
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
megg - Memory for AI Agents. Simplified knowledge system with auto-discovery and size-aware loading.
Give your AI agents long-term memory. A lightweight knowledge management system for LLM agents with automatic context loading and smart token management.
AI agents are stateless. Every session starts from zero. Your agent:
megg turns stateless AI agents into "good employees" who remember context across sessions. Works with Claude, GPT, and any MCP-compatible AI assistant.
Session 1: "We decided to use JWT with refresh tokens"
→ megg stores this decision
Session 47: Agent automatically knows about JWT decision
→ No re-explaining, no re-deciding
auth, api, security/megg-statenpm install -g megg
megg setup
This automatically:
/megg-state skillcd your-project
megg init
This creates a .megg/ folder with:
info.md - Project identity and rulesknowledge.md - Accumulated learningsThat's it! Run megg context to verify, then context loads automatically when you start Claude Code.
Add to your claude_desktop_config.json:
{
"mcpServers": {
"megg": {
"command": "npx",
"args": ["-y", "megg@latest"]
}
}
}
And add to ~/.claude/hooks.json for automatic context loading:
{
"SessionStart": [
{
"matcher": "startup|resume",
"hooks": [
{
"type": "command",
"command": "npx megg context --json 2>/dev/null || echo '{}'"
}
]
}
]
}
megg organizes knowledge by bounded contexts, not file paths:
Company/
├── .megg/info.md # Company-wide rules
├── ProductA/.megg/ # Product-specific context
└── clients/
└── acme/.megg/ # Client-specific knowledge
When you call context("clients/acme"), megg loads the full chain:
| Type | Use For | Example |
|---|---|---|
decision | Architectural choices | "We chose PostgreSQL over MongoDB because..." |
pattern | Team conventions | "API endpoints use kebab-case" |
gotcha | Traps to avoid | "Don't use localStorage for auth tokens" |
context | Background info | "This client requires HIPAA compliance" |
| Knowledge Size | Behavior |
|---|---|
| < 8,000 tokens | Full knowledge loaded |
| 8k - 16k tokens | Summary + topic index |
| > 16,000 tokens | Blocked - run maintain() to clean up |
| Tool | Purpose |
|---|---|
context(path?, topic?) | Load context chain + knowledge + state |
learn(title, type, topics, content) | Add knowledge entry |
init() | Initialize megg in directory |
maintain() | Analyze and clean up bloated knowledge |
state(content?, status?) | Session state handoff (ephemeral) |
# Load context for current directory
npx megg context
# Load context with topic filter
npx megg context . --topic auth
# Add a decision
npx megg learn "JWT Auth" decision "auth,security" "We use JWT with refresh tokens..."
# Initialize megg
npx megg init
# Check knowledge health
npx megg maintain
# Show current session state
npx megg state
# Clear session state (mark task done)
npx megg state --clear
// Load context (usually automatic via hooks)
context()
context("src/api")
context(null, "auth") // filter by topic
// Add knowledge
learn({
title: "JWT with refresh tokens",
type: "decision",
topics: ["auth", "api"],
content: "We chose JWT because..."
})
// Initialize
init()
// Maintenance
maintain()
// Session state
state() // Read current state
state({ content: "..." }) // Write state
state({ status: "done" }) // Clear state
Unlike permanent knowledge, session state is ephemeral - designed for passing context between sessions when you're mid-task.
# In Claude Code, use the skill:
/megg-state # Capture current work for next session
/megg-state show # Display current state
/megg-state clear # Mark task complete, clear state
State vs Knowledge:
| Aspect | state.md | knowledge.md |
|---|---|---|
| Purpose | Session handoff | Permanent wisdom |
| Lifecycle | Overwritten each capture | Accumulated over time |
| Expiry | Auto-expires after 48h | Never expires |
| Size limit | 2k tokens (hard) | 8k-16k tokens (soft) |
Example state.md:
---
updated: 2026-01-17T10:30:00Z
status: active
---
## Working On
Implementing user authentication
## Progress
- Created auth middleware
- Added JWT validation
## Next
- Add refresh token rotation
- Write tests
## Context
Files: src/middleware/auth.ts, src/utils/jwt.ts
| Feature | megg | .cursorrules | Custom prompts |
|---|---|---|---|
| Hierarchical context | Yes | No | No |
| Auto-discovery | Yes | No | No |
| Knowledge accumulation | Yes | No | Manual |
| Token management | Yes | No | No |
| MCP compatible | Yes | No | No |
| Cross-session memory | Yes | No | No |
project/
├── .megg/
│ ├── info.md # Identity & rules (~200 tokens)
│ ├── knowledge.md # Accumulated learnings (permanent)
│ └── state.md # Session handoff (ephemeral)
# Project Name
## Context
Brief description of what this project is.
## Rules
1. Always do X
2. Never do Y
3. When Z, prefer A
## Memory Files
- knowledge.md: decisions, patterns, gotchas
---
## 2024-01-15 - JWT Auth Decision
**Type:** decision
**Topics:** auth, api, security
We chose JWT with refresh tokens because:
- Stateless authentication scales better
- Mobile apps need offline capability
- Refresh tokens provide security without constant re-auth
---
v1 tools still work but are deprecated:
| v1 | v1.1.0 |
|---|---|
awake() | context() |
recall() | context() |
remember() | learn() |
map() | Included in context() |
settle() | maintain() |
| - | state() (new in v1.1.0) |
megg makes AI agents behave like good employees who:
Every AI session starts fresh, but with megg, your agent remembers.
# Clone and install
git clone https://github.com/toruai/megg.git
cd megg
npm install
# Build
npm run build
# Run tests
npm test
# Verify everything works
./scripts/verify-install.sh
# Link for local testing (use sudo on Linux if needed)
npm link
megg --help
# Setup with symlinks (changes reflect immediately)
megg setup --link
Contributions welcome! Please read our contributing guidelines before submitting PRs.
MIT License - see LICENSE for details.
FAQs
megg - Memory for AI Agents. Simplified knowledge system with auto-discovery and size-aware loading.
The npm package megg receives a total of 10 weekly downloads. As such, megg popularity was classified as not popular.
We found that megg demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.