_checker · 100%
low
Tool 'memory_store' has no annotations annotation_checker · 100%
low
Tool 'memory_update' has no annotations annotation_checker · 100%
low
Tool 'memory_get' has no annotations annotation_checker · 100%
low
Tool 'memory_delete' has no annotations annotation_checker · 100%
low
Tool 'relationship_store' has no annotations annotation_checker · 100%
low
Tool 'bootstrap' has no annotations annotation_checker · 100%
low
Tool 'soul_set' has no annotations annotation_checker · 100%
low
Tool 'soul_get' has no annotations annotation_checker · 100%
low
Tool 'flair_workspace_set' has no annotations annotation_checker · 100%
low
Tool 'flair_orgevent' has no annotations annotation_checker · 100%
high
Hardcoded OAuth client secret in tpsdev-ai-flair-a1e468b/test/integration/mcp-client-credentials-e2e.test.ts auth_checker · 95%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: @mariozechner/pi-coding-agent@0.73.0 (GHSA-7v5m-pr3q-6453) dependency_analyzer · 95%
medium
Vulnerable dependency: @mariozechner/pi-coding-agent@0.73.0 (GHSA-jfgx-wxx8-mp94) dependency_analyzer · 95%
medium
Vulnerable dependency: @mariozechner/pi-coding-agent@0.73.0 (GHSA-r95r-rj6r-c39x) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@42 (GHSA-537c-gmf6-5ccf) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@42 (GHSA-6vqw-3v5j-54x4) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@42 (GHSA-79v4-65xg-pq4g) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@42 (GHSA-9v9h-cgj8-h64p) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@42 (GHSA-h4gh-qq45-vh27) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@42 (GHSA-jwv3-5hgf-82ww) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@42 (GHSA-m2h6-j472-rp4c) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@42 (GHSA-m959-cc7f-wv43) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@42 (GHSA-r6ph-v2qm-q3c2) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@42 (PYSEC-2024-225) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@42 (PYSEC-2026-1284) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@42 (PYSEC-2026-1285) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@42 (PYSEC-2026-2141) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@42 (PYSEC-2026-35) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@42 (PYSEC-2026-3553) dependency_analyzer · 95%
medium
Vulnerable dependency: cryptography@42 (PYSEC-2026-3554) dependency_analyzer · 95%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/resources/auth-middleware.ts:203 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/src/cli.ts:17827 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/src/mcp-client-assertion.ts:122 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/scripts/migrate-memories.mjs:17 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/scripts/flair-bootstrap.mjs:22 entropy_analyzer · 75%
info
pyproject.toml metadata manifest_parser · 100%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/scripts/flair-client.mjs:16 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/scripts/flair-sync.mjs:17 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/scripts/flair-sync-soul.mjs:17 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/scripts/repro-resource-busy.mjs:42 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/integration/init-remote-ops.test.ts:89 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/integration/init-remote-ops.test.ts:104 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/integration/init-remote-ops.test.ts:123 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/integration/deploy-public-url.test.ts:95 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/unit/federation-sync-auth.test.ts:49 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/unit/federation-sync-auth.test.ts:224 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/unit/secret-envelope.test.ts:50 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/unit/secret-envelope.test.ts:52 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/unit/secret-envelope.test.ts:53 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/unit/secret-envelope.test.ts:54 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/unit/secret-envelope.test.ts:126 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/unit/secret-envelope.test.ts:136 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/unit/secret-envelope.test.ts:151 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/unit/secret-envelope.test.ts:161 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/unit/SkillScan.test.ts:126 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/unit/SkillScan.test.ts:239 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/unit/federation-pair-cli.test.ts:122 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/unit/federation-pair-cli.test.ts:131 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/unit/federation-pair-cli.test.ts:403 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/unit/cli.test.ts:529 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/unit/secrets-push.test.ts:123 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/unit/secrets-push.test.ts:124 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/unit/secrets-push.test.ts:125 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/unit/secrets-push.test.ts:126 entropy_analyzer · 75%
medium
Hex string literal (>50 chars) in tpsdev-ai-flair-a1e468b/test/unit/doctor-client-native-shapes.test.ts:72 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in tpsdev-ai-flair-a1e468b/test/unit/doctor-client-native-shapes.test.ts:78 entropy_analyzer · 70%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/unit/auth-middleware.test.ts:255 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/unit/deploy-staging.test.ts:90 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/unit/deploy-staging.test.ts:102 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/unit/auth-middleware-spoke-sync.test.ts:52 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/unit/auth-middleware-spoke-sync.test.ts:85 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/unit/auth-middleware-spoke-sync.test.ts:230 entropy_analyzer · 75%
medium
Hex string literal (>50 chars) in tpsdev-ai-flair-a1e468b/test/bench/longmemeval/config.ts:27 entropy_analyzer · 70%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/test/bench/corpus-profiler/fetch.ts:50 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/packages/adk-flair-js/src/signing.ts:130 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/packages/flair-client/src/auth.ts:20 entropy_analyzer · 75%
medium
Buffer.from base64 in tpsdev-ai-flair-a1e468b/src/lib/auth-resolve.ts:216 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: memory_search manifest_parser · 70%
info
Tool: memory_store manifest_parser · 70%
info
Tool: memory_update manifest_parser · 70%
info
Tool: memory_get manifest_parser · 70%
info
Tool: memory_delete manifest_parser · 70%
info
Tool: relationship_store manifest_parser · 70%
info
Tool: bootstrap manifest_parser · 70%
info
Tool: soul_set manifest_parser · 70%
info
Tool: soul_get manifest_parser · 70%
info
Tool: flair_workspace_set manifest_parser · 70%
info
Tool: flair_orgevent manifest_parser · 70%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (132) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 90%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 27 components sbom_generator · 100%
critical
RSA Private Key found in tpsdev-ai-flair-a1e468b/packages/pi-flair/README.md secret_scanner · 95%
critical
RSA Private Key found in tpsdev-ai-flair-a1e468b/packages/adk-flair-js/src/signing.ts secret_scanner · 95%
critical
RSA Private Key found in tpsdev-ai-flair-a1e468b/packages/adk-flair/src/adk_flair/memory_service.py secret_scanner · 95%
critical
RSA Private Key found in tpsdev-ai-flair-a1e468b/packages/pi-flair/src/index.ts secret_scanner · 95%
critical
EC Private Key found in tpsdev-ai-flair-a1e468b/packages/pi-flair/src/index.ts secret_scanner · 95%
high
Hardcoded Password found in tpsdev-ai-flair-a1e468b/packages/n8n-nodes-flair/src/credentials/FlairApi.credentials.ts secret_scanner · 65%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%