🐉 Wyrm Cloud

Encrypted multi-device sync for the Wyrm MCP server. A paid add-on: sync needs a Pro license or higher. Wyrm itself stays free to use on your machine.

Live at wyrm.ghosts.lk.

Two editions — don't confuse them (constitution Article IX):

• Wyrm Sync — this page. Zero-knowledge, end-to-end encrypted multi-device sync. Your master key never leaves your device; the server stores opaque ciphertext and cannot read your memory.
• Wyrm Cloud (managed memory) — a separate, opt-in, entitlement-gated tier at mcp.wyrm.ghosts.lk for Claude web/phone connectors (remote MCP). Those clients have no local machine or key, so this store is server-readable by design (not E2E) and disclosed as such. It is never created from your Sync/Local data automatically.

What it does

You install wyrm-mcp on your phone, laptop, workstation. Each one has its own local Wyrm database. Without Wyrm Cloud, those databases drift — a quest you closed on your laptop doesn't appear on your phone.

With Wyrm Cloud:

1. You sign in once per device with Google or GitHub
2. Mark rows as cross-project visible (cross_project_visibility = 'org' or 'public')
3. Run wyrm cloud sync — those rows are encrypted client-side, pushed to the cloud, then pulled to your other devices
4. The cloud stores opaque ciphertext only — your encryption key never leaves your devices

What's encrypted

Row type	Synced
Ground truths	✓
Memory artifacts	✓
Quests	✓
Design tokens	✓
Design references	✓
Sessions, hour entries, failure patterns	— (device-local time-series)

Only rows where you explicitly set cross_project_visibility = 'org' or 'public' are pushed. Default is 'within' — local-only.

Quick start

# install the latest stable
npm install -g wyrm-mcp@latest

# sign in (browser flow with Google or GitHub)
wyrm cloud login

# see what's there
wyrm cloud status

# push + pull (needs a Pro license or higher)
wyrm cloud sync

Without a Pro license wyrm cloud sync stops and prints your current tier. Signing in, status, devices, recovery and delete work on any tier.

The login flow:

1. CLI prints https://wyrm.ghosts.lk/cli and a short code like ABCD-1234
2. You open the URL on your phone, type the code, sign in
3. CLI polls; completes in seconds

Encryption details

• Algorithm: AES-256-GCM (Cloudflare server cannot decrypt)
• Key: 32 random bytes stored at ~/.wyrm/cloud.key (0600 perms)
• Generated automatically on first wyrm cloud login
• Per-payload envelope: [version:1][iv:12][ciphertext+tag:N+16]
• Tamper detection: GCM auth tag rejects modified ciphertext

You're responsible for backing up ~/.wyrm/cloud.key. Losing it means losing access to your synced data — by design. This is the operator-owns-data guarantee in our constitution.

Architecture

┌──────────────────────────┐                ┌──────────────────────────┐
│ Your machine             │                │ Cloudflare edge          │
│ wyrm-mcp + wyrm CLI      │                │ wyrm.ghosts.lk Worker    │
│ ~/.wyrm/wyrm.db (SQLite) │ HTTPS+Bearer   │                          │
│ ~/.wyrm/cloud.key (0600) │ ──────────►    │ Validates session         │
│                          │                │ Stores ciphertext in R2   │
│ Encrypts BEFORE sending  │                │ Indexes deltas in D1      │
└──────────────────────────┘                └──────────────────────────┘

The cloud server has access to:

• Your email + the OAuth provider (Google or GitHub) you signed in with
• Counts of deltas, devices, storage usage
• Encrypted blob bytes (opaque to the server)

The cloud server does NOT have access to:

• Plaintext memory content
• Your encryption key (~/.wyrm/cloud.key)
• The actual kind, row_id, or payload data inside blobs (well — kind is cleartext for filtering, but the payload contents are encrypted)

Tiers

Tier	Price	What it adds
Free	$0	Local Wyrm: the memory, the firewall, the recall. No cloud sync
Pro	$29/mo	Cloud sync, encrypted snapshots, analytics, priority support
Team	$199/mo	Shared team memory, up to 25 seats, admin dashboard
Enterprise	$499/mo	Unlimited seats, SSO/SAML, custom SLA, on-premise option

Plans and self-serve checkout: ghosts.lk/pricing. The CLI checks the license before it moves data: wyrm cloud sync, wyrm cloud daemon and wyrm cloud export need Pro or higher. login, logout, status, doctor, devices, recovery and delete work on any tier, so you can always sign in, see your account, and delete your own data.

Web dashboard

wyrm.ghosts.lk/login — same Google/GitHub sign-in, then a web dashboard at /app showing:

• Account email + tier
• Storage usage
• Devices (revoke individual machines)
• Orgs you belong to
• Logout

CLI command reference

wyrm cloud login                  # Google or GitHub OAuth
wyrm cloud logout                 # revoke session both ends
wyrm cloud status                 # account / tier / storage / devices
wyrm cloud devices                # list registered devices
wyrm cloud devices revoke <id>    # revoke a specific device
wyrm cloud sync [--dry-run]       # push + pull encrypted deltas (Pro or higher)

Config locations:

• ~/.wyrm/cloud.json — session token (HttpOnly-equivalent, 0600)
• ~/.wyrm/cloud.key — AES-256-GCM master key (0600, NEVER shared)
• ~/.wyrm/cloud-cursor.json — last-pulled timestamp per device

Security guarantees

• All HTTP traffic over TLS 1.3 (Cloudflare-enforced)
• 60-second timeout on every CLI request (no hung sessions)
• OAuth login defeats: code-substitution phishing (typed-code), login-CSRF (state-cookie binding), redirect-URI tampering (registered-URI verification)
• Sessions are 256-bit random tokens, 30-day expiry, revocable instantly
• Devices revoked from the dashboard refuse future syncs at the next attempt
• Server-side: every D1 query is tenancy-filtered by account_id from the validated Bearer
• Pentest pass: 50+ adversarial probes across SQL injection, IDOR, oversize payloads, cleartext-payload rejection — all clean

Constitution alignment

Wyrm Cloud is rule I (local-first) compliant: Wyrm runs unchanged without ever logging in. The cloud is purely additive opt-in.

Wyrm Cloud is rule IV (operator owns the data) compliant: AES-256-GCM with operator-held keys, server stores opaque blobs only, full data export via ~/.wyrm/wyrm.db, can be deleted on demand.

Links

• Docs and community: github.com/Ghosts-Protocol-Pvt-Ltd/wyrm-mcp

Cost transparency

Wyrm Cloud runs on Cloudflare's free tier:

• Workers: 100K requests/day free
• D1: 5GB · 5M reads/day · 100K writes/day free
• R2: 10GB storage · $0 egress free

At current scale (single founder + a few testers), monthly cost is $0.00. We'll publish a hosting-cost transparency report once traffic warrants it.