wordcellCAUTION
Wordcell keeps decisions, plans, and sources as Markdown beside your code, so coding agents can find them from the file they are about to change.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
🧠 Wordcell hands the next agent session what this one learned. Decisions, plans, and sources live as Markdown files beside your code. Tie a note to the paths it explains, and an agent about to change that code gets the note first. Search matches exact words or meaning, with an optional local model, and every index rebuilds from files you can read in any editor. Ask your agent to set it up: https://wordcell.io
[](https://github.com/hraness/wordcell/tree/main/skills/wordcell)
Wordcell is a Markdown knowledge base and local MCP memory server for coding agents such as Claude Code, Codex, and Cursor. It keeps decisions, plans, and sources as Markdown files beside your code, and agents find them by exact words, by meaning with an optional local model, or from the file they are about to change.
A new coding-agent session needs the reasons behind the code it is changing. Wordcell keeps the decision, its supporting sources, and the plan that puts it into practice in a connected set of Markdown files. Tie a note to a repository path, and the next agent can recover that context before it edits the file. When an assumption changes, update the decision and keep its earlier reasoning in Git.
Captured sources preserve what you read, maintained notes explain what you currently understand, and plans record the work and its results. Named relationships such as evidenced-by and supersedes make those connections available to the embedded Oh graph engine, whose results point back to the supporting files. Optional local semantic search helps when the words in a question differ from the note; Git history connects the explanation to its commits and accompanying code changes.
Use the CLI, local MCP server, or TypeScript SDK from your existing agent and editor. The public Agent Skill teaches agents to recover context, maintai
30d765618f5dOBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add story-film --env KB_TLS_FIXTURE_KEY=${KB_TLS_FIXTURE_KEY} --env NEXT_PUBLIC_POSTHOG_KEY=${NEXT_PUBLIC_POSTHOG_KEY} --env WORDCELL_OBJECTS_SECRET=${WORDCELL_OBJECTS_SECRET} -- npx -y story-film{
"mcpServers": {
"story-film": {
"command": "npx",
"args": [
"-y",
"story-film"
],
"env": {
"KB_TLS_FIXTURE_KEY": "${KB_TLS_FIXTURE_KEY}",
"NEXT_PUBLIC_POSTHOG_KEY": "${NEXT_PUBLIC_POSTHOG_KEY}",
"WORDCELL_OBJECTS_SECRET": "${WORDCELL_OBJECTS_SECRET}"
}
}
}
}Exposed tools (14)
7 read · 6 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
add_relation | write | Add a typed relation from one note to another in the source note |
backlinks | read | Notes that link to this note, with the linking edges and authored relations. |
context | write | Agent guides, context notes, and repository memory records that apply to a file or directory |
create_note | write | Create a new Markdown note with frontmatter. Never overwrites: an existing note is an error. |
create_token | write | Mint a wc_pub_ capability token (self-serve, IP-limited). The token is |
delete_site | destructive | Unpublish a site conditionally and retain a deletion receipt. Shared artifact bytes remain stored. |
get_note | read | Read one note as frontmatter, body, and revision. Pass revision as expected_revision to |
get_site | read | Read the current site revision, or reconcile an operation ID after an uncertain write. Requires Bearer wc_pub_ authorization. |
links | read | Notes linked from or to this note, with the edges and authored relations between them. |
list_notes | read | List notes with their frontmatter, filtered by frontmatter fields, tags, and repository scopes. |
list_sites | read | List the token |
publish_site | write | Publish a bounded Markdown vault as a public site. files maps vault |
search | read | Search the vault. Hybrid mode joins exact matches with local semantic search (QMD); each hit keeps |
update_note_body | write | Replace the Markdown after a note |
Trust audit
CAUTIONgrade D · trust 60/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (6 observation(s))
- Network
- declared (4 observation(s))
- Shell
- declared (3 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
publish-graph.ts
url: `http://127.0.0.1:${address.port}`,let encoded = "1f8b08000000000002ffedc13101000000c2a0da8b6f0c1fa0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
const secret = "super-secret-cookie-value";
const secret = "do-not-leak-this-value";
token: "11111111-1111-4111-8111-111111111111",
token: "22222222-2222-4222-8222-222222222222",
delete_site
publish.ts
return createHash("sha1").update(bytes).digest("hex");return createHash("sha1").update(bytes).digest("hex");const actualShasum = createHash("sha1").update(archiveBytes).digest("hex");const actualShasum = createHash("sha1").update(archiveBytes).digest("hex");this.objects.set(key, { bytes, etag: `"${createHash("md5").update(bytes).digest("hex")}"`, contentType });import { apiOk, apiUnavailable } from "../../../../lib/hosted/errors";import { hostedConfig } from "../../../../lib/hosted/config";import { ObjectStore } from "../../../../lib/hosted/store";import { HOSTED_PACKAGE_VERSION } from "../../../../lib/hosted/reader.generated";import { apiError } from "../../../../lib/hosted/errors";resolveHostname: () => Promise.resolve([publicAddress, { address: "169.254.169.254", family: 4 }]),Open `http://127.0.0.1:8080`. You get readable pages, linked notes, and search
Open `http://127.0.0.1:8080` to read the two pages and search them in the
Open `http://127.0.0.1:8080` to inspect the pages. Nothing is publicly hosted
for (const origin of ["http://127.0.0.1:1","http://127.0.0.1:12345","http://127.0.0.1:65535"]) {"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA3MjAgNDcxIiB3aWR0aD0iNzIwIiBoZWlnaHQ9IjQ3MSI+CiAgPHBhdGggZD0iTTAgMCBDMS4wMDUxIC0wLjAwNTQgMi4wMTAzIC0wL
Gates applied: no_behavioural_pass.
30d765618f5dfull audit observations/trust-audit/mcp-server/hraness__wordcell.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | 30d765618f5d | CAUTION | D | 60 | first audit |
Questions
What is the wordcell MCP server?
Wordcell keeps decisions, plans, and sources as Markdown beside your code, so coding agents can find them from the file they are about to change.
What tools does wordcell expose?
14 in total: 7 read-only, 6 that write, and 1 that can delete or overwrite (delete_site). Every one is listed on this page with its risk.
Is wordcell safe to connect to an agent?
With care. The audit graded it D (60/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does wordcell need?
It reads KB_TLS_FIXTURE_KEY, NEXT_PUBLIC_POSTHOG_KEY and WORDCELL_OBJECTS_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does wordcell run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as story-film.
How current is this page?
The grade is for one exact copy of the source (30d765618f5d), read on 2026-10-10. The repository is watched and re-audited when it changes.