cache-commander - Cache Commander — a TUI and MCP server to explore,

项目说明

ccmd — Cache Commander

![CI]()
![codecov]()
![Release]()
![GitHub release]()
![Rust]()
![macOS]()
![Linux]()
![crates.io]()
![crates.io downloads]()
![GitHub downloads]()
![Homebrew]()

A terminal UI (TUI) for exploring, auditing, and cleaning de cache directories on macOS and Linux. Scan cached packages for known CVEs, find outdated dependencies, and reclaim disk space — all from one tool.

De machines accumulate tens of gigabytes of in cache data — ML models, package archives, build artifacts, downloaded bottles. ccmd makes it all , scannable for , and safely deletable.

!Cache Commander screenshot

Why

ccmd gives you a single view across all of them with security scanning built in.

Install

Homebrew (macOS and Linux, includes MCP)

From crates.io

With cargo-binstall (prebuilt, includes MCP)

From source

Prebuilt binaries (includes MCP)

Download from GitHub Releases — a for macOS (x86_64, Apple Silicon) and Linux (x86_64, aarch64).

Quick Start

Features

Browse and Understand

Security Scanning

Clean Up

Platform Support

macOS and Linux only. Windows is not supported. Path detection, cache directory resolution, and provider logic all assume Unix-style paths.

Supported Caches

| Provider | Location | Semantic names |
|----------|----------|----------------|
| HuggingFace | ~/.cache/huggingface | Model/dataset names, re |
| pip | ~/.cache/pip, ~/Library/Caches/pip | Wheel packages |
| uv | ~/.cache/uv, ~/Library/Caches/uv | Package names |
| Poetry | ~/.cache/pypoetry, ~/Library/Caches/pypoetry | Wheels and sdists from artifacts/ |
| npm | ~/.npm | npx packages + transiti deps |
| Homebrew | ~/Library/Caches/Homebrew | Bottles, casks |
| Cargo | ~/.cargo/registry | Crate names and |
| pre-commit | ~/.cache/pre-commit | Hook repo names |
| Whisper | ~/.cache/whisper | Model names (Large v3, Tiny, etc.) |
| GitHub CLI | ~/.cache/gh | Workflow run logs |
| PyTorch | ~/.cache/torch | Model checkpoints |
| Chroma | ~/.cache/chroma | Embedding models |
| Prisma | ~/.cache/prisma | Engine |
| Yarn | ~/.yarn-cache, .yarn/cache | Package names and |
| pnpm | ~/.pnpm-store, ~/Library/pnpm/store, ~/.local/share/pnpm/store (probed via pnpm store path) | Package names and |
| Bun | ~/.bun/install/cache | Package names and |
| Maven | ~/.m2/repository | group:artifact from layout |
| Gradle | ~/.gradle/caches | group:artifact from files-2.1 layout |
| SwiftPM | ~/Library/Caches/org.swift.swiftpm (macOS), ~/.cache/org.swift.swiftpm (Linux) | Package names from repositories/ and artifacts/ |
| Xcode | ~/Library/De/Xcode/Deri, ~/Library/De/Xcode/iOS De, ~/Library/De/CoreSimulator/Caches | Workspace path from Info.plist, iOS strings |
| Go | ~/go/pkg/mod (module cache), $GOCACHE / ~/Library/Caches/go-build (build cache) | Module paths (bang-decoded) with from cache/download/<module>/@v/*.zip |

Provider Capabilities

All pro support tree na, size display, and deletion. This matrix shows which optional capabilities each provider implements.

