.cursor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .cursor (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center">
Your AI wrote it. Mushi tells you why it broke.
Plain-English diagnosis + a paste-ready fix, right inside Cursor and Claude Code. No log-reading. No second LLM API key for MCP.
Fastest path — drop Mushi into your AI editor:
npx mushi-mushi setup --ide cursor # or: --ide claudeAlready shipping an app? One command installs the SDK + env vars + an optional test report:
npx mushi-mushiOpen source, self-hostable, MIT JS core — bring your own LLM key, no second key for MCP, no lock-in. Self-host in minutes · licensing.
<sub>What is Mushi, exactly? Read the one-page constitution: [VISION.md](./VISION.md) — the single source of truth for positioning, the north-star sentence, and who this is for.</sub>
Vision · Quick start · Connect your editor · Self-host · Already on Sentry? · Packages · Docs · Live demo · Operators / platform · Roadmap
<!-- TODO(loop-video): embed the 20–30s incident-loop gif when recut (docs/screenshots/incident-loop.gif). Until then the static diagnosis screenshot above shows error → diagnosis → fix. Script + target metric (time-to-first-diagnosis < 2 min) in docs/marketing/STOREFRONTS.md. -->
<a href="https://kensaur.us/mushi-mushi/admin/reports" title="Open a classified report in the live demo"> <img alt="Report detail — plain-English root cause, confidence chip, paste-ready Cursor fix prompt, and PDCA receipt strip." src="./docs/screenshots/report-detail-dark.png" width="100%" /> </a>
<sub>↑ the diagnosis: plain-English root cause + a paste-ready fix prompt · click to open the live demo</sub>
</div>
npx mushi-mushiThe wizard auto-detects your framework, installs the right SDK, writes MUSHI_PROJECT_ID + MUSHI_API_KEY to .env.local, and prints the snippet to paste. Then, the moment something breaks:
npx mushi-mushi setup --ide cursor # then ask Cursor: "what's broken in prod?"No Sentry, no account, no monitoring stack required to see value. Self-host the whole thing in under five minutes, or use the free hosted tier (no card).
These are the bugs your monitoring can't see, and the ones you didn't write:
When a user shakes their phone (or clicks the reporter), four things happen in the order a careful colleague would do them:
flowchart LR
subgraph App["Your app"]
SDK["mushi-mushi/{react, vue, svelte, angular, …}<br/>shadow-DOM widget · screenshot · console · network"]
end
subgraph Edge["Supabase Edge (Hono gateway + ~50 functions)"]
API["api"]
FF["fast-filter"]
CR["classify-report<br/>+ vision + RAG"]
ORCH["fix-worker"]
end
subgraph DB["Postgres + pgvector"]
REP["reports"]
KG["knowledge graph"]
FIX["fix_attempts"]
end
subgraph Agents["mushi-mushi/agents"]
SBX["sandbox: e2b / modal / cloudflare"]
GH["GitHub PR"]
end
SDK -->|HTTPS| API
API --> FF --> CR
CR --> KG
CR --> REP
REP --> ORCH --> Agents
Agents --> GHThe architecture, sequence diagram, and component-by-component spec live in apps/docs/content/concepts/architecture.mdx.
A single Docker Compose file gets you a working stack against your own Supabase project:
cd deploy
cp .env.example .env # ANTHROPIC_API_KEY, Supabase creds
docker compose up -dSELF_HOSTED.md and the Self-host in minutes guide are the long-form walkthroughs. A production-ready Helm chart lives at deploy/helm/ — one helm install on any cluster.
Hosted (zero-config). Prefer we run it? Sign up at kensaur.us/mushi-mushi/, click _Start free, no card_, create a project, and copy your projectId + apiKey. The free tier covers 50 diagnoses a month (no card required).
One BYOK rule, both ways. Self-host and you bring your own Anthropic / OpenAI key — you pay the vendor at list rate, we never mark up a token. On hosted you bring no key at all: we meter by diagnosis (the plain-English root cause + fix), never by tokens, with a per-project spend cap and 50 / 80 / 100% alerts so the bill can't surprise you. Full numbers: pricing.
