MCP server · Org-owned · Audited from source

Basic Memory MCP server

by basicmachines-co/basic-memoryAGPL-3.0 licenceAudited 22 Sep 2026 · source 66cdcaa927f9

npm @basicmemory/pi-basic-memory 0.23.2stdiostreamable-http★ 4,016

✕BLOCKGrade F · 36/100 · 22 Sep 2026 · 66cdcaa

Safer alternatives View source on GitHub ↗

Is it safe? No — BLOCK, grade F (36/100). It exposes 18 tools: 14 read, 3 write and 1 destructive. The audit recorded 57 findings (0 critical, 2 high, 16 medium, 39 low). Maintainer's description: AI conversations that actually remember. Never re-explain your project to your AI again. Join our Discord: https://discord.gg/tyvKNccgqN

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “Basic Memory MCP server (basicmachines-co/basic-memory)”. Retrieved 22 Sep 2026. https://modelsatlas.com/mcp/basicmachines-co/basic-memory

Why this is BLOCK. The audit found 0 critical and 2 high findings; the most severe is Hard-coded secrets at .env.example:12. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

Trust audit

Audit 0.4.1 · full source read 22 Sep 2026

Trust score36/100✕BLOCK F

0 critical2 high16 medium39 low0 info

57 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemDeclared4 observations
NetworkDeclared3 observations
ShellDeclared1 observation
DependenciesNot pinnedSome ranges float
SecretsFoundSee the findings

Findings (57)

Sorted by severity · the 25 most severe of 57 are listed

HIGHHard-coded secretssecret.db_uri · .env.example:12

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

HIGHPrompt injectionprompt.hide_from_user · .agents/skills/cmux-settings/SKILL.md:68

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

- Never tell the user to restart cmux. The file watcher reloads on save.

Why: asks the agent to act without the user's knowledge
Fix: —

MEDIUMInventory / provenanceinv.symlink · .claude/skills/adversarial-review

F-13 Inventory / provenanceCWE-1104Layer L0

.claude/skills/adversarial-review

Why: link not followed
Fix: —

MEDIUMInventory / provenanceinv.symlink · .claude/skills/basic-machines-review

F-13 Inventory / provenanceCWE-1104Layer L0

.claude/skills/basic-machines-review

Why: link not followed
Fix: —

MEDIUMInventory / provenanceinv.symlink · .claude/skills/cmux

F-13 Inventory / provenanceCWE-1104Layer L0

.claude/skills/cmux

Why: link not followed
Fix: —

MEDIUMInventory / provenanceinv.symlink · .claude/skills/cmux-markdown

F-13 Inventory / provenanceCWE-1104Layer L0

.claude/skills/cmux-markdown

Why: link not followed
Fix: —

MEDIUMInventory / provenanceinv.symlink · .claude/skills/cmux-settings

F-13 Inventory / provenanceCWE-1104Layer L0

.claude/skills/cmux-settings

Why: link not followed
Fix: —

MEDIUMInformation disclosuredisclose.log_secret · src/basic_memory/cli/commands/cloud/shares.py:180

F-12 Information disclosureCWE-209 · CWE-532Layer L1

console.print(f"  Token: {data.get('token', 'unknown')}")

Why: No further detail recorded for this rule.
Fix: —

MEDIUMInformation disclosuredisclose.log_secret · src/basic_memory/cli/commands/cloud/shares.py:457

F-12 Information disclosureCWE-209 · CWE-532Layer L1

console.print(f"[red]Share not found: {token}[/red]")

Why: No further detail recorded for this rule.
Fix: —

MEDIUMInformation disclosuredisclose.log_secret · src/basic_memory/cli/commands/cloud/shares.py:514

F-12 Information disclosureCWE-209 · CWE-532Layer L1

console.print(f"[green]Share {token} revoked successfully[/green]")

Why: No further detail recorded for this rule.
Fix: —

MEDIUMInformation disclosuredisclose.log_secret · src/basic_memory/cli/commands/cloud/shares.py:525

F-12 Information disclosureCWE-209 · CWE-532Layer L1

console.print(f"[red]Share not found: {token}[/red]")

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.raw_ip · .agents/skills/cmux-workspace/SKILL.md:35

F-04 Network egressCWE-200 · CWE-319Layer L1

cmux new-pane --workspace "${CMUX_WORKSPACE_ID}" --type browser --direction right --url "http://127.0.0.1:8765"

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.db_uri · .github/workflows/test.yml:264

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.db_uri · .github/workflows/test.yml:338

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.db_uri · tests/cli/test_config_command.py:334

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.db_uri · tests/mcp/test_tool_basic_memory_diagnostics.py:106

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.private_key · integrations/tau/tests/test_recovery.py:248

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMFilesystem / pathmcp.destructive_tools

F-05 Filesystem / pathCWE-22 · CWE-59Layer L3

delete_project

Why: 1 tool(s) can delete or overwrite
Fix: prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenanceinv.hidden_file · integrations/hermes/.coveragerc

