settings — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited settings (Hook) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Powered by Enlighter and Hyperskill.
Cortex is an MCP server that helps build and maintain a project Memory Bank so AI assistants always have up-to-date context, plans, and rules. It follows the Memory Bank pattern and keeps your .cortex/ files (roadmap, activeContext, progress, rules) in sync so agents can reliably run a plan → do → commit loop instead of ad-hoc edits. Use Cortex when you want reproducible, high-quality AI-driven development that survives restarts, editor changes, and long-running projects.
rumdl Markdown linter (installed via the Python dev environment; see Prerequisites).mcp.json (most users pick uvx).In your IDE/assistant, ask the agent to orchestrate these commands:
For new projects, use the initialize prompt to create the Memory Bank and .cortex/ structure.
This is the daily workflow:
| Step | What happens |
|---|---|
| Plan | Create or refine plans in .cortex/plans/ and register them in roadmap.md. |
| Do | Apply the next PENDING roadmap step with tests and quality checks. |
| Commit | Run the full pre-commit pipeline and push only healthy commits. |
See docs/prompts for setup/migration prompt details.
If Cortex MCP cannot be reached in your environment, you can still do a read-only audit of the repo under the boundaries in AGENTS.md (MCP unavailable: read-only audit fallback) and the runbook MCP unavailable: read-only audits.
.cortex/, shared by filing, search, and recent/deep context retrieval. Architectural findings retain their memory-bank destination.
manage_file(operation="migrate_artifacts")relocation with reference/index preservation, recoverable byte preimages, immutable historical provenance, and unchanged wiki-mirror allocation rules. See the migration guide.
uv sync --extra dev, which adds the rumdl CLI to .venv/bin/rumdl){
"mcpServers": {
"cortex": {
"command": "uvx",
"args": [
"--from",
"git+https://github.com/igrechuhin/Cortex.git",
"cortex"
]
}
}
}First run / IDE timeouts: uvx --from git+… must resolve GitHub HEAD, download dependencies, and build the package into uv’s cache. That can take minutes on a cold machine or right after uv cache clean. Some MCP clients time out during the first Initialize if the server is not ready yet. Pre-warm once in a terminal (same command you use in mcp.json), then start or reload the MCP client:
uvx --from git+https://github.com/igrechuhin/Cortex.git cortex --helpDetails: Getting started — Stable MCP setup, Troubleshooting — uvx cold start.
Project-level vs global config: Place the snippet in your project's .mcp.json rather than in the global client config. Project-level config lets Cortex resolve the correct workspace root immediately. A global config makes your client launch Cortex with CWD set to the home directory; Cortex falls back to a heuristic root-finder that can pick up stale .cortex/ state left in ~/ and show spurious setup prompts.
{
"mcpServers": {
"cortex": {
"command": "npx",
"args": [
"-y",
"@smithery/cli@latest",
"run",
"@igrechuhin/cortex",
"--key",
"your_smithery_key"
]
}
}
}{
"mcpServers": {
"cortex": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"19283744/cortex:latest"
]
}
}
}Clone the repository, then:
bash scripts/bootstrap.shOptionally initialize the Synapse submodule for shared rules:
git submodule update --init --recursiveAdd to your mcp.json:
{
"mcpServers": {
"cortex": {
"command": "uv",
"args": ["run", "cortex"]
}
}
}For local development, use these Make targets (after running bash scripts/bootstrap.sh once to create the virtualenv and install dependencies):
uv sync or installs fail (proxy, SSL, or registry access), use Dependency and network verification to separate environment setup failures from actual test failures.UV_INDEX_URL before uv sync when triaging connectivity; see Dependency and network verification.scripts/bootstrap.sh to create or update the .venv and install all dependencies.src/ and tests/, Ruff lint, Pyright, then the fast test suite. Does not rewrite files; use make fix when checks fail for formatting or auto-fixable lint.I), and Ruff --fix on src/ and tests/ (mutating).uv run (synapse format/lint scripts, type checks, file/function limits, rumdl, pytest with coverage). Requires uv on your PATH. Still not identical to CI: spell check (cspell), the eval suite, Codecov, and health-check upload steps run only in Actions—see Troubleshooting — Local make check vs CI.-n auto), skip @pytest.mark.slow, no coverage (timeouts). Use make check-ci-parity for the full pytest+coverage command that matches CI.make check before using /cortex/commit for the full commit pipeline. With Cortex MCP connected, Phase A / Step 12 use the zero-arg tools documented in docs/api/tools.md.For Swift Package Manager projects, the native quality gate runs the complete suite with swift test --enable-code-coverage --no-parallel. Test cases are scheduled serially; concurrent tasks and task groups inside each test remain concurrent. This native adapter invokes Swift directly, not the Synapse test script, and records the same arguments in its test transcript.
