
Security News
npm Tooling Bug Incorrectly Marks One-Character Packages as Security Holders
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.
graphonomous
Advanced tools
Continual learning MCP server for AI agents — topology-aware knowledge graph with kappa-routing, exposed as 5 loop-phase machines (retrieve/route/act/learn/consolidate), causal metadata, and neural embeddings. One of four MCP servers in the [&] three-prot
Continual learning memory loop for AI agents — 5 loop-phase MCP machines.
One of four MCP servers in the [&] three-protocol stack:
| Package | Role | Install |
|---|---|---|
box-and-box | [&] Protocol validator / composer | npx -y box-and-box --db ~/.box-and-box/specs.db |
graphonomous | Memory loop (this, 5 machines) | npx -y graphonomous --db ~/.graphonomous/knowledge.db |
os-prism | Diagnostic loop (6 machines) | npx -y os-prism --db ~/.os-prism/benchmarks.db |
os-pulse | PULSE manifest registry | npx -y os-pulse --db ~/.os-pulse/manifests.db |
Graphonomous exposes the five memory-loop machines — retrieve, route, act,
learn, consolidate — with κ-aware routing, causal metadata, and neural
embeddings. When PRISM benchmarks Graphonomous, the loops nest: PRISM.interact → Graphonomous.retrieve → route → act → learn → consolidate → PRISM.observe.
This package provides an npm-friendly launcher for the Graphonomous MCP server CLI.
It installs (or reuses) a platform-specific graphonomous binary and exposes:
graphonomous ...npx graphonomous ...The underlying server communicates over STDIO, so it works well with MCP-capable editors/clients (for example Claude Code, Zed, and Cursor).
darwin|linux + x64|arm64)vendor/<platform>-<arch>/graphonomous/bin/graphonomous when availablevendor/<platform>-<arch>/graphonomous as the launcher target for consistent execution>= 18x64, arm64x64, arm64npm i -g graphonomous
Then run:
graphonomous --help
npx -y graphonomous --help
npm i graphonomous
npx graphonomous --help
Start Graphonomous MCP server with a local DB path:
graphonomous --db ~/.graphonomous/knowledge.db --embedder-backend fallback
Safe laptop-oriented defaults:
graphonomous \
--db ~/.graphonomous/knowledge.db \
--embedder-backend fallback \
--log-level info
In Zed settings JSON:
{
"context_servers": {
"graphonomous": {
"command": "graphonomous",
"args": ["--db", "~/.graphonomous/knowledge.db", "--embedder-backend", "fallback"],
"env": {
"GRAPHONOMOUS_EMBEDDING_MODEL": "sentence-transformers/all-MiniLM-L6-v2"
}
}
}
}
If you prefer not to install globally:
{
"context_servers": {
"graphonomous": {
"command": "npx",
"args": ["-y", "graphonomous", "--db", "~/.graphonomous/knowledge.db", "--embedder-backend", "fallback"],
"env": {}
}
}
}
Add to your project's .mcp.json:
{
"mcpServers": {
"graphonomous": {
"command": "npx",
"args": ["-y", "graphonomous", "--db", "./.graphonomous/knowledge.db", "--embedder-backend", "fallback"]
}
}
}
To run the full four-package stack side by side:
{
"mcpServers": {
"box-and-box": { "command": "npx", "args": ["-y", "box-and-box", "--db", "~/.box-and-box/specs.db"] },
"graphonomous": { "command": "npx", "args": ["-y", "graphonomous", "--db", "~/.graphonomous/knowledge.db", "--embedder-backend", "fallback"] },
"os-prism": { "command": "npx", "args": ["-y", "os-prism", "--db", "~/.os-prism/benchmarks.db"] },
"os-pulse": { "command": "npx", "args": ["-y", "os-pulse", "--db", "~/.os-pulse/manifests.db"] }
}
}
By default, the installer resolves the GitHub release source from this package metadata (repository.url, then homepage, then bugs.url).
Current default source in this package points to:
c-u-l8ergraphonomousSo for version X.Y.Z, the default asset URL pattern is:
https://github.com/c-u-l8er/graphonomous/releases/download/vX.Y.Z/graphonomous-vX.Y.Z-<platform>-<arch>.tar.gzYou can override this behavior with environment variables for custom repos/tags/asset hosting.
GRAPHONOMOUS_GITHUB_OWNER=my-org \
GRAPHONOMOUS_GITHUB_REPO=graphonomous \
GRAPHONOMOUS_RELEASE_TAG=v0.1.1 \
npm i graphonomous
GRAPHONOMOUS_VERSION=0.1.1 npm i graphonomous
GRAPHONOMOUS_RELEASE_BASE_URL should point to a directory containing assets named like:
graphonomous-v<version>-<platform>-<arch>.tar.gz
Example:
GRAPHONOMOUS_RELEASE_BASE_URL=https://downloads.example.com/graphonomous \
GRAPHONOMOUS_VERSION=0.1.1 \
npm i graphonomous
GRAPHONOMOUS_GITHUB_TOKEN=ghp_xxx npm i graphonomous
(You can also use GITHUB_TOKEN.)
# Skip download entirely
GRAPHONOMOUS_SKIP_DOWNLOAD=1 npm i graphonomous
# Force re-download even if binary exists
GRAPHONOMOUS_FORCE_DOWNLOAD=1 npm i graphonomous
# Timeout and redirect controls
GRAPHONOMOUS_DOWNLOAD_TIMEOUT_MS=120000 \
GRAPHONOMOUS_DOWNLOAD_MAX_REDIRECTS=10 \
npm i graphonomous
You can bypass installed vendor binaries/release layout and point directly to a custom executable:
GRAPHONOMOUS_BINARY_PATH=/absolute/path/to/graphonomous graphonomous --help
Try reinstalling or rebuilding:
npm rebuild graphonomous
# or
npm i graphonomous@latest
Current prebuilt targets are Linux/macOS + x64/arm64.
Reinstall the package, or manually set executable bit on unix-like systems:
chmod +x node_modules/graphonomous/vendor/<target>/graphonomous
chmod +x node_modules/graphonomous/vendor/<target>/graphonomous/bin/graphonomous
This package ships a PULSE loop manifest describing Graphonomous's 5-phase continual learning loop:
graphonomous.continual_learning.pulse.json (at the package root)Any PULSE-conforming benchmark (for example os-prism) can read this file
directly to discover the loop's phases, signatures, substrates, and
cross-loop token connections. To register it with a running os-pulse
instance:
npx -y os-pulse --db ~/.os-pulse/manifests.db
# then, from another shell or an MCP client:
# pulse.register { "path": "$(npm root -g)/graphonomous/graphonomous.continual_learning.pulse.json" }
The npm package is a distribution wrapper around the Graphonomous Elixir CLI. Core implementation and release process live in the Graphonomous repository.
FAQs
Continual learning MCP server for AI agents — topology-aware knowledge graph with kappa-routing, exposed as 5 loop-phase machines (retrieve/route/act/learn/consolidate), causal metadata, and neural embeddings. One of four MCP servers in the [&] three-prot
The npm package graphonomous receives a total of 48 weekly downloads. As such, graphonomous popularity was classified as not popular.
We found that graphonomous demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.

Research
/Security News
Newer packages in this compromise use native extensions and .pth loaders to execute JavaScript stealers in developer environments.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.