What Are the Dependencies for Caveman? Zero-External-Dependency Analysis

Caveman has zero external npm dependencies and relies exclusively on the Node.js standard library, requiring only Node.js version 18 or higher to run.

The JuliusBrussee/caveman repository implements a rare zero-dependency architecture for its installer and plugin system. Unlike conventional Node.js projects that rely on extensive node_modules trees, Caveman operates entirely using built-in modules. Understanding the dependencies for Caveman reveals a lightweight design that eliminates supply chain risks and simplifies deployment.

Root package.json: No External Dependencies

The root package.json in the JuliusBrussee/caveman repository contains no "dependencies" field whatsoever. Instead, the manifest specifies only an "engines" requirement mandating Node.js version 18 or above. This architectural choice means that executing npm install -g . fetches absolutely no third-party packages from the npm registry.

Standard Library Modules Powering Caveman

Caveman leverages native Node.js modules to handle all file operations, process management, and cryptographic tasks without importing external libraries.

File System Operations in caveman-config.js

The configuration utilities in src/hooks/caveman-config.js utilize only the fs, path, and os modules from the standard library. These built-in APIs handle directory creation, path resolution, and platform-specific flag storage.

// src/hooks/caveman-config.js
const fs   = require('fs');
const path = require('path');
const os   = require('os');

// Example: safely write a flag file
function safeWriteFlag(flagPath, data) {
  const dir = path.dirname(flagPath);
  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
  fs.writeFileSync(flagPath, data, { mode: 0o600 });
}

Process Spawning in the Shrink MCP Server

The MCP shrink server at src/mcp-servers/caveman-shrink/index.js imports child_process to spawn subprocesses. This native approach allows Caveman to execute external binaries without depending on wrapper libraries like execa or cross-spawn.

// src/mcp-servers/caveman-shrink/index.js
const { spawn } = require('child_process');

function launchShrinkServer() {
  const child = spawn('node', ['compress.js'], { stdio: 'inherit' });
  child.on('exit', code => console.log(`Shrink server exited with ${code}`));
}

Cryptographic Utilities in bin/lib/settings.js

For generating secure keys, bin/lib/settings.js employs the native crypto module. This eliminates the need for external cryptography packages while maintaining cryptographically secure randomness.

// bin/lib/settings.js
const crypto = require('crypto');

function generateKey() {
  return crypto.randomBytes(32).toString('hex');
}

Submodule Manifests: Plugins and Servers

The zero-dependency pattern extends throughout the entire codebase. Secondary package manifests confirm that neither plugins nor auxiliary servers declare external requirements.

• Opencode Plugin: src/plugins/opencode/package.json exists as a private package with no "dependencies" section.
• Shrink Server: src/mcp-servers/caveman-shrink/package.json similarly lacks any dependency declarations.

Consequently, the entire Caveman ecosystem—including the root installer, the Opencode plugin, and the shrink MCP server—operates without npm-installable dependencies.

Installation Requirements

Since Caveman declares no npm dependencies, the sole prerequisite is a compatible Node.js runtime. Ensure your environment runs Node.js 18 or higher as specified in the root package.json "engines" field. Global installation completes instantly without downloading additional packages.

Summary

• Caveman maintains zero external npm dependencies across all modules including the root installer, Opencode plugin, and shrink MCP server.
• The project relies exclusively on Node.js standard library modules including fs, path, os, child_process, and crypto.
• Installation requires only Node.js version 18 or higher, with no packages fetched from npm during npm install.
• Key files confirming this architecture include package.json, src/plugins/opencode/package.json, and src/mcp-servers/caveman-shrink/package.json.

Frequently Asked Questions

Does Caveman require any npm packages to be installed?

No. Caveman does not declare any dependencies in its package.json files. The project uses only Node.js built-in modules such as fs, path, and crypto, meaning npm install will not fetch any third-party packages from the registry.

What version of Node.js is required to run Caveman?

Caveman requires Node.js version 18 or higher, as specified in the "engines" field of the root package.json. This is the only prerequisite for running the installer and its associated plugins.

Are the Caveman plugins also dependency-free?

Yes. Both the Opencode plugin at src/plugins/opencode/package.json and the shrink MCP server at src/mcp-servers/caveman-shrink/package.json contain no "dependencies" sections. They operate as private packages using only standard library functionality.

How does Caveman handle file operations without external libraries?

Caveman uses the native fs and path modules directly. For example, src/hooks/caveman-config.js uses fs.mkdirSync and fs.writeFileSync with standard Node.js APIs, eliminating the need for utility libraries like fs-extra.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}