ruvnet/ruflo

Review signals: 14 download and execute, 10 hardcoded secret, 1640 known vulnerability. 130 static matches retained as context.

Source contains download and execute; review its purpose. 4 distinct locations. 14 findings.

Gitleaks found a possible hardcoded secret; value withheld. 10 distinct locations. 10 findings.

OSV reports a known vulnerability in this dependency version. 85 distinct locations. 1003 findings.

29 download and execute matches retained as context; full list in the evidence.

3 encoded execution matches retained as context; full list in the evidence.

95 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Ruflo works as an MCP server that clients can call tools on: Real input produced the expected result: coldpass-probe-key

  Source: Use NPX for Ruflo project setup and connect your client to the Ruflo MCP server.

  Input: {"tool": "memory_store", "arguments": {"key": "coldpass-probe-key", "value": "coldpass-value-7731", "namespace": "coldpass"}}

  Expected: store succeeds and returns the key

  Command: npx -y ruflo@latest mcp start tools/call {"tool": "memory_store", "arguments": {"key": "coldpass-probe-key", "value": "coldpass-value-7731", "namespace": "coldpass"}}

  Observed: coldpass-probe-key\",\n \"namespace\": \"coldpass\",\n \"stored\": true,\n \"storedAt\": \"2026-10-23T15:40:41.682Z\",\n \"hasEmbedding\": true,\n \"embeddingDimensions\": 384,\n \"provenanceType\": \"unknown\",\n \"backend\": \"sqlite (bridge, brute-force cosine)\",\n \"storeTime\": \"1062.92ms\"\n}"}], "isError": false}

• Ruflo remembers values across sessions: Real input produced the expected result: coldpass-value-7731

  Source: remember across sessions

  Input: {"tool": "memory_retrieve", "arguments": {"key": "coldpass-probe-key", "namespace": "coldpass"}}

  Expected: the stored value is returned from a new server process

  Command: npx -y ruflo@latest mcp start tools/call {"tool": "memory_retrieve", "arguments": {"key": "coldpass-probe-key", "namespace": "coldpass"}}

  Observed: coldpass-value-7731\",\n \"tags\": [],\n \"storedAt\": 1792770041640,\n \"updatedAt\": 1792770041678,\n \"accessCount\": 1,\n \"hasEmbedding\": true,\n \"found\": true,\n \"backend\": \"sqlite (bridge, brute-force cosine)\"\n}"}], "isError": false}

Examples

• Quick non-interactive init sets up Ruflo in a project: command completed successfully

  Source: README.md CLI Install (npx ruflo@latest init); checked with init check

  Input: init check in a project created by init --minimal

  Expected: project reports initialized

  Command: npx -y ruflo@latest init check

  Observed: [OK] RuFlo is initialized [INFO] V3 Runtime: .claude-flow/config.yaml

Cycles

• Background worker can be triggered manually to run one cycle: Triggered one cycle by hand (run-once via daemon trigger -w audit; normal trigger: daemon background workers (no timer fired; manual trigger)): Worker audit completed in 8ms Output { "timestamp": "2026-10-23T15:40:48.902Z", "mode": "local", "checks": { "envFilesProtected": true, "gitIgnoreExists": true, "noHardcodedSecrets": true }, "riskLevel": "low", "recommendations": [], "note": "Install Claude Code CLI for AI-powered security analysis" } Transformers.js loaded: Xenova/all-MiniLM-L6-v2

  Source: v3/@claude-flow/cli/src/commands/daemon.ts

  Input: -w audit

  Expected: audit worker runs once and prints its result

  Command: npx -y ruflo@latest daemon trigger -w audit

  Observed: Worker audit completed in 8ms Output { "timestamp": "2026-10-23T15:40:48.902Z", "mode": "local", "checks": { "envFilesProtected": true, "gitIgnoreExists": true, "noHardcodedSecrets": true }, "riskLevel": "low", "recommendations": [], "note": "Install Claude Code CLI for AI-powered security analysis" } Transformers.js loaded: Xenova/all-MiniLM-L6-v2

Local or hosted: local

Start the Ruflo MCP server with npx and call its memory tools: store a value, then read it back from a new server process.

