
Product
Socket Threat Intel Now Shows Which Malware Campaigns Were Blocked or Detected
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.
@legioncodeinc/honeycomb
Advanced tools
Honeycomb monorepo foundation: a long-lived daemon plus thin clients for six coding harnesses, the unified honeycomb CLI, the MCP server, and the embed daemon.
Shared, persistent memory for your AI coding agents.
What one harness learns, every other one recalls, across sessions, tools, devices, and teammates.
A Legion Code Inc. × Activeloop collaboration.
AI coding agents forget. They forget across sessions, and they forget across tools. A decision you reached in Claude Code at midnight is invisible to Cursor the next morning. Honeycomb fixes that. A local daemon captures what happens on every turn, distills it, and serves it back to any harness that asks. Learn something once; recall it everywhere, on any machine, in any tool, for anyone on your team.
It answers the questions you keep paying for twice: What did we decide about this? Why is it built this way? What fixed it the last time it broke? Who on the team already solved this?
New here? One command and you're on a dashboard. Jump to Install. · Want the docs? Everything lives at theapiary.sh.
🛹 For AI Augmented DevsStop re-explaining your project to a fresh agent every morning. Honeycomb remembers your decisions, your conventions, and the fixes that worked, then primes your next session with them automatically. One install command, a friendly dashboard, no SQL, no config gauntlet. |
🏢 For Enterprise TeamsOne shared brain across every developer, device, and coding tool. A skill discovered by one engineer propagates to the whole team on their next session. Tenancy is enforced at the storage layer; credentials live behind a single loopback boundary; everything is versioned and auditable. |
A vector database can store text and hand it back by similarity. Honeycomb does that, and then keeps going. On top of Activeloop Deeplake, Legion Code builds the memory system that turns raw recall into a brain your agents actually trust.
No Node? No npm? No problem. The installer detects and sets up everything, then opens a dashboard in your browser. The terminal is just a progress log; the product is the first thing you touch.
# macOS / Linux
curl -fsSL https://get.theapiary.sh | sh
# Windows (PowerShell)
irm https://get.theapiary.sh/install.ps1 | iex
That single line installs a current Node/npm if missing, installs @legioncodeinc/honeycomb globally, brings up the daemon on 127.0.0.1:3850, opens the dashboard (Hive portal at 127.0.0.1:3853), and sets up Doctor, a tiny watchdog that keeps it all healthy (opt out with --no-doctor). Then:
Already running Hivemind? The dashboard detects it, explains that running both is unsupported, and "Proceed with Honeycomb" migrates you cleanly. Prefer to inspect before you pipe? The script and a published
SHA256SUMSare served from get.theapiary.sh.
git clone https://github.com/legioncodeinc/honeycomb.git
cd honeycomb
npm install
npm run build # tsc + esbuild → bundle/cli.js, daemon, harness, MCP, embed bundles
node bundle/cli.js setup # detect your assistants, wire hooks, start the daemon
node bundle/cli.js status # check the daemon and your environment
setup wires every coding assistant it detects and starts the loopback daemon; any storage command auto-starts the daemon if it is down. You'll need Activeloop Deeplake credentials; the device flow above writes them to the shared ~/.deeplake/credentials.json.
Self-hosting the storage backend? You can run Honeycomb against Activeloop's open-source
pg_deeplakePostgres extension instead of hosted Deeplake, and point Honeycomb at it withhoneycomb login --endpoint postgres://...(direct) or--endpoint https://...(HTTP gateway), no Activeloop account required. See the self-hosting guide for the setup and the backend contract.
The dashboard is Hive portal at http://127.0.0.1:3853, the one UI for the whole Apiary stack and the first thing the installer opens. Honeycomb's old in-daemon dashboard is retired; the daemon on :3850 serves data, the portal serves the picture. Everything Honeycomb knows shows up there: KPIs up top (memories, turns, estimated savings, team skills), memory recall you can query by hand, the codebase graph, every captured turn, skill-sync status, and settings, hydrated server-side from the daemon's API. It doubles as the guided-setup surface for first-time login.
One unified honeycomb binary drives everything. Run honeycomb --help for the full list; these are the core verbs:
honeycomb install # one-shot install on a fresh machine
honeycomb setup # detect your coding assistants and wire hooks
honeycomb status # daemon + environment health at a glance
honeycomb login # sign in via the Deeplake device flow, any time
honeycomb start # start the daemon (bare verb)
honeycomb stop # stop the daemon (bare verb)
honeycomb daemon start|stop|status # the same lifecycle, spelled the classic way
honeycomb uninstall # remove hooks, service unit, registry entry, state dir
honeycomb remember "<fact>" # write a memory from anywhere
honeycomb recall "<query>" # search the shared memory
honeycomb sessions # browse captured sessions
honeycomb skill # list, inspect, and sync mined skills
honeycomb goal # track goals across sessions
honeycomb sources # manage capture sources
honeycomb graph # query the codebase and knowledge graphs
honeycomb dashboard # open the dashboard (Hive portal, :3853)
A few lifecycle notes:
honeycomb install never opens its own sign-in; Hive's onboarding is the one login surface, and the daemon sits degraded on /health until that login writes the shared ~/.deeplake/credentials.json, then recovers on its own, no restart needed. Solo (no Hive), a fresh install with no credentials opens the device-flow sign-in automatically, and headless sessions get the URL and code printed instead of a browser. honeycomb login works the same way in both modes whenever you want it.uninstall is surgical. It removes only Honeycomb's things: assistant hooks, the OS service unit (current and legacy labels), Honeycomb's entry in Doctor's registry, and ~/.apiary/honeycomb. Shared credentials and every other product survive. Running it when nothing is installed is a friendly no-op. For a full-machine wipe, use doctor purge or the one-command uninstall at get.theapiary.sh.# Capture a decision once…
honeycomb remember "we deploy from the prd-022 branch, never from main"
# …recall it anywhere: same daemon, same Deeplake, any harness
honeycomb recall "how do we deploy"
Write it from Claude Code; recall it from Cursor tomorrow on a different laptop. That's the whole point.
