AgentStack
Browse Sign in
Browse Why AgentStack Sell Docs
Sign in
MCP verified Apache-2.0 Self-run

Rifugio Community

mcp-anrrow2002-ctrl-rifugio-community · by anrrow2002-ctrl

我们的港湾

↗ Repository
— No reviews yet
0 installs
0 views
— view→install

Install

$ agentstack add mcp-anrrow2002-ctrl-rifugio-community

✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

  • ✓ Prompt-injection patterns
  • ✓ Secret / credential exfiltration
  • ✓ Dangerous shell & filesystem operations
  • ✓ Untrusted network calls
  • ✓ Known-malicious package signatures

What it can access

  • ✓ Network access No
  • ✓ Filesystem access No
  • ✓ Shell / process execution No
  • ● Environment & secrets Used
  • ✓ Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

View the full security report →

Verified badge

Passed review? Show it. Paste this badge into your README — it links to the public security report.

AgentStack Verified badge Links to your public security report.
[![AgentStack Verified](https://agentstack.voostack.com/badges/verified.svg)](https://agentstack.voostack.com/security/report/mcp-anrrow2002-ctrl-rifugio-community)

Reliability & compatibility

✓ Security review passed
0 installs to date
— no reviews yet
● yesterday

Declared compatibility

Claude CodeClaude DesktopCursorWindsurf

Compatibility is declared by the source manifest. End-to-end runtime verification is coming — see below.

Preview Execution monitoring

We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps — measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.

How agent discovery & health will work →
Are you the author of Rifugio Community? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

Rifugio Community

A self-hostable home for AI conversations, long-term memory, and MCP tools.

This is a clean-room community edition: application code and empty templates only. Production memories, chat logs, health data, media, credentials, private domains, and private Git history do not belong here.

What stays private

  • .env: credentials and cryptographic secrets
  • private/profile.json: names and relationship identity
  • private/features.json: optional personal integrations
  • private/persona.md: optional private persona prompt
  • data/: SQLite databases and generated files

All of them are ignored by Git.

Quick start (computer or NAS)

node scripts/setup.mjs
# edit private/profile.json
npm run privacy:scan
docker compose up -d --build

Open http://localhost:8080. The API creates empty databases and schemas on first start. Its health endpoint performs a rolled-back SQLite read/write probe, so it verifies storage without leaving test data.

Android phone-only hosting is documented in [Termux deployment](docs/TERMUX.md). See [deployment](docs/DEPLOYMENT.md), [architecture](docs/ARCHITECTURE.md), and the [safe publishing checklist](docs/PUBLISHING.md).

Layout

  • apps/web — installable PWA frontend
  • apps/api — HTTP API and provider orchestration
  • packages/mcp — canonical remote MCP server
  • config — public example configuration
  • private — ignored local identity and secrets
  • data — ignored databases and generated media

Security defaults

Arbitrary shell execution is not part of the Community MCP. Health, radio, image, voice, toy, and CLI bridge integrations are off by default. The API bridge uses an allowlist. MCP accepts a bearer token at /mcp; legacy token-in-path transport remains compatible but should not be placed in proxy access logs.

License and attribution

Rifugio-authored code is available under the Apache License 2.0 in [LICENSE](LICENSE). UI or virtual-phone portions that may be adapted from SullyOS / 手抓糯米机 remain subject to the PolyForm Noncommercial License 1.0.0. See [NOTICE](NOTICE) and [the included PolyForm license](LICENSES/PolyForm-Noncommercial-1.0.0.md).

Required Notice: Copyright (c) 2024-2026 NMJ (SullyOS / 手抓糯米机)

Redistributors must preserve all three files and the Required Notice. Commercial use is not authorized for SullyOS-derived portions without separate permission or a provenance audit that removes/replaces them.

Community builds ship emoji/character App launcher defaults rather than third-party photo icons. The installable PWA icons are separate project assets.

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet — be the first.

Write a review

Versions

  • v0.1.0 Imported from the upstream source.

More in Databases