Internal edge functions (fast-filter,classify-report,fix-worker,judge-batch,intelligence-report,usage-aggregator,generate-synthetic) authenticate viarequireServiceRoleAuth. Never expose them with--no-verify-jwt. Only the publicapifunction should face the internet — seepackages/server/README.md.
You don't need it — Mushi works standalone — but if you already run it, Mushi enriches it. Sentry owns "errors your code throws"; Mushi owns the bugs that don't throw (dead buttons, 12-second screens, layouts that break on one phone) and the plain-English diagnosis + fix Sentry's $80/mo Seer tier reserves for bigger teams.
Inbound adapters forward Sentry (and Datadog, Bugsnag, Rollbar, Crashlytics, New Relic, Honeycomb, Grafana Loki, CloudWatch, Opsgenie, Firebase) alerts into Mushi for deeper fix context; outbound plugins send Mushi's verdicts back so a Sentry issue auto-resolves the moment Mushi merges its fix. The full enrichment / synthesis story lives in docs/operators/ — it's the upgrade path, never the front door.
Most developers install one SDK — npx mushi-mushi picks it for you. React/Next.js quick start:
npm install @mushi-mushi/react # also covers Next.jsimport { MushiProvider } from '@mushi-mushi/react';
function App() {
return (
<MushiProvider config={{ projectId: 'proj_xxx', apiKey: 'mushi_xxx' }}>
<YourApp />
</MushiProvider>
);
}<details> <summary><b>Other frameworks</b> — Vue, Svelte, Angular, React Native, Vanilla JS, iOS, Android, Flutter</summary>
// Vue 3 / Nuxt
import { MushiPlugin } from '@mushi-mushi/vue';
app.use(MushiPlugin, { projectId: 'proj_xxx', apiKey: 'mushi_xxx' });
// Svelte / SvelteKit
import { initMushi } from '@mushi-mushi/svelte';
initMushi({ projectId: 'proj_xxx', apiKey: 'mushi_xxx' });
// Angular 17+
import { provideMushi } from '@mushi-mushi/angular';
bootstrapApplication(AppComponent, { providers: [provideMushi({ projectId: 'proj_xxx', apiKey: 'mushi_xxx' })] });
// React Native / Expo
import { MushiProvider } from '@mushi-mushi/react-native';
// Vanilla JS / any framework
import { Mushi } from '@mushi-mushi/web';
Mushi.init({ projectId: 'proj_xxx', apiKey: 'mushi_xxx' });iOS (Swift PM, v0.4.0): .package(url: "https://github.com/kensaurus/mushi-mushi.git", from: "0.4.0") · Android (Gradle): dev.mushimushi:mushi-android:0.4.0 · Flutter: pub add mushi_mushi.
</details>
Want a runnable example? examples/react-demo is a minimal Vite + React app with test buttons for dead clicks, thrown errors, failed API calls, and console errors.<details> <summary><b>All packages</b> — SDKs, plugins, adapters, and backend</summary>
| Install | Framework | What you get |
|---|---|---|
npx mushi-mushi | Any (auto-detects) | One-command wizard — installs the right SDK, writes env vars, prints the snippet |
npm i @mushi-mushi/react | React / Next.js | <MushiProvider>, useMushi(), <MushiErrorBoundary> |
npm i @mushi-mushi/vue | Vue 3 / Nuxt | MushiPlugin, useMushi() composable, error handler |
npm i @mushi-mushi/svelte | Svelte / SvelteKit | initMushi(), SvelteKit error hook |
npm i @mushi-mushi/angular | Angular 17+ | provideMushi(), MushiService, error handler |
npm i @mushi-mushi/react-native | React Native / Expo | Shake-to-report, bottom-sheet widget, navigation capture, offline queue |
npm i @mushi-mushi/capacitor | Capacitor / Ionic | iOS + Android via Capacitor |
pub add mushi_mushi | Flutter / Dart | Shake-to-report, screenshot capture, offline queue |
npm i @mushi-mushi/web | Vanilla / any framework | Framework-agnostic SDK |
npm i @mushi-mushi/node | Node (Express / Fastify / Hono) | Server-side SDK — error-handler middleware, uncaughtException hook |
npm i @mushi-mushi/adapters | Any Node webhook server | Translate alerts from 11 sources into Mushi reports |
Backend packages — @mushi-mushi/server, @mushi-mushi/agents, @mushi-mushi/verify (AGPLv3) — power the classification pipeline, knowledge graph, fix dispatch, and Playwright verification. Plugins: Jira, Slack, Linear, PagerDuty, Zapier, Sentry, Discord, MS Teams, GitHub Issues, Bugsnag, Rollbar, Crashlytics, Cursor Cloud. Inventory tooling: inventory-schema, inventory-auth-runner, eslint-plugin-mushi-mushi, mcp-ci.
