agent-wire-cli 0.2.3__tar.gz → 0.2.4__tar.gz

{agent_wire_cli-0.2.3 → agent_wire_cli-0.2.4}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-wire",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Live web and 31-platform access for agents: token-compressed, privacy-firewalled, injection-shielded. Auto-triggers on links and live questions.",
   "author": {
     "name": "uncoalesced"

{agent_wire_cli-0.2.3 → agent_wire_cli-0.2.4}/.github/dependabot.yml

@@ -1,7 +1,8 @@
 version: 2
 updates:
   # Python dependencies in uv.lock. Security fixes come as separate PRs straight away
-  # (Dependabot security updates); this keeps routine upgrades to one weekly batch.
+  # (Dependabot security updates); this keeps routine upgrades to one weekly batch. Routine
+  # upgrades wait 7 days after a release, so a hijacked version is usually pulled before we take it.
   - package-ecosystem: uv
     directory: /
     target-branch: dev
@@ -13,6 +14,8 @@ updates:
         patterns: ["*"]
         update-types: [minor, patch]
     open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
 
   # Actions are pinned to commit SHAs; this bumps the SHA and the version comment together.
   - package-ecosystem: github-actions

{agent_wire_cli-0.2.3 → agent_wire_cli-0.2.4}/.github/workflows/ci.yml

@@ -17,10 +17,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       - name: Lockfile matches pyproject.toml
         run: uv lock --check
       - name: Install
@@ -44,10 +44,10 @@ jobs:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           python-version: ${{ matrix.python }}
       - name: Install
@@ -59,10 +59,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       - name: Build sdist and wheel
         run: uv build
       - name: Package metadata renders on PyPI
@@ -93,10 +93,10 @@ jobs:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           python-version: ${{ matrix.python }}
       - name: Build wheel

{agent_wire_cli-0.2.3 → agent_wire_cli-0.2.4}/.github/workflows/codeql.yml

@@ -27,7 +27,7 @@ jobs:
       contents: read
       security-events: write # upload results to the Security tab
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1

{agent_wire_cli-0.2.3 → agent_wire_cli-0.2.4}/.github/workflows/release.yml

@@ -15,10 +15,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           enable-cache: false # never build a release from a cache another run could have written
       - name: Tag matches the package version
@@ -29,7 +29,7 @@ jobs:
       - run: uv run pytest -q
       - run: uv build
       - run: uvx twine check --strict dist/*
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: dist
           path: dist/
@@ -42,7 +42,7 @@ jobs:
     permissions:
       id-token: write # PyPI trusted publishing
     steps:
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: dist
           path: dist/

{agent_wire_cli-0.2.3 → agent_wire_cli-0.2.4}/.github/workflows/security.yml

@@ -21,10 +21,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       - name: Export the lockfile
         run: uv export --frozen --no-hashes --all-extras --no-emit-project -o requirements-audit.txt
       - name: pip-audit
@@ -35,10 +35,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       - name: bandit
         run: uvx bandit==1.9.4 -r src -ll
 
@@ -47,10 +47,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       - name: zizmor
         run: uvx zizmor==1.31.1 --format plain .github/workflows
         env:
@@ -62,7 +62,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

{agent_wire_cli-0.2.3 → agent_wire_cli-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agent-wire-cli
-Version: 0.2.3
+Version: 0.2.4
 Summary: High-speed, privacy-first, token-compressed live web and multi-platform intelligence engine for AI agents.
 Project-URL: Homepage, https://github.com/uncoalesced/agent-wire
 License: MIT
@@ -43,6 +43,7 @@ Description-Content-Type: text/markdown
   <a href="https://github.com/uncoalesced/agent-wire/actions/workflows/ci.yml"><img alt="CI" height="20" src="https://img.shields.io/github/actions/workflow/status/uncoalesced/agent-wire/ci.yml?branch=main&label=ci"></a>
   <a href="LICENSE"><img alt="MIT license" height="20" src="https://img.shields.io/badge/license-MIT-f5b884"></a>
   <a href="https://m8ven.ai/mcp/uncoalesced/agent-wire?s=readme"><img alt="M8ven Score" height="20" src="https://m8ven.ai/badge/mcp/uncoalesced/agent-wire"></a>
+  <a href="https://mcpservers.org/servers/uncoalesced/agent-wire"><img alt="Listed on mcpservers.org" height="20" src="https://mcpservers.org/badge.svg"></a>
 </p>
 
 <p align="center">
@@ -459,52 +460,65 @@ Tokens are the cost an agent feels first: money on an API plan, rate limits on a
 
