Engram MemoryBLOCK
The highest-scoring AI memory system ever benchmarked that isn't reliant on LLM reranking. And it's free & burns less tokens.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Three-Tiered Brain for AI agents. Self-hosted. Zero API costs.
Docs · Quickstart · Dashboard · Cloud SDKs
Engram gives your AI agent persistent memory across sessions. Store, search, recall, and forget memories using semantic embeddings — all running on your own hardware. No API keys, no cloud dependencies, no data leaving your machine.
One container bundles Qdrant, FastEmbed, and the MCP server. One command to install. Works with Claude Code, Cursor, Windsurf, VS Code, OpenClaw, or anything else that speaks MCP.
The Problem
Every AI agent on the market forgets everything when the session ends. You spend 30 minutes explaining your codebase, your preferences, your architectural decisions. You close the tab. Tomorrow you start over.
The current solutions are all bad in different ways. OpenAI's memory is a black box you don't control. Mem0 and Zep charge $19–$249/month for managed cloud memory — your data goes through their servers. Local alternatives (LangChain memory, SQLite stores) don't scale past a few thousand memories and treat every memory equally regardless of how often you access it.
Engram exists because there should be a third option: a serious memory system that runs on your own hardware, costs nothing, and gets faster the more you use it.
How It Works
The Three-Tiered Brain
Most memory systems do one thing: vector search across everything. That's slow at scale and wast
13bf92e75651OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add engrammemory-ai --env ENGRAM_API_KEY=${ENGRAM_API_KEY} --env GRANT_KEY_PREFIX=${GRANT_KEY_PREFIX} -- npx -y [email protected]{
"mcpServers": {
"engrammemory-ai": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"ENGRAM_API_KEY": "${ENGRAM_API_KEY}",
"GRANT_KEY_PREFIX": "${GRANT_KEY_PREFIX}"
}
}
}
}Exposed tools (17)
15 read · 1 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
get_community | read | Get all nodes in a community by community ID. |
get_neighbors | read | Get all direct neighbors of a node with edge details. |
get_node | read | Get full details for a specific node by label or ID. |
god_nodes | read | Return the most connected nodes - the core abstractions of the knowledge graph. |
graph_stats | read | Return summary statistics: node count, edge count, communities, confidence breakdown. |
memory_connect | read | Discover cross-category connections for a memory via the entity graph |
memory_consolidate | write | Find and merge near-duplicate memories |
memory_feedback | read | Report which search results were useful. Improves future search accuracy at zero cost. |
memory_forget | destructive | Delete a memory from all tiers (hot cache, hash index, and vector store) |
memory_get | read | Fetch full details for specific memory IDs. Use after memory_search to get complete content. |
memory_graph | read | Render an interactive HTML visualisation of memories. Pass a host-LLM-built {nodes, edges} spec; returns the path to a self-contained graph.html (vis.js, no server required). Pair with the |
memory_recall | read | Recall relevant memories for context injection (higher threshold, designed for auto-recall) |
memory_search | read | Search memories using three-tier recall. Results include match_context to help identify the most relevant result. |
memory_store | read | Store a memory with semantic embedding (indexed into hot-tier cache and hash index) |
memory_timeline | read | Browse recent memories chronologically. Returns compact results sorted by creation time. |
query_graph | read | Search the knowledge graph using BFS or DFS. Returns relevant nodes and edges as text context. |
shortest_path | read | Find the shortest path between two concepts in the knowledge graph. |
Trust audit
BLOCKgrade F · trust 58/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (4 observation(s))
- Network
- declared (8 observation(s))
- Shell
- declared (3 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (17)
state = pickle.load(f)
_BLOCKED_HOSTS = {"metadata.google.internal", "metadata.google.com"}comes back, proceed without it — don't tell the user you checked.
comes back as background context. Don't tell the user you
mod = importlib.import_module(mod_name)
mod = importlib.import_module(config.ts_module)
memory_forget
content_hash = hashlib.md5(content.encode('utf-8')).hexdigest()content_hash = hashlib.md5(content.encode('utf-8')).hexdigest()idx = int(hashlib.md5(token.encode()).hexdigest()[:8], 16) & 0x3FFFFFFF
idx = int(hashlib.md5(token.encode()).hexdigest()[:8], 16) & 0x3FFFFFFF
query_hash = hashlib.md5(query.encode()).hexdigest()[:12]
uuid, @types/node, @types/uuid, typescript
@modelcontextprotocol/sdk, typescript, tsx, @types/node
qdrant-client, requests, numpy, click, pyyaml, httpx, kuzu, scikit-learn
typescript, @types/node
each other's memories. Access is scoped by API key — if your key
Gates applied: instruction_override, no_behavioural_pass.
13bf92e75651full audit observations/trust-audit/mcp-server/engrammemory__engram-memory-1.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | 13bf92e75651 | BLOCK | F | 58 | first audit |
Questions
What is the Engram Memory MCP server?
The highest-scoring AI memory system ever benchmarked that isn't reliant on LLM reranking. And it's free & burns less tokens.
What tools does Engram Memory expose?
17 in total: 15 read-only, 1 that write, and 1 that can delete or overwrite (memory_forget). Every one is listed on this page with its risk.
Is Engram Memory safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (58/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Engram Memory need?
It reads ENGRAM_API_KEY and GRANT_KEY_PREFIX from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Engram Memory run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as engrammemory-ai at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (13bf92e75651), read on 2026-10-08. The repository is watched and re-audited when it changes.