cd <guest-path> && pwd && ls -la && id -u && python3 --version && git --version 2>/dev/null; ls /inputs 2>/dev/null; head -c 400 README.md 2>/dev/null
cat /etc/os-release | head -3; which node npm uv pip3 2>&1; node --version 2>&1; ls <guest-path>
cd <guest-path> && grep -n -i -E "install|npx|node|requires|version" README.md | head -80
cd <guest-path> && sed -n 286,330p README.md; grep -n -i -E "prerequisite|node\.?js|node 20|node 18|>= ?[0-9]+" README.md | head -20; grep -A3 '"engines"' package.json; ls v3/@claude-flow/cli 2>/dev/null | head; cat .coldpass/* 2>/dev/null | head -5
sudo -n true && echo SUDO_OK; apt-cache policy nodejs 2>/dev/null | head -3; curl -sI https://deb.nodesource.com/ 2>&1 | head -1; env | grep -i proxy
cd /tmp && (curl -fsSL https://deb.nodesource.com/setup_22.x -o /tmp/ns_setup.sh && sudo -E bash /tmp/ns_setup.sh && sudo apt-get install -y nodejs) > /tmp/node_install.log 2>&1; echo rc=$?; tail -5 /tmp/node_install.log; node --version; npm --version
mkdir -p /tmp/ruflo-run && cd /tmp/ruflo-run && export NODE_USE_ENV_PROXY=1 && timeout 600 npx -y ruflo@latest --version > /tmp/ruflo_version.log 2>&1; echo rc=$?; tail -20 /tmp/ruflo_version.log
cd /tmp/ruflo-run && export NODE_USE_ENV_PROXY=1 && { printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"probe","version":"1"}}}' '{"jsonrpc":"2.0","method":"notifications/initialized"}' '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'; sleep 20; } | timeout 90 npx -y ruflo@latest mcp start > /tmp/mcp_list.out 2>/tmp/mcp_list.err; echo rc=$?; python3 -c "
import json,sys
for l in open('/tmp/mcp_list.out'):
    try: d=json.loads(l)
    except Exception: continue
    if d.get('id')==2:
        t=d['result']['tools']; print(len(t)); print([x['name'] for x in t][:60])
    if d.get('id')==1: print('init ok', d['result']['serverInfo'])
"; tail -3 /tmp/mcp_list.err
cd /tmp/ruflo-run && export NODE_USE_ENV_PROXY=1 && { printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"probe","version":"1"}}}' '{"jsonrpc":"2.0","method":"notifications/initialized"}' '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'; sleep 15; } | timeout 60 npx -y ruflo@latest mcp start 2>/dev/null > /tmp/mcp_list.out; python3 -c "
import json
for l in open('/tmp/mcp_list.out'):
    try: d=json.loads(l)
    except Exception: continue
    if d.get('id')==2:
        for x in d['result']['tools']:
            if x['name'] in ('memory_store','memory_retrieve'): print(json.dumps(x['inputSchema']))
"
mkdir -p /tmp/mcpclient && cat > /tmp/mcpclient/call.py <<'EOF'
import json, subprocess, sys
# usage: call.py <tool> <json-args>
tool, args = sys.argv[1], json.loads(sys.argv[2])
msgs = [
 {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"probe","version":"1"}}},
 {"jsonrpc":"2.0","method":"notifications/initialized"},
 {"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":tool,"arguments":args}},
]
inp = "\n".join(json.dumps(m) for m in msgs) + "\n"
p = subprocess.run(["npx","-y","ruflo@latest","mcp","start"], input=inp, capture_output=True, text=True, timeout=240, cwd="/tmp/ruflo-run", env={**__import__('os').environ, "NODE_USE_ENV_PROXY":"1"})
for l in p.stdout.splitlines():
    try: d = json.loads(l)
    except Exception: continue
    if d.get("id") == 2:
        print(json.dumps(d, indent=1)[:3000])
EOF
cd /tmp/ruflo-run && timeout 300 python3 -I /tmp/mcpclient/call.py memory_store '{"key":"coldpass-probe-key","value":"coldpass-value-7731","namespace":"coldpass"}'; echo rc=$?
cat > /tmp/mcpclient/call.py <<'EOF'
import json, subprocess, sys, os, time
tool, args = sys.argv[1], json.loads(sys.argv[2])
env = {**os.environ, "NODE_USE_ENV_PROXY": "1"}
p = subprocess.Popen(["npx","-y","ruflo@latest","mcp","start"], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, text=True, cwd="/tmp/ruflo-run", env=env)
def send(m): p.stdin.write(json.dumps(m)+"\n"); p.stdin.flush()
send({"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"probe","version":"1"}}})