 ### What a page costs
 
-We read a set of pages cold, from India, with a fresh `WIRE_HOME`, on 2026-10-20 (v0.2.1), and counted tokens with tiktoken. "Raw HTML" is what a plain fetch returned. Six of the pages are below.
-
-| Page | Raw HTML tokens | agent-wire tokens | Saved |
-|---|---|---|---|
-| GitHub issue (uv #1495) | 197,594 | 2,066 | 99% |
-| YouTube video page | ~533,000 | 3,040 | 99% |
-| Wikipedia (Model Context Protocol) | 79,926 | 1,868 | 98% |
-| dev.to/t/ai | 52,636 | 835 | 98% |
-| docs.python.org asyncio page | 50,059 | 2,989 | 94% |
-| arXiv abstract (Attention Is All You Need) | 12,961 | 3,031 | 77% |
-
-Across the benchmark set the typical saving was 94% (the median, counting only pages where a plain fetch worked), and the arXiv abstract was the weakest case. Hacker News, Stack Overflow and Medium refused the plain fetch outright, so there is no raw count to compare against. agent-wire read all three.
-
-A cold read of one URL took about 1.4 to 1.9 seconds at the median, from 0.15 seconds (dev.to) to about 10 seconds (Reddit through the archive fallback). One search that auto-reads its top hits took about 2.3 seconds and returned around 2,400 tokens.
+On 2026-11-04 we read 16 pages from India, three times each, every time cold with a fresh `WIRE_HOME`, on the `dev` branch after v0.2.3 (commit `e7077af`). Tokens are counted with tiktoken (`o200k_base`), and the agent-wire count includes its header line, since that reaches the model too. "Plain fetch" is one ordinary GET with a browser user agent. [Jina Reader](https://jina.ai/reader/) is the free `r.jina.ai` endpoint with no key, which is what Agent-Reach uses first for web reads.
+
+| Page | Plain fetch | Jina Reader | agent-wire | Saved vs plain |
+|---|---|---|---|---|
+| GitHub issue (uv #1495) | 184,922 | failed (403) | 2,066 | 99% |
+| GitHub repo README (uv) | 152,386 | failed (403) | 3,003 | 98% |
+| YouTube video page | 630,615 | failed (bot check) | 3,031 | 99.5% |
+| Wikipedia (Model Context Protocol) | 80,494 | 8,326 | 1,868 | 98% |
+| dev.to/t/ai | 56,834 | 12,290 | 1,017 | 98% |
+| Cloudflare blog post | 105,755 | 2,369 | 2,051 | 98% |
+| MDN Fetch API | 41,251 | 1,355 | 633 | 98% |
+| Bluesky profile | 15,673 | 142 | 756 | 95% |
+| Hacker News thread | 32,712 | 16,656 | 1,933 | 94% |
+| docs.python.org asyncio | 6,941 | 883 | 584 | 92% |
+| arXiv abstract (Attention Is All You Need) | 12,961 | 772 | 3,031 | 77% |
+| Stack Overflow question | blocked (403) | 25,821 | 2,211 | |
+| Medium post | blocked (403) | failed (403) | 2,827 | |
+| Reddit r/Python | blocked | failed (blocked) | 2,395 | |
+| npm package page (react) | blocked (403) | failed (CAPTCHA) | 123 | |
+| Cloudflare challenge page (nowsecure.nl) | challenge page | 52 | 87 | |
+
+- **Pages read:** agent-wire 16 of 16, Jina Reader 10 of 16, plain fetch 11 of 16.
+- **Saving vs plain fetch:** median 98% on the 11 pages a plain fetch could read. The arXiv abstract was the weakest at 77%, because agent-wire opens the full paper rather than the abstract page and fills its token budget from it.
+- **Against Jina Reader:** on the 10 pages both could read, agent-wire returned 14,171 tokens in total and Jina 68,666, so 79% fewer, and fewer on 7 of the 10. Jina was smaller on the arXiv abstract (it returns only the abstract page), the Bluesky profile (a thin cached snapshot) and the nowsecure.nl page. The comparison isn't like for like: agent-wire trims every read to a budget (3,000 tokens by default, ranked by relevance when you pass a `query`), and Jina returns the whole page. Long Hacker News and Stack Overflow threads are where that shows most.
+- **Speed:** a cold read took 0.76 seconds at the median over 48 reads, and 3.1 seconds at the 90th percentile. The slowest was the Cloudflare challenge page, which goes through the stage 4 browser: 6 to 16 seconds. Jina's median was 0.7 seconds on the pages it could read, with a few 15 to 16 second outliers.
+- **Search:** five searches that auto-read their top hits took 2.4 seconds at the median and returned about 2,500 tokens each.
 
 ### What it costs to have it installed
 
-This is the part that doesn't flatter agent-wire, so here it is plainly. On 2026-10-29 we counted what each tool puts into context before it does any work, using the `o200k_base` tokenizer. Claude's tokenizer counts differently, so read these as comparable to each other and not as an exact bill.
+This is the part that doesn't flatter agent-wire, so here it is plainly. We counted what each tool puts into context before it does any work, using the `o200k_base` tokenizer. Claude's tokenizer counts differently, so read these as comparable to each other and not as an exact bill. The agent-wire rows were re-counted on 2026-11-04 from the server's live tool list, taking each tool's name, description and input schema, which is what an API client sends to the model. That method counts a little more than the one we used on 2026-10-29 (1,603 for the standard profile then); the tools themselves haven't changed since v0.2.3.
 
