AutoGineer
Generated banner for ArcRift — Persistent Memory for AI Coding Tools
Generated logo for ArcRift — Persistent Memory for AI Coding Tools

ArcRift — Persistent Memory for AI Coding Tools

Memory server

First committed by Eshaan-Nair

Published in Eshaan-Nair/ArcRift. Publisher page

247 GitHub stars

What it is

Smart, local-first RAG and Knowledge Graph for AI conversations.
— the description by Eshaan-Nair

AutoGineer overview, from the brain’s own files

ArcRift is a memory server designed to bridge the gap between disparate AI sessions. It captures conversations from web-based AI interfaces via a browser extension and provides persistent context to AI coding agents through an MCP server. By building a local knowledge graph and vector database, it ensures that AI models retain project-specific decisions and facts across sessions, preventing the need to re-explain context. It supports multiple storage backends, with SQLite as the recommended default, and utilizes local models via Ollama for embedding and fact extraction.

How it works

Memory model: Hybrid

AutoGineer overview, from the brain’s own files

ArcRift operates as a background service that stores AI conversation data in a local database. It uses a hybrid approach: a browser extension captures chat history from web interfaces, while an MCP server allows coding agents to query this memory. The system processes text by extracting structured facts into a knowledge graph and creating searchable vector embeddings. When a user prompts an AI, ArcRift automatically retrieves relevant context from its database and injects it into the prompt, ensuring the AI has access to historical project decisions.

Folders
FolderRoleFiles
.githubagent-config7
binscripts1
scriptsscripts8
backendfolder74
dashboardfolder95
extensionfolder26
reportsfolder4

The agent reads

The agent writes

Requirements

Runtimes: Node.js

Databases: Chroma, MongoDB, Neo4j, PostgreSQL, Qdrant, Redis, SQLite

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Google Antigravity, Kiro, OpenCode, Amp, Roo Code, Cline, JetBrains Junie, Devin (ex-Windsurf)

Set it up

  1. This brain runs code automatically: 1 script. Review install.sh before opening the folder in Claude Code. No step below turns a hook on for you.

    • install.sh: sh install.sh

  2. Add arcrift-setup to .mcp.json:

    {
  "mcpServers": {
    "arcrift-setup": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}

  3. Or add it with the Claude Code CLI:

    claude mcp add arcrift-setup -- npx -y [email protected]

  4. AutoGineer scanned exactly what this command runs: [email protected], fetched by its integrity digest and pinned to the version AutoGineer scanned, with no third-party dependency.

  5. Not scanned by AutoGineerThe author’s MCP configuration (README.md) also starts it in a way AutoGineer does not offer. Read that file: AutoGineer did not scan that path; what it runs is listed under “This brain runs”. https://github.com/Eshaan-Nair/ArcRift/blob/5424ea14dd9a848dcbcfb49586f348324999af88/README.md

  6. First committed by Eshaan-Nair. Published in Eshaan-Nair/ArcRift. Licence: MIT License.

Usage

AutoGineer overview, from the brain’s own files

  • Automatically injecting project context into browser-based AI chats.
  • Providing persistent memory to coding agents like Claude Code or Cursor via MCP.
  • Searching across historical project conversations to retrieve past decisions.
  • Visualizing knowledge relationships through a force-directed graph dashboard.
  • Managing memory via CLI tools or the native desktop dashboard.
“Use recall_context with prompt: 'implementing JWT refresh token rotation' and project: 'AuthService'”
The agent retrieves relevant memory chunks and knowledge graph facts specific to the AuthService project.
“Use store_memory with content: 'We implemented refresh token rotation using Redis...' and project: 'AuthService'”
The information is saved to the ArcRift database and indexed for future retrieval.

Documentation by Eshaan-Nair

<div align="center">

ArcRift — Persistent Memory for AI Coding Tools

Your AI forgets everything between sessions. ArcRift fixes that.
Memory saved in a browser chat is instantly available in your coding tool, and vice versa.

A local-first memory layer that captures your conversations, builds a searchable knowledge graph, and automatically injects the right context into every new prompt — no cloud, no subscriptions, no re-explaining yourself.

<br/>

Image: Stars Image: Forks Image: Issues Image: Version Image: License: MIT

<br/>

Browser Extension: Claude · ChatGPT · Gemini · DeepSeek · Grok · Copilot · Mistral

MCP (AI Coding Tools): Claude Code · Cursor · Windsurf · Claude Desktop

https://github.com/user-attachments/assets/f77a865a-cee9-4f7c-b0fa-4fb4d1cee7be

Youtube Link

The Demo only showcases the main function of ArcRift, there are a lot of features for you to Explore!

<br/>

</div>

One Command Setup

npx arcrift-setup

<details> <summary><b>Historical NPM Downloads (Legacy Brands)</b></summary> <br/> Due to rebranding, the total historical download count is split across our three NPM packages:

Package NameDownloads
arcrift-setup (Current)Image: Downloads
glia-ai-setup (Legacy)Image: Downloads
synq-setup (Legacy)Image: Downloads

</details>

The Problem

You are deep in a complex project. You have had 30 conversations with Claude about your auth flow, database schema, and deployment strategy. You open a new chat — and it is all gone. You spend 10 minutes re-explaining context you have already covered, and the AI gives you advice that contradicts decisions you made two weeks ago.

ArcRift stops the cycle. It captures your AI conversations, extracts structured facts into a knowledge graph, embeds them as searchable vectors, and automatically prepends the most relevant context to every new prompt — before you even finish typing.

Table of Contents

  • One Command Setup

  • The Problem

  • Installation

    • Web Extension Setup

    • MCP Server Setup

    • Running Both Together

  • Usage Guide

    • Using the Browser Extension

    • Using the MCP Tools

    • Dashboard

  • System Requirements

  • Key Features

  • Architecture

  • Quality-of-Life Details

  • How It Works

  • How the Two Modes Work

  • Performance Benchmarks

  • Privacy and Security

  • Comparison with Alternatives

  • What's New in v1.6.3

  • Documentation

  • Contributing

  • License

Installation

For Users (The Easy Way)

IMPORTANT
ArcRift is a powerful AI developer tool. Before installing the .exe, you must have Node.js and Ollama installed on your computer to run the backend and local AI models. If you don't have these, use the Developer (One-Command Setup) below to automatically install them!

  1. Head over to the Releases page.

  2. Download the latest ArcRift_Installer.exe (or your OS equivalent).

  3. Double-click the installer to install ArcRift on your machine.

  4. Launch ArcRift from your Start menu! The app will live entirely in your system tray and run seamlessly in the background.

For Developers (Building from Source)

If you want to modify the code, build the project yourself, or use the MCP Tools:

1. One-Command Setup (All Platforms)

npx arcrift-setup
copy .env.example .env

This clones the repo, checks dependencies, pulls Ollama models, installs packages, builds the backend, and sets up the env file.

2. Launching the Development Server To launch the native desktop application in dev mode:

npm run dev:desktop

or 

cd dashboard
npm run dev
cd backend
npm run dev

This will start the backend seamlessly in the background and open the native ArcRift dashboard. When you close the window, it will minimize to your system tray. You can fully quit ArcRift from the tray menu.

Web Extension Setup

The extension requires the ArcRift backend to be running. If you have the ArcRift Desktop App running in your system tray, you are already good to go!

