
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Version 1.12.x · Semantic Search · MCP Compatible · Node.js
Give your AI agents an always-updated, queryable memory of any codebase – with intelligent semantic search and automatic learning – in one npx command.
🇪🇸 Versión en Español | 🇺🇸 English Version | 🤖 Agent Version
🎯 Scoped Search Filters - Filter by path_glob, tags, lang for precise results
🔄 Hybrid Search - BM25 + Vector fusion with reciprocal rank blending (enabled by default)
🧠 Cross-Encoder Re-Ranker - Transformers.js reranker for precision boosts
👀 File Watcher - Real-time incremental indexing with Merkle-like hashing
📦 Context Packs - Reusable search scopes with CLI + MCP integration
🛠️ Multi-Project CLI - --project and --directory aliases for clarity
🏆 Performance Analysis - Architectural comparison with general-purpose IDE tools
Major improvements:
Large language model agents can read thousands of tokens, but projects easily reach millions of characters. Without an intelligent retrieval layer, agents:
vendor/, node_modules/...)PAMPA solves this by turning your repository into a semantic code memory graph:
pampa.codemap.json commits to git so context follows the repoAny MCP-compatible agent (Cursor, Claude, etc.) can now search with natural language, get instant responses for learned patterns, and stay synchronized – without scanning the entire tree.
🤖 If you're an AI agent: Read the complete setup guide for agents → or 👤 If you're human: Share the agent setup guide with your AI assistant to automatically configure PAMPA!
PAMPA automatically extracts semantic tags from your code without any special comments:
// File: app/Services/Payment/StripeService.php
function createCheckoutSession() { ... }
Automatic tags: ["stripe", "service", "payment", "checkout", "session", "create"]
The system learns from successful searches and provides instant responses:
# First search (vector search)
"stripe payment session" → 0.9148 similarity
# System automatically learns and caches this pattern
# Next similar searches are instant:
"create stripe session" → instant response (cached)
"stripe checkout session" → instant response (cached)
"create" = "crear", "session" = "sesion""[PROVIDER] payment session"Enhance search precision with optional JSDoc-style comments:
/**
* @pampa-tags: stripe-checkout, payment-processing, e-commerce-integration
* @pampa-intent: create secure stripe checkout session for payments
* @pampa-description: Main function for handling checkout sessions with validation
*/
async function createStripeCheckoutSession(sessionData) {
// Your code here...
}
Benefits:
| Search Type | Without @pampa | With @pampa | Improvement |
|---|---|---|---|
| Domain-specific | 0.7331 | 0.8874 | +21% |
| Intent matching | ~0.6 | 1.0000 | +67% |
| General search | 0.6-0.8 | 0.8-1.0 | +32-85% |
PAMPA can index and search code in several languages out of the box:
.js, .ts, .tsx, .jsx).php).py).go).java)Add to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json on macOS):
{
"mcpServers": {
"pampa": {
"command": "npx",
"args": ["-y", "pampa", "mcp"]
}
}
}
Optional: Add "--debug" to args for detailed logging: ["-y", "pampa", "mcp", "--debug"]
Configure Cursor by creating or editing the mcp.json file in your configuration directory:
{
"mcpServers": {
"pampa": {
"command": "npx",
"args": ["-y", "pampa", "mcp"]
}
}
}
Your AI agent should automatically:
get_project_statsindex_project if neededupdate_project after changesNeed to index manually? See Direct CLI Usage section.
Additionally, install this rule in your application so it uses PAMPA effectively:
Copy the content from RULE_FOR_PAMPA_MCP.md into your agent or AI system instructions.
Once configured, your AI agent can:
🔍 Search: "authentication function"
📄 Get code: Use the SHA from search results
📊 Stats: Get project overview and statistics
🔄 Update: Keep memory synchronized
For direct terminal usage or manual project indexing:
# Run without installing
npx pampa --help
# Or install globally (requires Node.js 20+)
npm install -g pampa
# Index current repository with the best available provider
npx pampa index
# Force the local CPU embedding model (no API keys required)
npx pampa index --provider transformers
# Re-embed after code changes
npx pampa update
# Inspect indexed stats at any time
npx pampa info
Indexing writes
.pampa/(SQLite database + chunk store) andpampa.codemap.json. Commit the codemap to git so teammates and CI re-use the same metadata.