 | What loads | Tokens | When |
 |---|---|---|
-| agent-wire tool definitions, standard profile (8 tools) | 1,603, plus 150 for server instructions | every session |
-| agent-wire tool definitions, `--profile local` (7 tools) | 740 | every session |
-| agent-wire tool definitions, `--code-mode` (2 tools) | 471 | every session |
-| agent-wire skill (`SKILL.md`) | 1,354 | when the skill triggers, depending on the client |
-| [last30days](https://github.com/mvanhorn/last30days-skill) skill (`SKILL.md`, v3.31.0) | 7,029 | when the skill triggers |
-| [Agent-Reach](https://github.com/Panniantong/Agent-Reach) skill (`SKILL.md`) | 1,933 | when the skill triggers |
+| agent-wire tool definitions, standard profile (8 tools) | 1,838, plus 150 for server instructions | every session |
+| agent-wire tool definitions, `--profile local` (7 tools) | 961 | every session |
+| agent-wire tool definitions, `--code-mode` (2 tools) | 500 | every session |
+| agent-wire tool definitions, `--profile local --code-mode` (2 tools) | 155 | every session |
+| agent-wire skill (`SKILL.md`) | 1,342 | when the skill triggers, depending on the client |
+| [last30days](https://github.com/mvanhorn/last30days-skill) skill (`SKILL.md`, v3.31.0, counted 2026-10-29) | 7,029 | when the skill triggers |
+| [Agent-Reach](https://github.com/Panniantong/Agent-Reach) skill (`SKILL.md`, counted 2026-10-29) | 1,933 | when the skill triggers |
 
-An MCP server pays its tool definitions in every session, used or not. A skill costs roughly its one-paragraph description until it triggers. So on a day you never touch the web, agent-wire is the most expensive of the three to have installed. On a day you do, the order flips: its tool list plus its skill come to about 3,100 tokens, and last30days's skill alone is about 7,000. If the 1,603 bothers you, `--profile local` and `--code-mode` cut it to 740 and 471.
+An MCP server pays its tool definitions in every session, used or not. A skill costs roughly its one-paragraph description until it triggers. So on a day you never touch the web, agent-wire is the most expensive of the three to have installed. On a day you do, the order flips: its tool list, instructions and skill come to about 3,300 tokens, and last30days's skill alone is about 7,000. If the 1,838 bothers you, `--profile local` and `--code-mode` cut it to 961 and 500, and both together to 155.
 
 The comparison isn't clean. last30days's `SKILL.md` also carries a setup wizard and formatting rules, and Agent-Reach's is largely Chinese text, so its count isn't directly comparable with an English file's.
 
 ### What a task costs
 
-Code Mode is where the biggest single saving is. The bundled benchmark (`pytest -s tests/test_codemode_bench.py`) asks for the top four Hacker News threads on a topic with each thread's three best comments, offline. It counts every token that enters the model's context: the tool arguments or the script, plus every tool result.
+Code Mode is where the biggest single saving is. The task: find the top four Hacker News threads on "rust async" and give each thread's three best comments. We count every token that enters the model's context: the tool arguments or the script, plus every tool result. The live run is from 2026-11-04 (three cold runs, same result each time); the offline one is the bundled benchmark (`pytest -s tests/test_codemode_bench.py`) on canned pages.
 
-| Route | Context tokens | Round trips |
-|---|---|---|
-| Classic tools (one search, one batched read) | 3,394 | 2 |
-| `wire_run` script | 468 | 1 |
+| Route | Context tokens, live | Context tokens, offline | Round trips |
+|---|---|---|---|
+| Classic tools (one search, one batched read) | 2,864 | 3,394 | 2 |
+| `wire_run` script | 459 | 468 | 1 |
 
-That is 86% fewer. On a live run over Reddit and Hacker News, a script fetched 41,005 tokens of pages and returned 61 to the model.
+That is 84% fewer live and 86% offline. In the live run the script's two calls pulled in 210,569 tokens of pages, and 297 tokens of answer came back to the model; the whole script took about 2.4 seconds. A second script that read r/LocalLLaMA and the Hacker News front page in parallel fetched 13,469 tokens and returned 569.
 
 ### What we didn't measure
 
-We have not run last30days or Agent-Reach against agent-wire on the same pages, so we have no per-page or per-task comparison to show. Neither project publishes per-run token figures in its README (we checked both), so there was nothing to quote either.
+We have not run last30days or Agent-Reach themselves against agent-wire on the same pages. The Jina Reader column above covers the first step of Agent-Reach's web reads, not the whole tool, and we have no per-task comparison with either. Neither project publishes per-run token figures in its README (we checked both), so there was nothing to quote either.
 
 What their own docs say is structural. Agent-Reach tries an ordered list of tools for each action (web reads go to Jina Reader first, then Exa) and returns what they produce. Its README says some channels, such as Xueqiu, V2EX and GitHub, come back as organized content, but it describes no token budget or slicing step. last30days collects and ranks evidence across sources, and its `SKILL.md` has the host model write the brief from that evidence, so the evidence lands in your context and the model's brief is output tokens on top. Those are differences in design, not measurements, and either could be smaller than it looks.
 
@@ -636,6 +650,24 @@ Pages get the opposite treatment. Anything a person reading the page couldn't se
 
 Logins you add with `wire auth login <site>` live in an AES-GCM vault whose key is protected by Windows DPAPI, or by a 0600 key file on macOS and Linux.
 
