EMETBLOCK
EMET is an MCP memory server built for ISO 9001 / ISO 13485 document control: persistent, shared memory for AI agents and bot teams. Nothing is deleted; records are superseded, retired and retained. Controlled templates, verified writes, a word-for-word transcript tier, stdio and remote HTTP with OA
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
EMET is an MCP (Model Context Protocol) memory server, persistent shared memory for AI agents, bot teams and chats.
[](https://m8ven.ai/mcp/dreamforgestudiollc-emet-z9o7e8?s=readme)
אמת — Hebrew for truth. Also Enduring Memory & Epistemic Tiers.
Website:
What it does
- Layered memory. Six layers — identity, semantic, episodic, procedural, meta, and working — hold curated claims, split by what kind of thing an entry is.
- Verified writes. Every write is read back and compared before it is reported as saved.
- Word-for-word transcript tier. A separate tier stores the conversation as it was written, so a summary cannot overwrite the record it came from.
- stdio and remote HTTP with OAuth. The same server runs locally over stdio, and remotely over HTTP with OAuth. The transport changes. The store does not.
- MongoDB. Atlas, or MongoDB you run yourself. A one-machine trial can use MongoDB 6 or newer. Only
semantic_recallneeds Atlas. - MIT. Version 0.2.3. EMET is still 0.x: stored document shapes may change before 1.0. Pin a version if you depend on them.
The store has one owner, and other people can join only through the optional Guest (read-only) and Member (read and write) access, both off by default.
Document control (ISO 9001 7.5.3 / ISO 13485 4.2.5)
EMET is built for document control in environments that work under ISO 9001 and ISO 13485. It supports that work; it holds no certification and claims no conformity. An organization that uses it stays responsible for its own quality system, including validating EMET for its intended use.
- No delete, on any store, by design. No tool re
24504c83c73fOBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add emet --env MONGODB_URI=${MONGODB_URI} -- npx -y @dreamforgestudiollc/[email protected]Exposed tools (16)
12 read · 4 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
corpus_recall | read | Semantic search over an optional supplementary knowledge corpus that the user has loaded separately from memory. Returns nothing unless a corpus has been populated; this is not where session memory lives. |
emet_floor | read | Read the floor: the standing description of how this assistant engages with the person using it. It ships in the server code, so setup cannot overwrite it and no install can lose it - the character document holds the user |
emet_gaps | read | The record |
emet_initialize | write | START HERE. Call this FIRST in every session, before answering anything that might have prior context, and always when the user opens with |
emet_invite_create | write | EMET Guest Access: create a one-time code for a guest. They paste it on the connect screen instead of the passphrase. Default access is read-only. Only the owner can create a guest code. EMET Member Access is a different door. |
emet_member_access_create | write | EMET Member Access: create a one-time code for a new person with read and write access. They paste it on the connect screen instead of the passphrase. This is not EMET Guest Access, and it never makes them the owner. Only the owner can create it. Off unless EMET_MEMBER_ACCESS=1. |
emet_session_open | read | Open a transcript session. Returns session_id, dated in the configured local time zone (EMET_TIMEZONE, default America/New_York). A slug whose id is already CLOSED is never reopened: the session opens as <id>-2, -3, ... and the result |
emet_setup_complete | read | First-time setup, the owner |
list_docs | read | List continuity documents (metadata only; optional doc_id prefix filter, e.g. |
query_layer | read | Query a specific memory layer with structured filters |
query_transcripts | read | Retrieve session transcripts - the second tier, word for word. Reads the live store written by save_transcript AND the legacy archive (exchanges written by earlier hosts, June 2025 to June 2026), grouped into the same session shape; every result carries |
read_doc | read | Read a continuity document from the versioned document store. A document longer than one page (18,000 UTF-8 bytes by default) comes back in pages: the result then carries |
read_doc_history | read | Read a RETAINED revision of a document, or list the revisions retained for it. Every write archives the prior copy (nothing is deleted); this is the reader for that archive. Without a version: the list of retained revisions with their digests and dates. With a version: that revision |
recall | read | Search memories by keyword. Ranked by how many of your words match, then by importance. Current entries come first in every order. Pass order: |
restore_doc | write | Write a retained revision back as the current document. The retained row is copied through the normal write path, with a reason. Nothing is deleted. |
semantic_recall | read | Semantic (meaning-based) memory search across all six memory layers via Atlas Vector Search autoEmbed. Finds conceptually related memories even without keyword overlap. Complements keyword-based recall/query_layer. |
Trust audit
BLOCKgrade D · trust 64/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | FAIL |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (6 observation(s))
- Shell
- declared (3 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
startup-payload.js
['169.254.0.0', 16], // link-local, including metadata 169.254.169.254
if (!host || host === 'localhost' || host.endsWith('.localhost') || host === 'metadata.google.internal') {order, then call `emet_session_close` to confirm it landed. Do not tell the user