Step 1 — Install the Extension

For Google Chrome / Edge / Brave:

  1. Download the Chrome .zip file from the GitHub Releases page.

  2. Extract the .zip file to a permanent folder on your computer.

  3. Open chrome://extensions

  4. Enable Developer mode (top-right toggle)

  5. Click Load unpacked and select the folder you just extracted.

  6. The ArcRift icon will appear in your toolbar!

For Mozilla Firefox:

  1. Download the officially signed .xpi file from the GitHub Releases page.

  2. Simply drag and drop the .xpi file directly into your open Firefox window.

  3. Click Add when prompted. It will be installed permanently!

Step 2 — Use it

Navigate to Claude, ChatGPT, Gemini, DeepSeek, Grok, Copilot, or Mistral. Click the ArcRift popup, enter a project name, and click Save Chat. Auto-connect activates immediately.

MCP Server Setup

The MCP server runs as a separate process and communicates with AI coding tools over stdio. The backend does not need to be running as an HTTP server — the MCP server initializes its own storage connection.

Step 1 — Build the backend

cd backend
npm install
npm run build

This produces backend/dist/mcp/server.js.

Step 2 — Generate your config (easiest)

cd backend
npm run mcp:config

This prints a pre-formatted JSON block with absolute paths resolved for your machine. Copy it directly into your tool's config file.

Step 3 — Add to your AI tool

Claude Desktop — %APPDATA%\Claude\claude_desktop_config.json (Windows) or ~/.claude/claude_desktop_config.json (macOS):

{
  "mcpServers": {
    "arcrift": {
      "command": "node",
      "args": ["C:/path/to/ARCRIFT/backend/dist/mcp/server.js"]
    }
  }
}

Claude Code — run in your project directory:

claude mcp add ArcRift node /path/to/ARCRIFT/backend/dist/mcp/server.js

Cursor — create .cursor/mcp.json in your project root:

{
  "mcpServers": {
    "arcrift": {
      "command": "node",
      "args": ["/path/to/ARCRIFT/backend/dist/mcp/server.js"]
    }
  }
}

Windsurf — create .windsurf/mcp.json in your project root:

{
  "mcpServers": {
    "arcrift": {
      "command": "node",
      "args": ["/path/to/ARCRIFT/backend/dist/mcp/server.js"]
    }
  }
}

Use forward slashes in all paths, even on Windows. Restart your AI tool after editing the config.

Step 4 — Set the storage mode

The MCP server reads backend/.env. Make sure it contains:

ARCRIFT_STORAGE_MODE=sqlite
OLLAMA_URL=http://localhost:11434

Ollama must be running for the MCP server to generate embeddings and extract knowledge graph triples.

Running Both Together

When running the browser extension and MCP server together, they share the same ArcRift.db database. No extra configuration is needed.

  1. Start the HTTP backend: start.bat or ./start.sh

  2. Load the extension in Chrome (it talks to http://localhost:3001)

  3. Your AI coding tool starts the MCP server automatically when you open a project

Memory saved via the extension is immediately available in recall_context, and memory stored via store_memory appears in the dashboard history. They are the same database.

The HTTP backend and MCP server both use WAL mode on SQLite, which allows them to read and write concurrently without locking each other out.

Usage Guide

Using the Browser Extension

Saving a conversation:

  1. Have a conversation on any supported platform

  2. Click the ArcRift icon in your browser toolbar

  3. Enter a project name (e.g. AuthService, MyApp-Backend)

  4. Click Save Chat

ArcRift scrubs PII, chunks the text, embeds it locally with Ollama, and sends it to the backend. The UI confirms success in under 5 seconds. Background indexing (sentence-level embeddings, knowledge graph extraction) continues asynchronously.

Auto-connect:

Once a session is saved and activated, ArcRift intercepts every prompt you type on that platform. Before the request is sent, it queries the backend for relevant context and prepends the top results. You do not need to do anything — just type normally.

To pause: click the ArcRift popup and hit Pause. The badge dims. Click again to resume.

New chat detection:

When you click "New Chat" on ChatGPT, Claude.ai, or Gemini, ArcRift detects the URL or DOM change and resets the active session. The next Save will start a fresh project, and context from the previous session will not bleed in.

Classic inject:

For a one-time context push without enabling auto-connect, click Inject Context in the popup. ArcRift pastes the knowledge graph summary directly into the chat input field. You review it and send manually.

Using the MCP Tools

Once connected, your coding agent has access to seven ArcRift tools. A typical session looks like this:

At session start — recall project memory:

Use recall_context with prompt: "implementing JWT refresh token rotation"
and project: "AuthService"

After completing work — save decisions:

Use store_memory with content: "We implemented refresh token rotation using
Redis for token invalidation. The key insight was using a sliding expiry window
of 15 minutes for access tokens and 7 days for refresh tokens." and project: "AuthService"

Finding something from a different project:

Use search_memory with query: "rate limiting strategy"

Getting an overview before starting:

Use get_project_summary for project: "AuthService"

Auto-detecting the current project:

Use identify_active_project with path: "/Users/me/code/auth-service"

Correcting outdated information:

Use prune_memory with prompt: "Redis rate limiting" and project: "AuthService"
Dashboard

Open http://localhost:3001 while the backend is running.

TabWhat you see
GraphD3.js force-directed knowledge graph. Nodes are entities, edges are relations. Degree-scaled sizing — high-connectivity nodes appear larger. Hover for details, scroll to zoom, drag to reposition.
HistoryAll extracted triples (subject / relation / object) with timestamps. Filterable by project and relation type.
ChatThe full saved conversation rendered as color-coded chat bubbles, with platform attribution.
Job QueueLive view of background indexing jobs — pending, processing, completed, dead-lettered.

System Requirements

ModeMin RAMDiskDockerWhat runs
SQLite (Recommended)2 GB3 GBNot requiredAll features — single .db file + Ollama
Full Docker8 GB15 GBRequiredNeo4j + MongoDB + ChromaDB + Ollama
Lite Docker4 GB10 GBRequiredMongoDB + ChromaDB (no knowledge graph)

SQLite mode is the recommended default. The installer detects Docker automatically and sets SQLite mode if Docker is not available.

Prerequisites
RequirementVersionNotes
Node.js20 LTS+nodejs.org
OllamaLatestollama.com — required for local embeddings and extraction
Docker Desktop24.0+docker.com — only needed for Docker mode
Groq API Key—console.groq.com — free, used as fallback if Ollama is slow