+### Supply chain
+
+A lot of recent malware has arrived through package registries: a hijacked npm package, or a post-install script that runs the moment you install something. Here is what agent-wire pulls in and how it gets to you, as of a scan on 2026-11-04.
+
+- **No npm, no Node.** agent-wire is a Python package on PyPI. `uvx` or `pip` installs it, and nothing runs `npm` or `npx`.
+- **No install scripts.** Every package in the lockfile ships prebuilt wheels, and installing a wheel unpacks files without running any of its code. Only the optional extras fetch more later, and only when you ask: `stealth` needs `playwright install chromium`, and `local-whisper` downloads a speech model on first use.
+- **Small direct list.** 13 direct dependencies (12 on Python 3.13 and newer), all long-standing projects. The youngest is `quickjs-ng`, the Code Mode sandbox engine, first released in February 2026. With everything they pull in, that is 94 packages, or 117 with every optional extra.
+- **Pinned and hashed.** `uv.lock` pins every package to one version with sha256 hashes, and CI installs from it. `pip install` and `uvx` resolve fresh versions within the ranges in `pyproject.toml`, so if you want our exact set, install from a checkout with `uv sync --locked`.
+- **Scanned.** `pip-audit` over the full locked set (runtime plus every extra) found one advisory: CVE-2026-119284 in `joserfc`, pulled in through `fastmcp`. agent-wire never parses the JSON web tokens it concerns, and the lock now uses the fixed version, so there are no known vulnerabilities. Bandit found nothing at medium severity or above, and zizmor finds nothing in the workflows. CodeQL flagged seven host checks that matched by substring (so `evilnpmjs.com` counted as npm); those now match the exact host or its subdomains. Cookies were never at risk, because the vault picks them by the real request host.
+- **Routine upgrades wait.** Dependabot holds routine dependency and Actions upgrades for 7 days after a release, so a hijacked version usually gets yanked before we take it. Security fixes still arrive straight away.
+- **Releases you can check.** Releases are built and uploaded by GitHub Actions through PyPI Trusted Publishing, so no upload token exists to steal. Each file on PyPI carries a signed attestation that ties it to `release.yml` in this repository. Actions are pinned to commit SHAs, and every pull request runs `pip-audit`, bandit, zizmor, dependency review and CodeQL.
+
+To check a release yourself:
+
+```bash
+uvx --from pypi-attestations pypi-attestations verify pypi --repository https://github.com/uncoalesced/agent-wire pypi:agent_wire_cli-0.2.3-py3-none-any.whl
+```
+
 ## Privacy Policy
 
 agent-wire runs on your machine. There's no agent-wire server, no account, no analytics and no telemetry.

{agent_wire_cli-0.2.3 → agent_wire_cli-0.2.4}/README.md

@@ -13,6 +13,7 @@
   <a href="https://github.com/uncoalesced/agent-wire/actions/workflows/ci.yml"><img alt="CI" height="20" src="https://img.shields.io/github/actions/workflow/status/uncoalesced/agent-wire/ci.yml?branch=main&label=ci"></a>
   <a href="LICENSE"><img alt="MIT license" height="20" src="https://img.shields.io/badge/license-MIT-f5b884"></a>
   <a href="https://m8ven.ai/mcp/uncoalesced/agent-wire?s=readme"><img alt="M8ven Score" height="20" src="https://m8ven.ai/badge/mcp/uncoalesced/agent-wire"></a>
+  <a href="https://mcpservers.org/servers/uncoalesced/agent-wire"><img alt="Listed on mcpservers.org" height="20" src="https://mcpservers.org/badge.svg"></a>
 </p>
 
 <p align="center">
@@ -429,52 +430,65 @@ Tokens are the cost an agent feels first: money on an API plan, rate limits on a
 