| Provider | Safety classification | Vuln scan (v/V) | Outdated check (o/O) | Upgrade copy (c) |
|----------|----------------------|---------------------|--------------------------|--------------------|
| HuggingFace | Safe | — | — | — |
| pip | Safe | OSV PyPI | PyPI | pip install |
| uv | Safe ⁴ | OSV PyPI | PyPI | uv pip install |
| Poetry | artifacts/ + cache/repositories/ = Safe; / = Caution | OSV PyPI | PyPI | poetry add |
| npm | Safe | OSV npm | npm registry | npm install |
| Homebrew | Safe | — | — | — |
| Cargo | Safe | OSV crates.io | crates.io | cargo update -p |
| pre-commit | Safe | — | — | — |
| Whisper | Safe | — | — | — |
| GitHub CLI | Safe | — | — | — |
| PyTorch | Safe | — | — | — |
| Chroma | Safe | — | — | — |
| Prisma | Safe | — | — | — |
| Yarn | Safe; Berry .yarn/cache/ = Caution (zero-install) | OSV npm | npm registry | yarn add |
| pnpm | Safe; store (node_modules/.pnpm/) = Caution | OSV npm ³ | npm registry ³ | pnpm add |
| Bun | Safe for install/cache/; .bun/bin/* = Unsafe (runtime); else Caution | OSV npm | npm registry | bun add |
| Maven | Safe | OSV Maven | Ma | <dependency>…</dependency> snippet |
| Gradle | Safe; build-cache-*/ + transforms-*/ = Caution | OSV Maven | Ma | implementation '…' line |
| SwiftPM | repositories/ = Caution (re-clone); artifacts/ + manifests/ = Safe; unknown subdirs = Caution | — ¹ | — ¹ | — ¹ |
| Xcode | Deri/ = Caution (5–30 min rebuild); iOS De/ + CoreSimulator/Caches/ = Safe | — ² | — ² | — ² |
| Go | pkg/mod = Safe (re-resolvable from proxy); go-build = Caution (cold rebuild cost) | OSV Go | proxy.golang.org /@v/list | go get |

Legend:

Notes:

Key Bindings

Na

| Key | Action |
|-----|--------|
| ↑/k ↓/j | Move up / down |
| →/l ←/h | Expand / Collapse (or go to parent) |
| Enter | Toggle expand |
| g / G | Jump to top / bottom |
| / | Search — type to filter, Enter to keep, Esc to clear |

Security

| Key | Action |
|-----|--------|
| v / V | Scan selected / all for CVEs |
| o / O | Check selected / all for outdated |
| f | Cycle status filter: none → vuln → outdated → both |
| c | Copy upgrade command to clipboard |

Marking and Deleting

| Key | Action |
|-----|--------|
| Space | Mark / unmark item |
| Shift+Space | Unmark all |
| m | Mark all items (with confirmation) |
| u | Unmark all |
| d / D | Delete marked items |

Other

| Key | Action |
|-----|--------|
| s | Cycle sort (size → name → modified) |
| r / R | Refresh selected / all |
| ? | Help o |
| q / Ctrl+C | Quit |

Configuration

Create ~/.config/ccmd/config.toml:

CLI flags o config file .

How It Works

Cache Detection

ccmd walks your cache directories and identifies pro by directory name and structure. Each provider has custom logic to decode semantic names — for example, HuggingFace stores models in directories like models--meta-llama--Llama-3.1-8B, which ccmd displays as [model] meta-llama/Llama-3.1-8B.

Scanning

When you press V (or pass --):

1. ccmd walks the cache tree to disco with identifiable name +
2. Sends a batch query to the OSV.dev API (chunked to 100 packages per request)
3. For each found, fetches the detailed ad to extract fix
4. Filters out already fixed by the installed
5. Displays results in the detail panel with fix , upgrade command, and ad link

npm Supply Chain Detection

The npx cache (~/.npm/_npx/) contains full node_modules trees. ccmd scans every transiti for:

Filter and Clean Workflow

The intended workflow for cleaning packages:

1. Scan: Press V to scan all packages for CVEs
2. Filter: Press f to show only items (non-matching items are dimmed)
3. Review: Na to see fix and upgrade commands
4. Mark: Press m to mark all items for deletion
5. Delete: Press d to delete — frees space and forces fresh downloads

MCP Server (AI Integration)

ccmd includes an MCP server that lets AI assistants like Claude query and manage your caches con. Build with the mcp feature and run ccmd mcp to start the stdio transport.

Configure in Claude Code:

Then ask Claude things like:

> "list my caches"

> "find the most npm packages"

! npm packages

> "find outdated packages in my cache"

!Outdated packages

A tools: list_caches, get_summary, search_packages, get_package_details, scan_, check_outdated, pre, delete_packages. See docs/mcp.md for full details.

Architecture

Contributing

Contributions and feedback are welcome!

Author

Julien Simon — — github.com/juliensimon

License

MIT — see LICENSE for details.

项目信息

开发语言：Rust

Star 数：72

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Cache Commander — a TUI and MCP server to explore, audit, and clean developer cache directories. Scan for CVEs, find outdated packages, reclaim disk space. Supports pip, npm, Cargo, HuggingFace, Homebrew, and more.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。