rutterSAFE
A record of what your AI sessions decided — and the receipts behind it. An MCP memory-of-use server over markdown notes: append-only, content-hashed, no model inside.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Recall past decisions and the notes your AI session cited.
An MCP (Model Context Protocol) server over a folder of markdown notes. As a session decides something, your client leaves one line about it. A hook stores that line, without rewriting it for style, in a dated file inside your notes folder, with the path and a content hash of each note it cited.
Weeks later you ask what you concluded, in the same AI tool or another one you have set up, and get the line back with its date and its notes. A note renamed without edits is followed by its hash. A reference rutter cannot place is shown as unresolved rather than dropped. A note changed in place is not flagged yet.
It suits people who keep markdown notes and are comfortable configuring an AI client. Start with docs/getting-started.md; Claude Code users can install the plugin in a few minutes.
There is no model inside it. It is code plus storage, so the reasoning stays in your client.
The name is from the age of sail: a rutter was the logbook of the routes actually sailed, as against the map. The map records what is known. The rutter records what you did about it.
A personal tool, published as a reference implementation — not a supported product. Built for one person's workflow and shared because the mechanism might be useful. No roadmap promises, no support commitment, no guarantee the next commit won't move something you depend on. Fork it, take the ideas, file an issue if you like. Please don't put anything load-bearing on top of it.
One memory across your AI tools
rutter keeps one set of records for Claude Code, Grok, Codex, and Antigravity. Each client writes its session summaries to the same notes folder. Each client reads them back through the same MCP server.
A decision you made in Codex on Tuesday is there when you ask Claude Code on Thursday, provided Codex wrote a line for it and its hook ran. You copy nothin
0e985eade4faOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add rutter -- npx -y [email protected]
{
"mcpServers": {
"rutter": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (4)
4 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
librarian-get-note | read | |
librarian-positions | read | |
librarian-recent | read | |
librarian-search | read |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (11)
.vale.ini
const result = captureSession({ summary: "absolute", refs: ["/etc/passwd"], now: NOON });assert.deepEqual(result.rejectedRefs, ["/etc/passwd"]);
const result = captureSession({ summary: "traversal", refs: ["../../../../etc/passwd"], now: NOON });assert.deepEqual(result.rejectedRefs, ["../../../../etc/passwd"]);
const result = captureSession({ summary: "smuggle", refs: ["[[../secret]] | ?run=1 &redirect=../../"], now: NOON });const cwd = `/tmp/x${LF}---${LF}admin: true/../../vault`;'[remote "origin"]\n\turl = https://evil.invalid/exfil.git\n',
@modelcontextprotocol/sdk, gray-matter, zod, @types/node, tsx, typescript
**7. Check recall.** Ask Codex *"What was I working on lately?"* It should call `librarian-recent` and report the session you just finished. If step 6 found the file but Codex says no sessions are rec
- The server-level `instructions` direct clients to report recalled session
Gates applied: no_behavioural_pass.
0e985eade4fafull audit observations/trust-audit/mcp-server/shinytoyrobots__rutter.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 0e985eade4fa | SAFE | B | 89 | first audit |
Questions
What is the rutter MCP server?
A record of what your AI sessions decided — and the receipts behind it. An MCP memory-of-use server over markdown notes: append-only, content-hashed, no model inside.
What tools does rutter expose?
4 in total: 4 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is rutter safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does rutter need?
No credential environment variables were found in its source, so it appears to need none.
How does rutter run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as rutter at 0.5.0.
How current is this page?
The grade is for one exact copy of the source (0e985eade4fa), read on 2026-10-11. The repository is watched and re-audited when it changes.