 ### What a page costs
 
-We read a set of pages cold, from India, with a fresh `WIRE_HOME`, on 2026-10-20 (v0.2.1), and counted tokens with tiktoken. "Raw HTML" is what a plain fetch returned. Six of the pages are below.
-
-| Page | Raw HTML tokens | agent-wire tokens | Saved |
-|---|---|---|---|
-| GitHub issue (uv #1495) | 197,594 | 2,066 | 99% |
-| YouTube video page | ~533,000 | 3,040 | 99% |
-| Wikipedia (Model Context Protocol) | 79,926 | 1,868 | 98% |
-| dev.to/t/ai | 52,636 | 835 | 98% |
-| docs.python.org asyncio page | 50,059 | 2,989 | 94% |
-| arXiv abstract (Attention Is All You Need) | 12,961 | 3,031 | 77% |
-
-Across the benchmark set the typical saving was 94% (the median, counting only pages where a plain fetch worked), and the arXiv abstract was the weakest case. Hacker News, Stack Overflow and Medium refused the plain fetch outright, so there is no raw count to compare against. agent-wire read all three.
-
-A cold read of one URL took about 1.4 to 1.9 seconds at the median, from 0.15 seconds (dev.to) to about 10 seconds (Reddit through the archive fallback). One search that auto-reads its top hits took about 2.3 seconds and returned around 2,400 tokens.
+On 2026-11-04 we read 16 pages from India, three times each, every time cold with a fresh `WIRE_HOME`, on the `dev` branch after v0.2.3 (commit `e7077af`). Tokens are counted with tiktoken (`o200k_base`), and the agent-wire count includes its header line, since that reaches the model too. "Plain fetch" is one ordinary GET with a browser user agent. [Jina Reader](https://jina.ai/reader/) is the free `r.jina.ai` endpoint with no key, which is what Agent-Reach uses first for web reads.
+
+| Page | Plain fetch | Jina Reader | agent-wire | Saved vs plain |
+|---|---|---|---|---|
+| GitHub issue (uv #1495) | 184,922 | failed (403) | 2,066 | 99% |
+| GitHub repo README (uv) | 152,386 | failed (403) | 3,003 | 98% |
+| YouTube video page | 630,615 | failed (bot check) | 3,031 | 99.5% |
+| Wikipedia (Model Context Protocol) | 80,494 | 8,326 | 1,868 | 98% |
+| dev.to/t/ai | 56,834 | 12,290 | 1,017 | 98% |
+| Cloudflare blog post | 105,755 | 2,369 | 2,051 | 98% |
+| MDN Fetch API | 41,251 | 1,355 | 633 | 98% |
+| Bluesky profile | 15,673 | 142 | 756 | 95% |
+| Hacker News thread | 32,712 | 16,656 | 1,933 | 94% |
+| docs.python.org asyncio | 6,941 | 883 | 584 | 92% |
+| arXiv abstract (Attention Is All You Need) | 12,961 | 772 | 3,031 | 77% |
+| Stack Overflow question | blocked (403) | 25,821 | 2,211 | |
+| Medium post | blocked (403) | failed (403) | 2,827 | |
+| Reddit r/Python | blocked | failed (blocked) | 2,395 | |
+| npm package page (react) | blocked (403) | failed (CAPTCHA) | 123 | |
+| Cloudflare challenge page (nowsecure.nl) | challenge page | 52 | 87 | |
+
+- **Pages read:** agent-wire 16 of 16, Jina Reader 10 of 16, plain fetch 11 of 16.
+- **Saving vs plain fetch:** median 98% on the 11 pages a plain fetch could read. The arXiv abstract was the weakest at 77%, because agent-wire opens the full paper rather than the abstract page and fills its token budget from it.
+- **Against Jina Reader:** on the 10 pages both could read, agent-wire returned 14,171 tokens in total and Jina 68,666, so 79% fewer, and fewer on 7 of the 10. Jina was smaller on the arXiv abstract (it returns only the abstract page), the Bluesky profile (a thin cached snapshot) and the nowsecure.nl page. The comparison isn't like for like: agent-wire trims every read to a budget (3,000 tokens by default, ranked by relevance when you pass a `query`), and Jina returns the whole page. Long Hacker News and Stack Overflow threads are where that shows most.
+- **Speed:** a cold read took 0.76 seconds at the median over 48 reads, and 3.1 seconds at the 90th percentile. The slowest was the Cloudflare challenge page, which goes through the stage 4 browser: 6 to 16 seconds. Jina's median was 0.7 seconds on the pages it could read, with a few 15 to 16 second outliers.
+- **Search:** five searches that auto-read their top hits took 2.4 seconds at the median and returned about 2,500 tokens each.
 
 ### What it costs to have it installed
 
-This is the part that doesn't flatter agent-wire, so here it is plainly. On 2026-10-29 we counted what each tool puts into context before it does any work, using the `o200k_base` tokenizer. Claude's tokenizer counts differently, so read these as comparable to each other and not as an exact bill.
+This is the part that doesn't flatter agent-wire, so here it is plainly. We counted what each tool puts into context before it does any work, using the `o200k_base` tokenizer. Claude's tokenizer counts differently, so read these as comparable to each other and not as an exact bill. The agent-wire rows were re-counted on 2026-11-04 from the server's live tool list, taking each tool's name, description and input schema, which is what an API client sends to the model. That method counts a little more than the one we used on 2026-10-29 (1,603 for the standard profile then); the tools themselves haven't changed since v0.2.3.
 
 | What loads | Tokens | When |
 |---|---|---|
-| agent-wire tool definitions, standard profile (8 tools) | 1,603, plus 150 for server instructions | every session |
-| agent-wire tool definitions, `--profile local` (7 tools) | 740 | every session |
-| agent-wire tool definitions, `--code-mode` (2 tools) | 471 | every session |
-| agent-wire skill (`SKILL.md`) | 1,354 | when the skill triggers, depending on the client |
-| [last30days](https://github.com/mvanhorn/last30days-skill) skill (`SKILL.md`, v3.31.0) | 7,029 | when the skill triggers |
-| [Agent-Reach](https://github.com/Panniantong/Agent-Reach) skill (`SKILL.md`) | 1,933 | when the skill triggers |
+| agent-wire tool definitions, standard profile (8 tools) | 1,838, plus 150 for server instructions | every session |
+| agent-wire tool definitions, `--profile local` (7 tools) | 961 | every session |
+| agent-wire tool definitions, `--code-mode` (2 tools) | 500 | every session |
+| agent-wire tool definitions, `--profile local --code-mode` (2 tools) | 155 | every session |
+| agent-wire skill (`SKILL.md`) | 1,342 | when the skill triggers, depending on the client |
+| [last30days](https://github.com/mvanhorn/last30days-skill) skill (`SKILL.md`, v3.31.0, counted 2026-10-29) | 7,029 | when the skill triggers |
+| [Agent-Reach](https://github.com/Panniantong/Agent-Reach) skill (`SKILL.md`, counted 2026-10-29) | 1,933 | when the skill triggers |
 
-An MCP server pays its tool definitions in every session, used or not. A skill costs roughly its one-paragraph description until it triggers. So on a day you never touch the web, agent-wire is the most expensive of the three to have installed. On a day you do, the order flips: its tool list plus its skill come to about 3,100 tokens, and last30days's skill alone is about 7,000. If the 1,603 bothers you, `--profile local` and `--code-mode` cut it to 740 and 471.
+An MCP server pays its tool definitions in every session, used or not. A skill costs roughly its one-paragraph description until it triggers. So on a day you never touch the web, agent-wire is the most expensive of the three to have installed. On a day you do, the order flips: its tool list, instructions and skill come to about 3,300 tokens, and last30days's skill alone is about 7,000. If the 1,838 bothers you, `--profile local` and `--code-mode` cut it to 961 and 500, and both together to 155.
 
