security-audit-cli

TricorderKit

CLI-first Agentic Knowledge Operating System — local-first

---

What is TricorderKit?

TricorderKit is an Agentic Knowledge OS — a local-first system that transforms user intentions into traceable, auditable, and reusable workflows.

v0.6 definition : memory + skills + token hygiene + observability
v0.7 definition : CLI-first Agentic OS + Temporal workflows + skill registry + deep research + Obsidian knowledge layer
v0.8 definition : linked_project architecture + hook layer + quality loop + CLI tk + audit tools
v0.9 definition : Supabase layer + Langfuse observability + obsidian-agent-layer + tk doctor + public-ready documentation
v0.9.5 definition : graphify hybrid RAG (vault local-first, dense search, incremental indexer) + veille ingestion dedup (G1) + obsidian-goat ID safety (replace-id R29 / next-id R34) + security hardening

What's New (v0.9.5) : the graphify plugin gains a local-first hybrid RAG layer — incremental vault indexer, dense semantic search, a veille-ingestion bridge with G1 deduplication (new vs existing entries gated against the Master Index), and a health heartbeat (DEC-023). The obsidian-goat tool now guarantees safe ID operations (replace-id, next-id).

It takes inspiration from the Star Trek tricorder — a tool that scans, analyzes, and synthesizes information on demand.

---

Stack

Layer	Technology	Purpose
Agent	Claude Code (Anthropic)	Main reasoning agent
Knowledge	Obsidian (local vault)	Local-first knowledge base
Connectors	MCP servers	Service integrations
Graph DB	Neo4j 5.18	Relational knowledge graph
Vector DB	Qdrant v1.8.4	Semantic search / RAG
Workflows	Temporal 1.23	Persistent workflow engine
Observability	Langfuse 2	Token tracing + cost tracking
Infrastructure	Docker Compose	Local infra
CLIs	cli-forge (custom)	Deterministic API wrappers

---

Quick Start

# 1. Clone the repo
git clone https://github.com/GeekFamilyCorp/TricorderKit.git
cd TricorderKit

# 2. Copy and fill environment variables
cp .env.example .env

# 3. Start infrastructure (optional — Phase 3+)
docker compose up -d

# 4. Boot the agent session
/tk:boot

Full setup (prerequisites, make install, tk doctor) → INSTALL.md. A root Makefile wraps common tasks: make doctor, make test, make gate.

---

CLI Usage

TricorderKit ships a unified tk CLI plus deterministic domain CLIs generated by the cli-forge plugin. They replace raw API calls with structured, cacheable, dry-run-able commands.

tk — unified entrypoint

python cli/tk.py doctor                  # health-check (14 checks)
python cli/tk.py status --format json    # system state
python cli/tk.py security audit          # secrets + anonymization + patterns
python cli/tk.py research run "<query>" --dry-run
python cli/tk.py project audit <id>      # audit a linked_project

obsidian-goat — safe vault ID operations (v0.9.5)

# Next free ID for a prefix (R34) + collision check
python tools/obsidian-goat/obsidian_goat.py next-id ST --check ST027

# Rename an ID, bounded to the full token (R29) — dry-run by default, --apply to write
python tools/obsidian-goat/obsidian_goat.py replace-id ST012 ST200 --apply

github-goat — generated example CLI (cli-forge)

python plugins/cli-forge/generated/github-goat/github_goat.py list-repos <owner>
python plugins/cli-forge/generated/github-goat/github_goat.py --dry-run list-repos <owner>

Windows encoding tip: Set PYTHONUTF8=1 before running scripts to handle non-ASCII characters correctly.

---

Agent Commands

Slash commands live in .claude/commands/ (Claude Code). Current set:

/boot            → load state + memory + context
/token-check     → token budget audit
/vault-analyze   → analyze vault structure
/vault-audit     → audit vault coherence
/vault-delta     → vault change delta
/vault-optimize  → vault token optimization
/vault-sync      → sync vault routing
/jp-scraper-scan → run a domain source scan
/jp-scraper-audit→ audit domain sources

For operational tasks, prefer the tk CLI (see CLI Usage): tk doctor, tk status, tk security audit, tk research run, tk project audit, …

---

Repo Structure