The skill and proxy attack different token costs
Caveman v2.4.0 combines two products under one name. The MIT skill changes how an agent writes, asking for compact answers while preserving code, commands, and errors. The local proxy tackles input instead. It sits between a supported coding agent and the provider, classifies payloads such as logs, JSON, source, diffs, search results, and HTML, then sends a smaller form upstream. You can install either part by itself, which is the sensible way to evaluate a tool that can change both prompts and replies.
This has grown far beyond a novelty prompt. The commit we inspected contained 1,400 files, about 249,058 lines of source, and a workspace structure spread across Node and Go components. Commands cover session-history analysis, shell-output compression, memory, browser extraction, agent wrapping, and skill conversion. Eight named agent profiles are documented, alongside recipes for provider SDKs and frameworks. That breadth is useful when several context drains share one workflow, but it also means an update can interact with agent configuration, network routing, local storage, and hooks.
Byte-exact recovery makes compressed context reversible
Caveman v2.4.0 exposes 5 MCP tools, including caveman_retrieve, which turns a recovery handle back into the stored original bytes. Its context packer ranks candidate material by relevance, recency, and error signal, then returns selected pieces in their original order. A dropped log line or collapsed array does not have to disappear permanently. That is a better failure model than irreversible summarization, provided the agent recognizes when it needs the original and asks for it.
The repository still asks you to trust a substantial local runtime. Our checkout was 16.4 MB before installation and occupied 915 MB after pnpm added its dependencies. Recovery copies live in SQLite, while browser work needs a local Chrome installation. The README says prompts, code, and file paths are excluded from anonymous telemetry, but command names and token counts are sent by default. caveman telemetry off and DO_NOT_TRACK=1 are documented, so privacy-sensitive teams can set the policy before the first real session.
What happened when we ran it
Our sandbox installed commit df2ccd8 in 47 seconds. Pnpm added 391 packages and the resulting dependency tree used 915 MB on disk. Npm audit reported 0 known vulnerabilities across all listed severity levels. The repository supplied no build script or target, so we skipped that step rather than inventing an equivalent. Our measurement setup was a fresh unprivileged Debian container with 3 CPUs, 8 GB of RAM, Node 22, and no secrets. These results establish setup cost, not token savings or answer quality.
The test command failed with exit 9 after 4 seconds. It invoked Node's test runner with --test-force-exit, and Node printed bad option: --test-force-exit; pnpm then reported the lifecycle failure. The log never reached individual test cases, so it does not tell us whether Caveman's installer or hook behavior is correct. It tells us that the repository's declared test command did not run successfully in the stated environment. A buyer should reproduce the suite on the exact Node version chosen for deployment.
The local proxy adds a credential boundary
Caveman v2.4.0 routes supported wrappers through a proxy on port 8787 and passes existing OAuth or API credentials through. Compression happens locally, and the README says there is no required Caveman backend. That keeps a new cloud account out of the path, but the proxy still becomes part of the credential and prompt route. Security review therefore needs to cover process ownership on that port, local file access to recovery data, telemetry policy, and what happens when the proxy cannot start cleanly.
Open issue 945 describes a specific fail-open concern: if another process owns port 8787, the wrapper reportedly warns about it and avoids killing it, yet may still point the agent and inherited provider credentials at that listener. The report is based on code-path inspection and does not claim a live exploit. Our 3-CPU, 8 GB sandbox had no secrets, so our run did not test credential forwarding. Until the issue is resolved and verified, operators should treat the loopback listener as a security boundary and confirm which process owns it before wrapping an authenticated agent.
Claude Remote Control and third-party hosting are real limits
Open issue 947 reports that Caveman's ANTHROPIC_BASE_URL override prevents Claude Code Remote Control from starting with Caveman CLI 1.3.1 and Claude Code 2.1.252. The reporter reproduced it with both the VS Code extension and npm package. Another open report, issue 946, says a Pi session using OpenCode Go was routed to the original OpenAI endpoint and returned a 401. These are recent user reports rather than findings from our sandbox, but they concern the exact provider-routing layer the proxy depends on.
The project is active: GitHub recorded 102,180 stars, 117 combined issues and pull requests, and a last push on August 29, 2026. Release v2.4.0 arrived that day. Our scan found 7 CI workflow files and a tests directory, though no Dockerfile. Licensing deserves the same attention as activity. The skill, CLI, and several client surfaces are MIT; the engine, proxy, MCP server, browser, and related runtime are BSL-1.1. First-party self-hosting is allowed, while third-party hosted, managed, or embedded service use requires a commercial license before the stated change date.