headroomlabs-ai/headroom hook
token optimization
Headroom is a context compression layer that reduces token usage for AI agents by 15–95% depending on content type (JSON data sees the highest savings). It works as a library, proxy, MCP server, or agent wrapper, compressing prompts, tool outputs, logs, and RAG results before they reach the LLM while preserving accuracy and offering reversible compression for retrieval.
Import as a library (Python/TypeScript) to compress messages inline in your app Run as a local proxy (zero code changes) to compress traffic from any language or agent Wrap coding agents (Claude, Cursor, Cline, etc.) with a single command for automatic compression Deploy as an MCP server to integrate compression into any MCP-compatible client Trim model output tokens with verbosity steering and effort routing, reducing costs on expensive output-heavy models ⚠ REVIEW
Risk score 65/100
19 HIGH✓ 76 MEDIUM 23 LOW 2 INFO
✓ CRITICAL/HIGH reflect AI-verified findings (false positives excluded) · MEDIUM/LOW/INFO are unverified scanner output
AI-verified (CRITICAL/HIGH): 19 likely real (100%) 13 false positive — excluded from CRITICAL/HIGH count above
Findings by checker · 4 high-signal, 2 mostly false-positive (hidden by default)
CHK-083 11 findings 10 likely 1 false positive
9% FP CHK-047 5 findings 4 likely 1 false positive
20% FP CHK-042 1 finding 1 likely
0% FP CHK-073 1 finding 1 likely
0% FP ▼ Show 2 checkers that are mostly false positives (14 findings) 120 findings click to expand
CHK-083 Potential path traversal — user-controlled path in file operation: headroom/proxy/cc_switch_reconciler.py
headroom/proxy/cc_switch_reconciler.py
AI: likely real possible ▼
CHK-129 Sensitive field in return type/schema — token: str
headroom/subscription/models.py
AI: likely real likely ▼
CHK-083 Potential path traversal — user-controlled path in file operation: headroom/evals/__main__.py
headroom/evals/__main__.py
AI: likely real possible ▼
CHK-042 Supabase Service Role Key detected in crates/headroom-core/benches/auth_mode.rs
crates/headroom-core/benches/auth_mode.rs
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — token: str
headroom/copilot_auth.py
AI: likely real likely ▼
CHK-083 Potential path traversal — user-controlled path in file operation: headroom/copilot_auth.py
headroom/copilot_auth.py
AI: likely real possible ▼
CHK-083 Potential path traversal — user-controlled path in file operation: benchmarks/headroom_adversarial_benchmark.py
benchmarks/headroom_adversarial_benchmark.py
AI: likely real possible ▼
CHK-083 Potential path traversal — user-controlled path in file operation: benchmarks/real_world_agent_benchmark.py
benchmarks/real_world_agent_benchmark.py
AI: likely real possible ▼
CHK-047 Potential SSRF — user-controlled URL passed to HTTP client in headroom/providers/proxy_routes.py
headroom/providers/proxy_routes.py
AI: likely real likely ▼
CHK-047 Potential SSRF — user-controlled URL passed to HTTP client in headroom/cli/mcp.py
headroom/cli/mcp.py
AI: likely real likely ▼
CHK-073 Curl Pipe Bash Install detected in wiki/docker-install.md
wiki/docker-install.md
AI: likely real likely ▼
CHK-047 Potential SSRF — user-controlled URL passed to HTTP client in headroom/proxy/handlers/openai.py
headroom/proxy/handlers/openai.py
AI: likely real likely ▼
CHK-047 Potential SSRF — user-controlled URL passed to HTTP client in e2e/wrap/run.py
e2e/wrap/run.py
AI: likely real likely ▼
CHK-083 Potential path traversal — user-controlled path in file operation: headroom/evals/comprehensive_benchmark.py
headroom/evals/comprehensive_benchmark.py
AI: likely real possible ▼
CHK-099 Potential IDOR — 'user_id' accessed without ownership check
headroom/proxy/handlers/anthropic.py
AI: likely real possible ▼
CHK-083 Potential path traversal — user-controlled path in file operation: headroom/evals/batch_compression_eval.py
headroom/evals/batch_compression_eval.py
AI: likely real possible ▼
CHK-083 Potential path traversal — user-controlled path in file operation: e2e/wrap/run.py
e2e/wrap/run.py
AI: likely real likely ▼
CHK-083 Potential path traversal — user-controlled path in file operation: headroom/cli/learn.py
headroom/cli/learn.py
AI: likely real possible ▼
CHK-083 Potential path traversal — user-controlled path in file operation: headroom/cli/wrap.py
headroom/cli/wrap.py
AI: likely real likely ▼
CHK-125 eval() — arbitrary code execution — no scope constraint in scripts/export_kompress_v2_onnx.py
scripts/export_kompress_v2_onnx.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in scripts/sync-plugin-versions.py
scripts/sync-plugin-versions.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in headroom/_subprocess.py
headroom/_subprocess.py
possible ▼
CHK-125a shutil.rmtree() — recursive directory deletion — no scope constraint in interceptors/astgrep.py
headroom/proxy/interceptors/astgrep.py
possible ▼
CHK-125b chown — ownership change — no scope constraint in Dockerfile
Dockerfile
possible ▼