| Command | Purpose |
| ---------------------------------------- | -------------------------------------------------------- | ----- | ------------------------------------------------- |
| npx pampa index [path] [--provider X] | Create or refresh the full index at the provided path |
| npx pampa update [path] [--provider X] | Force a full re-scan (helpful after large refactors) |
| npx pampa watch [path] [--provider X] | Incrementally update the index as files change |
| npx pampa search <query> | Hybrid BM25 + vector search with optional scoped filters |
| npx pampa context <list | show | use> | Manage reusable context packs for search defaults |
| npx pampa mcp | Start the MCP stdio server for editor/agent integrations |
pampa search supports the same filters used by MCP clients. Combine glob patterns, semantic tags, language filters, provider overrides, and ranking controls:
| Flag / option | Effect |
| --------------------- | --------------------------------------------------------------------- | --------------- |
| --path_glob | Limit results to matching files ("app/Services/**") |
| --tags | Filter by codemap tags (stripe, checkout) |
| --lang | Filter by language (php, ts, py) |
| --provider | Override embedding provider for the query (openai, transformers) |
| --reranker | Reorder top results with the Transformers cross-encoder (off | transformers) |
| --hybrid / --bm25 | Toggle reciprocal-rank fusion or the BM25 candidate stage (on | off) |
| --symbol_boost | Toggle symbol-aware ranking boost that favors signature matches (on | off) |
| -k, --limit | Cap returned results (defaults to 10) |
# Narrow to service files tagged stripe in PHP
npx pampa search "create checkout session" --path_glob "app/Services/**" --tags stripe --lang php
# Use OpenAI embeddings but keep hybrid fusion enabled
npx pampa search "payment intent status" --provider openai --hybrid on --bm25 on
# Reorder top candidates locally
npx pampa search "oauth middleware" --reranker transformers --limit 5
# Disable signature boosts for literal keyword hunts
npx pampa search "token validation" --symbol_boost off
PAMPA extracts function signatures and lightweight call graphs with tree-sitter. When symbol boosts are enabled, queries that mention a specific method, class, or a directly connected helper will receive an extra scoring bump.
When a context pack is active, the CLI prints the pack name before executing the search. Any explicit flag overrides the pack defaults.
Store JSON packs in .pampa/contextpacks/*.json to capture reusable defaults:
// .pampa/contextpacks/stripe-backend.json
{
"name": "Stripe Backend",
"description": "Scopes searches to the Stripe service layer",
"path_glob": ["app/Services/**"],
"tags": ["stripe"],
"lang": ["php"],
"reranker": "transformers",
"hybrid": "off"
}
# List packs and highlight the active one
npx pampa context list
# Inspect the full JSON definition
npx pampa context show stripe-backend
# Activate scoped defaults (flags still win if provided explicitly)
npx pampa context use stripe-backend
# Clear the active pack (use "none" or "clear")
npx pampa context use clear
MCP tip: The MCP tool use_context_pack mirrors the CLI. Agents can switch packs mid-session and every subsequent search_code call inherits those defaults until cleared.
# Watch the repository with a 750 ms debounce and local embeddings
npx pampa watch --provider transformers --debounce 750
The watcher batches filesystem events, reuses the Merkle hash store in .pampa/merkle.json, and only re-embeds touched files. Press Ctrl+C to stop.
npm run bench
The harness seeds a deterministic Laravel + TypeScript corpus and prints a summary table with Precision@1, MRR@5, and nDCG@10 for Base, Hybrid, and Hybrid+Cross-Encoder modes. Customise scenarios via flags or environment variables:
npm run bench -- --hybrid=off – run vector-only evaluationnpm run bench -- --reranker=transformers – force the cross-encoderPAMPA_BENCH_MODES=base,hybrid npm run bench – limit to specific modesPAMPA_BENCH_BM25=off npm run bench – disable BM25 candidate generationBenchmark runs never download external models when PAMPA_MOCK_RERANKER_TESTS=1 (enabled by default inside the harness).
An end-to-end context pack example lives in examples/contextpacks/stripe-backend.json.
PAMPA supports multiple providers for generating code embeddings:
| Provider | Cost | Privacy | Installation |
|---|---|---|---|
| Transformers.js | 🟢 Free | 🟢 Total | npm install @xenova/transformers |
| Ollama | 🟢 Free | 🟢 Total | Install Ollama + npm install ollama |
| OpenAI | 🔴 ~$0.10/1000 functions | 🔴 None | Set OPENAI_API_KEY |
| Cohere | 🟡 ~$0.05/1000 functions | 🔴 None | Set COHERE_API_KEY + npm install cohere-ai |
Recommendation: Use Transformers.js for personal development (free and private) or OpenAI for maximum quality.
PAMPA v1.12 uses a specialized architecture for semantic code search with measurable results.
Synthetic Benchmark Results:
| Setting | P@1 | MRR@5 | nDCG@10 |
| ---------- | ----- | ----- | ------- |
| Base | 0.750 | 0.833 | 0.863 |
| Hybrid | 0.875 | 0.917 | 0.934 |
| Hybrid+CE | 1.000 | 0.958 | 0.967 |
# Search for authentication functions
pampa search "user authentication"
→ AuthController::login, UserService::authenticate, etc.
# Search for payment processing
pampa search "payment processing"
→ PaymentService::process, CheckoutController::create, etc.