</details>
Mushi is honest about what's still partial. Skim before you commit:
| Area | Working | Still partial |
|---|---|---|
| Classification | Haiku fast-filter, Sonnet deep + vision air-gap closed, structured outputs, prompt-cached prompts, pg_cron self-healing, Stage 2 streaming via `streamObject` with progressive `reports.stage2_partial` UI updates and OpenAI fallback | — |
| Judge / self-improve | Sonnet judge with OpenAI fallback, prompt A/B auto-promotion via judge → avg_judge_score → promoteCandidate, OpenAI fine-tune adapter end-to-end (submit JSONL → poll → predict against fine_tuned_model_id, BYOK OPENAI_API_KEY), Bedrock fine-tune adapter (SigV4-signed CreateModelCustomizationJob, requires MUSHI_BEDROCK_FINETUNE_ENABLED=1 + AWS BYOK keys) | Anthropic fine-tune API is not publicly self-service in 2026 — the adapter stub links to the access-request form. |
| Fix orchestrator | Single-repo validateResult gating, GitHub PR, MCP JSON-RPC 2.0 client, multi-repo coordinator, first-party `ClaudeCodeAgent` (spawns local `claude` CLI) and `CodexAgent` (OpenAI Responses API, BYOK) — both gated behind explicit env flags so shared deployments never invoke them unintentionally | — |
| Sandbox | Provider abstraction; local-noop (tests) + e2b / modal / cloudflare (prod). Production refuses local-noop unless MUSHI_ALLOW_LOCAL_SANDBOX=1. | — |
| Verify | Playwright screenshot diff + step interpreter (navigate / click / type / press / select / assertText / waitFor / observe) | — |
| Enterprise | Plugin marketplace + HMAC, audit ingest, region pinning, retention CRUD, Stripe metering, SAML SSO via Supabase Auth Admin API, OIDC SSO self-service — see the commercial boundary below for which of these are paid/Enterprise-tier | — |
| Graph backend | SQL adjacency over graph_nodes / graph_edges ships in every deployment | Apache AGE is a hosted-tier enhancement when the extension is installed. Managed Supabase stays on SQL adjacency. |
| Inventory v2 & QA-gates | Hand-written inventory.yaml, SDK-driven discovery, Claude proposer, ESLint gate rules, 5-gate composite GitHub check, synthetic monitor, expected_outcome contract end-to-end — see docs/operators/ | Inventory is gated behind _Advanced mode_ + the inventory_v2 plan flag. |
| Self-host (Helm) | Single-pod deploy on any Kubernetes; pre-install Job applies all SQL migrations from a bundled ConfigMap. Multi-region via global.region + global.peerRegions Helm values. | Full active/active write replication is not automated yet — write routing relies on client-side region stickiness. |
The platform depth — inbound adapters, outbound plugins, A2A / AG-UI / MCP interop, the inventory.yaml QA-gate system, the synthetic monitor, SSO / audit / retention / region pinning, and open-standards plumbing — lives in [`docs/operators/`](./docs/operators/) so the front door stays on the wedge. Start there if you're wiring Mushi into an existing stack or evaluating it as a platform.
