claude-historian-mcp

The server's primary function involves reading local `.jsonl` conversation files. It utilizes `fs/promises` and `readline` for file access, which are standard for local file operations. It does not perform outbound network requests for its core search functionality. The `UniversalHistorySearchEngine` attempts to access Claude Desktop data (e.g., LevelDB, SQLite) via temporary file copying to prevent locks, with temporary directories created using `mkdtemp` with secure permissions (`0o700`) and subsequently cleaned up. The `child_process` module is used for internal build/test scripts or controlled local execution in `testMCPServer`, not for executing arbitrary user input. No hardcoded secrets or 'eval' are observed in the runtime code. Desktop support for directly reading LevelDB/SQLite is explicitly marked as 'TEMPORARILY DISABLED' in the code, further reducing potential attack surface related to complex database interactions, and simplifying its runtime behavior to primarily local Claude Code files.