Check the repository's Security tab for private vulnerability reporting. If that option is unavailable, contact a maintainer privately. Share the affected version, a minimal reproduction, and the impact.

Starting with npm version 1.6.0, MCP state and vector tools accept a file name within their configured directory. Pass a name such as state.json and set CONSCIOUSNESS_EXPLORER_STATE_DIR or SUBLINEAR_SOLVER_VECTOR_DIR if you need a different directory. See the 1.6.0 upgrade notes and issue 19 for the change history.

The CI workflow runs file handling regression tests. The supply chain workflow runs Rust and npm audits, dependency policy checks, and lockfile verification. It also runs GitHub dependency review as an informational check on pull requests.