Install Mushi skills in your Cursor or Claude Code project for one-command setup, usage, and debugging:
npx skills add kensaurus/mushi-mushiThen: /mushi-setup (guided SDK install + MCP wiring), /mushi-debug (diagnose ingest / MCP / pipeline failures), /mushi-health (pass/fail check across CLI, API, edge functions, BYOK keys). The admin Connect & Update page (/connect) mirrors the same flows with one-click Add to Cursor deeplinks.
<sub>Repo at a glance (run pnpm docs-stats): ~339K TS lines · 1,610 source files · 44 workspace / 36 npm packages · 51 edge functions · 298 SQL migrations · 19 pipeline agents. Full tour: docs/SCREENSHOTS.md.</sub>
Issues and PRs welcome:
git clone https://github.com/kensaurus/mushi-mushi.git
cd mushi-mushi
pnpm install
pnpm devRequires Node.js ≥ 22 and pnpm ≥ 10. See individual package READMEs, docs/stats.md for canonical counts, and CONTRIBUTING.md.
This repository is open-core — the Supabase / Grafana model. The SDK packages are MIT — use them in any product, open or closed. The server (the part you self-host or we run for you) is AGPLv3 — true OSI open source: self-host it, fork it, modify it for your own org. If you offer a modified server as a hosted service to third parties, publish your changes or see COMMERCIAL-LICENSE.md. A small Enterprise Edition boundary (packages/server/ee/) is source-available but commercial for production use — that's operator/enterprise plumbing only, never the wedge.
| Surface | License | Permitted | Notes |
|---|---|---|---|
SDK packages — core, web, react, vue, svelte, angular, react-native, capacitor, flutter, ios, android, node, cli, mcp, mcp-ci, plugin-* (13 plugins), adapters (11 sources), inventory-schema, inventory-auth-runner, eslint-plugin-mushi-mushi, brand, marketing-ui | MIT | Use, fork, sell, embed in proprietary products. | Trademarks separate — see below. |
Server packages — @mushi-mushi/server, @mushi-mushi/agents, @mushi-mushi/verify | AGPLv3 | Use, modify, self-host, fork for your own org. SaaS modifiers publish changes or commercial license. | OSI-approved copyleft. The cloud runs this exact core. |
| Enterprise features — SSO/SCIM, audit-log ingest, retention policy CRUD, region pinning, SOC2 evidence | Commercial / paid tier | Available on the Enterprise plan (hosted) or with a commercial license (self-host). | The code may be source-visible, but production use of these specific features is a paid boundary — see docs/operators/. |
| Trademarks — "Mushi Mushi", "Mushi", 虫, the bug logo | Trademark policy | Refer to the project, build add-ons, link to the repo. | Forks must rename. Hosting a service under the Mushi name requires written permission. |
| Third-party attributions | NOTICE | — | Upstream projects we depend on and their licenses. |
Security researchers: see SECURITY.md for the threat model, PII commitments, and safe-harbor terms.
Other free apps and tools from the same Tokyo studio:
| App | What it does | Links |
|---|---|---|
| [glot.it — Learn Thai Free](https://kensaur.us/glot-it/) | 161 lessons, pitch-contour tone mirror, AI roleplay chat, offline-first. | App Store · Google Play |
| [yen-yen — Expense Tracker](https://kensaur.us/yen-yen/) | Kakeibo-style household ledger. No bank password, no ads, no auto-writes. | App Store · Google Play |
| [The Wanting Mind — Free Book](https://kensaur.us/the-wanting-mind/) | 147,000-word interactive book — 3D knowledge graph, 12 narrators, 22 simulations. | App Store · Google Play |
| [cursor-kenji](https://github.com/kensaurus/cursor-kenji) | 58 Cursor AI agent skills for React / Next.js / Supabase development. | npx skills add kensaurus/cursor-kenji |
<div align="center"> <sub>If Mushi-chan helped, drop a ⭐ — next devs find the repo faster that way. <a href="https://github.com/kensaurus/mushi-mushi/stargazers">Star the repo</a> · <a href="https://github.com/kensaurus/mushi-mushi/issues/new/choose">Open an issue</a> · <a href="https://bsky.app/profile/mushimushi.dev">Follow on Bluesky</a></sub> </div>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.