SharedContextCAUTION
MCP server that gives AI coding assistants persistent cross-client memory. Facts and conversations stored in SQLite, encrypted with AES-256-GCM, synced to Arweave. No server, no account, recoverable with a 12-word phrase.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
SharedContext
Sovereign, encrypted, portable memory for AI agents.
What Is It
SharedContext is a local-first memory layer for LLM agents. It gives Cursor, Claude Code, and Codex persistent memory that you own, synced to Arweave so it follows you across sessions and machines.
Your AI assistant forgets everything the moment a session ends. Project decisions, coding preferences, architectural context — all gone. You re-explain the same things every day.
SharedContext fixes that. It runs as an MCP server that your AI client connects to. Agents store and recall facts through MCP tools. A background watcher syncs your conversation history. Everything is encrypted client-side and uploaded to Arweave. Restore it all on a new machine with a 12-word recovery phrase.
Why Shared Context
Your AI memory is fragmented:
- Cursor stores transcripts in
~/.cursor/projects/ - Claude Code stores sessions in
~/.claude/projects/ - Codex has its own isolated context
None of them talk to each other. None of them persist structured knowledge. None of them let you move to a new machine and pick up where you left off.
SharedContext collapses all of that into one encrypted, portable layer that every client reads from and writes to. One memory. One identity. One place to look.
What It Does
8da88cae64c3OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add ai-sharedcontext --env SHAREDCONTEXT_TEST_PRIVATE_KEY=${SHAREDCONTEXT_TEST_PRIVATE_KEY} -- npx -y [email protected]{
"mcpServers": {
"ai-sharedcontext": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"SHAREDCONTEXT_TEST_PRIVATE_KEY": "${SHAREDCONTEXT_TEST_PRIVATE_KEY}"
}
}
}
}Exposed tools (4)
2 read · 1 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
delete_fact | destructive | Delete a fact from memory. Use when information is no longer accurate or relevant. |
recall_context | write | Recall relevant facts from long-term memory. Call this at the start of a conversation or when you need context about a topic. Returns facts ranked by relevance. |
recall_conversation | read | Retrieve a previous conversation from another AI client (Cursor, Claude Code). Use this when the user says |
store_fact | read | Store an important fact for long-term memory. Call this when the user expresses a preference, makes a project decision, shares architectural context, or provides information that should be remembered across sessions. |
Trust audit
CAUTIONgrade B · trust 88/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (2 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (8)
console.log(` Token: ${token}`);delete_fact
import type { Conversation, ConversationMessage } from "../../types.js";import type { Conversation, ConversationMessage } from "../../types.js";const point = secp256k1.Point.fromHex(pubHex);
@ardrive/turbo-sdk, @modelcontextprotocol/sdk, @noble/ciphers, @noble/curves, @noble/hashes, better-sqlite3, commander, uuid
**What this means:** Arweave stores opaque encrypted blobs. Without your recovery phrase (or a share token for shared conversations), the data is unreadable. There is no server, no account, no API key
Gates applied: no_behavioural_pass, no_license.
8da88cae64c3full audit observations/trust-audit/mcp-server/eversmile12__sharedcontext.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | 8da88cae64c3 | CAUTION | B | 88 | first audit |
Questions
What is the SharedContext MCP server?
MCP server that gives AI coding assistants persistent cross-client memory. Facts and conversations stored in SQLite, encrypted with AES-256-GCM, synced to Arweave. No server, no account, recoverable with a 12-word phrase.
What tools does SharedContext expose?
4 in total: 2 read-only, 1 that write, and 1 that can delete or overwrite (delete_fact). Every one is listed on this page with its risk.
Is SharedContext safe to connect to an agent?
With care. The audit graded it B (88/100) and found 8 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does SharedContext need?
It reads SHAREDCONTEXT_TEST_PRIVATE_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does SharedContext run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as ai-sharedcontext at 0.0.11.
How current is this page?
The grade is for one exact copy of the source (8da88cae64c3), read on 2026-10-08. The repository is watched and re-audited when it changes.