Honeycomb is a long-lived local daemon plus thin clients. The daemon is the only process that talks to storage. Every harness, the CLI, the MCP server, and the SDK reach it over loopback HTTP. One shared memory behind one boundary; your Deeplake credentials in exactly one place.
flowchart TB
CC["Claude Code"] --> TC
CU["Cursor"] --> TC
CX["Codex"] --> TC
HE["Hermes"] --> TC
PI["pi"] --> TC
OC["OpenClaw"] --> TC
TC["thin clients<br/>hooks · CLI · MCP · SDK"] --> HTTP["loopback HTTP<br/>127.0.0.1:3850"]
HTTP --> D["honeycomb daemon<br/>capture · recall · skillify · pollinate · session priming<br/>sole storage client, owns your credentials"]
D --> DL["Activeloop Deeplake<br/>Tier 1 · Tier 2 · Tier 3<br/>BM25 + semantic vectors"]
This is the heart of what Legion Code adds on top of Deeplake. The same memory lives at three levels of detail at once, and the agent chooses how far to zoom:
| Tier | What it is | When it's used |
|---|---|---|
| Tier 1 · Key | One keyword-dense sentence per session or fact. The index. | Skimmed at session start during priming. |
| Tier 2 · Summary | A distilled recap: goals, decisions, blockers, outcomes. Carries the semantic embedding. | Pulled when a key looks relevant. |
| Tier 3 · Raw | The full session dialogue: exact turns and tool calls, never rewritten. | Resolved when the agent needs ground truth. |
Resolution is a deterministic SQL join, not a fuzzy search. key → summary → raw is a pointer walk down three Deeplake tables. Mining ("find the thing I didn't know to name") is where the hybrid vector + lexical search kicks in. Cheap when you're skimming, precise when you're zooming.
Most agent-memory tools bolt onto a vector-only store, which forces every access pattern through a similarity engine. Honeycomb's zoom model needs both exact joins and semantic search, and Deeplake, the database for AI, gives it both natively:
nomic-embed-text-v1.5 cosine arms, fused by Reciprocal Rank Fusion. Turn embeddings off and recall silently falls back to lexical, never an error, no quality cliff.Honeycomb stands on two shoulders: Deeplake gives the memories somewhere durable and queryable to live, and Hivemind, Activeloop's open-source agent-memory project, is the foundation Legion Code extended into Honeycomb's multi-tier system.
Honeycomb supports 3 harnesses in production (Claude Code, Codex, Cursor). Hermes, pi, and OpenClaw are in progress.
| Supported today | In progress |
|---|---|
| Claude Code, Cursor, Codex | Hermes, pi, OpenClaw |
honeycomb setup detects the ones you have installed and wires each idempotently; honeycomb uninstall reverses only Honeycomb's changes. A skill mined while you were in Cursor is auto-pulled and ready in Claude Code on your next session.
Beyond the CLI, three more ways to reach the same daemon and the same shared memory:
http://127.0.0.1:3853, covered above. One front door for the whole stack; Honeycomb's data hydrates through it.mcp/bundle) exposing Honeycomb's read/resolve and search/mine tools to any MCP-capable host.@legioncodeinc/honeycomb client with framework subpath entries (/react, /vercel, /openai). The core entry is fetch-only and browser-safe; react and ai are optional peers.Honeycomb is production ready (v0.4.x) and fully tested in live scenarios. We document what's real and flag what's opt-in.
Production today
npm run smoke:golden-path with credentials).honeycomb login --endpoint, with idle connection hibernation for scale-to-zero.Opt-in / by design
Full documentation and guides live at theapiary.sh; vote on what ships next at ideas.theapiary.sh.
npm install # dependencies
npm run build # tsc + esbuild → bundle/cli.js, the daemon, harness, MCP, and embed bundles
npm run ci # the gate: typecheck + duplication (jscpd) + tests (vitest) + SQL-safety audit
npm run ci is the quality gate every change must pass.
Honeycomb exists because two halves fit together:
Honeycomb is licensed under the GNU Affero General Public License v3.0 or later (AGPL-3.0-or-later).
Use it commercially or privately, free of charge. In return: keep the copyright and license notices intact, and if you modify it, your changes ship under the same AGPL license with source available. The "Affero" part is the point: run a modified version as a network service and you owe its source to the users who interact with it. No locking a fork behind a SaaS wall.
© 2026 Legion Code Inc.
Built by Legion Code Inc · Powered by Activeloop Deeplake · theapiary.sh
I am Legion. We are Legion.
#vibewithlegion
FAQs
Honeycomb monorepo foundation: a long-lived daemon plus thin clients for six coding harnesses, the unified honeycomb CLI, the MCP server, and the embed daemon.
The npm package @legioncodeinc/honeycomb receives a total of 8 weekly downloads. As such, @legioncodeinc/honeycomb popularity was classified as not popular.
We found that @legioncodeinc/honeycomb demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Product
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.

Security News
Fixes for eMudhra and Brotli are out. Getting them everywhere they’re needed means tracking down bundled libraries, runtimes, and certificate stores.

Threat Research
/Security News
Socket uncovered secret-stealing workflows that ran in LiteLLM’s GitHub repository 11 days before the supply chain attack on PyPI and Docker.