
Research
/Security News
737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.
@pranavnpm/core
Advanced tools
Offline, zero-dependency BM25/TF-IDF tool ranker — funnel many tools down to a ranked shortlist.
The offline, zero-dependency ranker behind Quartermaster. No embedding model, no network, no runtime dependencies.
npm install @pranavnpm/core
import { createRouter } from '@pranavnpm/core';
const router = createRouter(tools, {
ranker: 'bm25', // 'bm25' (default) | 'tfidf'
synonyms: { bug: ['issue'] }, // optional query expansion; omit for pure lexical
});
const shortlist = router.search('how do I file a bug?', 8);
createRouter(tools, config?) => { search }tools: Tool[] — { name, description?, keywords?, category? }. Only name required.config: RouterConfig — ranker, synonyms, stopwords, nameWeight, k1, b, expansionWeight.search(query, k = 8, opts?): ToolCandidate[] — { tool, score, category }[], highest score first.
{ includeDescription: true } → adds each tool's description to its candidate (so the host LLM can choose from more than the name; the proxy uses this).{ explain: true } → adds matches, a per-term { term, contribution }[] breakdown (desc) for tuning.route(query, k = 8, opts?): RouteResult — search plus a confidence
(none / low / high) and a guidance string for the host LLM, so it knows
when not to trust the shortlist. none = nothing matched; low = top
candidates near-tied (relative marginThreshold, default 0.15); high = clear winner.k1=1.5, b=0.75) is the default — it beats plain TF-IDF on tool
retrieval and is what Anthropic's native Tool Search and mcpproxy-go also use.nameWeight=2) because the name encodes intent
(create_issue) even when the prose description doesn't echo the query.expansionWeight so they nudge ranking without washing
out exact-term matches. expansionWeight auto-defaults by corpus: 0 (off)
when average description length is rich (>200 chars, where expansion adds noise),
0.5 when terse. Set it explicitly to override.[a-z0-9] characters, so
CJK and other non-Latin scripts produce no tokens and won't match (queries
still run safely, just empty). Tool names are typically ASCII, so routing for
ASCII-named tools with non-Latin descriptions still works via the name.See how it works.
FAQs
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.

Company News
Open source maintainers are under more pressure than ever. We're raising our open source program from the Team plan to the Business plan, free.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.