Key Features

Core Retrieval Engine
FeatureDetail
Three-Layer Hybrid SearchSentence vectors, chunk vectors, and FTS5 keyword search run in parallel. Results are fused and ranked by a combined score.
Surgical Sentence TrimmingChunks are split into individual sentences at index time. On retrieval, only the sentences that directly match the query are returned — not the entire surrounding paragraph. Reduces prompt noise by up to 95%.
HyDE (Hypothetical Document Embedding)Before querying the vector store, ArcRift generates a hypothetical answer to your query and uses that embedding alongside the raw query. This dramatically improves recall for rephrased or indirect questions.
Small-to-Big RetrievalHigh-precision sentence match triggers fetching the parent chunk for broader context. Precision of a sentence search, context of a full paragraph.
Knowledge Graph LayerEvery saved conversation is processed to extract subject-relation-object triples (22 entity types, 20+ relation types). Graph facts are fused with vector results on every recall.
Background IndexingSentence-level embedding is offloaded to a background job queue so Save is instant. The deep index is built asynchronously without blocking the UI.
Extension Quality-of-Life
FeatureDetail
Auto-ConnectOnce a session is active, ArcRift re-attaches automatically on every page load. No clicking required — just type.
SPA Navigation AwarenessDetects "New Chat" clicks in single-page apps (ChatGPT, Claude, Gemini) without a full page reload. Automatically resets the active session so context does not bleed between conversations.
Pause / ResumeOne click in the popup pauses auto-injection. Click again to resume. State persists across tabs.
Classic InjectOne-time manual inject button for priming a cold start without enabling auto-connect.
FNV-1a DeduplicationIdentical conversation segments are fingerprinted and skipped — re-saving a chat never creates duplicate embeddings.
Multi-Strategy DOM ResolverEach platform has five ordered selector strategies. If one breaks after a UI update, the next activates automatically.
Restricted URL GuardInjection is blocked on chrome://, about:, and extension pages. Prevents crashes on non-chat pages.
MCP Tool Quality-of-Life
ToolWhat it does
recall_contextRetrieves the top-N most relevant memory chunks for a prompt, scoped to a project. Includes knowledge graph facts.
store_memorySaves text or a transcript to ArcRift Memory. Auto-creates the project if it does not exist. Triggers full background indexing.
search_memoryCross-project global search. Useful for finding decisions made in a different project that apply to the current one.
list_projectsLists all saved projects with metadata — chunk count, triple count, last updated.
get_project_summaryReturns a structured knowledge graph summary for a project as readable markdown.
identify_active_projectMatches a folder path against saved project names. Lets the AI agent auto-detect which project it is working on from the CWD.
prune_memorySurgically removes facts or chunks matching a description. Corrects outdated information without wiping an entire project.
Infrastructure
FeatureDetail
Zero-Docker ModeARCRIFT_STORAGE_MODE=sqlite replaces all Docker services with a single ArcRift.db file. Full feature parity — vector search, knowledge graph, job queue, everything.
WAL ConcurrencySQLite runs in Write-Ahead Logging mode, allowing simultaneous reads from the dashboard, extension, and MCP server without lock contention.
Dead Letter QueueBackground jobs that fail are retried up to 5 times with exponential backoff. Failed jobs move to a dead letter queue visible in the dashboard — nothing is silently lost.
Ghost Job CleanupOn startup, any jobs stuck in PROCESSING state from a previous crashed run are automatically reset to PENDING.
Rate LimitingSave endpoint is rate-limited independently from read endpoints. Prevents accidental flooding from rapid saves.
Helmet Security HeadersAll responses include Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and related headers.

Architecture

ARCRIFT/
├── backend/
│   ├── src/
│   │   ├── mcp/           MCP server and seven tool implementations
│   │   ├── routes/        REST API (chat, rag, session, jobs)
│   │   ├── services/      Storage bridge, SQLite engine, vector store,
│   │   │                  graph store, embeddings, job queue, extractor
│   │   ├── middleware/     Rate limiting, sanitization, CORS
│   │   └── utils/         Logger, privacy scrubber
│   └── scripts/           Benchmarking, stress testing, maintenance tools
├── dashboard/             React 19 + D3.js + Vite — built to dashboard/dist/
├── extension/
│   ├── src/
│   │   ├── platform/      Multi-strategy DOM resolver
│   │   ├── platforms/     claude, chatgpt, gemini, deepseek, grok, copilot, mistral
│   │   ├── content.ts     DOM scraping, prompt interception, auto-connect
│   │   └── background.ts  Service worker, backend proxy
│   └── popup/             Popup UI and controls
├── reports/               Benchmark and audit outputs
├── .env.example           Configuration template
├── docker-compose.yml     Full Docker profile
├── install.bat / .sh      First-time setup
└── start.bat / .sh        Daily launcher
Ports
ServicePortNotes
Backend API + Dashboard3001Single process — API and static files
MCP ServerstdioSpawned by your AI tool on demand
Ollama11434Local LLM and embeddings
Neo4j7474 / 7687Docker full mode only
MongoDB27017Docker mode only
ChromaDB8000Docker mode only
Tech Stack
LayerTechnology
ExtensionTypeScript, Chrome MV3, esbuild
BackendNode.js, Express 5, TypeScript, Pino
Vector StoreSQLite-vec (vec0 virtual tables, 768-dim float32)
Full-Text SearchSQLite FTS5 with Porter stemmer
Knowledge GraphSQLite facts table (or Neo4j in Docker mode)
EmbeddingsOllama nomic-embed-text (768-dim, CPU-optimized)
LLMOllama llama3.1:8b primary — Groq fallback
MCP@modelcontextprotocol/sdk v1.29+ (stdio transport)
DashboardReact 19, Vite 7, D3.js v7
Static Servingsirv (served from same process as the API)
SecurityHelmet, express-rate-limit

Quality-of-Life Details

These are the smaller decisions that make the system faster and more reliable in practice.

Instant save, deep index later. When you click Save, only the chunk-level embeddings are computed synchronously (1–2 embeddings). Sentence-level embeddings (20–40 embeddings per conversation) are offloaded to a background job. The UI confirms success immediately; the deep index catches up within seconds.

Delete-then-insert for vector updates. SQLite virtual tables do not support UPDATE on vector columns. ArcRift uses a delete-then-insert pattern to avoid UNIQUE constraint errors when re-saving a conversation.

Prefix keyword matching. FTS5 queries use wildcard suffixes (encrypt* matches encryption, encrypted, encryptor). This significantly improves recall for technical terms where the exact suffix varies.

Threshold set at 0.30, not 0.45. Surgical trimming allows a lower similarity threshold. Even if a chunk is only loosely related, if the matching sentences are precise, the noise penalty is near zero.

History-aware fallback. If a query is detected as a history-seeking question ("what did we talk about", "what was decided"), the trimmer falls back to the first three sentences of the chunk rather than returning nothing.

5-character minimum sentence filter. The sentence splitter ignores fragments shorter than 5 characters. This prevents code snippets and punctuation artifacts from polluting the sentence index.

WAL mode on all writes. SQLite is opened in WAL mode on startup. The MCP server, HTTP backend, and dashboard can all read and write concurrently without database lock errors.

Ghost job recovery. On startup, any jobs stuck in PROCESSING from a previous crash are reset to PENDING automatically. No manual intervention needed after an unclean shutdown.

CORS locked to localhost. The backend only accepts requests from localhost origins. External requests are rejected before they reach any route handler.

How It Works

SAVE
  Browser scrapes conversation → FNV-1a dedup check
  → PII scrub (API keys, JWTs, emails, IPs → [REDACTED])
  → POST to backend

STORAGE (two parallel tracks)

  Vector Track                      Graph Track
  Sliding window chunker            Text sent to Ollama llama3.1:8b
  300 words, 80-word overlap        (Groq as fallback)
  Embeds with nomic-embed-text      Extracts subject-relation-object triples
  Stores in SQLite vec0             Stores in SQLite facts table
  Background: sentence-level        Background: stores after chunk embedding
  embedding job queued

RECALL (on every prompt or tool call)
  Query → HyDE (generate hypothetical answer → embed both)
  → Sentence vector search (top 100, filter by session)
  → Chunk vector search (top 20, filter by session)
  → FTS5 keyword search (prefix match, filter by session)
  → Fuse results, score, deduplicate
  → Surgical trim (keep only matching sentences from each chunk)
  → sanitizeChunks() (scan for injection patterns → redact)
  → wrapInContextBlock() (lean text header)
  → Prepend to prompt

How the Two Modes Work

ArcRift has two complementary modes that share the same memory store. You can use one, the other, or both at the same time.

Mode 1 — Browser Extension (Web)

The extension lives inside Chrome and works on any AI chat website. When you save a conversation, it scrapes the page, scrubs PII, chunks and embeds the text locally, and sends it to the ArcRift backend. On every subsequent prompt you type, the extension intercepts the input, queries the backend for relevant context, and prepends it to your message automatically — before the request hits the AI.

