NoemaBLOCK
The intentional memory layer for your AI agents.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
The intentional memory layer for your AI agents.
Noema gives AI agents — and the humans working alongside them — a persistent, structured place to record what they know, decide, observe, and intend. Every memory is a plain markdown file. The index is a local SQLite database. Nothing lives in the cloud; nothing requires an API key.
In short:
- Local-first agent memory exposed as an MCP server (stdio + Streamable HTTP). Works out of the box with Claude Code, GitHub Copilot, Zed, Cursor, Aider, and anything else that speaks MCP.
- Plain markdown on disk as the source of truth; a local SQLite database with FTS5 as the index. No cloud, no API keys, no telemetry.
- One cross-platform Rust binary with SQLite and the Hermes and Obsidian plugin installers built in. Release archives cover macOS, Linux, and Windows on x86-64 and ARM64.
- Peer-to-peer federation across Cortexes with vector clocks, event-log audit trail, and
divergencetraces on concurrent edits. - Your editor is a first-class client. A filesystem watcher turns
be7dca2a75e7OBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add noema-obsidian --env NOEMA_MCP_KEY=${NOEMA_MCP_KEY} -- npx -y [email protected]{
"mcpServers": {
"noema-obsidian": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"NOEMA_MCP_KEY": "${NOEMA_MCP_KEY}"
}
}
}
}Exposed tools (3)
3 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
hermes | read | Hermes memory provider |
obsidian | read | Obsidian vault plugin |
test | read | test plugin |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (4 observation(s))
- Network
- declared (9 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (18)
"refusing to start: TLS certificate at {path} expired {} day(s) ago (NotAfter={not_after}).\n Clients reject expired certificates and the server would appear unreachable.\n Rotate the certificate an"[serve] WARN --insecure-allow-expired: TLS cert at {path} expired {} day(s) ago (NotAfter={not_after})","refusing to start: TLS certificate at {path} NotBefore is in the future (NotAfter={not_after}).\n This is usually clock skew or the wrong certificate path.\n Pass --insecure-allow-expired to bypass"[serve] WARN --insecure-allow-expired: TLS cert at {path} not yet valid (NotAfter={not_after})""description": "Noema HTTP endpoint (e.g. https://10.0.0.1:3000). Required when transport=http",
secret = "lifecycle-test-access-key"
REPO_ROOT="$(cd -- "$SCRIPT_DIR/../../.." && pwd)"
tar -czf "$archive" -C target/release noema -C ../../ LICENSE README.md
header.set_link_name("../../outside").unwrap();"relative_path": "../../outside.md",
entry.linkname = "../../outside"
"url": "https://10.0.0.5:3000/mcp"
endpoint: http://192.168.1.10:3000
endpoint: https://192.168.1.11:3000
noema federation add-peer beta http://192.168.1.10:3000
"--insecure-allow-expired",
pytest
@types/node, builtin-modules, esbuild, obsidian, tslib, typescript
Gates applied: no_behavioural_pass.
be7dca2a75e7full audit observations/trust-audit/mcp-server/fail-safe__noema.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | be7dca2a75e7 | BLOCK | D | 69 | first audit |
Questions
What is the Noema MCP server?
The intentional memory layer for your AI agents.
What tools does Noema expose?
3 in total: 3 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Noema safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does Noema need?
It reads NOEMA_MCP_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Noema run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as noema-obsidian at 0.5.2.
How current is this page?
The grade is for one exact copy of the source (be7dca2a75e7), read on 2026-10-10. The repository is watched and re-audited when it changes.