 The comparison isn't clean. last30days's `SKILL.md` also carries a setup wizard and formatting rules, and Agent-Reach's is largely Chinese text, so its count isn't directly comparable with an English file's.
 
 ### What a task costs
 
-Code Mode is where the biggest single saving is. The bundled benchmark (`pytest -s tests/test_codemode_bench.py`) asks for the top four Hacker News threads on a topic with each thread's three best comments, offline. It counts every token that enters the model's context: the tool arguments or the script, plus every tool result.
+Code Mode is where the biggest single saving is. The task: find the top four Hacker News threads on "rust async" and give each thread's three best comments. We count every token that enters the model's context: the tool arguments or the script, plus every tool result. The live run is from 2026-11-04 (three cold runs, same result each time); the offline one is the bundled benchmark (`pytest -s tests/test_codemode_bench.py`) on canned pages.
 
-| Route | Context tokens | Round trips |
-|---|---|---|
-| Classic tools (one search, one batched read) | 3,394 | 2 |
-| `wire_run` script | 468 | 1 |
+| Route | Context tokens, live | Context tokens, offline | Round trips |
+|---|---|---|---|
+| Classic tools (one search, one batched read) | 2,864 | 3,394 | 2 |
+| `wire_run` script | 459 | 468 | 1 |
 
-That is 86% fewer. On a live run over Reddit and Hacker News, a script fetched 41,005 tokens of pages and returned 61 to the model.
+That is 84% fewer live and 86% offline. In the live run the script's two calls pulled in 210,569 tokens of pages, and 297 tokens of answer came back to the model; the whole script took about 2.4 seconds. A second script that read r/LocalLLaMA and the Hacker News front page in parallel fetched 13,469 tokens and returned 569.
 
 ### What we didn't measure
 
-We have not run last30days or Agent-Reach against agent-wire on the same pages, so we have no per-page or per-task comparison to show. Neither project publishes per-run token figures in its README (we checked both), so there was nothing to quote either.
+We have not run last30days or Agent-Reach themselves against agent-wire on the same pages. The Jina Reader column above covers the first step of Agent-Reach's web reads, not the whole tool, and we have no per-task comparison with either. Neither project publishes per-run token figures in its README (we checked both), so there was nothing to quote either.
 
 What their own docs say is structural. Agent-Reach tries an ordered list of tools for each action (web reads go to Jina Reader first, then Exa) and returns what they produce. Its README says some channels, such as Xueqiu, V2EX and GitHub, come back as organized content, but it describes no token budget or slicing step. last30days collects and ranks evidence across sources, and its `SKILL.md` has the host model write the brief from that evidence, so the evidence lands in your context and the model's brief is output tokens on top. Those are differences in design, not measurements, and either could be smaller than it looks.
 
@@ -606,6 +620,24 @@ Pages get the opposite treatment. Anything a person reading the page couldn't se
 
 Logins you add with `wire auth login <site>` live in an AES-GCM vault whose key is protected by Windows DPAPI, or by a 0600 key file on macOS and Linux.
 
+### Supply chain
+
+A lot of recent malware has arrived through package registries: a hijacked npm package, or a post-install script that runs the moment you install something. Here is what agent-wire pulls in and how it gets to you, as of a scan on 2026-11-04.
+
+- **No npm, no Node.** agent-wire is a Python package on PyPI. `uvx` or `pip` installs it, and nothing runs `npm` or `npx`.
+- **No install scripts.** Every package in the lockfile ships prebuilt wheels, and installing a wheel unpacks files without running any of its code. Only the optional extras fetch more later, and only when you ask: `stealth` needs `playwright install chromium`, and `local-whisper` downloads a speech model on first use.
+- **Small direct list.** 13 direct dependencies (12 on Python 3.13 and newer), all long-standing projects. The youngest is `quickjs-ng`, the Code Mode sandbox engine, first released in February 2026. With everything they pull in, that is 94 packages, or 117 with every optional extra.
+- **Pinned and hashed.** `uv.lock` pins every package to one version with sha256 hashes, and CI installs from it. `pip install` and `uvx` resolve fresh versions within the ranges in `pyproject.toml`, so if you want our exact set, install from a checkout with `uv sync --locked`.
+- **Scanned.** `pip-audit` over the full locked set (runtime plus every extra) found one advisory: CVE-2026-119284 in `joserfc`, pulled in through `fastmcp`. agent-wire never parses the JSON web tokens it concerns, and the lock now uses the fixed version, so there are no known vulnerabilities. Bandit found nothing at medium severity or above, and zizmor finds nothing in the workflows. CodeQL flagged seven host checks that matched by substring (so `evilnpmjs.com` counted as npm); those now match the exact host or its subdomains. Cookies were never at risk, because the vault picks them by the real request host.
+- **Routine upgrades wait.** Dependabot holds routine dependency and Actions upgrades for 7 days after a release, so a hijacked version usually gets yanked before we take it. Security fixes still arrive straight away.
+- **Releases you can check.** Releases are built and uploaded by GitHub Actions through PyPI Trusted Publishing, so no upload token exists to steal. Each file on PyPI carries a signed attestation that ties it to `release.yml` in this repository. Actions are pinned to commit SHAs, and every pull request runs `pip-audit`, bandit, zizmor, dependency review and CodeQL.
+
+To check a release yourself:
+
+```bash
+uvx --from pypi-attestations pypi-attestations verify pypi --repository https://github.com/uncoalesced/agent-wire pypi:agent_wire_cli-0.2.3-py3-none-any.whl
+```
+
 ## Privacy Policy
 
