dgui-hypermemCAUTION
DGUI-HyperMem (DeckerGUI HyperMemory) - self-hosted hybrid memory MCP server on Cloudflare Workers with a JEV (Choice/Noul/Score) reasoning layer and a HuggingFace training-brain flywheel.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
DGUI-HyperMem (DeckerGUI HyperMemory) — a self-hosted, hybrid long-term memory MCP server for AI agents, running entirely on Cloudflare Workers. Retrieval fuses vector search with full-text search, then a JEV reasoning layer (Choice / Noul / Score) re-ranks and curates what gets remembered.
A DeckerGUI project.
[](https://workers.cloudflare.com/) [](https://modelcontextprotocol.io/) [](https://huggingface.co/datasets/ctaxnagomi/DGUI_HYPERMEM-JEV) [](LICENSE)
What it does
- Stores durable memories — an LLM/JEV layer assigns each memory a type, a salience
score and a durability judgement; non-durable chatter is dropped.
- Recalls hybrid — Vectorize ANN + D1 FTS5 BM25 candidates, fused by reciprocal rank,
then re-ranked by JEV so the best memory wins even when wording differs.
- Self-maintains — near-duplicate/contradicting memories are superseded automatically.
- Gets better with use — every JEV decision is logged and flushed to a HuggingFace
dataset, building a training corpus for the reasoning layer.
┌───────────────────────────── Cloudflare Worker ─────────────────────────────┐ MCP client │ │ (opencode, etc.)│ /mcp ─ Streamable HTTP MCP add · search · list · profile · forget │ ───────────┼─► /api/* ─ REST mirror · help · sync_jev_dataset · jev_queue_stats│ │ │ │ │ ┌─────────────────┴─────────────────┐ │ │
c5ef2bd5ebb1OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add dgui-hypermem --env DGUI_ADMIN_PASSKEY=${DGUI_ADMIN_PASSKEY} -- npx -y [email protected]{
"mcpServers": {
"dgui-hypermem": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"DGUI_ADMIN_PASSKEY": "${DGUI_ADMIN_PASSKEY}"
}
}
}
}Exposed tools (11)
8 read · 3 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
add | write | |
forget | read | |
help | read | |
jev_queue_stats | read | |
list | read | |
profile | read | |
quota_notices | read | |
search | read | |
suggest | read | |
sync_embed_corpus | write | |
sync_jev_dataset | write |
Trust audit
CAUTIONgrade C · trust 75/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (4 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (18)
DGUI_HMEM_RULESET_INSTRUCT.zip
export const GITHUB_LOGO_B64 = "iVBORw0KGgoAAAANSUhEUgAABkAAAAJSCAYAAACbXQkkAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAEueSURBVHgB7d09dJxVli/8M706u+uOFL93rvSm/VEivXRLxA0SMY3E
export const HF_LOGO_B64 = "iVBORw0KGgoAAAANSUhEUgAAAbQAAAB0CAMAAADadTd0AAABMlBMVEX///8ACxv/0h4AAAD/nQD8/Pz/mwD/1R8yND35+fn/mQAAAAwABxn19fUAABIAABX/Mj3/lQDU1dednqEAAAZGSVD/rQO+wMKTlZlnam+tr7ISGij/zhzp
export const OPENCODE_LOGO_B64 = "iVBORw0KGgoAAAANSUhEUgAABQAAAALRCAYAAAAEIQ7zAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAADczSURBVHgB7d1PjBzXfSfwUsAcPLScRUD6EGlNHnKIaMgXS0D2YP
export const STRIPE_LOGO_B64 = "iVBORw0KGgoAAAANSUhEUgAAAVwAAACRCAMAAAC4yfDAAAAAllBMVEX///9jW/9hWf9dVP9ZUP9XTv+mo/9ya/9gV//c2v/My/9TSf9WTf+/vf9bUv+Dfv+Vkf/X1f+hnf94cv/m5f9+eP9uZ/9RR/+koP/S0P/39//f3v+B
export const ICON_180_B64 = "iVBORw0KGgoAAAANSUhEUgAAALQAAAC0CAYAAAA9zQYyAAAGcklEQVR4nO3dQY7jRgxGYTvIAWrtLJNV7n+WrJJluPYNJmgDAjTKdPe0VCz+JN87wExJ/kRIbsm63YiIiIiIiIiIiIiIKH/Pb9+il9ChX6IX0AozqN27+/8Xjfs
const TOKEN = "test-mcp-token-fixture";
const token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dBjftJeZ4CVPmB92K27uhbUJU1p1r_wW1gFWFOEjXk";
REDIRECT = "http://127.0.0.1:8765/callback"
status, _, body = request(f"{BASE}/authorize?{urllib.parse.urlencode(authorize_params(client['client_id'], challenge, redirect='http://127.0.0.1:9999/other'))}")status, _, body = exchange(code2, verifier2, client["client_id"], redirect="http://127.0.0.1:8765/other")
BASE = (sys.argv[1] if len(sys.argv) > 1 else "http://127.0.0.1:8799").rstrip("/")REDIRECT = "http://127.0.0.1:8765/callback"
const bin = atob(pad);
const bin = atob(b64);
const img = Uint8Array.from(atob(iconB64), c => c.charCodeAt(0));
const decoded = atob(basic.slice(6).trim());
@modelcontextprotocol/sdk, stripe, zod, @cloudflare/workers-types, typescript, wrangler
Gates applied: no_behavioural_pass.
c5ef2bd5ebb1full audit observations/trust-audit/mcp-server/ctaxnagomi__dgui-hypermem.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | c5ef2bd5ebb1 | CAUTION | C | 75 | first audit |
Questions
What is the dgui-hypermem MCP server?
DGUI-HyperMem (DeckerGUI HyperMemory) - self-hosted hybrid memory MCP server on Cloudflare Workers with a JEV (Choice/Noul/Score) reasoning layer and a HuggingFace training-brain flywheel.
What tools does dgui-hypermem expose?
11 in total: 8 read-only, 3 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is dgui-hypermem safe to connect to an agent?
With care. The audit graded it C (75/100) and found 18 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does dgui-hypermem need?
It reads DGUI_ADMIN_PASSKEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does dgui-hypermem run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as dgui-hypermem at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (c5ef2bd5ebb1), read on 2026-10-11. The repository is watched and re-audited when it changes.