Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/komluk/scaffolding/memorygit clone --depth 1 https://github.com/komluk/scaffoldingWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.01227 |
| Opus 5 | $0.00000 | $0.00613 |
| Sonnet 5 | $0.00000 | $0.00245 |
| Haiku 4.5 | $0.00000 | $0.00123 |
Grade C, and why
memory scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
chmod 700 "$HOME/.claude/hooks/refresh-mcp-token.sh" Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
python3 - "$HOME/.claude/settings.json" <<'PY' How it starts
The opening of the file, as written. The whole thing — 106 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/memory Command
Manage cross-device semantic memory for scaffolding (self-hosted mem0 + pgvector, Ollama on GPU). Opt-in, per-device. Memory is off by default — nothing is wired until you enable it.
Usage
/memory enable # wire the memory MCP backend into Claude Code (user scope)
/memory disable # remove it from this device (stored memories on the backend are kept)
/memory status # show whether it's wired and reachable
The assistant reads the argument (enable / disable / status; default: status) and
performs the matching section below.
enable
Connects this device so scaffolding agents gain persistent memory via the
semantic_search / semantic_recall / semantic_store tools (see the
semantic-memory-mcp and semantic-memory-store skills). The token is personal —
memory is yours only; anyone without it gets 401.
- Check the token is in the environment:
test -n "${MEMORY_MCP_TOKEN:-}" || echo "MEMORY_MCP_TOKEN not set — export it (e.g. from Vault: export MEMORY_MCP_TOKEN=$(vault kv get -field=token kv/memory/mcp)) and re-run" - Register the MCP server (user scope; default endpoint = homelab backend, override
with
MEMORY_MCP_URL):
(The literalclaude mcp add --scope user --transport http memory \ "${MEMORY_MCP_URL:-http://memory.bernardynska.waw.pl:8000/mcp}" \ --header "Authorization: Bearer \${MEMORY_MCP_TOKEN}"${MEMORY_MCP_TOKEN}is stored and expanded at runtime — the token is never written to disk.) - Verify:
claude mcp list | grep memory - (Optional) Wire token auto-refresh from Vault. Offer this only if the user wants
the token kept fresh per-device without manual re-export. It installs a SessionStart
hook (shipped with the plugin) into user settings — opt-in, never an always-on
plugin hook:
It re-pullsmkdir -p "$HOME/.claude/hooks" cp "${CLAUDE_PLUGIN_ROOT}/hooks/refresh-mcp-token.sh" "$HOME/.claude/hooks/refresh-mcp-token.sh" chmod 700 "$HOME/.claude/hooks/refresh-mcp-token.sh" python3 - "$HOME/.claude/settings.json" <<'PY' import json, os, sys p = sys.argv[1] d = json.load(open(p)) if os.path.exists(p) else {} cmd = "$HOME/.claude/hooks/refresh-mcp-token.sh" ss = d.setdefault("hooks", {}).setdefault("SessionStart", []) if not any(h.get("command") == cmd for e in ss for h in e.get("hooks", [])): ss.append({"matcher": "", "hooks": [{"type": "command", "command": cmd, "timeout": 30}]}) json.dump(d, open(p, "w"), indent=2); open(p, "a").write("\n") print("auto-refresh hook installed") else: print("auto-refresh hook already present") PYMEMORY_MCP_TOKENfrom Vault (kv/memory/mcp) each session and keepssettings.jsontopped up. Requires thevaultCLI + a valid login; a clean no-op without them. Skip if the token is supplied another way (e.g. theclaude()shell wrapper). Takes effect next session. - Tell the user to restart Claude Code so the server + token load and connect. After
restart,
mcp__memory__*tools are available and skills use them automatically.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 106 lines · 0 tokens per session scan C cfa3723ba0bf
memory is a command published in the GitHub repository komluk/scaffolding (15 stars, last pushed 27d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,227 tokens. A static security scan graded it C with 2 findings (asks for root, reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
auto
Intent-classified router, the front door to OrchestKit and the DEFAULT entry point for any goal-shaped request. Classifies a plain-English goal and routes it to the right specialist skill. Routing is never overhead, so use it even when the target skill seems obvious; skip only when already executing inside another…
design-to-code
Mockup-to-component pipeline using Google Stitch, 21st.dev, and Storybook MCP. Accepts a screenshot, a description, or a URL and produces production-ready React components, checking existing Storybook components before generating anything new. Use when implementing UI from a mockup or screenshot. To call the MCP tool…
brand-setup
Configure a new brand profile with colors, fonts, logo, visual style, platforms, and compliance rules.
save
Save this conversation as a new or existing reusable context.
graphify
Turn your vault into a clustered knowledge graph with HTML and JSON outputs.
screens
Structures product UX screen design — inventory, flow, states, and reusable briefs for external design tools — without generating pixels or UI code.