<!-- cortex-published-inventory: tools=14 resources=6 prompts-max=4 -->
Cortex exposes 14 MCP tools, 6 static `cortex://` resources, and up to 4 setup prompts (one always-on plus up to three configuration-dependent). Machine-readable inventory: docs/_generated/tool-inventory.json (must match cortex.discovery.published_inventory; CI enforces parity).
Published tools (canonical TOOL_CATEGORIES order — see docs/api/tools.md):
| Tool | Purpose |
|---|---|
manage_file() | Memory bank read/write (zero-arg reads activeContext.md) |
plan() | Plan create/list/get/complete/register/archive_completed |
update_memory_bank() | Roadmap/progress/activeContext mutations |
session() | Session start, orientation, compact |
run_quality_gate() | Phase A quality checks and Step 12 final gate (zero-arg) |
autofix() | Auto-fix lint/format/types/markdown (zero-arg) |
think() | Reasoning scratchpad |
ingest() | Stage raw external sources under memory-bank for /cortex/ingest |
run_docs_gate() | Phase B docs validation (zero-arg) |
pipeline_handoff() | Inter-phase state exchange (init/write/read/clear) |
write_artifact() | Allowlisted skill JSON and Synapse rule artifact writes |
compress_memory_bank() | Compress project CLAUDE.md and memory-bank markdown to reduce session tokens |
memory_wal() | Memory-bank WAL read, anomaly hints, snapshot/restore |
propose_framework_optimization() | Draft/self-test a Synapse prompt/rule change in an isolated, always-removed worktree |
Read-only discovery uses resources (not in this table): cortex://health/connection, cortex://structure, cortex://context, cortex://rules, cortex://validation, cortex://analysis. Quick “do not” guidance: AGENTS.md quick reference.
Prompts are for setup and migration; for daily work use plan → do → commit tools.
| Situation | Prompt |
|---|---|
| New project, no Memory Bank | initialize |
Legacy Memory Bank under memory-bank/ or .memory-bank/ | migrate |
| Share rules across projects | setup_synapse |
| tiktoken cache missing (local encoding cache setup) | populate_tiktoken_cache |
Full prompt list: docs/prompts
The Memory Bank lives under .cortex/ and works with any editor, LLM, or agent.
.cortex/memory-bank/ — core files: projectBrief, productContext, activeContext, systemPatterns, techContext, progress, roadmap.cortex/plans/ — development plans linked to the roadmap.cortex/synapse/ — shared rules and prompts (Git submodule).cortex/config/, .cortex/history/, .cortex/index.json — configuration, history, and metadataLegacy layouts are migrated by the migrate prompt; see Getting started.
extract_key_sections strategy kept sections are replayed verbatim and dropped sections are disclosed by name or count. It is not lossless — whole sections are removed to meet the budget — and it may miss its target reduction rather than rewrite content. The compress_verbose and headers_only strategies additionally rewrite lines, elide code blocks and keep partial bodies, so a path, error string or constraint can disappear mid-section. Prefer the default when content must survive intact.retrieval/bm25.py) computes IDF over the per-call candidate corpus only — there is no global index, so scores are not comparable across calls.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.