
Security News
OpenCode User Hit with Hostile Backlash After Reporting Free AI Loophole
An OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.
@knolo/tools
Advanced tools
Host-agnostic verified Knowledge Image query, policy, and receipt service.
@knolo/tools is the host-agnostic service behind Knolo's read-only adapters.
@knolo/openclaw and @knolo/mcp both import it. The package pins a local V5
Knowledge Image by file SHA-256 and state root, checks the policy root at
load, and writes a replayable query receipt before search results are
returned.
Caller identity is an argument of search, get, verify, and status.
The host must supply that identity from its own configuration or attestation.
Tool arguments are not a caller.
Receipts use version openclaw-knolo-query-v1. An unwritable audit directory
fails the search with AUDIT_UNAVAILABLE and returns no hits. Mount failures
use ACCESS_DENIED, IMAGE_INVALID, IMAGE_UNAVAILABLE, NOT_FOUND,
QUERY_INVALID, or STATE_ROOT_MISMATCH.
The package requires Node 20 or newer and @knolo/core ^6.0.0. It does not
download images, open a network connection, or implement KAR, coverage, or
composition. @knolo/tools@0.1.0 is not on npm yet. Publish it before @knolo/mcp,
which depends on ^0.1.0.
FAQs
Host-agnostic verified Knowledge Image query, policy, and receipt service.
The npm package @knolo/tools receives a total of 14 weekly downloads. As such, @knolo/tools popularity was classified as not popular.
We found that @knolo/tools demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Security News
An OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.

Threat Research
/Security News
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.

Threat Research
Malicious Firefox extensions mimic Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys, with one fetching its payload remotely.