CHK-053 Tool 'memory_save' — unusually long description (1326 chars)
tests/fixtures/memory_tool_definitions/anthropic.json
possible ▼
CHK-053 Tool 'memory_search' — unusually long description (1193 chars)
tests/fixtures/memory_tool_definitions/anthropic.json
possible ▼
CHK-053 Tool 'memory_update' — unusually long description (950 chars)
tests/fixtures/memory_tool_definitions/anthropic.json
possible ▼
CHK-053 Tool 'memory_delete' — unusually long description (1006 chars)
tests/fixtures/memory_tool_definitions/anthropic.json
possible ▼
CHK-053 Tool 'memory_list' — unusually long description (853 chars)
tests/fixtures/memory_tool_definitions/anthropic.json
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in CHANGELOG.md
CHANGELOG.md
possible ▼
CHK-102 Direct SQL execution — may bypass ORM-level access controls
tests/e2e_cortex_savings.py
possible ▼
CHK-102 Direct SQL execution — may bypass ORM-level access controls
tests/e2e_cortex_mcp.py
possible ▼
CHK-102 Direct SQL execution — may bypass ORM-level access controls
tests/e2e_cortex_quality.py
possible ▼
CHK-102 Direct SQL execution — may bypass ORM-level access controls
tests/e2e_cortex_latency.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in REALIGNMENT/10-phase-H-python-retirement.md
REALIGNMENT/10-phase-H-python-retirement.md
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in tests/e2e_real_compression.py
tests/e2e_real_compression.py
possible ▼
CHK-125a open() with absolute path — unrestricted file access — no scope constraint in tests/e2e_real_compression.py
tests/e2e_real_compression.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in tests/e2e_cortex_proxy_mcp.py
tests/e2e_cortex_proxy_mcp.py
possible ▼
CHK-125a open() with absolute path — unrestricted file access — no scope constraint in tests/e2e_cortex_proxy_mcp.py
tests/e2e_cortex_proxy_mcp.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in tests/e2e_cortex_proxy.py
tests/e2e_cortex_proxy.py
possible ▼
CHK-125a open() with absolute path — unrestricted file access — no scope constraint in tests/e2e_cortex_proxy.py
tests/e2e_cortex_proxy.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in tests/e2e_ws_responses_compression.py
tests/e2e_ws_responses_compression.py
possible ▼
CHK-125a open() with absolute path — unrestricted file access — no scope constraint in tests/e2e_ws_responses_compression.py
tests/e2e_ws_responses_compression.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in tests/e2e_ws_codex_usage_headers.py
tests/e2e_ws_codex_usage_headers.py
possible ▼
CHK-125a open() with absolute path — unrestricted file access — no scope constraint in tests/e2e_ws_codex_usage_headers.py
tests/e2e_ws_codex_usage_headers.py
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in wiki/troubleshooting.md
wiki/troubleshooting.md
possible ▼
CHK-125b chmod — permission modification — no scope constraint in wiki/macos-deployment.md
wiki/macos-deployment.md
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in .devcontainer/post-create.sh
.devcontainer/post-create.sh
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in benchmarks/cache_validation_bundle.py
benchmarks/cache_validation_bundle.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in benchmarks/claude_session_branch_compare.py
benchmarks/claude_session_branch_compare.py
possible ▼
CHK-125a shutil.rmtree() — recursive directory deletion — no scope constraint in benchmarks/claude_session_branch_compare.py
benchmarks/claude_session_branch_compare.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in benchmarks/run_benchmarks.py
benchmarks/run_benchmarks.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in benchmarks/cache_bust_trace_report.py
benchmarks/cache_bust_trace_report.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in scripts/audit_wheel_glibc_symbols.py
scripts/audit_wheel_glibc_symbols.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in evals/suite_runner.py
headroom/evals/suite_runner.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in learn/analyzer.py
headroom/learn/analyzer.py
possible ▼
CHK-125 eval() — arbitrary code execution — no scope constraint in learn/fixtures.py
headroom/learn/fixtures.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in install/runtime.py
headroom/install/runtime.py
possible ▼
CHK-125a shutil.rmtree() — recursive directory deletion — no scope constraint in install/state.py
headroom/install/state.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in memory/sync.py
headroom/memory/sync.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in memory/budget.py
headroom/memory/budget.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in lean_ctx/installer.py
headroom/lean_ctx/installer.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in graph/watcher.py
headroom/graph/watcher.py
possible ▼
CHK-125 eval() — arbitrary code execution — no scope constraint in models/ml_models.py
headroom/models/ml_models.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in cli/update.py
