🎩 You're Invited:Meet the Socket team at Black Hat in Las Vegas, August 3-6.RSVP →
@saihm/mcp-server-pro
Advanced tools
@saihm/mcp-server-pro - npm Package Compare versions
| # Installing @saihm/mcp-server-pro | ||
| This file is for the AI agent doing the install. Follow it end to end; it needs | ||
| no input from the user for the free path. | ||
| ## What this server is | ||
| Sovereign, client-side-sealed persistent memory. Cells are sealed **in the | ||
| client process** before they leave the machine, so the operator stores | ||
| ciphertext it cannot open. Nine tools are exposed: the eight canonical protocol | ||
| tools (`saihm_remember`, `saihm_recall`, `saihm_forget`, `saihm_status`, | ||
| `saihm_share`, `saihm_revoke_share`, `saihm_governance_propose`, | ||
| `saihm_governance_vote`) plus `saihm_join`, a one-time onboarding affordance. | ||
| ## Step 1 — write the MCP config | ||
| Add this entry to the host's MCP settings file. For Cline that is | ||
| `cline_mcp_settings.json`; merge into the existing `mcpServers` object rather | ||
| than overwriting it. | ||
| ```json | ||
| { | ||
| "mcpServers": { | ||
| "saihm": { | ||
| "command": "npx", | ||
| "args": ["-y", "@saihm/mcp-server-pro"], | ||
| "env": { | ||
| "SAIHM_ENDPOINT_URL": "https://saihm.coti.global/mcp" | ||
| }, | ||
| "timeout": 60 | ||
| } | ||
| } | ||
| } | ||
| ``` | ||
| **`timeout` is required, not decorative.** Cline's default MCP start-up budget | ||
| is 1.5 seconds. `npx` cannot resolve and launch a package that fast, and a | ||
| server that misses the deadline is skipped **silently** — the tools simply never | ||
| appear, with no error surfaced in the chat. If this server seems absent after | ||
| install, check the setting before anything else. | ||
| Do **not** ask the user for an API key, token, or master secret at this step. | ||
| The free path needs none, and the master secret in particular must never be | ||
| pasted into a third-party config store — see step 3. | ||
| ## Step 2 — verify | ||
| Restart the MCP connection and confirm the host lists tools under the `saihm` | ||
| server. Nine should appear. If zero appear, revisit `timeout` first, then | ||
| confirm `npx` is on `PATH`. | ||
| Do not call `saihm_join` as a smoke test — see below. To verify liveness | ||
| without side effects, `saihm_status` is read-only. | ||
| ## Step 3 — activation (only when the user asks) | ||
| Tell the user that memory is installed but not yet activated, and that saying | ||
| **"Join SAIHM"** activates it. When they do, call `saihm_join`. It generates a | ||
| 32-byte master secret locally at `~/.saihm/free-identity.key` (mode 600) and | ||
| returns a one-time device sign-in link plus a short code; the user opens the | ||
| link, enters the code, and approves. That step confirms a unique person. The | ||
| secret never leaves the machine. | ||
| Two things to tell the user, in your own words: | ||
| 1. **`saihm_join` is one-time.** It claims a lifetime free grant for this | ||
| device identity. Do not call it speculatively, in a loop, or to test that | ||
| the install worked. | ||
| 2. **`~/.saihm/free-identity.key` is the only copy of their key.** Advise | ||
| backing it up. If it is lost, no one — including SAIHM — can open their | ||
| cells. That is the point of the design, and it is not recoverable. | ||
| Set `SAIHM_SELF_JOIN=0` to suppress `saihm_join` and expose only the canonical | ||