F-13 Inventory / provenanceCWE-1104Layer L0

.coveragerc

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWCode injectioncode.dynamic_import · tests/mcp/tools/test_mutating_memory_url_routing.py:51

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

tool_module = importlib.import_module(module_name)

Why: No further detail recorded for this rule.
Fix: —

LOWInsecure cryptocrypto.weak_hash · src/basic_memory/cli/commands/cloud/webdav_transfer.py:350

F-09 Insecure cryptoCWE-327 · CWE-338Layer L1

digest = hashlib.md5(usedforsecurity=False)

Why: No further detail recorded for this rule.
Fix: —

LOWInsecure cryptocrypto.weak_hash · tests/cli/cloud/test_webdav_transfer.py:34

F-09 Insecure cryptoCWE-327 · CWE-338Layer L1

return hashlib.md5(data, usedforsecurity=False).hexdigest()

Why: No further detail recorded for this rule.
Fix: —

LOWInformation disclosuredisclose.log_secret · tests/markdown/test_task_detection.py:17

F-12 Information disclosureCWE-209 · CWE-532Layer L1

print(f"{token.type}: {token.content}")

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.credential_store · tests/mcp/test_tool_move_note.py:776

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

"../../../root/.ssh/id_rsa",

Why: touches a credential store
Fix: —

LOWFilesystem / pathfs.credential_store · tests/mcp/test_tool_move_note.py:844

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

"/root/.ssh/id_rsa",

Why: touches a credential store
Fix: —

Tools it exposes

18 declared in source · 1 destructive

14 read3 write1 destructive

1 tool can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one, so give it a token scoped to what you need.

Tool	What it does	Risk
`delete_project`	Delete a Basic Memory project.	destructive
`bm-setup`	Install or update the Basic Memory CLI (requires uv)	write
`create_memory_project`	No description in the source	write
`remember`	Save something to the Basic Memory knowledge graph	write
`basic_memory_diagnostics`	No description in the source	read
`cat`	Print a note	read
`fetch`	ChatGPT/OpenAI MCP fetch adapter returning a single text content item.	read
`grep`	Search note content, semantically by default.	read
`list_memory_projects`	No description in the source	read
`ls`	List the immediate contents of one directory.	read
`man`	Look up one manual page, search the manual, or render the index.	read
`recall`	Search the Basic Memory knowledge graph	read
`schema_diff`	Detect drift between a schema definition and actual note usage.	read
`schema_infer`	Analyze existing notes and suggest a schema definition.	read
`schema_validate`	Validate notes against their resolved schema.	read
`search`	ChatGPT/OpenAI MCP search adapter returning a single text content item.	read
`tail`	Show the most recently changed notes in a project.	read
`view_note`	View a markdown note as a formatted artifact.	read

Safer alternatives

All memory & knowledge servers →

Binder✓SAFE

mpazik/binder

Headless knowledge base with bidirectional Markdown sync

52 readGrade B

SilverBullet✓SAFE

ahmad-a0/silverbullet-mcp

A Model Context Protocol (MCP) server to interact with your SilverBullet notes and data.

1 destructiveGrade B

rutter✓SAFE

shinytoyrobots/rutter

A record of what your AI sessions decided — and the receipts behind it. An MCP memory-of-use server over markdown notes: append-only, content-hashed, no model inside.

4 readGrade B

Audit history

2026-09-22
✕BLOCK F 36 / 100
Source changed, verdict held · 66cdcaa927f9

README badge

Badges show the current verdict, BLOCK included

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about Basic Memory MCP server

What is the Basic Memory MCP server?

AI conversations that actually remember. Never re-explain your project to your AI again. Join our Discord: https://discord.gg/tyvKNccgqN

What tools does Basic Memory expose?

18 in total: 14 read-only, 3 that write, and 1 that can delete or overwrite (delete_project). Every one is listed on this page with its risk.

Is Basic Memory safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (36/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does Basic Memory need?

It reads GITHUB_TOKEN, MEM0_OPENAI_COMPAT_API_KEY, OPENAI_API_KEY and SUPERMEMORY_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Basic Memory run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @basicmemory/pi-basic-memory at 0.23.2.

How current is this page?

The grade is for one exact copy of the source (66cdcaa927f9), read on 2026-09-22. The repository is watched and re-audited when it changes.

I already installed Basic Memory. What should I do?

Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.

Can the verdict change?

Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

basicmachines-co/basic-memory on GitHub — the source we read, its licence, stars and activityObserved · 22 Sep 2026
ModelsAtlas trust audit — BLOCK verdict for commit 66cdcaa927f9Observed · 22 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the Basic Memory MCP server?
GChatGPT CClaude PPerplexity
What tools does Basic Memory expose?
GChatGPT CClaude PPerplexity
Is Basic Memory safe to connect to an agent?
GChatGPT CClaude PPerplexity