{
  "markdown": "# voyager\n\n**The verified-brief organ for coding agents.**\n\nAn AI coding agent that reaches the open internet gets a raw, unsigned,\npossibly-poisoned blob and feeds it straight into its own prompt. voyager\nsits in front of that: it turns a query into a **cited, confidence-scored,\nOSV-gated, injection-hardened brief** — the only surface your model ever sees.\n\nEvery claim carries its provenance and a confidence signal. Package\nrecommendations pass a **fail-closed OSV vulnerability gate**, surface **build\nprovenance** (npm SLSA attestations) when present, and can be **reproduced in a\ndisposable twin** — install + smoke-import run inside a **hardened, rootless,\nnetwork-isolated container** (never on the host). That proves the package\ninstalls and its entrypoint loads; it is **not** a safety proof. All fetched\ntext is stripped of instruction-shaped payloads (multilingual + base64 + markdown\n/HTML vectors) and framed as **untrusted evidence the model must analyze, never obey**.\n\n- **check** — is this package safe to use? Registry facts + OSV gate (fail-closed)\n  + provenance/license/age supply-chain signals + optional isolated twin.\n  Exit codes: **0** ok · **1** rejected (unsafe) · **2** tool/usage error (no verdict).\n- **brief / retrieve** — a cited brief combining package verification, GitHub\n  discovery, canonical docs, and open-web search, each cross-referenced.\n- **security by construction** — one egress allowlist, https-only, streamed\n  size cap, injection-strip + evidence framing. Zero-network unless you query.\n\nCLI, library, and MCP server.\n\n## Install\n\n```bash\nnpm i @dir-ai/voyager\nnpx -y @dir-ai/voyager check express\n```\n\n## CLI\n\n```bash\nvoyager check <name> [--ecosystem npm|pypi] [--version V] [--twin]   # exit 1 if unsafe\nvoyager brief \"<query>\" [--package name] [--discover \"<intent>\"] [--search \"<q>\"] [--docs <lib>]\nvoyager discover \"<intent>\"     # GitHub repo discovery (Tier-A)\nvoyager search \"<query>\"        # open-web search (Tier-C, needs a key)\nvoyager docs <library>          # canonical docs (Tier-B)\nvoyager doctor                  # which source keys are configured\n```\n\n`check` is a natural CI gate: fail the build if an agent picked a vulnerable,\ndeprecated, or non-existent dependency.\n\n## Library\n\n```ts\nimport { checkPackage, voyagerRetrieve, setKeyResolver } from '@dir-ai/voyager'\n\nconst v = await checkPackage({ name: 'express', ecosystem: 'npm' })\n// → { verdict: 'belief' | 'fact' | 'rejected', claim, steps }  (adversarial trace)\n\nconst brief = await voyagerRetrieve('a safe date library', {\n  packages: [{ name: 'date-fns', ecosystem: 'npm' }],\n  discover: 'date library',\n})\nbrief.rendered   // the injection-hardened, framed text to feed a model\nbrief.claims     // structured, cited, confidence-scored\n\n// Bring your own key store (default is env vars):\nsetKeyResolver((provider) => mySecrets.get(provider))\n```\n\n## MCP server\n\n```jsonc\n// .mcp.json\n{\n  \"mcpServers\": {\n    \"voyager\": { \"command\": \"npx\", \"args\": [\"-y\", \"@dir-ai/voyager\", \"mcp\"] }\n  }\n}\n```\n\nTools: `check_package`, `retrieve`, `discover_repos`, `fetch_docs`.\n\n## Docker\n\n```bash\ndocker run --rm ghcr.io/dir-ai/voyager check express\ndocker run -i --rm ghcr.io/dir-ai/voyager mcp   # stdio MCP\n```\n\n## Tiers & trust\n\n| Tier | Source | Base trust |\n|------|--------|-----------|\n| **A** | GitHub · npm · PyPI · OSV (structured facts) | high |\n| **B** | canonical docs (official hosts only) | high |\n| **C** | open-web search (Tavily / Exa / Apify) | low — cross-referenced before trusted |\n| **D** | isolated twin (install + smoke in a container) | reproduction, not a safety proof |\n\nKeys are optional: the Tier-A core (npm/PyPI/OSV, and GitHub unauthenticated) is\nzero-key. Tier-C providers each no-op without their key. Set `GITHUB_TOKEN`,\n`TAVILY_API_KEY`, etc., or inject a resolver.\n\n## Security posture\n\nOne egress allowlist (a fixed set of public API hosts), https-only, `redirect:\nerror`, a **streamed** byte cap that aborts an oversized body mid-download, and\nan injection-strip that removes role-hijacks / chat-template tokens / zero-width\n& bidi characters, decodes-and-rescans base64, neutralizes markdown images and\nHTML comments, and matches instruction payloads across several languages. The\nframing is the real defense — the strip keeps it from being trivially escaped.\nThe twin runs the package's code **only inside a hardened, network-isolated,\nread-only, non-root container**; with no container runtime it refuses to run\n(returns `unsupported`) rather than execute on the host. See [SECURITY.md](./SECURITY.md).\n\n## Cache\n\nIdempotent Tier-A facts (npm / PyPI / OSV) are cached in-process **and** on disk\nunder `~/.voyager/cache` (content-addressed, TTL'd) so repeated checks are fast,\nsurvive across runs, and lean less on the network. No secret is ever written\n(auth headers are never part of a cache key or value). `VOYAGER_NO_CACHE=1`\ndisables it; `VOYAGER_CACHE_DIR` relocates it.\n\n## Roadmap\n\ndeps.dev-backed multi-ecosystem facts (crates / Go / RubyGems / Packagist),\ntyposquatting detection, PyPI/cargo twins. Contributions welcome.\n\n## License\n\nMIT © dir-ai\n",
  "bytes": 5118,
  "sha": "a9a59e6bcacb2c1d59a336782b1e8ebd17835de3e961ea1ba445695f3f64e392",
  "repo_slug": "dir-ai/voyager",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_dir_ai_voyager_16a5b298/readme"
}