# http://127.0.0.1:PORT.
const PUBLIC_URL = (process.env.PUBLIC_URL || `http://127.0.0.1:${PORT}`).replace(/\/+$/, '');EMET_OAUTH_PASSPHRASE: 'p4ssPhr4se!', MONGODB_URI: 'mongodb://u:pw123456@h/db',
const key = `-----BEGIN EC PRIVATE KEY-----
.nojekyll
startup-payload.test.js
'<img src="../../secret.png">',
'../../secret.png',
'169.254.169.254', '169.254.1.1', '100.64.0.1', '100.127.255.255',
: [{ address: '169.254.169.254', family: 4 }];const res = await fetch(`http://127.0.0.1:${httpServer.address().port}/mcp`, {const res = await fetch(`http://127.0.0.1:${httpServer.address().port}/mcp`, {const res = await fetch(`http://127.0.0.1:${shared.http.port}/mcp`, {@modelcontextprotocol/sdk, mongodb, express
> Set up EMET for me. Fetch `https://raw.githubusercontent.com/dreamforgestudiollc/EMET/main/docs/GUIDED-SETUP.md`, read Part B, and follow it stage by stage. Ask me only when a step needs me — I will
| **The monorail (session graph)** | Checks the order of each session's writes on every host, with no host hook: a session is opened before it is written to, no exchange is skipped, the handoff comes
**Session close — this is the one place the order is stated:** update working documents → session record in memory → board → verbatim transcript, confirmed complete (it was appended as the session ran
**Startup pages fetched late** (2026-10-03). In enforce only an open with a page missing is refused, so no session opens without its pages and no `late` row is written through the server's door. The s
- **Guardrails & Monorails** ([docs/GUARDRAILS-AND-MONORAILS.md](GUARDRAILS-AND-MONORAILS.md)): the server checks the order of a session's writes. Enforce only since 0.2.1 (deployed 2026-10-03; report
A session that has not initialized can read everything and can write only a new drop (`drops/<date>-<slug>.md`): its items, wrap-up and handoff. A session with a registered source and the full startup
`EMET_TIMEZONE` and `EMET_CLOSE_GRACE_MINUTES`. These read `process.env` directly, so **only the
Gates applied: instruction_override, no_behavioural_pass.
24504c83c73ffull audit observations/trust-audit/mcp-server/dreamforgestudiollc__emet.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 24504c83c73f | BLOCK | D | 64 | first audit |
Questions
What is the EMET MCP server?
EMET is an MCP memory server built for ISO 9001 / ISO 13485 document control: persistent, shared memory for AI agents and bot teams. Nothing is deleted; records are superseded, retired and retained. Controlled templates, verified writes, a word-for-word transcript tier, stdio and remote HTTP with OA
What tools does EMET expose?
16 in total: 12 read-only, 4 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is EMET safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (64/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does EMET need?
It reads EMET_SIGNING_KEY and MONGODB_URI from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does EMET run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @dreamforgestudiollc/emet at 0.2.4.
How current is this page?
The grade is for one exact copy of the source (24504c83c73f), read on 2026-10-12. The repository is watched and re-audited when it changes.