zero runtime dependencies, on purpose

claude-rpc installs next to your Claude Code credentials, your transcripts, and your source code. A tool in that position deserves paranoia, yours and mine. So as of v0.13.5 the npm package has zero runtime dependencies, and I intend to keep it that way.

what that took

The obvious dependency for a project like this is a Discord RPC library. I wrote the IPC client by hand instead, and honestly it was less work than the reputation suggests. The protocol is small: a unix socket on macOS and Linux, a named pipe on Windows, an eight byte header carrying an opcode and a length, then a JSON payload. A few hundred lines covers connect, handshake, activity updates, and reconnects.

The transcript parser is hand rolled too, a line by line JSONL reader with incremental caching. Same for the SVG renderers behind the badges, cards, and the year heatmap. None of these needed a framework. They needed attention.

what you get

• npm i installs exactly one package. There is no tree to audit, because there is no tree.
• No install scripts. Nothing runs on your machine at install time.
• Publishing is CI only, with npm provenance attached. The package on the registry provably comes from the public repo.
• GitHub Actions are pinned to commit SHAs, not floating tags.
• Discord communication is a local socket. The only network features are opt in, and they are documented in SECURITY.md.

The point of all this is not purity. The point is that one person can sit down with the repo and audit the entire supply chain in a single session. Most tools in this space cannot offer that, not because their authors are careless, but because the default path piles up dependencies fast.

the tradeoff

I maintain more code. When the IPC handshake has a bug, it is my bug, with no upstream to wait on. I think that trade is correct for a tool that lives this close to your work, and so far the hand rolled parts have been the most stable code in the project.

If you want to check my claims, the code is short and public: github.com/rar-file/claude-rpc. Start with src/discord-ipc.js.