LLM WikiCAUTION
Open Source Implementation of Karpathy's LLM Wiki. Upload documents, connect your Claude account via MCP, and have it write your wiki !
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
An autonomous, self-maintaining personal Wikipedia built and maintained by AI.
[](https://opensource.org/licenses/Apache-2.0)
LLM Wiki transforms your scattered reading and research into a persistent, AI-maintained second brain. Capture documents, notes, and web clippings as you work, and deploy a nightly Claude Routine to autonomously synthesize those sources into a permanent knowledge base. Because the clipper captures your highlights and margin notes alongside the source, the wiki becomes a record of not just what you read but what you thought about it — one that compounds over months and years, long after the original context would have faded. This architecture is heavily inspired by Andrej Karpathy's LLM Wiki concept, with an increased emphasis on autonomous maintenance.
LLM Wiki is designed to work at three distinct scales:
- For you — a personal Wikipedia of what you've read that you don't have to remember to update.
- For your AI — a context layer for LLMs to apply your own mental models when working with you.
- For your organization — most organizations have poor institutional memory, because know-how generally lives in people's heads. We hope companies will consider adopting this model to build a self-maintaining institutional knowledge layer.
Features
- Connect via MCP Connect Claude.ai, Claude Cowork, Claude Code, or Codex (or any other MCP-compatible app)
- A Chrome extension Clip webpages and PDFs as you read, highlight key sections, and leave comments that Claude can see over MCP.
- Uploads Markdown, PowerPoint, PDFs, Word documents, and more.
- A clean Next.js web app to navigate your own wikipedia — and view the un
33c6624f5a10OBSERVED · 2026-09-24Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add llmwiki-web --env AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} --env AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} --env CONVERTER_SECRET=${CONVERTER_SECRET} --env LOGFIRE_TOKEN=${LOGFIRE_TOKEN} -- npx -y llmwiki-web{
"mcpServers": {
"llmwiki-web": {
"command": "npx",
"args": [
"-y",
"llmwiki-web"
],
"env": {
"AWS_ACCESS_KEY_ID": "${AWS_ACCESS_KEY_ID}",
"AWS_SECRET_ACCESS_KEY": "${AWS_SECRET_ACCESS_KEY}",
"CONVERTER_SECRET": "${CONVERTER_SECRET}",
"LOGFIRE_TOKEN": "${LOGFIRE_TOKEN}"
}
}
}
}Exposed tools (2)
2 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
guide | read | user_id = get_user_id(ctx) |
ping | read | return |
Trust audit
CAUTIONgrade B · trust 83/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (25)
text = text.replace("", "").replace("", "").replace("\xa0", " ")const ZERO_WIDTH_RE = /[]/g
return ch === '' || ch === ''
digest = hashlib.sha1(content.encode()).hexdigest()[:8]
result = instance.write_to_disk("/../../../", "evil.md", "pwned")filename="../../bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb/secret.pdf",
path="/../../bob/",
assert _sanitize_filename("../../etc/passwd") == "passwd.pdf""internal.test": ["169.254.169.254"],
@pytest.mark.parametrize("ip", ["127.0.0.1", "169.254.169.254", "10.0.0.5", "192.168.1.1", "::1"])(socket.AF_INET, socket.SOCK_STREAM, 6, "", ("169.254.169.254", 0)),return [(socket.AF_INET, socket.SOCK_STREAM, 6, "", ("169.254.169.254", 0))]result = await webclip_assets._fetch_remote_image("http://169.254.169.254/latest/meta-data/")expect(isAllowedApiFetchUrl("http://127.0.0.1:8000/v1/knowledge-bases", apiUrl)).toBe(false);result = await webclip_assets._fetch_remote_image("http://169.254.169.254/latest/meta-data/")value = b64decode(parts[1]).decode("utf-8")img_bytes = base64.b64decode(img_b64)
return base64.b64decode(b64), fmt
data = base64.b64decode(payload, validate=True)
png_bytes = _b64.b64decode(png_1x1)
expect(normalizeAnchorText(' hello world\n\t!')).toBe('hello world !')idna
idna
starlette, idna
idna
Gates applied: no_behavioural_pass.
33c6624f5a10full audit observations/trust-audit/mcp-server/lucasastorian__llm-wiki-1.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-09-24 | 33c6624f5a10 | CAUTION | B | 83 | first audit |
Questions
What is the LLM Wiki MCP server?
Open Source Implementation of Karpathy's LLM Wiki. Upload documents, connect your Claude account via MCP, and have it write your wiki !
What tools does LLM Wiki expose?
2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is LLM Wiki safe to connect to an agent?
With care. The audit graded it B (83/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does LLM Wiki need?
It reads AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, CONVERTER_SECRET, LOGFIRE_TOKEN, NEXT_PUBLIC_SUPABASE_ANON_KEY and SUPABASE_JWT_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does LLM Wiki run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as llmwiki-web.
How current is this page?
The grade is for one exact copy of the source (33c6624f5a10), read on 2026-09-24. The repository is watched and re-audited when it changes.