by liliu-z
Turn local files into searchable context for AI agents.
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
# Add to your Claude Code skills
git clone https://github.com/liliu-z/stashbaseGuides for using ai agents skills like stashbase.
Last scanned: 7/30/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@electron/asar: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@electron/universal: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "app-builder-lib: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash",
"severity": "high"
},
{
"type": "npm-audit",
"message": "dir-compare: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "dmg-builder: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "ejs: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "electron-builder: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "electron-builder-squirrel-windows: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "electron-winstaller: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "filelist: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "glob: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "jake: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "minimatch: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "rimraf: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "temp: Vulnerability found",
"severity": "high"
}
],
"status": "WARNING",
"scannedAt": "2026-07-30T06:27:15.682Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}Turn local files into searchable context for Agents.
Much of your best context lives in local files that Agents can't easily search — papers, contracts, scanned documents, recordings. 📂 Open a folder in StashBase and its supported contents become searchable:
Your folders remain the source of truth; StashBase adds a search index that can be rebuilt from them.
The core idea:
Local files -> prepared text -> search index -> MCP -> Agents
Open this repo in StashBase and ask the built-in Agent: How is this project designed?

StashBase's primary platforms are macOS 12+ (Apple Silicon) and Windows 10+ (x64). A community-supported Linux build is also available for x86_64 Debian 12+ / Ubuntu 22.04+.
brew install --cask liliu-z/stashbase/stashbase
Download the latest StashBase-*-win-x64.exe installer from Releases, then run it.
Download the latest StashBase-*-linux-amd64.deb asset from Releases, then install it:
sudo dpkg -i ./StashBase-*-linux-amd64.deb
Don't have an embedding API key? In-app keyword search works without one. Join our Discord to ask about evaluation access.
Your library is opt-in: only folders you open in StashBase are indexed. You can remove a folder from the library at any time; StashBase clears its index but never deletes the folder from disk.
Use File → New Window or Cmd/Ctrl+Shift+N to keep different folders and tools side by side. Window close follows VS Code's platform shortcuts; Cmd/Ctrl+W continues to close the active document tab.
StashBase has two core jobs: prepare files and index their contents.
Some formats need preparation before their contents can be searched. StashBase keeps the original files in place and creates derived text only where needed for search and Agent access.
| Format | Visible source | Indexed text |
|---|---|---|
| Markdown | The Markdown file | Source text |
| HTML | The HTML file | Clean text extracted from the HTML |
| The original PDF | Derived Markdown | |
| DOCX | The original DOCX | Derived HTML |
| Images | The original image | OCR text |
| Audio and video | The original media | Audio track transcribed locally to timestamped Markdown |
For PDF, DOCX, audio, and video, Agents read the derived text while the original remains the visible source file. Audio and video play directly when supported; otherwise, StashBase creates a compatible local audio preview. Large files dragged into the app stream to disk instead of being held entirely in memory. See Architecture and Preparation for the product and system contracts.
StashBase builds semantic and keyword search over:
Search results point back to the user-visible source file, not hidden app data.
Background preparation is intentionally quiet. Browsing a folder should feel like browsing files, not watching an indexing job. If preparation fails, StashBase shows a lightweight failure marker and lets you retry. Readiness matters most when you search, so that is where StashBase shows how much of your content is ready.
MCP is the main interface between StashBase and Agents.
While the StashBase app is running, a local MCP server makes the same library available to external clients and the built-in Agent panel.
Core tools:
library_info - return the default folder home, opened folders, optional folder descriptions, and embedder status.search_library - search the library, optionally scoped by folder or path prefix.reindex - reconcile disk changes and make updated files searchable.StashBase also exposes bounded file helpers for opened folders:
list_directoryread_filewrite_fileedit_filemove_filedelete_fileThese helpers exist for Agent clients that run in a sandbox and cannot directly access the user's host files. They are not a general-purpose filesystem API.
The normal path is Settings -> MCP. StashBase can write the MCP config for supported clients or copy the stdio snippet for clients that manage config themselves.
For manual stdio setup, URL-based clients, Docker access, ports, CORS boundaries, and token rotation, see Advanced MCP configuration.
StashBase includes a built-in panel for running local Agent CLIs such as Claude Code and Codex against the current folder.
The panel is a convenient client of the same MCP server, not a separate knowledge base. It adds:
Local files are the source of truth.
~/.stashbase/config.json # app-level config, including transcription preferences
<folder>/
paper.pdf # user file
<appData>/derived.nosync/ # derived text, assets, transcript work, media previews
<appData>/models/whisper/ # explicitly downloaded local speech models
<appData>/vector-store.nosync/ # Milvus Lite vector store
<appData>/state/state.db # conversion failures and local app state
Removing a folder from the library clears StashBase's app-owned state for that folder. It does not delete the folder or its files from disk.
The design docs explain the product intent, system contracts, and contribution areas without duplicating the source tree:
For contributors and developers building locally, and for platforms without a prebuilt installer.
git clone https://github.com/liliu-z/stashbase
cd stashbase
pnpm install
pnpm setup:python
# Build the renderer and run Electron
pnpm build:web
pnpm electron
# Development mode
pnpm dev
# Build a distributable app for your platform
pnpm dist # macOS
pnpm dist:win # Windows
pnpm dist:linux # Linux
# Optional: include the local PDF/OCR extractor sidecar
pnpm build:python-extract-sidecar
Before opening a PR:
pnpm check
Early alpha.
Primary support:
Community-supported:
Reasonably stable:
Small focused PRs are preferred. Open an issue before larger changes so scope and direction can be discussed first.
Not sure where to start? Pick something from Where We Need Help, or open design-docs/ in StashBase and ask the Agent — or just ask us.
See CONTRIBUTING.md for local development, validation, and release-maintainer notes.
StashBase is an independent open-source project built by [Li
stashbase is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by liliu-z. Turn local files into searchable context for AI agents. It has 145 GitHub stars.
stashbase returned warnings in SkillsLLM's automated security scan. It has no critical vulnerabilities, but review the flagged issues in the Security Report section before adding it to your workflow.
Clone the repository with "git clone https://github.com/liliu-z/stashbase" and add it to your Claude Code skills directory (see the Installation section above).
stashbase is primarily written in TypeScript. It is open-source under liliu-z on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh stashbase against similar tools.
No comments yet. Be the first to share your thoughts!