llm-wiki-compilerBLOCK
The knowledge compiler. Raw sources in, interlinked wiki out. Inspired by Karpathy's LLM Wiki pattern.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/atomicstrata/llm-wiki-compiler/actions/workflows/ci.yml) [](https://www.npmjs.com/package/llm-wiki-compiler) [](https://llmwiki.atomicstrata.ai) [](LICENSE)
New in 1.4.0 — Review answers before publishing.
- Choose what becomes part of your wiki. Review generated answers and check their citations before saving them as published pages.
- Approve pages together. Review a batch of generated pages and publish the ones you choose in one operation.
- See the pages behind an answer. Follow citations back to your wiki and see which pages were used to answer your question.
Release notes · Upgrade guide · Install llmwiki
New in 1.3 — A fresh look for your wiki.
Meet Scientific Clay, with soft surfaces and rounded typography, and Minimal, which follows your system’s light or dark setting. Switch instantly between four themes, including Nebula Light and Dark.
Scientific ClayMinimal
The same page in a demonstration wiki. Click either screenshot for a closer look.
Recursive sour
1d695722f78aOBSERVED · 2026-10-14Exposed tools (27)
23 read · 4 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
compile_wiki | read | |
describe_workflow_action | read | |
export_okf | read | |
extract | read | Extract |
extract_concepts | read | Extract knowledge concepts from a source document |
extract_rules | read | Extract machine-actionable workflow rules from a source document. |
get_context_pack | read | |
get_weather | read | Get the weather for a city |
import_okf | write | |
ingest_source | read | |
judge_citation | read | Rate how well the source excerpt supports the claim. |
lint_wiki | read | |
list_workflow_actions | read | |
query_wiki | read | |
read_page | read | |
return_value | read | Return one string value |
run_eval | write | |
run_workflow_action | write | |
search | read | Search documents |
search_pages | read | |
select_pages | read | Select the most relevant wiki pages to answer a question |
t | read | d |
tool_a | read | First tool |
tool_b | read | Second tool |
verify_artifact | read | |
wiki_status | read | |
workflow_run_status | write |
Trust audit
BLOCKgrade F · trust 44/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | FAIL |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (7 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
payload-store.ts
page-payload.ts
return (yaml.load(raw) as ThresholdConfig) ?? {};const parsed = isJson ? JSON.parse(content) : yaml.load(content);
const parsed = yaml.load(match[1]);
const output = await exec(process.execPath, [path.resolve(cli), ...arguments_], {const { stdout } = await exec(process.execPath, [resolveTsupCli()], {const SECRET = "OUTSIDE-INDEX-SECRET-3b91";
const SECRET = "OUTSIDE-SECRET-BYTES-7f3a9c";
const secret = "TOP-SECRET-OUTSIDE-BYTES";
const secret = "OUTSIDE_SECRET-parent-symlink";
relation-evidence-contract.test.ts
.fallowrc.json
.atlas-analysis.json
.mintignore
provider-payload.ts
lifecycle-audit-payload.test.ts
payload-store.test.ts
return { frontmatter: yaml.load(match[1]) as SkillFrontmatter, body: match[2] };const { stdout, stderr } = await exec(process.execPath, [CLI, ...args], {await exec(process.execPath, [resolveTsupCli()], { cwd: path.resolve(".") });const FORBIDDEN_BODY = { command: "rm -rf /", absolutePath: "/etc/passwd", expression: "eval(x)", writablePath: "../../x" };expect(render("[a](vscode://file//Users/anyone/.ssh/id_rsa)")).not.toMatch(/href=["']?vscode:/i);index: "../../src/core-index.ts",
"compiler-cli": "../../src/compiler-cli.ts",
Gates applied: no_behavioural_pass.
1d695722f78afull audit observations/trust-audit/mcp-server/atomicstrata__llm-wiki-compiler.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-14 | 1d695722f78a | BLOCK | F | 44 | first audit |
Questions
What is the llm-wiki-compiler MCP server?
The knowledge compiler. Raw sources in, interlinked wiki out. Inspired by Karpathy's LLM Wiki pattern.
What tools does llm-wiki-compiler expose?
27 in total: 23 read-only, 4 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is llm-wiki-compiler safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (44/100) and found 7 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does llm-wiki-compiler need?
It reads ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, ATLASCLOUD_API_KEY, ATLAS_CLOUD_API_KEY, FIXTURE_KEY, GITHUB_TOKEN, LLMWIKI_TEST_PROVIDER_TASK6_SECRET, MINIMAX_API_KEY, OPENAI_API_KEY, ORCAROUTER_API_KEY, READINESS_FIXTURE_KEY and VOYAGE_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does llm-wiki-compiler run?
It speaks stdio, so it runs as a local process your client starts.
How current is this page?
The grade is for one exact copy of the source (1d695722f78a), read on 2026-10-14. The repository is watched and re-audited when it changes.