basemind 0.17.0

Full AI context layer over MCP — tree-sitter code-map, document RAG (PDF/Office/HTML/email + OCR + reranker), shared agent memory, on-demand web crawl, git history + blame + per-symbol diff. 300+ languages, 10+ coding-agent harnesses, content-addressed Fjall + LanceDB.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116

[graph]
targets = []
all-features = false
no-default-features = false

[output]
feature-depth = 1

[advisories]
ignore = [
    # number_prefix — unmaintained, transitive via lance; no replacement available.
    "RUSTSEC-2025-0119",
    # paste — unmaintained, widely-used proc-macro; still functional, no migration path.
    "RUSTSEC-2024-0436",
    # rustls-pemfile — unmaintained, transitive via the rustls/reqwest stack; functional,
    # folded into rustls upstream, no migration needed here.
    "RUSTSEC-2025-0134",
    # bincode 1.x — unmaintained, transitive via rmux-proto (the shells rmux stack); functional,
    # bump belongs upstream in rmux, no migration path here.
    "RUSTSEC-2025-0141",
    # ttf-parser — unmaintained, transitive via the font/PDF text-extraction stack (xberg);
    # functional, no maintained drop-in, bump belongs upstream.
    "RUSTSEC-2026-0192",
    # quick-xml — quadratic parse of duplicate attribute names (DoS). Transitive via the
    # document/Office XML extraction stack; basemind only parses documents a user explicitly
    # indexes (local, operator-chosen inputs), so the DoS surface is not attacker-reachable. Fix
    # belongs in the upstream extractor's quick-xml bump.
    "RUSTSEC-2026-0194",
    # quick-xml — unbounded namespace-declaration allocation in `NsReader` (memory-exhaustion DoS).
    # Same transitive/document-only exposure as RUSTSEC-2026-0194 above.
    "RUSTSEC-2026-0195",
]

[licenses]
allow = [
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "MIT",
    "MIT-0",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "CDLA-Permissive-2.0",
    "Zlib",
    "Unlicense",
    "CC0-1.0",
    "Unicode-3.0",
    "BSL-1.0",
    "0BSD",
    # finl_unicode (transitive) ships under Unicode-DFS-2016 — the same Unicode
    # Consortium license family as Unicode-3.0 (already allowed).
    "Unicode-DFS-2016",
]
confidence-threshold = 0.8

# zstd-sys / zstd-safe still ship `license = "MIT/Apache-2.0"` (deprecated slash
# form). The licenses are individually allowed above — clarify the expression
# so cargo-deny parses them as an SPDX OR.
[[licenses.clarify]]
name = "zstd-sys"
expression = "MIT OR Apache-2.0"
license-files = []

[[licenses.clarify]]
name = "zstd-safe"
expression = "MIT OR Apache-2.0"
license-files = []

[[licenses.clarify]]
name = "zstd"
expression = "MIT OR Apache-2.0"
license-files = []

# option-ext (transitive via dirs → tree-sitter-language-pack) is MPL-2.0.
# Accept the file-level copyleft scope for this single dependency.
[[licenses.exceptions]]
name = "option-ext"
allow = ["MPL-2.0"]

# uluru (transitive via gix-pack → gix) is an LRU cache crate, MPL-2.0. Accept
# the same file-level copyleft scope as option-ext.
[[licenses.exceptions]]
name = "uluru"
allow = ["MPL-2.0"]

# libbz2-rs-sys (transitive via the document tier's archive support) ships
# under the bespoke bzip2-1.0.6 license — equivalent to BSD-style permissive.
[[licenses.exceptions]]
name = "libbz2-rs-sys"
allow = ["bzip2-1.0.6"]

[licenses.private]
ignore = false
registries = []

[bans]
multiple-versions = "warn"
wildcards = "allow"
highlight = "all"
workspace-default-features = "allow"
external-default-features = "allow"
allow = []
deny = []
skip = []
skip-tree = []

[sources]
unknown-registry = "warn"
unknown-git = "warn"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []

[sources.allow-org]
github = []
gitlab = []
bitbucket = []