What Are the Dependencies for the Caveman Project?

The Caveman project has zero external npm dependencies and relies exclusively on the Node.js standard library, requiring only Node.js version 18 or higher to run.

The Caveman installer and its associated plugins are designed as lightweight, standalone tools. Unlike typical Node.js projects that pull in external packages from npm, the JuliusBrussee/caveman repository contains no "dependencies" declarations in any of its manifest files. This article examines the specific package configurations and source code to confirm exactly what runtime requirements exist and how the codebase functions using only built-in Node.js modules.

Package Manifest Analysis: Where Dependencies Would Appear

A standard Node.js project lists external requirements in a "dependencies" object within package.json. In the Caveman repository, this field is completely absent across all sub-projects.

Root package.json

The root installer manifest at package.json contains no "dependencies" section. Instead, it only specifies Node.js engine requirements in the "engines" field, mandating Node.js version 18 or higher. This means running npm install -g . installs only the Caveman binary itself without fetching any additional packages from the npm registry.

Plugin and Server Manifests

The same pattern appears in secondary packages:

• Opencode plugin: src/plugins/opencode/package.json is marked as a private package with an empty dependency list
• Shrink MCP server: src/mcp-servers/caveman-shrink/package.json also contains no "dependencies" field

This consistency across the monorepo structure confirms that no external libraries are required for any component of the Caveman ecosystem.

Built-in Node.js Modules Used by Caveman

Without external dependencies, Caveman implements all functionality using Node.js core modules. The source code explicitly imports only built-in APIs for file system operations, process management, and cryptography.

File System Operations in src/hooks/caveman-config.js

Configuration management relies solely on fs, path, and os modules to handle directory creation and secure file writing:

// src/hooks/caveman-config.js
const fs   = require('fs');
const path = require('path');
const os   = require('os');

// Example: safely write a flag file
function safeWriteFlag(flagPath, data) {
  const dir = path.dirname(flagPath);
  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
  fs.writeFileSync(flagPath, data, { mode: 0o600 });
}

Child Process Spawning in src/mcp-servers/caveman-shrink/index.js

The MCP server implementation uses the child_process module to spawn Node.js subprocesses without requiring external process managers:

// src/mcp-servers/caveman-shrink/index.js
const { spawn } = require('child_process');

function launchShrinkServer() {
  const child = spawn('node', ['compress.js'], { stdio: 'inherit' });
  child.on('exit', code => console.log(`Shrink server exited with ${code}`));
}

Cryptographic Functions in bin/lib/settings.js

Security utilities leverage the native crypto module for generating secure random values:

// bin/lib/settings.js
const crypto = require('crypto');

function generateKey() {
  return crypto.randomBytes(32).toString('hex');
}

All modules referenced above—fs, path, os, child_process, and crypto—are part of the Node.js standard library and require no separate installation.

Node.js Engine Requirements

While Caveman has no package dependencies, it does enforce a runtime requirement. The root package.json specifies "node": ">=18" in the engines field, ensuring compatibility with modern JavaScript features and stable module APIs. This is the only prerequisite for running the installer or any of its plugins.

Summary

• Zero external dependencies: Caveman declares no "dependencies" in the root package.json, the Opencode plugin manifest (src/plugins/opencode/package.json), or the Shrink server manifest (src/mcp-servers/caveman-shrink/package.json)
• Standard library only: All functionality relies on Node.js built-in modules including fs, path, os, child_process, and crypto
• Single runtime requirement: Only Node.js version 18 or higher is required to execute the installer binary (bin/install.js) and associated hooks
• Lightweight installation: Global installation via npm install -g . fetches no additional packages from the npm registry

Frequently Asked Questions

Does Caveman require npm install to run local dependencies?

No. Caveman does not require npm install to fetch any external dependencies because it has none declared. You can clone the JuliusBrussee/caveman repository and immediately run the installer using Node.js directly, as all code relies only on modules built into the Node.js runtime.

What is the minimum Node.js version required for Caveman?

The minimum supported version is Node.js 18 or higher. This requirement is explicitly defined in the "engines" field of the root package.json file. The project uses modern Node.js APIs that are stable and available in version 18 and above.

Which specific Node.js modules does Caveman use instead of external packages?

Caveman uses several core Node.js modules: fs and path for file operations in src/hooks/caveman-config.js, child_process for spawning processes in src/mcp-servers/caveman-shrink/index.js, and crypto for generating keys in bin/lib/settings.js. These built-in modules provide all necessary functionality without third-party alternatives.

Why does the Caveman project avoid external npm dependencies?

By relying exclusively on the Node.js standard library, Caveman eliminates supply chain vulnerabilities, reduces installation time, and ensures the tool works in isolated or offline environments. This zero-dependency approach keeps the installer lightweight and maintainable across different systems without version conflicts or deprecated package issues.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}