send({"jsonrpc":"2.0","method":"notifications/initialized"})
send({"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":tool,"arguments":args}})
while True:
    l = p.stdout.readline()
    if not l: break
    try: d = json.loads(l)
    except Exception: continue
    if d.get("id") == 2:
        print(json.dumps(d, indent=1)[:3000]); break
p.stdin.close(); p.wait(timeout=60)
EOF
cd /tmp/ruflo-run && timeout 400 python3 -I /tmp/mcpclient/call.py memory_store '{"key":"coldpass-probe-key","value":"coldpass-value-7731","namespace":"coldpass"}'; echo rc=$?
cd /tmp/ruflo-run && timeout 400 python3 -I /tmp/mcpclient/call.py memory_retrieve '{"key":"coldpass-probe-key","namespace":"coldpass"}'; echo rc=$?
cd <guest-path> && grep -n -i -E "cron|schedul|--once|--now|webhook|telemetry|loop" README.md | head -30; cd /tmp/ruflo-run && export NODE_USE_ENV_PROXY=1 && timeout 300 npx -y ruflo@latest init --help 2>/dev/null | head -60
mkdir -p /tmp/ruflo-init-demo && cd /tmp/ruflo-init-demo && export NODE_USE_ENV_PROXY=1 && timeout 600 npx -y ruflo@latest init --minimal --no-signup --no-skills-sh --no-global --skip-claude --no-plugin-install < /dev/null > /tmp/init.log 2>&1; echo rc=$?; tail -25 /tmp/init.log; ls -la /tmp/ruflo-init-demo
cd /tmp/ruflo-init-demo && export NODE_USE_ENV_PROXY=1 && timeout 300 npx -y ruflo@latest daemon --help 2>/dev/null | head -40; timeout 120 npx -y ruflo@latest init check 2>/dev/null | tail -3
cd /tmp/ruflo-init-demo && export NODE_USE_ENV_PROXY=1 && timeout 600 npx -y ruflo@latest daemon trigger -w audit > /tmp/trigger.log 2>&1; echo rc=$?; tail -15 /tmp/trigger.log; grep -rn "trigger" <guest-path> 2>/dev/null | head -5
cd <guest-path> && mkdir -p .coldpass && cd /tmp/ruflo-run && NODE_USE_ENV_PROXY=1 timeout 300 python3 -I /tmp/mcpclient/call.py memory_store '{"key":"coldpass-probe-key","value":"coldpass-value-7731","namespace":"coldpass"}' | grep -o 'stored\\\\": true' | head -1; cd <guest-path> && python3 -I - <<'EOF'
import json
W="<guest-path>"
readme=open(W+"/README.md",encoding="utf-8").read()
q1="Use NPX for Ruflo project setup and connect your client to the Ruflo MCP server."
q2="remember across sessions"
for q in (q1,q2): assert q in readme, q
mcp_argv=["npx","-y","ruflo@latest","mcp","start"]
claims=[
 {"kind":"claim","claim":"Ruflo works as an MCP server that clients can call tools on",
  "source":q1,"input":"memory_store key coldpass-probe-key value coldpass-value-7731",
  "expected":"store succeeds and returns the key","probe_kind":"mcp","argv":mcp_argv,
  "tool":"memory_store","arguments":{"key":"coldpass-probe-key","value":"coldpass-value-7731","namespace":"coldpass"},
  "expected_text":"coldpass-probe-key","cwd":"/tmp/ruflo-run"},
 {"kind":"claim","claim":"Ruflo remembers values across sessions",
  "source":q2,"input":"memory_retrieve key coldpass-probe-key namespace coldpass",
  "expected":"the stored value is returned from a new server process","probe_kind":"mcp","argv":mcp_argv,
  "tool":"memory_retrieve","arguments":{"key":"coldpass-probe-key","namespace":"coldpass"},
  "expected_text":"coldpass-value-7731","cwd":"/tmp/ruflo-run"},
]
probe={"kind":"mcp","argv":mcp_argv,"cwd":"/tmp/ruflo-run","tool":"memory_retrieve",
 "arguments":{"key":"coldpass-probe-key","namespace":"coldpass"},"expected_text":"coldpass-value-7731"}
examples=[
 {"kind":"example","claim":"Quick non-interactive init sets up Ruflo in a project",
  "source":"README.md CLI Install (npx ruflo@latest init); checked with init check",
  "input":"init check in a project created by init --minimal","expected":"project reports initialized",
  "argv":["npx","-y","ruflo@latest","init","check"],"cwd":"/tmp/ruflo-init-demo","env":{"NODE_USE_ENV_PROXY":"1"},
  "expected_text":"RuFlo is initialized"},
]
cycles={"detected":True,"checks":[{
 "claim":"Background worker can be triggered manually to run one cycle",
 "source":"v3/@claude-flow/cli/src/commands/daemon.ts",
