@ivo-toby/talon
BMCP server package talon
Install
agr install @ivo-toby/talon --target claudeThis artifact does not publish files for Claude.
Document
{ "name": "talon", "version": "0.1.0", "description": "Resilient, secure, extensible autonomous agent daemon", "license": "AGPL-3.0-only", "type": "module", "engines": { "node": ">=24" }, "bin": { "talonctl": "bin/talonctl.js" }, "scripts": { "build": "tsc -p tsconfig.build.json && cp src/core/database/migrations/.sql dist/core/database/migrations/ && for d in src/subagents/default//; do n=$(basename "$d"); mkdir -p dist/subagents/default/$n/prompts; cp "$d"subagent.yaml dist/subagents/default/$n/ 2>/dev/null; cp "$d"prompts/.md dist/subagents/default/$n/prompts/ 2>/dev/null; done && mkdir -p dist/templates/tool-instructions && (cp templates/tool-instructions/.md dist/templates/tool-instructions/ 2>/dev/null || true)", "dev": "tsx watch src/index.ts", "test": "vitest run", "test:watch": "vitest", "test:coverage": "vitest run --coverage", "lint": "eslint "src//*.ts"", "format": "prettier --write "src//.ts" "tests/**/.ts"", "talond": "node dist/index.js", "talonctl": "node dist/cli/index.js", "migrate": "node dist/cli/index.js migrate", "rebuild:sqlite": "cd node_modules/better-sqlite3 && node-gyp rebuild --release" }, "dependencies": { "@ai-sdk/anthropic": "^3.0.58", "@ai-sdk/google": "^3.0.43", "@ai-sdk/openai": "^3.0.41", "@ai-sdk/openai-compatible": "^2.0.38", "@anthropic-ai/claude-agent-sdk": "^0.2.71", "@anthropic-ai/sdk": "^0.78.0", "@fly/sprites": "^0.0.1", "@langfuse/otel": "^5.0.1", "@langfuse/tracing": "^5.0.1", "@mastra/core": "^1.22.0", "@mastra/mcp": "^1.4.1", "@modelcontextprotocol/sdk": "^1.27.1", "@opentelemetry/api": "^1.9.0", "@opentelemetry/exporter-trace-otlp-http": "^0.213.0", "@opentelemetry/resources": "^2.6.1", "@opentelemetry/sdk-trace-base": "^2.6.0", "@opentelemetry/sdk-trace-node": "^2.6.0", "@opentelemetry/semantic-conventions": "^1.40.0", "@whiskeysockets/baileys": "^7.0.0-rc.9", "ai": "^6.0.116", "better-sqlite3": "^12.6.2", "commander": "^12.1.0", "cron-parser": "^4.9.0", "dockerode": "^4.0.2", "gray-matter": "^4.0.3", "hono": "^4.12.9", "js-yaml": "^4.1.0", "marked": "^15.0.0", "marked-terminal": "^7.3.0", "neverthrow": "^8.0.0", "ora": "^9.3.0", "pino": "^9.3.2", "pino-pretty": "^11.2.2", "uuid": "^10.0.0", "write-file-atomic": "^6.0.0", "ws": "^8.19.0", "zod": "^4.0.0" }, "devDependencies": { "@eslint/js": "^9.9.0", "@types/better-sqlite3": "^7.6.13", "@types/dockerode": "^3.3.31", "@types/js-yaml": "^4.0.9", "@types/node": "^22.5.1", "@types/uuid": "^10.0.0", "@types/write-file-atomic": "^4.0.3", "@types/ws": "^8.18.1", "@vitest/coverage-v8": "^2.1.1", "eslint": "^9.9.0", "eslint-config-prettier": "^9.1.0", "prettier": "^3.3.3", "tsx": "^4.19.0", "typescript": "^5.5.4", "typescript-eslint": "^8.3.0", "vitest": "^2.1.1" } }
Trustgrade B
- passBody integrity
Whether the stored document is plausibly the kind of file the artifact declares, rather than something fetched by mistake.
- warnType matchbest-effort: server code not analyzed
Whether the artifact is really the kind of thing its metadata claims it is.
- passFreshness
How long since the source repository was last pushed to.
- passPrompt injection
Scans the artifact's own text for instructions aimed at your agent rather than at you.
- warnLicensecopyleft/unknown — index-and-link only
Whether the source repository declares an SPDX license permissive enough to redistribute.
How the grade is calculated
Each check contributes 0 points when it passes, 1 when it warns, and 2 when it fails. The total maps to a letter:
- Aevery check passed
- Bone warning
- Ctwo warnings
- Dprompt injection or body integrity failed, or three warnings
- Fone of those failed, and something else is wrong
These are automated hygiene checks, not a security audit, and not a dependency or vulnerability scan. A grade of A means nothing was flagged — not that the artifact is safe.
Versions
git-ac763d17247d2026-08-06