
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@folterung/project-memory
Advanced tools
Local-first Project Memory: scoped indexing, embeddings, Cursor integration
Local-first project understanding for Cursor: scoped indexing, embeddings, and Cursor integration.
Option A — Run tasks (easiest)
Open this repo in Cursor/VS Code, then Terminal → Run Task (or Cmd+Shift+B for default build task) and pick:
.mem/ (config, state dir, docker-compose copy) and .memignoreThen register the MCP server in Cursor (or Claude Desktop) and use the agent with the Project Memory skill.
Register the Project Memory MCP server in Cursor, Claude Desktop, or any MCP client. The agent can then call search_project_memory, explain_symbol, refresh_project_memory_index, and store_project_memory (store a summary or finding so future search can use it — incremental context from the agent). Ask the agent to refresh the index when the codebase changes so the vector DB stays up to date.
mem scaffold in the project)..cursor/mcp.json in the project) with a stdio config pointing at project-memory-mcp. An example config is in docs/mcp-config.example.json—copy to .cursor/mcp.json if needed. Set MEM_SERVER_URL in env if the server is not on the default port (default http://127.0.0.1:31415). If the project has node_modules/@folterung/project-memory, run the MCP from that package; otherwise use project-memory-mcp on your PATH (e.g. after npm install -g @folterung/project-memory). See docs/commands.md and Cursor’s MCP docs for the config format./tmp/project-memory-mcp.log on macOS/Linux, or %TEMP%\project-memory-mcp.log on Windows. Override with PROJECT_MEMORY_MCP_LOG_FILE. Every line is prefixed with [project: <name>] (workspace dir name or PID) so multiple projects sharing the same file are distinguishable. Use tail -f /tmp/project-memory-mcp.log to watch.Option B — npm scripts
From the repo root (run mem:init once for first-time setup):
npm install && npm run build
npm run mem:init
npm run mem:scaffold
Option C — CLI directly
init first if you haven’t (e.g. via Option A or B), then scaffold:
node packages/cli/bin/mem.js init
node packages/cli/bin/mem.js scaffold
npm install -g @folterung/project-memory, run in that repo:
mem init
mem scaffold
| Topic | Doc |
|---|---|
| Architecture (diagram, pipeline, components) | docs/architecture.md |
| Commands (tasks, scripts, CLI) | docs/commands.md |
| Configuration (config.yml, .memignore, defaults) | docs/configuration.md |
| Packages (CLI, server, MCP, skill) | docs/packages.md |
| Cursor skill (use Project Memory in the agent) | docs/skill.md |
| Testing (run tests, coverage) | docs/testing.md |
| Development (build, run services) | docs/development.md |
| Publishing (npm, use in other projects) | docs/publishing.md |
All docs live under docs/. The Cursor skill (packages/skill) tells the agent when and how to use Project Memory; see docs/skill.md to install it. When using the published npm package in another project, copy the skill from node_modules/@folterung/project-memory/packages/skill to .cursor/skills/project-memory/ (or ~/.cursor/skills/project-memory/) so the agent gets the full usage rules.
FAQs
Local-first Project Memory: scoped indexing, embeddings, Cursor integration
We found that @folterung/project-memory demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.