 "quote":"description: 'Manually trigger a specific worker',",
 "schedule":"daemon background workers (no timer fired; manual trigger)",
 "method":"run-once via daemon trigger -w audit",
 "input":"-w audit",
 "expected":"audit worker runs once and prints its result",
 "kind":"cli","argv":["npx","-y","ruflo@latest","daemon","trigger","-w","audit"],
 "cwd":"/tmp/ruflo-init-demo","expected_text":"Worker audit completed"}]}
src=open(W+"/v3/@claude-flow/cli/src/commands/daemon.ts",encoding="utf-8").read()
assert cycles["checks"][0]["quote"] in src
json.dump(claims,open(W+"/.coldpass/claims.json","w"),indent=1)
json.dump(probe,open(W+"/.coldpass/probe.json","w"),indent=1)
json.dump(examples,open(W+"/.coldpass/examples.json","w"),indent=1)
json.dump(cycles,open(W+"/.coldpass/cycles.json","w"),indent=1)
print("written")
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay; echo rc=$?
pgrep -af "ruflo" | grep -v pgrep | head; cd <guest-path> && mkdir -p .coldpass && python3 -I - <<'EOF'
import json
r={"outcome":"working","fault_owner":None,
"operation":"Start the Ruflo MCP server with npx and call its memory tools: store a value, then read it back from a new server process.",
"operation_scope":"Linux Ubuntu 24.04, Node 22 (README requires >=20), npx ruflo@latest v3.59.17 from npm; offline checker replay of README claims, one manual daemon cycle; local SQLite memory store in /tmp/ruflo-run.",
"steps":[
 "npx -y ruflo@latest --version",
 "npx -y ruflo@latest mcp start (stdio MCP server, tools/list returned 367 tools)",
 "tools/call memory_store key=coldpass-probe-key value=coldpass-value-7731 namespace=coldpass",
 "tools/call memory_retrieve key=coldpass-probe-key namespace=coldpass -> coldpass-value-7731",
 "npx -y ruflo@latest init --minimal --no-signup --no-skills-sh --no-global --skip-claude --no-plugin-install",
 "npx -y ruflo@latest init check",
 "npx -y ruflo@latest daemon trigger -w audit"],
"deviations":[
 "Node/npm were not installed in the guest. Installed Node 22.23.4 with the NodeSource setup_22.x script and apt (sudo); README/package.json requires node >=20.",
 "Did not run the README one-line curl|bash installer or the interactive 'init wizard'; used the documented npx commands instead.",
 "Used init flags --no-signup --no-skills-sh --no-global --skip-claude --no-plugin-install to avoid signup, global ~/.claude writes, and plugin installs. init still enabled ruflo mods in the demo project's .claude/settings.json.",
 "npx-published package runs from /tmp/ruflo-run and /tmp/ruflo-init-demo (outside the checkout), not <guest-path>, as the task requires.",
 "Probe and claim commands assume the memory key stored during setup is still in /tmp/ruflo-run; memory_retrieve depends on that store.",
 "No browser, credentials or external network services were used; no servers were left running."],
"stuck_step":None,"main_blocker":None,"plain_failure":None,
"suggested_fix":None}
json.dump(r,open("<guest-path>","w"),indent=1)
print("report written")
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay | python3 -c "import json,sys; d=json.load(sys.stdin); print(d['valid'], d['problems'], d['replay']['status'])"
ls -la /inputs/coldpass-preflight.py 2>&1; [ -f /inputs/coldpass-preflight.py ] && <env-var>=<guest-path> python3 -I /inputs/coldpass-preflight.py --validate --replay | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('valid'), d.get('problems'), d.get('replay',{}).get('status'))"
cd <guest-path> && python3 -I - <<'EOF'
import json
p="<guest-path>"
r=json.load(open(p))
r["deviations"].append("/inputs/coldpass-preflight.py does not exist in this VM; the validation run used <guest-path> (the checker the task's validate command names), which reported valid=true and replay PASS.")
json.dump(r,open(p,"w"),indent=1)
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay | python3 -c "import json,sys; d=json.load(sys.stdin); print(d['valid'], d['problems'], d['replay']['status'])"; ls -la .coldpass