# Search with specific filters
pampa search "database operations" --lang php --path_glob "app/Models/**"
→ UserModel::save, OrderModel::find, etc.
Result: Optimized architecture for semantic code search with verifiable metrics.
┌──────────── Repo (git) ─────────-──┐
│ app/… src/… package.json etc. │
│ pampa.codemap.json │
│ .pampa/chunks/*.gz(.enc) │
│ .pampa/pampa.db (SQLite) │
└────────────────────────────────────┘
▲ ▲
│ write │ read
┌─────────┴─────────┐ │
│ indexer.js │ │
│ (pampa index) │ │
└─────────▲─────────┘ │
│ store │ vector query
┌─────────┴──────────┐ │ gz fetch
│ SQLite (local) │ │
└─────────▲──────────┘ │
│ read │
┌─────────┴──────────┐ │
│ mcp-server.js │◄─┘
│ (pampa mcp) │
└────────────────────┘
| Layer | Role | Technology |
|---|---|---|
| Indexer | Cuts code into semantic chunks, embeds, writes codemap and SQLite | tree-sitter, openai@v4, sqlite3 |
| Codemap | Git-friendly JSON with {file, symbol, sha, lang} per chunk | Plain JSON |
| Chunks dir | .gz code bodies (or .gz.enc when encrypted) (lazy loading) | gzip → AES-256-GCM when enabled |
| SQLite | Stores vectors and metadata | sqlite3 |
| MCP Server | Exposes tools and resources over standard MCP protocol | @modelcontextprotocol/sdk |
| Logging | Debug and error logging in project directory | File-based logs |
The MCP server exposes these tools that agents can use:
search_codeSearch code semantically in the indexed project.
query (string) - Semantic search query (e.g., "authentication function", "error handling")limit (number, optional) - Maximum number of results to return (default: 10)provider (string, optional) - Embedding provider (default: "auto")path (string, optional) - PROJECT ROOT directory path where PAMPA database is located{path}/.pampa/pampa.dbget_code_chunkGet complete code of a specific chunk.
sha (string) - SHA of the code chunk to retrieve (obtained from search_code results)path (string, optional) - PROJECT ROOT directory path (same as used in search_code){path}/.pampa/chunks/{sha}.gz or {sha}.gz.encindex_projectIndex a project from the agent.
path (string, optional) - PROJECT ROOT directory path to index (will create .pampa/ subdirectory here)provider (string, optional) - Embedding provider (default: "auto"){path}/.pampa/pampa.db (SQLite database with embeddings){path}/.pampa/chunks/ (compressed code chunks){path}/pampa.codemap.json (lightweight index for version control)update_project🔄 CRITICAL: Use this tool frequently to keep your AI memory current!
Update project index after code changes (recommended workflow tool).
path (string, optional) - PROJECT ROOT directory path to update (same as used in index_project)provider (string, optional) - Embedding provider (default: "auto")get_project_statsGet indexed project statistics.
path (string, optional) - PROJECT ROOT directory path where PAMPA database is located{path}/.pampa/pampa.dbpampa://codemapAccess to the complete project code map.
pampa://overviewSummary of the project's main functions.
analyze_codeTemplate for analyzing found code with specific focus.
find_similar_functionsTemplate for finding existing similar functions.
npx, no Python, no Docker| Idea | Hint |
|---|---|
| More languages | Install tree-sitter grammar and add it to LANG_RULES |
| Custom embeddings | Export OPENAI_API_KEY or switch OpenAI for any provider that returns vector: number[] |
| Security | Run behind a reverse proxy with authentication |
| VS Code Plugin | Point an MCP WebView client to your local server |
PAMPA can encrypt chunk bodies at rest using AES-256-GCM. Configure it like this:
Export a 32-byte key in base64 or hex form:
export PAMPA_ENCRYPTION_KEY="$(openssl rand -base64 32)"
Index with encryption enabled (skips plaintext writes even if stale files exist):
npx pampa index --encrypt on
Without --encrypt, PAMPA auto-encrypts when the environment key is present. Use --encrypt off to force plaintext (e.g., for debugging).
All new chunks are stored as .gz.enc and require the same key for CLI or MCP chunk retrieval. Missing or corrupt keys surface clear errors instead of leaking data.
Existing plaintext archives remain readable, so you can enable encryption incrementally or rotate keys by re-indexing.
feat/...)npm test (coming soon) & npx pampa index before PRAll discussions on GitHub Issues.
MIT – do whatever you want, just keep the copyright.
Happy hacking! 💙
🇦🇷 Made with ❤️ in Argentina | 🇦🇷 Hecho con ❤️ en Argentina
FAQs
PAMPA – Protocol for Augmented Memory of Project Artifacts (MCP compatible)
We found that pampa demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.