 agent-wire runs on your machine. There's no agent-wire server, no account, no analytics and no telemetry.

{agent_wire_cli-0.2.3 → agent_wire_cli-0.2.4}/SECURITY.md

@@ -34,7 +34,15 @@ agent-wire sits between an AI agent and the open web, so it treats two things as
 - Getting blocked, rate-limited or challenged by a site.
 - Problems that need someone who can already edit your `WIRE_HOME`, your agent client config or your environment variables.
 
+## Supply chain
+
+Dependency problems are in scope too: a vulnerable or malicious package in `uv.lock`, a release file that doesn't match this repository, or a workflow that could leak a secret or publish something we didn't build.
+
+- **Releases.** A pushed `v*` tag runs `.github/workflows/release.yml`, which builds the wheel and sdist, runs the tests and uploads to PyPI through Trusted Publishing. No PyPI token is stored anywhere. Each file gets a PEP 740 attestation naming this repository and workflow. Check one with `uvx --from pypi-attestations pypi-attestations verify pypi --repository https://github.com/uncoalesced/agent-wire pypi:<file name>`.
+- **Dependencies.** `uv.lock` pins every package with sha256 hashes, and CI installs with `uv sync --locked`. Every locked package ships wheels, so installing runs no package code. There is no npm or Node dependency. Routine upgrades come through Dependabot, which waits 7 days after a release; security updates come straight away.
+- **Checks on every push and pull request.** `pip-audit` over the full locked set including extras, bandit, zizmor on the workflows, CodeQL, and dependency review on pull requests. Actions are pinned to commit SHAs.
+- **Last manual scan, 2026-11-04.** `pip-audit` found CVE-2026-119284 in `joserfc` (via `fastmcp`, in a code path agent-wire doesn't use); the lock was moved to the fixed version. No other known vulnerabilities. CodeQL's substring host-check alerts in the channel routers were fixed; the ones left in tests are assertions on test data.
+
 ## Known limitations
 
-- **Private addresses.** `wire_read`, Code Mode's `wire.read` and the citation checker don't yet refuse `localhost`, private-network or cloud-metadata URLs. A fix is in review.
-- **Secret redaction.** Output scrubbing removes bearer tokens, session cookies, private IPs and your saved vault values. It does not catch every API-key format that might appear in public page text.
+- **Secret redaction.** Output scrubbing removes bearer tokens, session cookies, private IPs, your saved vault values and well-known prefixed API keys (GitHub, OpenAI, Anthropic, AWS, Slack, Google, GitLab, Stripe, Hugging Face, npm). Keys with no recognizable prefix that appear in public page text are not caught.

{agent_wire_cli-0.2.3 → agent_wire_cli-0.2.4}/manifests/gemini_extension.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-wire",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Live web and platform access: token-compressed, privacy-firewalled, injection-shielded.",
   "contextFileName": "GEMINI.md",
   "mcpServers": {

{agent_wire_cli-0.2.3 → agent_wire_cli-0.2.4}/manifests/hermes_skill.md

@@ -1,7 +1,7 @@
 ---
 name: agent-wire
 description: Live web and platform access (Reddit, X, GitHub, YouTube, HN, StackOverflow, arXiv, markets, Bilibili, Xiaohongshu). Use whenever the user shares a URL, asks about live facts or community opinion, or about their own social account activity.
-version: 0.2.3
+version: 0.2.4
 metadata:
   hermes:
     tags: [web, search, research, social]

{agent_wire_cli-0.2.3 → agent_wire_cli-0.2.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agent-wire-cli"
-version = "0.2.3"
+version = "0.2.4"
 description = "High-speed, privacy-first, token-compressed live web and multi-platform intelligence engine for AI agents."
 readme = "README.md"
 requires-python = ">=3.11"

agent_wire_cli-0.2.4/src/agent_wire/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.2.4"

{agent_wire_cli-0.2.3 → agent_wire_cli-0.2.4}/src/agent_wire/channels/base.py

@@ -6,6 +6,7 @@ import re
 from dataclasses import dataclass, field
 from datetime import UTC, datetime, timedelta
 from typing import ClassVar
+from urllib.parse import urlsplit
 
 from selectolax.lexbor import LexborHTMLParser
 
@@ -79,6 +80,12 @@ class Channel:
         return WireDocument(url=url, channel=self.name, **fields)
 
