Skillget

rifugio--community

mcp
Security Audit
Fail
Health Warn
  • License — License: Apache-2.0
  • Description — Repository has a description
  • Active repo — Last push 0 days ago
  • Low visibility — Only 8 GitHub stars
Code Fail
  • exec() — Shell command execution in apps/api/books.js
  • fs.rmSync — Destructive file system operation in apps/api/books.js
  • fs module — File system access in apps/api/books.js
  • exec() — Shell command execution in apps/api/buckets.js
  • process.env — Environment variable access in apps/api/buckets.js
  • network request — Outbound network request in apps/api/buckets.js
  • exec() — Shell command execution in apps/api/chat-digest.js
  • process.env — Environment variable access in apps/api/chat-digest.js
  • fs module — File system access in apps/api/chat-digest.js
  • network request — Outbound network request in apps/api/chat-digest.js
  • process.env — Environment variable access in apps/api/dedup.js
  • exec() — Shell command execution in apps/api/embedding.js
  • process.env — Environment variable access in apps/api/embedding.js
  • network request — Outbound network request in apps/api/embedding.js
  • exec() — Shell command execution in apps/api/health.js
  • child_process — Shell command execution capability in apps/api/image.js
  • fs.rmSync — Destructive file system operation in apps/api/image.js
  • process.env — Environment variable access in apps/api/image.js
  • fs module — File system access in apps/api/image.js
  • network request — Outbound network request in apps/api/image.js
  • process.env — Environment variable access in apps/api/mcp-health.js
  • process.env — Environment variable access in apps/api/mcp-image.js
  • fs module — File system access in apps/api/mcp-image.js
  • network request — Outbound network request in apps/api/mcp-image.js
  • exec() — Shell command execution in apps/api/mcp-memory.js
  • process.env — Environment variable access in apps/api/mcp-memory.js
Permissions Pass
  • Permissions — No dangerous permissions requested

No AI report is available for this listing yet.

SUMMARY

我们的港湾

README.md

Rifugio Community

A self-hostable home for AI conversations, long-term memory, and MCP tools.

This is a clean-room community edition: application code and empty templates only. Production memories, chat logs, health data, media, credentials, private domains, and private Git history do not belong here.

What stays private

  • .env: credentials and cryptographic secrets
  • private/profile.json: names and relationship identity
  • private/features.json: optional personal integrations
  • private/persona.md: optional private persona prompt
  • data/: SQLite databases and generated files

All of them are ignored by Git.

Quick start (computer or NAS)

node scripts/setup.mjs
# edit private/profile.json
npm run privacy:scan
docker compose up -d --build

Open http://localhost:8080. The API creates empty databases and schemas on first start. Its health endpoint performs a rolled-back SQLite read/write probe, so it verifies storage without leaving test data.

Android phone-only hosting is documented in Termux deployment. See deployment, architecture, and the safe publishing checklist.

Layout

  • apps/web — installable PWA frontend
  • apps/api — HTTP API and provider orchestration
  • packages/mcp — canonical remote MCP server
  • config — public example configuration
  • private — ignored local identity and secrets
  • data — ignored databases and generated media

Security defaults

Arbitrary shell execution is not part of the Community MCP. Health, radio, image, voice, toy, and CLI bridge integrations are off by default. The API bridge uses an allowlist. MCP accepts a bearer token at /mcp; legacy token-in-path transport remains compatible but should not be placed in proxy access logs.

License and attribution

Rifugio-authored code is available under the Apache License 2.0 in LICENSE. UI or virtual-phone portions that may be adapted from SullyOS / 手抓糯米机 remain subject to the PolyForm Noncommercial License 1.0.0. See NOTICE and the included PolyForm license.

Required Notice: Copyright (c) 2024-2026 NMJ (SullyOS / 手抓糯米机)

Redistributors must preserve all three files and the Required Notice. Commercial use is not authorized for SullyOS-derived portions without separate permission or a provenance audit that removes/replaces them.

Community builds ship emoji/character App launcher defaults rather than third-party photo icons. The installable PWA icons are separate project assets.

Reviews (0)

No results found