
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
@egchq/egc
Advanced tools
EGC - Extended Global Context. Persistent memory and shared context for AI coding tools.
Language: English | العربية | Español | हिन्दी | 日本語 | 한국어 | Português (Brasil) | Русский
Language / اللغة / Idioma / भाषा / 言語 / 언어 / Язык
English | العربية | Español | हिन्दी | 日本語 | 한국어 | Português (Brasil) | Русский
Your AI agents never start from zero again.
No commands to learn. Just work - EGC handles the rest.
EGC is a local runtime that gives every AI coding tool you use a persistent memory. At the end of each session, your AI saves what it learned: decisions made, what failed, your preferences, what to pick up next. At the start of the next session, it loads that state back on its own - no prompting required. Say "let's continue" or "where did we stop?" in any language and your AI already knows what to do. One install covers Claude Code, Cursor, Gemini CLI, Windsurf, Zed, VS Code with GitHub Copilot, and more. Works with Claude, GPT-4o, Gemini, and OpenRouter models including DeepSeek, Qwen3, and Llama 4.
You open Claude Code on a project you haven't touched in two weeks. Without typing anything:
State loaded from egc-memory via ~/.egc/state/MyApp.md
Context and preferences acknowledged.
Ready to pick up:
• Fix the rate limiter edge case on concurrent requests
• Add integration tests for the new auth module
• Review open PR from @contributor before merging
=== EGC Stack Briefing ===
Stack: typescript, node
Skills: tdd-workflow, coding-standards
Agents: code-reviewer
===
The AI already knows what you were building, what decisions you made, what failed, and exactly where you stopped. It knows because EGC saved that state at the end of your last session and loaded it back when this one started, on its own, without you asking. You didn't type anything. You just started working.
npm install -g @egchq/egc && egc install
Or run without installing globally:
npx @egchq/egc install
Use the Copilot target when you want EGC skills available in VS Code through GitHub Copilot Chat:
npm install -g @egchq/egc
egc install --target copilot
This requires the GitHub Copilot Chat extension. EGC installs skills to ~/.github/skills/, where Copilot discovers them automatically. The same memory state is shared with Claude Code, Cursor, Gemini CLI, Windsurf, and other EGC targets.
EGC ships two MCP servers that work together during every session.
No commands to memorize. Your AI reads this table so you never have to. Say anything in any language - "continue from yesterday", "remember this decision", "what broke last time?" - and it calls the right tool. You just work. EGC handles the rest.
egc-memory
| Tool | What it does |
|---|---|
get_state | Loads project memory at session start |
update_state | Saves decisions, preferences, and next steps |
store_decision | Persists a single decision to SQLite |
query_history | Returns past decisions by timestamp |
search_history | Full-text search with BM25 ranking |
working_memory_set | Stores transient context with a TTL |
working_memory_get | Reads a transient key |
working_memory_list | Lists all live transient entries for the current project |
lesson_save | Records cross-session knowledge with confidence decay |
lesson_recall | Retrieves active lessons above a confidence threshold |
lesson_reinforce | Boosts confidence on a lesson when the same pattern repeats |
detect_patterns | Surfaces repeated commands and recurring errors from hook events |
compress_observations | Compresses raw hook observations into typed summaries to reduce token usage |
get_project_state | Returns server health metadata and storage engine status |
State files live at ~/.egc/state/<project-slug>/<branch>.md, one per project branch (flat <project-slug>.md files from older versions are still read). They are encrypted at rest with AES-256-GCM and decrypted transparently by the memory server and session hooks; the key lives at ~/.egc/encryption.key.
egc-guardian
These tools run automatically in the background. Every shell command and every file write is checked before it executes. You never invoke them directly.
| Tool | What it does |
|---|---|
validate_command | Checks shell commands against project safety rules before execution |
validate_write | Validates file write paths to prevent unsafe writes |
reduce_context | Compresses file payloads to save your token budget |
orchestrate_task | Routes prompts with agent/skill context and returns compression metrics |
auto_learn | Mines session failures and writes actionable lessons to all AI tool config files in the project |
Validation does not depend on the AI choosing to cooperate. EGC installs harness hooks that run on every tool call: each shell command and file write is validated before it executes, and destructive commands, credential paths, and force-pushes are blocked even inside compound commands. Every prompt is also routed against the component catalog so the right skills and agents are injected into context. If the validator is ever missing, hooks fail open so you are never locked out of your own tool.
With a provider API key (ANTHROPIC_API_KEY, GEMINI_API_KEY, OPENAI_API_KEY, or OPENROUTER_API_KEY), EGC also understands session intent semantically, in any language, with no predefined phrases: say you are done for the night and your state is saved before the AI even answers; greet it the next morning and your next steps are already in context. At session end a memory miner distills the session's decisions and lessons into your project state. Without a key these LLM features honestly do nothing, and the lifecycle hooks still guarantee your state is saved. The end-of-reply save reminder is throttled to once per project every 30 minutes (EGC_STOP_SAVE_INTERVAL_MINUTES tunes it; 0 prompts on every stop), so memory stays fresh without interrupting the work.
egc watch - run it once and every tool you use stays in sync. Edit context in Cursor and it appears in Gemini CLI, Copilot, Windsurf, Zed, and everywhere else automatically. When your state updates, all your tool config files update with it. No manual steps, no stale state.
egc watch # watch current project
egc watch /path/proj # watch a specific project
egc watch --quiet # suppress output
See every tool call, token, and cost your agents generate -- live in your browser. Starts automatically after egc init. Full guide
481 components included as a bonus. Install to get access to 63 agents, 230 skills, and 77 commands, plus 111 rules, all written from real engineering sessions. Skip them entirely and EGC still gives you persistent memory.
EGC is built by one developer, maintained in the open, and free.
Support from the community keeps this project alive and independent.
AI coding tools that integrate natively with EGC. Partners get logo placement across all READMEs and EGCSite.
FAQs
EGC is a local-first MCP runtime that gives every AI agent the same brain: persistent shared memory, security guardrails, and up to 90% token savings across 20 AI coding tools.
The npm package @egchq/egc receives a total of 771 weekly downloads. As such, @egchq/egc popularity was classified as not popular.
We found that @egchq/egc demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.