
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
@egchq/egc
Advanced tools
EGC - Extended Global Context. Persistent memory and shared context for AI coding tools.
🌐 English · العربية · Español · हिन्दी · 日本語 · 한국어 · Português (Brasil) · Русский
Your AI agents never start from zero again.
Zero setup. Zero commands. You work, EGC remembers.
EGC is a local runtime that gives every AI coding tool you use a persistent memory. At the end of each session, your AI saves what it learned: decisions made, what failed, your preferences, what to pick up next. At the start of the next session, it loads that state back on its own, no prompting required. Say "let's continue" or "where did we stop?" in any language and your AI already knows what to do. One install covers Claude Code, Cursor, Gemini CLI, Windsurf, Zed, Warp, JetBrains Junie, VS Code with GitHub Copilot, and more (20 tools total). Works natively with Claude, GPT-4o, Gemini, DeepSeek, Mistral, Groq, Cohere, and Vertex AI, plus OpenRouter for Qwen3, Llama 4, and more.
You open Claude Code on a project you haven't touched in two weeks. Without typing anything:
State loaded from egc-memory via ~/.egc/state/MyApp/main.md
Context and preferences acknowledged.
Ready to pick up:
• Fix the rate limiter edge case on concurrent requests
• Add integration tests for the new auth module
• Review open PR from @contributor before merging
=== EGC Stack Briefing ===
Stack: typescript, node
Skills: tdd-workflow, coding-standards
Agents: code-reviewer
Guardian: active, every command checked before it runs
===
This isn't a cache of your last chat. EGC remembers the decisions, the dead ends, and your preferences, and it stands guard the whole session, blocking the commands that would burn your codebase down before they run. You didn't ask for any of it. You just started working.
Same install command on Windows, macOS, and Linux:
npm install -g @egchq/egc && egc install
Windows has a few of its own caveats (PowerShell version, Antigravity CLI, Gemini CLI's discontinued free tier): see the Windows notes if you hit anything unexpected.
Or run without installing globally:
npx @egchq/egc install
One brain, many tools. With the GitHub Copilot Chat extension installed, Copilot finds the skills on its own, and the same memory you already have in Claude Code or Cursor shows up there too:
npm install -g @egchq/egc
egc install --target copilot
EGC always runs two things together, every session: a memory that keeps what matters, and a safety layer that blocks dangerous commands before they run. It all comes ready, no configuration needed.
You'll never memorize a single command. Say it in any language: "continue from yesterday", "remember this decision", "what broke last time", and your AI knows exactly what to do. The work is yours, the remembering is EGC's.
egc-memory
| Tool | What it does |
|---|---|
get_state | Loads everything your AI already knew about the project the moment the session opens, plus your user-wide global memory |
update_state | Saves what got decided today so nobody loses the thread tomorrow; scope: "global" shares it across every project |
session_announce / session_peers | Parallel sessions see each other and split territory instead of colliding |
claim_path / release_path | Cooperative locks so two sessions never fight over the same files |
store_decision | Writes down one important decision, for good |
query_history | Shows past decisions in the order they happened |
search_history | Finds anything that was ever decided, even if you don't remember the date |
working_memory_set / _get / _list | Quick notes that expire on their own once they stop being useful |
lesson_save | Records something learned, which fades over time if nobody confirms it again |
lesson_recall | Brings back the lessons that are still worth acting on |
lesson_reinforce | Reinforces a lesson when it gets confirmed again |
detect_patterns | Notices when the same error or command keeps repeating |
compress_observations | Summarizes the raw history so you don't burn tokens for nothing |
get_project_state | Checks that memory is working the way it should |
Every branch of your project keeps its own memory, encrypted on your machine: nobody else has access, not even the cloud. Privacy by default, nothing to configure.
egc-guardian
These tools run automatically in the background. Every shell command and every file write is checked before it executes. You never invoke them directly.
| Tool | What it does |
|---|---|
validate_command | Checks every command before it runs: blocks the ones that could cause damage |
validate_write | Stops the AI from writing to sensitive files by accident |
reduce_context | Shrinks large files so you don't burn your token budget for nothing |
orchestrate_task | Picks the right tools for each request, without you needing to know which ones exist |
auto_learn | Learns from the session's mistakes and writes it down so it doesn't repeat |
A 200-commit git log, a 400-line npm install, a test run with 300 passing cases: your model reads all of it, and you pay for all of it. The Token Crusher compresses that output before it reaches the model: up to 90% smaller, with errors, warnings and failures always preserved.
egc run git log # same command, crushed output
egc run --raw git log # escape hatch: full output
egc saved # accumulated savings, computed locally at zero token cost
Conservative by design: small outputs pass through untouched, failures always survive, and the savings ledger never touches your context window.
Security that doesn't depend on the AI being in a good mood: every command passes through EGC before it runs, always. Full details on harness enforcement, session-intent detection, and the memory miner →
Run egc watch once and forget it exists. Change context in Cursor, it shows up on its own in Gemini CLI, Copilot, Windsurf, Zed: everywhere you work. No manual steps, no stale state anywhere.
egc watch # watch current project
egc watch /path/proj # watch a specific project
egc watch --quiet # suppress output
See every tool call, token, and cost your agents generate, live in your browser. Starts automatically after egc init. Full guide
As a bonus, EGC gives you access to 63 agents, 230 skills, and 77 commands, plus 111 rules: specialists that review your code on their own, best-practice guides for every language and situation, shortcuts that run a whole sequence of tasks for you, and style rules that keep your code consistent. All written from real engineering sessions, not theory. Don't want to use any of it? Fine: EGC's persistent memory works exactly the same.
🌐 English · العربية · Español · हिन्दी · 日本語 · 한국어 · Português (Brasil) · Русский
EGC is built by one developer, maintained in the open, and free.
Support from the community keeps this project alive and independent.
AI coding tools that integrate natively with EGC. Partners get logo placement across all READMEs and EGCSite.
FAQs
EGC is a local-first MCP runtime that gives every AI agent the same brain: persistent shared memory, security guardrails, and up to 90% token savings across 20 AI coding tools.
The npm package @egchq/egc receives a total of 771 weekly downloads. As such, @egchq/egc popularity was classified as not popular.
We found that @egchq/egc demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.