 
+def on_host(url: str, domain: str) -> bool:
+    """URL (or bare host) is `domain` or a subdomain of it; look-alikes like evil-domain.com don't match."""
+    host = (urlsplit(url if "//" in url else f"https://{url}").hostname or "").lower()
+    return host == domain or host.endswith("." + domain)
+
+
 def ts(value) -> datetime | None:
     """Epoch seconds/ms or ISO-8601 -> aware datetime."""
     if value in (None, ""):

{agent_wire_cli-0.2.3 → agent_wire_cli-0.2.4}/src/agent_wire/channels/tier1_global/github.py

@@ -9,7 +9,7 @@ from urllib.parse import quote, urlsplit
 
 from selectolax.lexbor import LexborHTMLParser
 
-from agent_wire.channels.base import Channel, WireUnsupported, compact_count, listing, ts
+from agent_wire.channels.base import Channel, WireUnsupported, compact_count, listing, on_host, ts
 from agent_wire.compression.anchor_slicer import parse_line_anchor, slice_lines, slice_section
 from agent_wire.models import WireComment, WireDocument, WireSearchHit
 
@@ -85,7 +85,7 @@ class GitHubChannel(Channel):
         parts = urlsplit(url)
         host, segs = parts.hostname or "", [s for s in parts.path.split("/") if s]
         anchor = section or parts.fragment or None
-        if host.endswith("githubusercontent.com"):
+        if on_host(host, "githubusercontent.com"):
             return await self._blob_raw(url, segs[0], segs[1], "/".join(segs[3:]), url)
         if host == "gist.github.com" and len(segs) >= 2:
             return await self._gist(url, segs[-1])

{agent_wire_cli-0.2.3 → agent_wire_cli-0.2.4}/src/agent_wire/channels/tier1_global/reddit.py

@@ -15,7 +15,7 @@ from urllib.parse import quote, urlencode, urlsplit
 
 import defusedxml.ElementTree as ET  # untrusted feeds: no entity expansion, no DTDs
 
-from agent_wire.channels.base import Channel, WireUnsupported, html_text, listing, ts
+from agent_wire.channels.base import Channel, WireUnsupported, html_text, listing, on_host, ts
 from agent_wire.engine.waterfall import WireFetchError
 from agent_wire.firewall.outbound_privacy import parse_json
 from agent_wire.models import WireComment, WireSearchHit
@@ -95,7 +95,7 @@ def listing_items(data: dict) -> list[dict]:
 
 
 def post_hit(d: dict, archived: bool = False) -> WireSearchHit:
-    link = None if d.get("is_self") or "reddit.com" in (d.get("url") or "") else d.get("url")
+    link = None if d.get("is_self") or on_host(d.get("url") or "", "reddit.com") else d.get("url")
     return WireSearchHit(
         url=WWW + d.get("permalink", ""), title=d.get("title") or "",
         snippet="" if d.get("selftext") in ("[removed]", "[deleted]") else (d.get("selftext") or "")[:300],

{agent_wire_cli-0.2.3 → agent_wire_cli-0.2.4}/src/agent_wire/channels/tier1_global/web.py

@@ -6,7 +6,7 @@ from urllib.parse import urlsplit
 
 import trafilatura
 
-from agent_wire.channels.base import Channel, WireUnsupported, html_to_markdown, ts
+from agent_wire.channels.base import Channel, WireUnsupported, html_to_markdown, on_host, ts
 from agent_wire.compression.anchor_slicer import parse_line_anchor, slice_lines, slice_section
 from agent_wire.firewall.inbound_shield import clean_html
 from agent_wire.models import WireDocument
@@ -87,7 +87,7 @@ class WebChannel(Channel):
         if anchor:
             body = slice_section(body, anchor) or body
         meta = {"site": info["site"]} if info["site"] else {}
-        if f.stage == 3 and "web.archive.org" in f.url:
+        if f.stage == 3 and on_host(f.url, "web.archive.org"):
             meta["archived"] = f.url
         return self.doc(
             f, url, title=info["title"], author_handle=info["author"],

{agent_wire_cli-0.2.3 → agent_wire_cli-0.2.4}/src/agent_wire/channels/tier2_pro/hubs.py

@@ -6,7 +6,7 @@ from urllib.parse import quote, urlsplit
 from curl_cffi.requests.exceptions import RequestException
 from selectolax.lexbor import LexborHTMLParser
 
-from agent_wire.channels.base import Channel, WireUnsupported, html_to_markdown
+from agent_wire.channels.base import Channel, WireUnsupported, html_to_markdown, on_host
 from agent_wire.engine.waterfall import WireFetchError
 from agent_wire.models import WireSearchHit
 
@@ -33,7 +33,7 @@ class HubsChannel(Channel):
         host, segs = (p.hostname or "").removeprefix("www."), [s for s in p.path.split("/") if s]
         if host == "pypi.org" and segs[:1] == ["project"] and len(segs) > 1:
             return await self._pypi(url, segs[1], segs[2] if len(segs) > 2 else None)
-        if host.endswith("npmjs.com") and segs[:1] == ["package"] and len(segs) > 1:
+        if on_host(host, "npmjs.com") and segs[:1] == ["package"] and len(segs) > 1:
             name = "/".join(segs[1:3]) if segs[1].startswith("@") else segs[1]
             return await self._npm(url, name)
         if host == "crates.io" and segs[:1] == ["crates"] and len(segs) > 1: