kage-40e393 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited kage-40e393 (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center">
<img src="docs/assets/kage-banner.svg" alt="Kage" width="150%">
<img src="docs/assets/kage-viewer-walkthrough.gif" alt="kage viewer: a team's captured decisions, runbooks, and bug fixes mapped to the code they're grounded in, with trust and savings — a live walkthrough" width="760">
<sub>kage viewer: your team's decisions, runbooks, and bug fixes (purple), kept in the repo and linked to the code they are about (blue).</sub>
The decisions behind your codebase, the runbook for a tricky deploy, the root cause of a gnarly bug: this knowledge lives in people's heads and scrolls past in chat, then gets lost. Kage captures it as your coding agents work, keeps it as plain files in your repo, and shares it with your whole team through git. The next session, yours or a teammate's, starts already knowing it. Every memory is also checked against the actual code, so what gets shared stays true. No account, no database, no API key.
npx -y @kage-core/kage-graph-mcp install<p> <a href="https://www.npmjs.com/package/@kage-core/kage-graph-mcp"><img src="https://img.shields.io/npm/v/@kage-core/kage-graph-mcp?color=41ff8f&label=npm" alt="npm version"></a> <a href="https://www.npmjs.com/package/@kage-core/kage-graph-mcp"><img src="https://img.shields.io/npm/dm/@kage-core/kage-graph-mcp?color=41ff8f" alt="downloads"></a> <img src="https://img.shields.io/npm/l/@kage-core/kage-graph-mcp?color=41ff8f" alt="license"> <img src="https://img.shields.io/badge/deps-0-41ff8f" alt="zero dependencies"> <img src="https://img.shields.io/badge/account-not%20required-41ff8f" alt="no account"> </p>
<img src="docs/kage-stats.svg" alt="Kage in numbers: 96% R@5 recall, 0% stale served, 18% faster than grep, 0 dependencies, 340+ tests passing, 15 agents supported" width="820">
<p> <a href="https://kage-core.com/">Website</a> · <a href="https://kage-core.com/guide.html">Docs</a> · <a href="https://kage-core.com/viewer/">Live viewer</a> · <a href="https://www.npmjs.com/package/@kage-core/kage-graph-mcp">npm</a> · <a href="https://kage-core.com/demo.html"><b>Book a demo</b></a> </p>
Works with Claude Code · Codex · Cursor · Windsurf · Gemini CLI · Cline · Goose · Roo Code · Kilo Code · OpenCode · Aider · Claude Desktop · Copilot · OpenClaw · Hermes · any MCP client
🌐 English · 简体中文 · 日本語 · 한국어 · Español · Português (Brasil) · Français · Deutsch · हिन्दी
</div>
One command, inside your repo, then restart your agent. That's the whole setup.
npx -y @kage-core/kage-graph-mcp installIt creates .agent_memory/, builds the code graph, writes the AGENTS.md / CLAUDE.md policy that tells agents to use Kage, auto-detects and wires your agents, and configures .gitignore + the packet merge driver. Requires Node.js 18+. No account, no API key.
Or just ask your agent to set it up. Paste this into Claude Code, Cursor, or any coding agent:
Set up Kage (verified memory for coding agents, https://github.com/kage-core/Kage) in this repo: run npx -y @kage-core/kage-graph-mcp install, then tell me to restart you.<details><summary>Other ways (plugin · per-agent · memory-only)</summary>
# Claude Code / Codex plugin
/plugin marketplace add kage-core/Kage # then: /plugin install kage@kage
# wire a single agent (run `kage setup list` for all supported)
kage setup claude-code --project . --write
# memory store only, no agent wiring
kage init --project .
# confirm the harness is live
kage setup verify-agent --agent claude-code --project .</details>
Kage is a memory layer for coding agents. As your agent works, it captures what it learns (decisions, bug fixes, conventions, how the code fits together) as small JSON packets committed in your repo under .agent_memory/. The next session (yours or a teammate's) starts already knowing it, instead of re-reading or re-asking.
Three things make it different from other memory tools:
whole team's. Memory is shared through git, so a teammate's next session starts with what you just learned, not a blank slate.
code, not locked in one machine or a vendor's cloud. Your knowledge stays yours.
against your actual files at write time, at recall time, and when a diff changes the code. Memory that no longer matches the code is withheld, so the agent never acts on a stale claim.
Once installed, it's ambient. You don't run anything by hand:
Kage surfaces the relevant verified memory for it. Stale or deleted memory is left out.
which doesn't exist is rejected on the spot, so hallucinations never enter storage.
memory is flagged at commit/PR time (kage pr check) and withheld from recall until it's re-verified or replaced, so knowledge can't quietly rot.
Watch it happen in the local dashboard (kage viewer): packets, the memory↔code graph, trust gates, and live events stream in as the agent works. Wrap anything in <private>…</private> and it's never stored.
Most memory tools (claude-mem, agentmemory, mem0, Zep) store memory per-machine or in a cloud you don't own, and never re-check it against the code. Kage keeps it in your repo and verifies it, so it stays your team's and stays true as the code changes.
| Kage | claude-mem | mem0 / Zep | |
|---|---|---|---|
| Automatic capture + session-start recall | ✓ | ✓ | via SDK |
| Hallucinated citations rejected at write time | ✓ | — | — |
| Stale memory withheld at recall (cited files deleted/changed, TTL, reported) | ✓ | — | — |
| Diff-time stale-catch, warned before the PR when your change breaks a memory | ✓ | — | — |
| Memory reviewed in git, same PR as the code (plain files, no DB) | ✓ | SQLite + cloud | hosted API |
Codify memory into team SKILL.md files agents auto-load | ✓ (kage skills) | — | — |
| Cross-machine sync | ✓ your own git remote | their cloud | their cloud |
| Account / API key required | none | cloud optional | yes |
kage scan reads any repo in ~60s and surfaces its highest-riskknowledge gaps: undocumented hot files, untested hot paths, complexity hotspots, unresolved code debt, and bus-factor-1 files, plus duplicate implementations, dead exports, and doc lies when they exist. Every finding cited to file:line. Zero setup, nothing generated, runs before you install anything.
kage gains keeps a per-repo value ledger (tokens + $ the agentdidn't have to re-spend), every number traceable to a logged event; the agent relays it after each recall.
kage skills turns durable, verified procedures into.claude/skills/<name>/SKILL.md files agents auto-load, committed and shared, no cloud.
kage learn --personal keeps cross-machine notes in~/.kage/memory, recalled as a clearly separated lower-trust section and synced over your own git remote.
you review; kage resume opens each session with a "previously…" digest; kage repair fixes broken packets and indexes in one command.
same agent/model; reproduce with kage benchmark --project . --compare).
changed is withheld), vs 100% for capture-everything stores.
grounding (kage benchmark --trust --project .).
Methodology, commands, and caveats: docs/BENCHMARKS.md.
kage recall "how do I run tests" --project .
kage verify --project . # check citations against current code
kage pr check --project . # stale-catch + graph freshness gate
kage gains --project . # what Kage saved you
kage viewer --project . # local dashboardFull CLI and MCP reference: docs.
Everything lives in .agent_memory/: packets/ is durable repo memory (git-tracked JSON); graph/, code_graph/, structural/, and indexes/ are rebuildable with kage refresh; reports/ holds the value ledger and health reports. Capture scans for secrets and PII before writing.
cd mcp
npm install
npm test
npm run buildKage is built in the open and we'd love your help. Zero runtime dependencies, no account, no cloud — it's a friendly codebase to jump into.
[Help wanted](https://github.com/kage-core/Kage/issues?q=is%3Aissue+is%3Aopen+label%3A%22help+wanted%22) — scoped places to start.
By participating you agree to our Code of Conduct.
GPL-3.0-only. See LICENSE. Releases before the GPL switch were MIT.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.