Best for: Claude, ChatGPT, Gemini, DeepSeek, Grok, Microsoft Copilot, and Mistral web interfaces.

Mode 2 — MCP Server (Coding Tools)

The MCP server exposes ArcRift as a set of tools that coding agents can call directly. Instead of intercepting DOM events, the AI tool calls recall_context at the start of a session to pull in relevant memory, and store_memory after completing work to save decisions and context for future sessions.

Best for: Claude Code, Cursor, Windsurf — anywhere you write code with an AI coding agent.

Shared Memory

Both modes write to and read from the same backend database. A conversation you save via the browser extension is immediately available to recall_context in your coding tool, and vice versa. They are two interfaces into one unified knowledge base.

Performance Benchmarks

Every release is stress-tested across four independent audits. All results are reproducible using the scripts in backend/scripts/.

Web Context Engine (Browser Extension)

Scale: 1,000 chunks (~300,000 words) | Needles: 20 facts | Queries: 60 phrasings

MetricResultWhat it means
Recall @ 190.0%Correct fact was the top result in 54 of 60 searches
Mean Reciprocal Rank0.806Correct answer appears at position 1.24 on average (1.0 is perfect)
Context Compression95.0%Payload reduced from 55,350 chars to 2,784 chars before injection
Mean Relevance Score0.464Average semantic similarity of retrieved results (0–1 scale)

Engine contribution across 54 successful recalls:

EngineHitsRole
Sentence Vector50High-precision match against individual sentences
Chunk Vector47Thematic match against full 150-word context windows
FTS5 Keyword43Exact literal matching, boosts low-similarity vector results

The 6 misses were all on degenerate "Context on X?" queries with no semantic content. All natural-language and rephrased queries passed.

Full report: reports/benchmark_web.md

MCP Context Engine (Coding Tools)

Scale: 10 facts across real project memory | Queries: 30 (3 phrasings each) | TopN: 6

MetricResultTarget
Total Recall90%>90%PASS
Context Compression81.3%>75%PASS
Noise Redacted131,700 chars—vs. returning 6 full chunks raw

Engine contribution across 27 successful recalls:

EngineHitsContribution
Sentence Vector26100% of recalls
FTS Keyword2492.3% of recalls
Chunk Vector934.6% of recalls

The 3 misses were all on highly rephrased semantic queries with no shared keywords. Standard and lowercase phrasings passed in every case.

Full report: reports/benchmark_mcp.md

MCP Project Isolation Audit

Scale: 10 simultaneous projects | Checks: Store + own-recall + cross-leak per project

MetricResultStatus
Isolation Integrity100%ELITE — zero cross-project leakage
Concurrent AccessPassAll projects readable under simultaneous load
Leak DetectionNegativeNo data from any project visible in another

Each project's vector space and knowledge graph is strictly siloed via sessionId constraints. Aggressive cleanup logic purges both IDs and Names between runs to prevent identity drift.

Full report: reports/mcp_stress_test.md

Knowledge Graph Stress Audit

Scale: 1,200+ nodes, 1,087 triples in a single session

MetricResultStatus
Total Triples Stored1,087PASS
Ingestion Throughput4,056 triples/secOPTIMIZED
Generation Time0.3 secondsELITE
Dashboard Load< 1.5 secondsPhysics-simulated D3.js render
Storage Cost~0.2 MBSQLite increase for entire stress session

Graph structure: 5 major hubs (40+ edges each), 15 intermediate clusters, 400 mesh entities, 100 isolated standalone facts.

Full report: reports/graph_stress_test.md

Privacy and Security

ArcRift was designed with a local-first philosophy from the ground up. Your conversations never leave your machine unless you explicitly configure a cloud LLM.

ControlDetail
Local StorageAll data lives in ArcRift.db on your machine or in local Docker volumes. Nothing syncs to any external service.
Local Embeddingsnomic-embed-text runs entirely via Ollama — zero API calls for embeddings.
Local Extractionllama3.1:8b runs via Ollama for knowledge graph extraction. Groq is only used as a fallback and only if you provide a key.
PII ScrubbingAPI keys, JWTs, connection strings, email addresses, and internal IPs are redacted to [REDACTED] in the browser before any data is sent to the backend.
Injection DefenceRetrieved chunks are scanned for 10 known prompt injection patterns before being injected into any prompt. Matching content is replaced with [Content redacted].
CORS LockedThe backend rejects requests from any origin other than localhost.
Security HeadersHelmet adds CSP, X-Frame-Options, X-Content-Type-Options, and other headers to every response.
No Shared SecretThe pre-v1.4.7 shared secret requirement has been removed. The extension communicates directly with the local backend.

See SECURITY.md for the full threat model and vulnerability reporting policy.

Comparison with Alternatives

While tools like Mem0, Zep, and Letta focus heavily on providing memory APIs for agent developers, ArcRift is built directly for end-users and human-in-the-loop workflows.

FeatureArcRiftMem0ZepLetta (MemGPT)LangGraph
Primary AudienceEnd-users & DevsAgent DevsAgent DevsAgent DevsAgent Devs
Cross-Platform Chat UXYes (Injects directly into ChatGPT, Claude, etc)Bring your own UIBring your own UIBring your own UIBring your own UI
Visual Knowledge GraphYes (D3 Dashboard)API OnlyAPI OnlyNoOptional / Custom
Context Retrieval PrecisionSurgical Sentence Trimming (95% noise reduction)Full ChunkFull ChunkFull ChunkVaries by implementation
Setup Complexity1 command (npx)Requires DB / APIRequires DB / DockerDocker / Python envCode-heavy (Framework)
Storage BackendSQLite (Zero config)PostgreSQL / QdrantPostgreSQL / RedisPostgreSQL / ChromaAny (BYO Database)
Local vs Cloud100% Local (Ollama)Cloud-first (Local avail)BothBothBoth
Native IDE IntegrationYes (via MCP)API OnlyAPI OnlyAPI OnlyAPI Only
MCP SupportYesYesYesYesYes
LicenseMITApache 2.0Apache 2.0Apache 2.0MIT

What's New in v1.6.3

This release brings full cross-browser support to ArcRift and patches a critical context injection bug.

  • Mozilla Firefox Support: ArcRift is now fully compatible with Firefox! The extension build pipeline generates independent Chrome and Firefox packages, and we have fully automated the Mozilla Add-ons signing pipeline so signed .xpi extensions are attached to every release.

  • RAG Hallucination Fix: We caught a bug where out-of-context chats were injecting irrelevant project memory because the vector DB returned the top closest matches no matter how semantically distant they actually were. The retrieval pipeline now enforces a strict 50% relevance threshold.

(Note: If you were testing v1.6.1 locally, all core desktop app updates remain the same in this release).

See CHANGELOG.md for the full history.

Documentation

FileDescription
ARCHITECTURE.mdData flow, storage schema, environment variables
RAG_PIPELINE.mdRetrieval pipeline, scoring, threshold tuning
MCP_SETUP.mdMCP setup guide for all supported tools
PLATFORM_SELECTORS.mdDOM resolver system, adding new platforms
SECURITY.mdThreat model, vulnerability reporting
SELF_HOSTING.mdPorts, passwords, backups, reverse proxy
CONTRIBUTING.mdFork workflow, commit format, adding platforms
CHANGELOG.mdFull version history
TROUBLESHOOTING.mdCommon issues and fixes

Contributing

Bug fixes, new platform support, UI improvements, and test coverage are all welcome.

