agent-memory-serverCAUTION
Munnin — an agent identity server: persistent memory for AI agents (identity, reasoning, episodic, knowledge) plus the procedures for tending it, served over MCP. Apache-2.0, runs locally in 5 minutes.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Munnin gives an AI agent a persistent self — identity, reasoning patterns, emotional moments, episodic history, knowledge — and serves the procedures for tending that memory beside the data, over MCP. It is the memory server of the agent-memory framework: an agent awakens from it as who it is, not from a pile of recalled facts, and writes back through the same discipline.
Python · FastMCP · FastAPI · SQLite. Apache-2.0. Runs on a laptop in five minutes with no identity provider.
Five-minute run
Needs Docker and git.
git clone --recurse-submodules https://github.com/alvseek/agent-memory-server
cd agent-memory-server
docker compose up -d --build
curl http://127.0.0.1:8200/health # {"status":"ok","service":"munnin","version":"0.1.0"}Connect a client. Claude Code:
claude mcp add --transport http munnin http://127.0.0.1:8200/mcp
or in a project's .mcp.json:
{ "mcpServers": { "munnin": { "type": "http", "url": "http://127.0.0.1:8200/mcp" } } }Then, in a session: ping answers pong, list_procedures returns the 14 memory procedures, and read_procedure("create-agent") walks you through making the first agent. No sign-in happens: this is local mode — one tenant, reachable from this machine only, and the server refuses to start any other way (how that guard works).
No Docker? uv sync && MUNNIN_AUTH=off uv run python -m munnin does the same on 127.0.0.1:8200.
Hosting it
The default is token mode: every /mcp and /api call needs a bearer token from an OIDC issuer that binds tokens to this server (aud = https:///mcp), and each person who signs in gets their own tenant. Set MUNNIN_PUBLIC_BASE_URL and MUNNIN_LOGTO_ENDPOINT, put it behind TLS, and paste https:///mcp into claude.ai's connectors or claude mcp add. The issuer requirements, the one-ident
4d753a51dea3OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add munnin --env MUNNIN_AUTH=${MUNNIN_AUTH} --env MUNNIN_AUTHKIT_DOMAIN=${MUNNIN_AUTHKIT_DOMAIN} -- uvx munnin{
"mcpServers": {
"munnin": {
"command": "uvx",
"args": [
"munnin"
],
"env": {
"MUNNIN_AUTH": "${MUNNIN_AUTH}",
"MUNNIN_AUTHKIT_DOMAIN": "${MUNNIN_AUTHKIT_DOMAIN}"
}
}
}
}Exposed tools (20)
13 read · 6 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
append | write | Add ``text`` to the END of a record |
archive | read | Retire a record from the hot index (still searchable on demand). |
awaken | read | Assemble and return an agent |
create_agent | write | Create a new agent. ``agent_id`` is a kebab domain and must not already exist — |
edit | write | Targeted string replace inside a record |
get | read | Load one record |
help | read | What this server is and what to call first — the same text a client receives at |
insert | write | Append a new memory item. ``scope= |
list_agents | read | List every agent in the fleet: ``agent_id`` + display name + one-line role. |
list_procedures | read | List the framework procedures this server serves — name, title, one-line purpose. |
list_resources | read | List the framework resources this server serves — name, title, one-line purpose. |
multi_edit | write | Apply a sequence of string edits to one record atomically (all-or-nothing). |
permanent_layer | read | The always-on memory a client writes into its system-prompt file: the |
ping | read | Liveness check — returns |
prepend | write | Add ``text`` to the START of a record |
query | read | Filter memory by exact field values, returning whole records with bodies. |
read_procedure | read | Read a served framework procedure, composed for this server |
read_resource | read | Read a served framework resource verbatim — a template or a script. |
search | read | Full-text (FTS5) keyword search over content + title + tags. |
soft_delete | destructive | Tombstone a record (excluded from all reads). |
Trust audit
CAUTIONgrade C · trust 80/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- found
Findings (16)
MUNNIN_PUBLIC_BASE_URL=http://127.0.0.1:8200
CMD ["python", "-c", "import os,sys,urllib.request; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:'+os.environ.get('MUNNIN_PORT','8200')+'/health', timeout=2).status==200 else 1)"]MUNNIN_PG_TEST_URL: postgresql://munnin:[email protected]:5432/munnin_test
SECRET = "alice-private-marker-zebra"
soft_delete
.gitmodules
.env.local.template
curl http://127.0.0.1:8200/health # {"status":"ok","service":"munnin","version":"0.1.0"}claude mcp add --transport http munnin http://127.0.0.1:8200/mcp
{ "mcpServers": { "munnin": { "type": "http", "url": "http://127.0.0.1:8200/mcp" } } }5. **Verify from outside before connecting anything**: `GET /api/agents` and `POST /mcp` both answer **401** anonymously, the `WWW-Authenticate` challenge names `.../.well-known/oauth-protected-resour
Three roles, and Munnin plays exactly one. The **identity provider** proves who the human is (Google, behind the issuer). The **authorization server** issues a token stamped for Munnin — `aud = https:
The tenant is a property of each **request**, not of the process. In token mode `TokenTenantResolver` maps the token's `(iss, sub)` — the only pair OpenID Connect guarantees stable — to an `account` r
- **Success Criteria**: **Pass, and by a stronger route than the plan specified.** The previously-open probe returns 401. The audience was then settled by Alvi completing the flow in MCP Inspector, an
- [ ] Present a token minted for a **different** registered resource (`https://default.logto.app/api`, the Management API — obtainable on the Authentra box via `configure-tenant.py`'s `token()`) to `P
At `initialize` the server returns four sentences of **instructions** — what Munnin is, what to call first whether you are new or returning, and that procedures come from `read_procedure`, never slash
Gates applied: no_behavioural_pass.
4d753a51dea3full audit observations/trust-audit/mcp-server/alvseek__agent-memory-server.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 4d753a51dea3 | CAUTION | C | 80 | first audit |
Questions
What is the agent-memory-server MCP server?
Munnin — an agent identity server: persistent memory for AI agents (identity, reasoning, episodic, knowledge) plus the procedures for tending it, served over MCP. Apache-2.0, runs locally in 5 minutes.
What tools does agent-memory-server expose?
20 in total: 13 read-only, 6 that write, and 1 that can delete or overwrite (soft_delete). Every one is listed on this page with its risk.
Is agent-memory-server safe to connect to an agent?
With care. The audit graded it C (80/100) and found 16 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does agent-memory-server need?
It reads MUNNIN_AUTH and MUNNIN_AUTHKIT_DOMAIN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does agent-memory-server run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on PyPI as munnin.
How current is this page?
The grade is for one exact copy of the source (4d753a51dea3), read on 2026-10-11. The repository is watched and re-audited when it changes.