Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

bug(windows): unsigned engram.exe is blocked by Smart App Control, and the MCP failure says EUNKNOWN: uv_spawn

Open
  • Is something wrong?
#1,703 4 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
55/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
go
Domain
cli, documentation, release

Research direction

Find where the MCP server spawns engram.exe (the code path producing the uv_spawn error) and, on Windows, check whether the binary exists yet is refused, emitting a message that names the path and points at Smart App Control; done means a blocked binary produces that diagnosis instead of EUNKNOWN: uv_spawn. Separately, the release workflow that builds Windows binaries needs an Authenticode signing step, which depends on maintainer-held certificates and secrets. Also add the registry and Get-AuthenticodeSignature checks to the Windows install documentation, and verify by running the reproduction steps on an affected machine.

Written by the indexing model from the issue text.

Description

help wanted status:approved type:bug

Summary

On a stock Windows 11 machine with Smart App Control enabled, engram never starts. The MCP client reports:

engram (EUNKNOWN): "EUNKNOWN: unknown error, uv_spawn"

That message points at nothing useful. The real cause is that engram.exe ships unsigned, and Windows refuses to execute it:

Una directiva de Control de aplicaciones bloqueó este archivo
("An Application Control policy has blocked this file")

The binary is installed and on PATH. Nothing is misconfigured. Windows simply will not run it.

Why this is worth fixing upstream

Smart App Control is on by default on clean Windows 11 installs, and it blocks unsigned executables by reputation. So this is not one user's broken setup: it is the default state of the platform for anyone who installs Windows 11 fresh and then installs engram.

It also fails in a way that is very hard to diagnose:

  • The MCP error (uv_spawn) names neither the binary nor the reason.
  • From Git Bash the failure surfaces as Permission denied (exit 126), which reads like a filesystem permission problem and sends you looking in the wrong place entirely.
  • Only PowerShell surfaces the real message.
  • It looks intermittent. Smart App Control decides by cloud reputation, not a fixed list, so the same binary can run once and be blocked twenty minutes later. In one session here engram answered once mid-afternoon and never again. That intermittency makes it easy to dismiss as flaky.

I spent several working days attributing this to AppLocker before checking, and it was wrong: the effective AppLocker policy on this machine has no Exe rule collection at all.

Reproduction

Windows 11 with Smart App Control enabled, engram installed (go install or the installer — both copies are blocked).

# 1. Confirm Smart App Control is enforcing (1 = on)
(Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy' `
  -Name VerifiedAndReputablePolicyState).VerifiedAndReputablePolicyState
# -> 1

# 2. Confirm the binary is unsigned
(Get-AuthenticodeSignature "$env:USERPROFILE\go\bin\engram.exe").Status
# -> NotSigned

# 3. Try to run it
& "$env:USERPROFILE\go\bin\engram.exe" --version
# -> Error al ejecutar el programa 'engram.exe':
#    Una directiva de Control de aplicaciones bloqueó este archivo

Both install locations are affected:

%USERPROFILE%\go\bin\engram.exe
%LOCALAPPDATA%\engram\bin\engram.exe

What the user is left with

The only workaround on the user's side is to turn Smart App Control off — and that is a one-way door: Windows does not let you re-enable it without reinstalling the OS. Asking users to permanently disable a system-wide security control so that a memory plugin can start is a steep price, and it weakens protection for everything else on the machine, not just for engram.

Copying the binary elsewhere appears to help and does not: it worked once here and then went back to being blocked in all four directories I tried.

Suggested fix

Authenticode-sign the Windows release binaries. That removes the problem for every Windows 11 user at once, instead of each of them individually disabling a security feature.

If signing is not immediately possible, two smaller things would still help a lot:

  1. Surface a better error. When spawning fails on Windows, check whether the binary exists and is executable, and say so. Something like "found engram.exe at <path> but Windows refused to execute it — this is usually Smart App Control blocking unsigned binaries" turns a dead end into a one-minute fix.
  2. Document it in the Windows install instructions, with the two registry/signature checks above, so people stop diagnosing it from scratch.

Environment

Windows 11 Pro 10.0.26200
Smart App Control: enabled (VerifiedAndReputablePolicyState = 1)
engram.exe: NotSigned
Claude Code plugin: engram@engram (marketplace Gentleman-Programming/engram)

I am happy to test a signed build if that helps.

Dominant language
Go
Stars
7.1k
Forks
729
Avg merge
11h 17m
Merged PRs (30d)
334

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Gentleman-Programming/engram

All issues in Gentleman-Programming/engram

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.