Contributing Guide · Code of Conduct

Good first issues: good first issue

License

MIT — see LICENSE.

<div align="center"> <br/>

Stop re-explaining yourself. Give your AI the memory it should have had from day one.

Built by Eshaan Nair

Image: MseeP.ai Security Assessment Badge

</div>

CHANGELOG.md

ArcRift — Changelog

All notable changes documented here. Format follows Keep a Changelog.

[1.6.3] — 2026-06-03 — Cross-Browser Extension Pipeline

This release brings full cross-browser support to ArcRift and patches a critical context injection bug.

Major Features

  • Mozilla Firefox Support: ArcRift is now fully compatible with Firefox! The extension build pipeline generates independent Chrome and Firefox packages, and we have fully automated the Mozilla Add-ons signing pipeline so signed .xpi extensions are attached to every release.

  • RAG Hallucination Fix: We caught a bug where out-of-context chats were injecting irrelevant project memory because the vector DB returned the top closest matches no matter how semantically distant they actually were. The retrieval pipeline now enforces a strict 50% relevance threshold.

[1.6.1] — 2026-05-31 — Standalone Desktop Bundling

This patch release hardens the Tauri Desktop installers, packaging the entire Node backend natively into the .exe so the application can run in highly protected environments like C:\Program Files without permission errors.

Major Features

  • Standalone Node Bundling: The Tauri resources array now natively bundles the compiled esbuild backend, meaning the application is now truly a monolithic application wrapper.

  • Secure AppData Storage: The Rust lifecycle manager intercepts the Node backend and reroutes the SQLite vector database to write directly to %APPDATA%/dev.arcrift.app/ArcRift.db. This permanently resolves write-permission crashes on Windows.

[1.6.0] — 2026-05-30 — Desktop App & Local File RAG

This release marks ArcRift's transition from a CLI-based tool to a fully native, highly-optimized desktop application, alongside a brand new Local Codebase Indexing feature.

Major Features

  • Native Tauri Desktop App: ArcRift now runs as a lightweight native desktop application that lives quietly in your system tray. The backend operates seamlessly as a hidden Rust sidecar process.

  • Direct Codebase Indexing: You can now point ArcRift directly at any local folder. It will scan, chunk, embed, and ingest your entire codebase into its Knowledge Graph instantly, allowing you to query massive projects effortlessly.

  • Esbuild Backend Engine: The backend compiler was completely swapped from TypeScript to Esbuild, bringing start times down from over 60 seconds to ~0.1 seconds.

  • GitHub Actions Auto-Releases: Full CI/CD pipeline integrated to automatically cross-compile .exe, .dmg, and .AppImage installers on every release.

[1.5.6] — 2026-05-30 — Installer Patch

Setup Script Optimization

  • Removed the massive playwright dependency from the root arcrift-setup package, drastically reducing install times and preventing users from downloading gigabytes of unneeded browser binaries.

[1.5.5] — 2026-05-30 — Analytics & Manual Graph Cleanups

Session Analytics & Telemetry

  • Settings Dashboard Tab — Added a dedicated "Session Analytics" tab that tracks your lifetime token savings and API cost reductions.

  • RAG Telemetry Calculation — The backend now natively computes token efficiency on every retrieval turn (comparing the raw context length against the injected subset) and persists it directly to the active SQLite session.

Manual Graph Editing

  • Interactive D3 Context Menus — Right-clicking any node on the visual Knowledge Graph now spawns a custom, floating ArcRift context menu, completely eliminating the need to use the CLI for graph cleanup.

  • Node Renaming — You can instantly rename a node across all of its relationships via the new context menu.

  • Edge Manager Modal — A new sleek overlay allows you to view and selectively sever specific relationship edges connected to a node with a single click.

Background Auto-Backup

  • Resilient Memory — Implemented an automated background chron-job that silently dumps a complete .sqlite snapshot to a backup folder once a week, protecting your local knowledge graphs from corruption or unexpected data loss.

[1.5.4] — 2026-05-29 — Session Merging & Context Summarisation

Multi-turn Context Summarisation

  • Hybrid Context Mode — Added a configuration toggle in the Settings tab to switch between "Raw Chunks" and "Summarized Context" in the RAG pipeline.

  • Token Efficiency — In Summarized Mode, retrieved chunks and graph facts are intercepted and fed into the local LLM to generate a concise, cohesive prose summary before injection, saving thousands of tokens per turn on large projects.

  • Automatic Fallbacks — The backend automatically falls back to raw chunk injection if the summarization LLM fails or times out.

Session Merging (Cross-Storage)

  • Unified Projects — You can now merge older or duplicate sessions directly into your active project via a new Merge Modal in the dashboard sidebar.

  • Data De-duplication — The system safely merges knowledge graph relationships (dropping duplicates), re-maps vector chunk metadata, and concatenates chat logs into a single historical record.

  • Cross-Ecosystem Support — Merging logic is natively implemented across both Zero-Docker (SQLite) and Docker (Chroma/Neo4j/Mongo) storage modes.

Dashboard Settings & Configuration

  • Ollama Model Switcher — Added a dedicated Settings UI to dynamically change the active Embedding and Extraction models on the fly, without needing to restart the backend or edit .env.

  • UI State Hardening — The dashboard visually disables irrelevant side-panels (Facts/Chat) when navigating to global views like Settings or Global Search to prevent UI deadlocks.

[1.5.3] — 2026-05-23 — The ArcRift Overhaul: Rebrand & Premium "Monolith" UI

Comprehensive Rebrand (Glia → ArcRift)

  • Codebase Sweep — Executed a 100% complete search-and-replace of all legacy brand references to "ArcRift" across the frontend, backend, and extension.

  • Configuration Updates — Updated environment variable namespaces (e.g., ARCRIFT_STORAGE_MODE), internal message types (PAUSE_ARCRIFT), Docker database names (arcriftdb), and core API files (ArcRift.ts) for case-sensitive Linux CI compliance.

  • Documentation — Completely rewrote the README.md, ARCHITECTURE.md, CONTRIBUTING.md, and all other Markdown files to reflect the new ArcRift identity.

Premium Monolith UI

  • Color Palette & Typography — Implemented a new Deep Slate (#020617), Orange (#F97316), and Emerald (#10B981) palette. Integrated Google Fonts Outfit and Inter for a high-end developer tool aesthetic.

  • Dynamic Graph Enhancements — Updated knowledge graph edges to use fluid quadraticCurveTo bezier curves and added a persistent top-center indigo radial glow to unify the graph background with the global search view.

  • Extension UI Parity — Completely rewrote popup.css so the Chrome extension perfectly mirrors the dashboard's new dark-glass aesthetic, including the grid background and status pill designs.

  • UI/UX Polish — Fixed text overflow issues in the System Health component and configured the Job Queue to display a cleaner - state when empty.

[1.5.2] — 2026-05-20 — Global Search, Observability & Extension Hardening

Dashboard

  • Global Search Bar — Added a debounced global search input to the dashboard header that queries POST /api/rag/global across all projects. Results are displayed in a floating dropdown showing a Facts section (structured subject → relation → object triples from the knowledge graph) and a Context section (semantic vector chunks with project attribution).

  • Knowledge Graph Pruning — Clicking a node in the D3 force graph opens a contextual panel with a Prune Node button. Pruned nodes are optimistically removed from the graph without a page reload.

  • System Health Panel — A live metrics panel pinned to the sidebar footer showing storage mode, session count, total chunk count, job queue status (pending / active / failed / idle pills), and Ollama reachability with model name. Polls every 10 seconds via GET /api/health.

