The Problem

AI assistants lose context across sessions and repositories. You re-explain background, repeat decisions, and sometimes continue with wrong assumptions. Most tools stop at storage without plugging into the coding agent you already use. OpenContext addresses this by providing a personal context store that persists across agents and repos.

What This Does

OpenContext is a collection of 6 self-contained projects rather than a single monorepo. The desktop GUI (src-ios and src/ui) provides a native interface for managing context, while the CLI (bin/oc.js) and Node crate (crates/opencontext-node) handle the underlying operations. The Tauri-backed desktop app (src-tauri) bridges the Rust core with the GUI. A Node.js API server (src/ui/server.js) serves the web UI locally.

Execution starts at bin/oc.js:136 (handle function, reaches 5 functions called from 1 place) or src/ui/src/App.jsx:187 (App, reaches 6 functions called by nothing else). The App component is the primary web entry point, while handle in bin/oc.js is the CLI entry point. The src/ui/src/api.js module defines 50 functions including hasTauriRuntime, waitForTauriRuntime, loadInvoke, getInvoke, and fetchJSON — it serves as the API hub with 12 modules depending on it and a blast radius suitable for high-impact changes.

Skills and slash commands are generated by oc init, which creates user-level skills for Cursor, Claude Code, and Codex plus corresponding slash commands. The MCP Server enables Cursor, Claude Code, Codex, and other agents to call OpenContext as tools. The knowledge layer reuses your existing coding agent CLI rather than requiring a separate subscription.

How It Is Wired

The internal call graph contains 818 resolved call edges between repository functions. Key entry points and their reach:

  • getInvoke — called from 45 places
  • fetchJSON — called from 25 places
  • handleResult — called from 17 places
  • src/ui/src/api.js — the central API module with 50 functions, called from 10 files, calls into 3
  • src/core/store-native.js — 18 functions managing folder operations, called from 10 files
  • src/ui/src/App.jsx — 23 functions including generateDocCitation, generateFolderCitation, saveReducer, and handleContextMenu

Notable wiring issues: src/ui/src/routes/index.jsx, src/ui/src/App.jsx, and src/ui/src/components/SidebarTree.jsx participate in a circular import dependency (instability 0.96). The src/ui/src/api.js hub has 12 dependents with high churn, making it a blast-radius risk. Empty catch blocks in src/ui/src/components/agent/AgentMessageList.jsx silently discard errors.

Effects: src/ui/src/components/PlateMarkdown.jsx reads/writes files; src/core/agents.js reads/writes files and runs external commands; src/ui/src/api.js conditionally loads Tauri runtime.

How To Use It

Setup: npm install -g @aicontextlab/cli installs the CLI globally. No Dockerfile or Makefile is present; the repository relies on npm scripts and Tauri's build system.

Configuration: No environment variables are documented in the scanned config files. The package.json at root and per-package Cargo.toml/package.json files manage dependencies and build settings.

Running it:

  • CLI: oc init generates skills and slash commands; oc manages the global contexts/ library
  • Desktop: Tauri build produces a native app from src-ios and src/ui
  • Web: npm run dev (or equivalent) starts the local API server at src/ui/server.js

MCP Server: The Model Context Protocol server enables agents to call OpenContext as tools; configuration is embedded in the generated skills.

Real-World Use

An agent running oc init creates skills like @/context/search and @/context/create that Cursor, Claude Code, or Codex can invoke. The agent loads your context library before acting: "load history first, then act; ship, then persist." When the agent completes a task, OpenContext persists the new knowledge automatically. The GUI lets you browse, search, and edit contexts without writing CLI commands. The MCP server means your coding agent can call search_context, create_entry, or update_entry as native tools.

Code Health & Issues

  • CRITICAL - .github/workflows/cli-publish.yml checks out untrusted pull request refs with privileged access, enabling credential exfiltration via NPM_TOKEN
  • CRITICAL - Same workflow exposes NPM_TOKEN to fork-triggered runs
  • HIGH - Third-party GitHub Actions pinned to @vN instead of commit SHAs (dtolnay/rust-toolchain, Swatinem/rust-cache, softprops/action-gh-release)
  • HIGH - native-build.yml discards exit codes on line 259, masking failures
  • HIGH - src/ui/server.js uses wildcard CORS origin with credentials, allowing any website to make authenticated requests
  • MEDIUM - No Dependabot/Renovate configured across 7 manifests
  • MEDIUM - ci.yml declares no GITHUB_TOKEN permissions, inheriting broad defaults
  • MEDIUM - 12.3MB docs/images/folder-refer-git.gif blob over 5MB should use Git LFS
  • MEDIUM - ci.yml checkout keeps persist-credentials, leaving tokens available to later steps

Static analysis of 160 code files found 62 issues: 3 import cycle members (high soundness risk), 11 oversized files, 27 deep nesting occurrences, and 184 duplicated code blocks across 38 files.

The Bottom Line

OpenContext successfully solves the context-retention problem for AI assistants by wrapping your existing coding agent CLI with a GUI, skills layer, and persistent knowledge store. The codebase is functional but shows signs of growth pressure: circular imports, an overloaded API hub, oversized components, and CI security gaps. It's worth evaluating if you already use Codex, Claude Code, or OpenCode and want to add persistent context without switching agents. The security hygiene issues should be addressed before exposing the tool across teams.