
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
@byterover/cipher
Advanced tools
Memory-powered AI agent framework with real-time WebSocket communication, MCP integration, and composable patterns
Cipher is an opensource memory layer specifically designed for coding agents. Compatible with Cursor, Windsurf, Claude Desktop, Claude Code, Gemini CLI, AWS's Kiro, VS Code, Roo Code, Trae, and Warp through MCP, and coding agents, such as Kimi K2. (see more on examples)
Built by Byterover team
Key Features:
# Install globally
npm install -g @byterover/cipher
# Or install locally in your project
npm install @byterover/cipher
# Clone and setup
git clone https://github.com/campfirein/cipher.git
cd cipher
# Configure environment
cp .env.example .env
# Edit .env with your API keys
# Start with Docker
docker-compose up --build -d
# Test
curl http://localhost:3000/health
💡 Note: Docker builds automatically skip the UI build step to avoid ARM64 compatibility issues with lightningcss. The UI is not included in the Docker image by default.
To include the UI in the Docker build, use:
docker build --build-arg BUILD_UI=true .
pnpm i && pnpm run build && npm link
# Interactive mode
cipher
# One-shot command
cipher "Add this to memory as common causes of 'CORS error' in local dev with Vite + Express."
# API server mode
cipher --mode api
# MCP server mode
cipher --mode mcp
# Web UI mode
cipher --mode ui
⚠️ Note: When running MCP mode in terminal/shell, export all environment variables as Cipher won't read from
.env
file.💡 Tip: CLI mode automatically continues or creates the "default" session. Use
/session new <session-name>
to start a fresh session.
The Cipher Web UI provides an intuitive interface for interacting with memory-powered AI agents, featuring session management, tool integration, and real-time chat capabilities.
Cipher supports multiple configuration options for different deployment scenarios. The main configuration file is located at memAgent/cipher.yml
.
# LLM Configuration
llm:
provider: openai # openai, anthropic, openrouter, ollama, qwen
model: gpt-4-turbo
apiKey: $OPENAI_API_KEY
# System Prompt
systemPrompt: 'You are a helpful AI assistant with memory capabilities.'
# MCP Servers (optional)
mcpServers:
filesystem:
type: stdio
command: npx
args: ['-y', '@modelcontextprotocol/server-filesystem', '.']
📖 See Configuration Guide for complete details.
Create a .env
file in your project root with these essential variables:
# ====================
# API Keys (At least one required)
# ====================
OPENAI_API_KEY=sk-your-openai-api-key
ANTHROPIC_API_KEY=sk-ant-your-anthropic-key
GEMINI_API_KEY=your-gemini-api-key
QWEN_API_KEY=your-qwen-api-key
# ====================
# Vector Store (Optional - defaults to in-memory)
# ====================
VECTOR_STORE_TYPE=qdrant # qdrant, milvus, or in-memory
VECTOR_STORE_URL=https://your-cluster.qdrant.io
VECTOR_STORE_API_KEY=your-qdrant-api-key
# ====================
# Chat History (Optional - defaults to SQLite)
# ====================
CIPHER_PG_URL=postgresql://user:pass@localhost:5432/cipher_db
# ====================
# Workspace Memory (Optional)
# ====================
USE_WORKSPACE_MEMORY=true
WORKSPACE_VECTOR_STORE_COLLECTION=workspace_memory
# ====================
# AWS Bedrock (Optional)
# ====================
AWS_ACCESS_KEY_ID=your-aws-access-key
AWS_SECRET_ACCESS_KEY=your-aws-secret-key
AWS_DEFAULT_REGION=us-east-1
# ====================
# Advanced Options (Optional)
# ====================
# Logging and debugging
CIPHER_LOG_LEVEL=info # error, warn, info, debug, silly
REDACT_SECRETS=true
# Vector store configuration
VECTOR_STORE_DIMENSION=1536
VECTOR_STORE_DISTANCE=Cosine # Cosine, Euclidean, Dot, Manhattan
VECTOR_STORE_MAX_VECTORS=10000
# Memory search configuration
SEARCH_MEMORY_TYPE=knowledge # knowledge, reflection, both (default: knowledge)
DISABLE_REFLECTION_MEMORY=true # default: true
💡 Tip: Copy
.env.example
to.env
and fill in your values:
cp .env.example .env
Cipher can run as an MCP (Model Context Protocol) server, allowing integration with MCP-compatible clients like Claude Desktop, Cursor, Windsurf, and other AI coding assistants.
To use Cipher as an MCP server in your MCP client configuration:
{
"mcpServers": {
"cipher": {
"type": "stdio",
"command": "cipher",
"args": ["--mode", "mcp"],
"env": {
"MCP_SERVER_MODE": "aggregator",
"OPENAI_API_KEY": "your_openai_api_key",
"ANTHROPIC_API_KEY": "your_anthropic_api_key"
}
}
}
}
📖 See MCP Integration Guide for complete MCP setup and advanced features.
👉 Built‑in tools overview — expand the dropdown below to scan everything at a glance. For full details, see docs/builtin-tools.md
📘.
cipher_extract_and_operate_memory
: Extracts knowledge and applies ADD/UPDATE/DELETE in one stepcipher_memory_search
: Semantic search over stored knowledgecipher_store_reasoning_memory
: Store high-quality reasoning tracescipher_extract_reasoning_steps
(internal): Extract structured reasoning stepscipher_evaluate_reasoning
(internal): Evaluate reasoning quality and suggest improvementscipher_search_reasoning_patterns
: Search reflection memory for patternscipher_workspace_search
: Search team/project workspace memorycipher_workspace_store
: Background capture of team/project signalscipher_add_node
, cipher_update_node
, cipher_delete_node
, cipher_add_edge
cipher_search_graph
, cipher_enhanced_search
, cipher_get_neighbors
cipher_extract_entities
, cipher_query_graph
, cipher_relationship_manager
cipher_bash
: Execute bash commands (one-off or persistent)Watch our comprehensive tutorial on how to integrate Cipher with Claude Code through MCP for enhanced coding assistance with persistent memory:
Click the image above to watch the tutorial on YouTube.
For detailed configuration instructions, see the CLI Coding Agents guide.
Topic | Description |
---|---|
Configuration | Complete configuration guide including agent setup, embeddings, and vector stores |
LLM Providers | Detailed setup for OpenAI, Anthropic, AWS, Azure, Qwen, Ollama, LM Studio |
Embedding Configuration | Embedding providers, fallback logic, and troubleshooting |
Vector Stores | Qdrant, Milvus, In-Memory vector database configurations |
Chat History | PostgreSQL, SQLite session storage and management |
CLI Reference | Complete command-line interface documentation |
MCP Integration | Advanced MCP server setup, aggregator mode, and IDE integrations |
Workspace Memory | Team-aware memory system for collaborative development |
Examples | Real-world integration examples and use cases |
For detailed documentation, visit:
We welcome contributions! Refer to our Contributing Guide for more details.
cipher is the opensource version of the agentic memory of byterover which is built and maintained by the byterover team.
Thanks to all these amazing people for contributing to cipher!
Elastic License 2.0. See LICENSE for full terms.
FAQs
Memory-powered AI agent framework with real-time WebSocket communication, MCP integration, and composable patterns
The npm package @byterover/cipher receives a total of 743 weekly downloads. As such, @byterover/cipher popularity was classified as not popular.
We found that @byterover/cipher demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.