Backend

  • GET /api/health endpoint — New route returning live system metrics: session count, chunk count, job queue summary, active storage mode, and Ollama connectivity check (2 second timeout).

  • POST /api/graph/prune endpoint — REST wrapper exposing the internal prune_memory MCP tool to dashboard clients.

  • Global Search: Graph Facts — POST /api/rag/global now returns a graphFacts array (knowledge graph triples) alongside vector chunks, mirroring the session-scoped /api/rag/retrieve endpoint.

  • Production Log Verbosity — Downgraded storage-layer logs to debug level. Set LOG_LEVEL=debug to restore verbose output.

Extension

  • Selector Failure Warning Badge — When the extension fails to locate the chat input element on a supported platform due to a stale CSS selector, the popup now shows a yellow warning banner: "Injection Failed — Could not connect to [Platform]. Selector may be stale." with a Report link (GitHub Issues) and a Dismiss button. The status badge turns amber. State persists via chrome.storage.local and clears on dismiss.

CI

  • SQLite-native Pipeline Test — Added pipeline-tests-sqlite job to .github/workflows/integration-tests.yml. Runs the full integration test suite with ARCRIFT_STORAGE_MODE=sqlite, removing the Docker service container requirement.

  • Storage-Agnostic Integration Tests — Refactored pipeline.integration.test.ts and jobs.test.ts to use the Unified Storage Interface (initStorage(), sessionStore, vectorStore). Tests auto-fallback to SQLite mode if ARCRIFT_STORAGE_MODE is unset, creating and cleaning up a temporary .db file.

Roadmap

  • v1.5.3 added — Rebrand & UI restructure milestone (name change due to brand collision, dashboard layout overhaul with command palette and left-rail nav).

  • Former v1.5.3 promoted to v1.5.4 — Multi-turn summarisation, session merging, Ollama model switcher, and export/import.

[1.5.1] — 2026-05-17 — MCP Security & Retrieval Hardening

Multi-Tenant Isolation (MCP)

  • Zero-Leakage Architecture — Enforced 100% project isolation in the Model Context Protocol (MCP) server. Sessions are now permanently anchored to project names as unique IDs.

  • Aggressive Cleanup — Enhanced the stress test suite to purge "Zombie" sessions by both ID and Name, ensuring a clean slate for multi-project audits.

  • Identity Predictability — Standardized the createSession flow to support custom, human-readable IDs for reliable cross-tool lookups.

RAG & Indexing Reliability

  • Unclogged Sentence Indexing — Resolved a critical ID mismatch in the background indexing worker that caused sentence-level vectors to fail linkage.

  • Precision Retrieval — Adjusted sentence length filters to ensure short facts, codes, and snippets are correctly captured by the RAG engine.

  • Virtual Table Resilience — Migrated vector updates to a delete-then-insert pattern to prevent 'UNIQUE constraint' errors on SQLite virtual tables.

Stability & Observability

  • WAL Mode Concurrency — Enabled Write-Ahead Logging (WAL) by default in SQLite mode to support high-concurrency multi-process access.

  • Hyper-Verbose Storage Logs — Added detailed diagnostic logging to the storage layer to trace session identity and lookup performance.

  • Audit Suite v1.5.1 — Synchronized versioning across all stress test reports and diagnostic tools.

Documentation & README

  • Full README Rewrite — Rebuilt the README from scratch with separate installation guides for the Web Extension and MCP Server, a "Running Both Together" section, and a Quality-of-Life details section explaining design decisions.

  • All Four Benchmarks Published — Added Web Context Engine, MCP Context Engine, MCP Project Isolation, and Knowledge Graph stress test results to the README with per-engine attribution breakdowns.

  • Shared Memory Clarified — Explicitly documented that memory saved via the browser extension is immediately available to MCP tools and vice versa, sharing the same database.

  • MCP Setup Guide Updated — MCP_SETUP.md troubleshooting and architecture sections updated to cover both Docker and Zero-Docker (SQLite) environments.

  • Environment Template — Added ARCRIFT_STORAGE_MODE and SQLITE_DB_PATH to backend/.env.example for new user discoverability.

CI & Tooling

  • Selector CI Expanded — scripts/check-selectors.js now monitors all 7 supported platforms (added Grok, Copilot, Mistral alongside the original four).

  • Actionable Failure Alerts — Selector CI now writes a structured selector-failures.json report on failure. The auto-created GitHub Issue now names the exact failing platforms and failure reasons in both the title and body, instead of asking developers to dig through workflow logs.

  • Interface Parity — Added hybridSearch to the IVectorStore interface and implemented it in both Docker and SQLite backends.

  • MCP Server Version Handshake — Updated the MCP server version string to 1.5.1 so connected tools (Claude, Cursor, Windsurf) receive the correct capability declaration.

  • Global Version Sync — Synchronized v1.5.1 across all package files, manifests, startup scripts, installer banners, source comments, and documentation files. Scrubbed all active v1.4.x references.

[1.5.0] — 2026-05-13 — Documentation & Alignment

Versioning & Alignment

  • Unified Versioning — Synchronized version 1.5.0 across all modules: root setup, backend, dashboard, extension package, and manifest.

  • Architectural Cleanup — Removed legacy ARCRIFT_SECRET requirement and updated all docstrings to reflect the current state of the platform.

Documentation Overhaul

  • Standardized Context Format — Updated all documentation to reflect the move from XML delimiters to the Lean Text Header (=== ArcRift RETRIEVED CONTEXT ===).

  • Npx-First Installation — Refactored all "Getting Started" guides to prioritize npx arcrift-setup over manual cloning.

  • New ROADMAP.md — Introduced a formal project roadmap for future milestones.

  • New TROUBLESHOOTING.md — Created a comprehensive guide for common installation and runtime issues.

  • Architecture Sync — Updated ARCHITECTURE.md and RAG_PIPELINE.md with accurate diagrams and thresholding logic.

[1.4.7] — 2026-05-12 — Strict Identity & Precision RAG

Identity & Anti-Hijacking

  • Strict Identity Architecture — Sessions are now permanently anchored to platform-specific Chat URLs (externalChatId).

  • SPA-Aware Navigation — Added URL watchers to the Extension (Content Script & Popup) that detect "New Chat" clicks in Single Page Apps (ChatGPT/Claude/Gemini) without needing a page reload.

  • Identity Verification — The backend now validates incoming Save requests against the URL; stale Session IDs from the extension are automatically ignored to prevent project overwrites.

  • Popup UX — The Project Name field now remains empty for new chats, ensuring a "clean slate" workflow.

RAG Precision & Token Efficiency

  • Hybrid Retrieval — Implemented keyword boosting for search queries and corrected L2 distance scoring to prioritize exact conceptual matches.

  • Lean Context Injection — Replaced heavy XML tags with a professional, token-efficient text header (=== ArcRift RETRIEVED CONTEXT ===).

  • Context Suppression — ArcRift now automatically suppresses the context block if no relevant memories are found, saving tokens.

Stability & Infrastructure

  • Resilient Database — Implemented a robust SQLite migration for the externalChatId column and added busy_timeout to handle simultaneous dashboard polling.

  • Graph "Silent Sync" — The Knowledge Graph now persists node coordinates and topology. The simulation only re-heats if the data structure changes, eliminating the "2-second pop" reset loop.

  • Console Cleanup — User-facing errors (like duplicate project names) are now handled quietly in the background script to prevent "Red Error" badges in Chrome.

Quality Assurance

  • Unit Tests — Updated the full backend suite to align with the new Lean Header format.

  • Bug Fixes — Resolved ReferenceError: smartKey and TypeScript indexing issues in the popup.

[1.4.6] — 2026-05-11 — The ARCRIFT Rebrand

Rebranding & Identity

  • Project Rebrand — Transitioned the project identity from Synq to ARCRIFT.

  • CLI Refresh — Updated the one-command installer to npx arcrift-setup.

  • Infrastructure Update — Renamed all environment variables (ARCRIFT_SECRET, ARCRIFT_STORAGE_MODE), Docker containers, and internal storage keys.

  • Documentation Audit — Comprehensive update of all guides, architecture diagrams, and repository metadata.

  • Extension Stability — Fixed a crash in the popup when opened on restricted browser pages (chrome://, edge://).

[1.4.5] — 2026-05-11 — Frictionless Setup & UI Refinement

Installation & UX

  • One-Command Setup — Introduced the automated repository cloning and installation script.

  • Automated Extension Loading — The installer now automatically opens the extension folder and the Chrome extensions page.

  • Smart URL Mapping — Enhanced session persistence across varied platform URL formats (e.g. shared chats).

Dashboard & UI

  • Unified Header — Consolidated the dashboard top bar, moving Load Extension and Fact/Chat tabs into a unified, clean layout.

  • Improved Alignment — Fixed multiple layout regressions in the history list and chat bubbles.

Backend & MCP

  • MCP Resilience — Updated the Model Context Protocol server for parity.

  • Logging — Standardized backend logs for improved debugging.

[1.4.4] — 2026-05-10 — Architectural Hardening

Retrieval & Process

  • RAG Benchmarking — Introduced a quantitative harness to measure retrieval accuracy.

  • Context Budgeting — Character-based context window management.

  • Memory Decay — Time-based relevance scoring for aging conversations.

  • Data Portability — Session export and import functionality.

  • Bug Fixes — Resolved UI deadlocks caused by missing polling routes and ghost jobs remaining in the queue after a backend restart.

  • Test Coverage — Expanded unit tests for DOM resolvers and extraction logic.

[1.4.3] — 2026-05-09 — Hybrid Search & MCP Evolution

Retrieval & Intelligence

  • Hybrid Search (Vector + Graph) — Both the Dashboard and MCP server now perform Hybrid Retrieval. The system extracts entities from user prompts and queries the Knowledge Graph for structured facts, combining them with semantic vector chunks.

  • Global Hybrid Search — search_memory now performs cross-project graph scans, improving discovery across multiple repositories.

  • Smart Project Detection — Added identify_active_project MCP tool to automatically match a terminal's CWD to a ArcRift project ID.

MCP (Model Context Protocol) Improvements

  • Dashboard Visibility — Manual saves from MCP-compatible tools (Claude Code, Cursor) are now saved to the full_chats table and appear in the Dashboard history.

  • MCP Resources — Exposed the entire Knowledge Graph as a browsable MCP Resource (ArcRift://projects/{id}/graph).

  • LLM Robustness — Implemented try/catch fallbacks for AI extraction. If Ollama/Groq is unavailable, tools fallback gracefully to vector-only mode.

  • Config Generator — Added npm run mcp:config to automatically generate absolute path configurations for AI tools.

CI/CD & Maintenance

  • MCP Integration Tests — Added automated tool verification to GitHub Actions, running on every PR in the SQLite-native environment.

  • Stability Fixes — Resolved critical compilation errors and test regressions in the isValidObjectId validator.

[1.4.2] — 2026-05-08 — SQLite Native (Zero-Docker) Migration

Storage Architecture

  • Unified Storage Interface — Introduced ISessionStore, IGraphStore, and IVectorStore interfaces.

  • SQLite Support — Implemented better-sqlite3 and sqlite-vec backends, allowing ArcRift to run without Docker (MongoDB, Neo4j, ChromaDB).

  • Dynamic Storage Factory — Added ARCRIFT_STORAGE_MODE (docker/sqlite) to .env to toggle between legacy Docker and new local storage.

Onboarding & Deployment

  • Zero-Docker Fallback — install.bat and install.sh now automatically detect if Docker is missing/not running and default to SQLite mode.

  • Resource Efficiency — SQLite mode reduces RAM requirement to 2GB and disk requirement to 5GB.

  • Version Alignment — Synchronized version 1.4.2 across all modules: backend, dashboard, extension manifest, and MCP server.

Maintenance & Fixes

  • Unified ID Validation — Updated isValidObjectId to support both MongoDB ObjectIds and standard UUIDs for SQLite compatibility.

  • Jobs Worker — Migrated background extraction worker to the unified storage layer.

  • MCP Server — Full support for SQLite mode added to the Model Context Protocol server.

[1.4.1] — 2026-05-05 — Expanding Platform Support

Supported Platforms

  • New: DeepSeek (chat.deepseek.com) — Full support. Leverages DeepSeek's stable #chat-input ID and product-specific .ds-markdown classes.

  • All platforms (Claude, ChatGPT, Gemini, DeepSeek) now share the same multi-strategy resolver architecture.

Automated Maintenance

  • Expanded Selector Monitoring — scripts/check-selectors.js and the weekly GitHub Action now monitor all 4 platforms.

  • Fail-fast CI — Selector staleness check updated to alert on DeepSeek regressions.

Version Alignment

  • Unified project versioning across extension manifest, extension package, backend, and dashboard to 1.4.1.

[1.4.0] — 2026-05-03 — Security, MCP & Production Hardening

Security

  • Prompt injection defence — backend/src/middleware/sanitize.ts scans every retrieved RAG chunk for 10 known injection patterns before it reaches any AI. Matching content is replaced with [Content redacted: potential prompt injection pattern detected]

  • XML context delimiters — all injected context is wrapped in <ARCRIFT_retrieved_context> XML tags. LLMs treat XML-tagged content as structured data rather than executable instructions

  • SECURITY.md — expanded with prompt injection threat model and Groq privacy disclosure

MCP Server — Universal Memory Layer

  • New: backend/src/mcp/server.ts — standalone stdio MCP server compatible with Claude Code, Cursor, Windsurf, and Claude Desktop

  • Five tools: recall_context, store_memory, search_memory, list_projects, get_project_summary

  • All tools use the same MongoDB, ChromaDB, and Neo4j databases as the Chrome extension

  • New: MCP_SETUP.md — copy-paste setup guide for all supported AI tools

Resilient Selectors

  • New: extension/src/platform/resolver.ts — multi-strategy DOM selector resolver

  • Each platform now has 4–7 ordered fallback strategies: testid → aria-label → role → placeholder → generic contenteditable

  • MutationObserver in watchForInput() auto-reconnects when the input is not yet in the DOM (SPA navigation)

  • Claude, ChatGPT, and Gemini platform files updated to use INPUT_SELECTOR_STRATEGIES from the resolver

Smart Ollama / Groq Auto-Detect

  • extractor.ts — probes Ollama at startup. Uses llama3.1:8b locally if available; falls back to Groq with an explicit privacy warning if not

  • GROQ_API_KEY removed from mandatory env validation — now strictly optional

  • New env vars: GRAPH_BACKEND (force ollama or groq), OLLAMA_MODEL (default: llama3.1:8b)

Production Dashboard

  • backend/src/index.ts — sirv middleware serves dashboard/dist/ as static files on port 3001

  • No separate Vite dev server needed. Dashboard URL: http://localhost:3001

  • Dashboard build reduced from ~5 MB to ~319 KB (gzip: 105 KB)

  • CORS allowlist updated to include localhost:3001

Lite Mode

  • docker-compose.yml — added full and lite profiles. Neo4j tagged as full only

  • New: docker-compose.lite.yml — standalone file with only MongoDB + ChromaDB

Installers & Launchers

  • New: install.sh — one-command first-time setup for macOS/Linux (~3 min)

  • New: install.bat — one-command first-time setup for Windows

  • Updated: start.bat — RAM detection (WMIC), llama3.1:8b model check, dashboard build step, plain ASCII output (no box-drawing characters)

  • Updated: start.sh — RAM detection, Docker profiles, builds production dashboard instead of starting Vite dev server, adds MCP reference

CI/CD & Maintenance

  • New: .github/workflows/integration-tests.yml — full RAG pipeline integration test on every PR

  • New: .github/workflows/selector-check.yml — weekly headless check for selector staleness; auto-creates GitHub issues

  • New: .github/workflows/release.yml — auto-creates GitHub Release with extension zip on version tags

  • New: backend/tests/integration/pipeline.integration.test.ts — seeds a fixture and asserts end-to-end retrieval

  • New: ROADMAP.md — versioned milestones and planned features

TypeScript

  • backend/tsconfig.json — include: ["src/**/*"] explicit, tests/ excluded from rootDir, resolveJsonModule: true added. Compilation: 0 errors.

[1.3.3] — 2026-05-03 — Startup Robustness

  • Forced Docker Compose project name to ArcRift — prevents errors when the repository folder has dots or version numbers in the name

  • Removed Unicode box-drawing characters from start.bat that caused rendering errors in Windows CMD

[1.3.2] — 2026-05-03 — UI Refinement & Extension Features

Dashboard

  • Complete UI overhaul — new layout and color palette

  • Granular graph settings (node size, position, tension)

  • Collapsible left sidebar (Facts + Chat tabs)

  • Fixed staggered graph rendering lag on large knowledge graphs

  • Resolved UI arrow/connection rendering errors

Extension

  • Multi-save support — same chat can be saved multiple times without duplicate sessions

  • Unload Session button — explicitly disconnect from active session

  • Pause/Resume always visible in compact UI layout

  • Badge toggle — click the ArcRift badge to toggle on/off instantly

  • Save button contrast fix

[1.3.1] — 2026-05-01 — Scripts & Documentation

  • Fixed start.bat and start.sh parenthesis/pipe parsing errors

  • Added automatic Ollama and backend dependency checks in launchers

  • Suppressed npm deprecation warnings in build output

  • README: added project logo and demo video

  • Added .gitattributes and updated .gitignore for extension /dist

[1.3.0] — 2026-04-27 — UI/UX Overhaul & Open Source Readiness

Dashboard — Graph

  • Degree-scaled nodes: 8–60px radius — hub nodes visually dominant

  • Curved quadratic bezier edges with hover-reveal labels

  • Per-type colored glow filters (22 types)

  • Hover tooltip: name, type, connection count

  • Zoom controls (+/−/reset)

  • 3D radial gradient fills

Dashboard — Chat Viewer

  • Color-coded conversation: user messages right-aligned (indigo), assistant left-aligned (cyan)

  • Turn parser from raw text into styled bubbles

  • Header stats: turn count, message count, save date

Dashboard — App Shell

  • Sidebar redesign with Outfit typeface

  • Skeleton loaders during data loading

  • Error banner when backend is unreachable

  • React hook lint errors resolved (0 ESLint errors)

Open Source

  • Added CODE_OF_CONDUCT.md, SECURITY.md, .github/ISSUE_TEMPLATE/, PULL_REQUEST_TEMPLATE.md

  • Added CHANGELOG.md, ARCHITECTURE.md, RAG_PIPELINE.md, PLATFORM_SELECTORS.md, SELF_HOSTING.md, CONTRIBUTING.md

[1.2.0] — 2026-04-26 — Zero-Loss RAG + Auto-Connect

RAG Pipeline

Replaced the Groq topic splitter with a pure sliding window chunker:

Groq Topic SplitterSliding Window Chunker
Personal factsDeleted as "filler"Preserved verbatim
Short messagesRejectedAlways included
API call on saveYesNone
Data lossSignificantZero
Auto-Connect

Replaced manual Connect button with automatic interceptor attachment on init(). Simple Pause/Resume toggle replaces the connect state machine.

Knowledge Graph

  • Entity types: 12 → 22 (added: Person, Pet, Goal, Problem, Preference, Habit, Tool, Pattern, Location, Organization)

  • Relation types: ~6 → 20+ (added: OWNS, NAMED, PREFERS, WANTS, KNOWS, IS_BUILDING, SOLVED_WITH, etc.)

Bug Fixes

  • Infinite loop in chunker when overlapWords >= windowWords — clamped to windowWords - 1

  • start.bat closed immediately — missing call keyword before all npm/npx invocations

  • Session change not broadcast to other tabs — fixed with broadcastSessionChanged()

[1.1.0] — 2026-04-25 — Security & Reliability Audit

  • CORS locked from wildcard to explicit allowlist

  • Rate limiting: 200 req/min global; 10 req/min on /api/chat/save

  • sessionId validated as MongoDB ObjectId on all routes

  • Body limit reduced from 50 MB to 5 MB

  • Embeddings generated in parallel via Promise.all (was sequential)

  • Neo4j connection with exponential backoff retry (5 attempts)

  • Project summary cached in Session.summary

  • All console.log replaced with structured logger utility

[1.0.0] — 2026-04-24 — Initial Release

  • Chrome extension: Claude, ChatGPT, Gemini support

  • Groq LLaMA 3.1 knowledge graph extraction

  • MongoDB session and FullChat storage

  • Neo4j semantic graph (12 entity types)

  • Classic Inject (structured summary pasted into input)

  • React dashboard with D3.js force graph

  • Docker Compose infrastructure

241 files · 226 not served here

Advantages

  • Reduces prompt noise by up to 95% using surgical sentence trimming and selective context injection. evidence: README.md
  • Improves recall for indirect questions using HyDE (Hypothetical Document Embedding). evidence: README.md

Limitations

  • Requires local installation of Node.js and Ollama for embedding and extraction. evidence: README.md
  • Full Docker-based deployment requires significant system resources (8GB+ RAM). evidence: README.md

Security

Risk level: Low risk

This brain runs

MCP servers (3)

  • README.md (arcrift): node C:/path/to/ARCRIFT/backend/dist/mcp/server.js
  • README.md (arcrift): node /path/to/ARCRIFT/backend/dist/mcp/server.js
  • README.md (arcrift): node /path/to/ARCRIFT/backend/dist/mcp/server.js

Install scripts (1)

  • install.sh: sh install.sh

Binaries (1)

  • backend/bin/node.exe: ships native binaries
  • Low risk: scripts-present (install.sh)

AutoGineer scanned [email protected] (sha512-YruQn43fKFIOs6lYNYTVmChm2su+5nZ/Ihapd8NJirrfof226TDcUKkGPTpeXtGz5RU7M8LKHoYzpW4PHm/OpQ==).

Attribution and licence

First committed by
GitHub avatar of Eshaan-NairEshaan-Nair
Declared authors
  • Eshaan Nair (declared in package.json)
Publisher
Perma_Banned (Community)
Source
Eshaan-Nair/ArcRift · commit 5424ea1
Licence
MIT License (files served here)
  • ATTRIBUTION.md (written by AutoGineer)
Synced
Contributors
Eshaan-Nair, mseep-ai, ray910408, singhal-shagun

AutoGineer is not affiliated with or endorsed by Eshaan-Nair.

Install from source

226 of its files are not served here, so there is no ZIP. Eshaan-Nair/ArcRift at 5424ea1