| eight tools. | ||
| ## Paid tiers | ||
| If the user already has a master secret, pass it as `SAIHM_MASTER_SECRET_HEX` | ||
| alongside `SAIHM_TIER` and `SAIHM_PAYMENT_METHOD`. Prefer having the user place | ||
| it in the config file themselves. Full option table: see `README.md`. | ||
| ## Troubleshooting | ||
| | Symptom | Cause | | ||
| | --- | --- | | ||
| | No tools appear, no error | `timeout` too low — see step 1 | | ||
| | Tools appear, calls fail | `SAIHM_ENDPOINT_URL` unreachable | | ||
| | Tool calls report no identity | `saihm_join` not yet run | |
+1
-1
@@ -10,3 +10,3 @@ #!/usr/bin/env node | ||
| const PACKAGE_VERSION = JSON.parse(readFileSync(pathJoin(dirname(fileURLToPath(import.meta.url)), '..', 'package.json'), 'utf-8')).version; | ||
| const server = new McpServer({ name: 'saihm', version: PACKAGE_VERSION }, { capabilities: { tools: {}, prompts: {} } }); | ||
| const server = new McpServer({ name: 'saihm-pro', version: PACKAGE_VERSION }, { capabilities: { tools: {}, prompts: {} } }); | ||
| let client = null; | ||
@@ -13,0 +13,0 @@ function getClient() { |
+3
-2
| { | ||
| "name": "@saihm/mcp-server-pro", | ||
| "version": "0.2.1", | ||
| "version": "0.3.0", | ||
| "mcpName": "io.github.SAIHM-Admin/saihm-mcp-server-pro", | ||
@@ -28,3 +28,4 @@ "description": "Sovereign encrypted memory for AI agents, sealed on your own machine. Start free with no card and no master secret — just ask your agent to \"Join SAIHM\". Seals client-side via @saihm/client-pro (ML-DSA-65 identity, per-cell AES-256-GCM DEK wrapped under a client KEK, ML-KEM-768 authenticated sharing) and POSTs opaque ciphertext to the blind, non-custodial SAIHM /mcp endpoint. The master secret, KEK, and plaintext never leave this process. Apache-2.0.", | ||
| "LICENSE", | ||
| "README.md" | ||
| "README.md", | ||
| "llms-install.md" | ||
| ], | ||
@@ -31,0 +32,0 @@ "publishConfig": { |
+17
-8
@@ -48,3 +48,3 @@ # @saihm/mcp-server-pro | ||
| ```jsonc | ||
| ```json | ||
| { | ||
@@ -59,9 +59,17 @@ "mcpServers": { | ||
| "SAIHM_TIER": "PRO", | ||
| "SAIHM_PAYMENT_METHOD": "stripe", | ||
| "SAIHM_PAYMENT_METHOD": "stripe" | ||
| }, | ||
| }, | ||
| }, | ||
| "timeout": 60 | ||
| } | ||
| } | ||
| } | ||
| ``` | ||
| Two details worth keeping as written. **`timeout`**: hosts that don't recognise | ||
| it ignore it, but Cline's default start-up budget is 1.5 s — too short for `npx` | ||
| to resolve and launch the package — and a server that misses it is skipped | ||
| **silently**, with no error in the chat. **No trailing commas**: these config | ||
| files are parsed as strict JSON, and a stray comma doesn't just break this entry, | ||
| it invalidates the whole file and drops every MCP server you had configured. | ||
| With no `SAIHM_AUTH_HEADER`, the server **self-onboards**: it mints and | ||
@@ -79,3 +87,3 @@ auto-refreshes its own short-lived access token from your master secret, so | ||
| ```jsonc | ||
| ```json | ||
| { | ||
@@ -87,6 +95,7 @@ "mcpServers": { | ||
| "env": { | ||
| "SAIHM_ENDPOINT_URL": "https://saihm.coti.global/mcp", | ||
| "SAIHM_ENDPOINT_URL": "https://saihm.coti.global/mcp" | ||
| }, | ||
| }, | ||
| }, | ||
| "timeout": 60 | ||
| } | ||
| } | ||
| } | ||
@@ -93,0 +102,0 @@ ``` |
No alert changes
Improved metrics
- Total package byte prevSize
102878
4.05%- Number of package files
10
11.11%- Number of lines in readme file
288
3.23%No dependency changes