agentdb — Greenflagged

Self-learning vector memory for AI agents — single-file .rvf cognitive container with HNSW search, episodic Reflexion memory, causal graph + Cypher, 9 RL algorithms, Thompson Sampling bandit, 41 MCP tools, hybrid (BM25 + dense) retrieval, GNN attention. 1

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

ruvnet

Keywords

agentdbvector-databaseai-agentsmemorycausal-reasoningreflexionepisodic-memoryskill-librarylifelong-learningexplainable-aiprovenancehnswembeddingssqlitesql.jswasm

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:zod	AI (phantom-deps): Used transitively/config; declared dep, not a risk.	ai	2026/07/08
phantom-deps	phantom-dep:commander	AI (phantom-deps): CLI dep used in bundled dist; stable FP.	ai	2026/07/08
install-scripts	install-script:postinstall	AI (install-scripts): Postinstall rebuilds optional better-sqlite3 binding only; no remote code.	ai	2026/07/08
install-behavior	install-behavior:native-compile	AI (install-behavior): npm rebuild of optional native sqlite dep; documented install flow.	ai	2026/07/08
semgrep	semgrep:child-process-import	AI (semgrep): child_process used solely for local npm rebuild in postinstall.	ai	2026/07/08

Versions (showing 3 of 3)

Version	Deps	Published
1.6.1	7 / 5	2025-10-25
1.6.0	6 / 5	2025-10-25
1.5.9	6 / 5	2025-10-25

v1.6.1

3 findings

HIGH Install script compiles native code with a raw toolchain install-behavior

Detected raw native compilation in install lifecycle script(s): 'postinstall'.

HIGH Package has 'postinstall' script install-scripts

Script: node scripts/postinstall.cjs || true

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.6.0

3 findings

HIGH Install script compiles native code with a raw toolchain install-behavior

Detected raw native compilation in install lifecycle script(s): 'postinstall'.

HIGH Package has 'postinstall' script install-scripts

Script: node scripts/postinstall.cjs || true

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.5.9

3 findings

HIGH Install script compiles native code with a raw toolchain install-behavior

Detected raw native compilation in install lifecycle script(s): 'postinstall'.

HIGH Package has 'postinstall' script install-scripts

Script: node scripts/postinstall.cjs || true

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.