headroom/cli/update.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in cli/wrap_rtk_metrics.py
headroom/cli/wrap_rtk_metrics.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in cli/tools.py
headroom/cli/tools.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in cli/wrap.py
headroom/cli/wrap.py
possible ▼
CHK-125a shutil.rmtree() — recursive directory deletion — no scope constraint in cli/wrap.py
headroom/cli/wrap.py
possible ▼
CHK-125 eval() — arbitrary code execution — no scope constraint in transforms/kompress_compressor.py
headroom/transforms/kompress_compressor.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in rtk/installer.py
headroom/rtk/installer.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in adapters/hnsw.py
headroom/memory/adapters/hnsw.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in interceptors/astgrep.py
headroom/proxy/interceptors/astgrep.py
possible ▼
CHK-125b chmod — permission modification — no scope constraint in interceptors/astgrep.py
headroom/proxy/interceptors/astgrep.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in openclaw/install.py
headroom/providers/openclaw/install.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in strands/bundle.py
headroom/integrations/strands/bundle.py
possible ▼
CHK-020 hooks field in plugin.json — 1 hooks cause duplicate execution in Claude Code v2.1+
plugins/headroom-agent-hooks/.github/plugin/plugin.json
possible ▼
CHK-036 [GHSA-mr82-8j83-vxmv] pydantic 2.0.0 — see advisory: GHSA-mr82-8j83-vxmv
possible ▼
CHK-036 [PYSEC-2026-1812] pydantic 2.0.0 — see advisory: PYSEC-2026-1812
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in headroom/copilot_linux_secret.py
headroom/copilot_linux_secret.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in headroom/agent_savings.py
headroom/agent_savings.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in headroom/copilot_macos_keychain.py
headroom/copilot_macos_keychain.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in src/lib.rs
crates/headroom-py/src/lib.rs
possible ▼
CHK-125a fs.writeFile — unrestricted file write — no scope constraint in openclaw/prepare-dist.mjs
plugins/openclaw/prepare-dist.mjs
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in openclaw/README.md
plugins/openclaw/README.md
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in src/proxy-manager.ts
plugins/openclaw/src/proxy-manager.ts
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in workflows/security.yml
.github/workflows/security.yml
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in workflows/ci.yml
.github/workflows/ci.yml
possible ▼
CHK-125 eval() — arbitrary code execution — no scope constraint in workflows/eval.yml
.github/workflows/eval.yml
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in headroom-e2e-setup/action.yml
.github/actions/headroom-e2e-setup/action.yml
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in headroom-e2e-setup/action.yml
.github/actions/headroom-e2e-setup/action.yml
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in _lib/harness.py
e2e/_lib/harness.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in _lib/path_env.py
e2e/_lib/path_env.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in wrap/run.py
e2e/wrap/run.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in mcp_registry/claude.py
headroom/mcp_registry/claude.py
possible ▼
CHK-125c urllib.request — unconstrained HTTP — no scope constraint in install/health.py
headroom/install/health.py
possible ▼
CHK-125c urllib.request — unconstrained HTTP — no scope constraint in rtk/installer.py
headroom/rtk/installer.py
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in ccr/batch_store.py
headroom/ccr/batch_store.py
possible ▼
CHK-125c urllib.request — unconstrained HTTP — no scope constraint in memory/locomo.py
headroom/evals/memory/locomo.py
possible ▼
CHK-125c urllib.request — unconstrained HTTP — no scope constraint in tests/e2e_cortex_proxy.py
tests/e2e_cortex_proxy.py
possible ▼
▼ Show 13 false positives (10% of this view) Last scanned: Jul 12, 2026
More servers
google-gemini/gemini-cli 85
An open-source AI agent that brings the power of Gemini directly into your terminal.
106k★
skypilot-org/skypilot 85
obra/superpowers 85
Foundational skill pack by Jesse Vincent now in anthropics/claude-plugins-official. Includes ffuf web-fuzzing/pentest skill. Partial analysis done — full hook and plugin inspection pending. tier=T2
191k★
Significant-Gravitas/AutoGPT 85
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.
186k★
nanocoai/nanoclaw 85
A lightweight alternative to OpenClaw that runs in containers for security. Connects to WhatsApp, Telegram, Slack, Discord, Gmail and other messaging apps,, has memory, scheduled jobs, and runs directly on Anthropic's Agents SDK
30k★
google-gemini/gemini-cli 85
An open-source AI agent that brings the power of Gemini directly into your terminal.
106k★
Scan your entire org's MCP deployment
2,500+ repos pre-scored. 22% carry CRITICAL findings.