al-buddy-memoryBLOCK
Portable, governed, model-agnostic memory for AI agents: facts invalidated never deleted, raw text as truth, one documented export format.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://mcpservers.org/servers/flytomoon/al-buddy-memory)
Al Buddy — that's Al, a name, said like "pal". Not A.I.
A memory that's yours.
Portable, governed, model-agnostic memory for AI agents.
A fact is invalidated, never overwritten; on a governed handle, erasure runs through policy and is audited. Raw text is the source of truth and cannot be edited. Embeddings are a disposable, model-tagged cache. Every fact and every link exports to one documented format. The memory outlives whatever model, runtime or company produced it.
Why this exists
Every agent-memory product on the market answers one question well: what does the agent recall? None of them answers the four questions that decide whether you can trust and keep that memory:
ccd873dea1b6OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add al-buddy-memory --env AL_BUDDY_MEMORY_AUDIT_KEY=${AL_BUDDY_MEMORY_AUDIT_KEY} -- npx -y [email protected] mcpExposed tools (12)
11 read · 0 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
al-buddy-memory | read | Adds the pinned rules and the facts recalled for this turn from al-buddy-memory. |
define_mental_model | read | Define a standing question to keep answered (e.g. \ |
explain | read | Why a fact is believed: who asserted it, when it was true and what ended or replaced it, and for a conclusion the exact words it rests on, each checked against its source now. |
export | read | Export the user |
history | read | Show the recorded changes to one fact, including each change time and the full mutable state before and after it. |
invalidate | destructive | A fact stopped being true: close its validity (never delete), optionally naming what replaced it. |
mental_model | read | Read a standing question |
pin | read | Pin a fact into the always-in-prompt tier. Only rules that belong in every conversation; it is a small, budgeted tier. |
pinned | read | The pinned tier, as a list and as the rendered prompt block. |
recall | read | Find facts. Every result says who asserted it, since when it has been true, whether it is still current, what superseded it, and which assistant wrote or retired it. The first call of a session also returns the user |
remember | read | Store a fact with its provenance. Returns the fact with validFrom, provenance and confidence, plus mayConflictWith: current facts this one may be correcting — read them and invalidate any that stopped being true. |
unpin | read | Unpin a fact (its validity closes; it is kept). |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (1 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (21)
writeFileSync(outPath.replace(/\.jsonl$/, ".summary.json"), JSON.stringify({ model, judgedWith: "codex exec (ChatGPT seat), official LongMemEval judge prompts", n: rows.length, overall: tot / rows.lenconst f = await src.addNode(fact("deploy key AKIAABCDEFGHIJKLMNOP"));const secret = await inner.addNode(fact("AKIAABCDEFGHIJKLMNOP", { privacyClassification: "Sensitive" }));const key = await store.addNode(fact("deploy token: token=ghp_abcdefghijklmnopqrstuvwxyz0123"));invalidate
import * as lib from "../../src/index.js";
import { InMemoryStore, PostgresMemoryStore, govern, storeAudit } from "../../dist/index.js";import * as lib from "../../src/index.js";
import { boundaries } from "../../docs/policies/boundaries.js";const pkg = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8")) as { version: string };`tailscale funnel --bg --https=8443 http://127.0.0.1:8787`) and give the apps its URL:
publicUrl: "http://127.0.0.1:1",
expect(meta.resource).toBe("http://127.0.0.1:1/mcp");publicUrl: "http://127.0.0.1:1",
expect(redirectAllowed("http://127.0.0.1:5555/cb")).toBe(true);better-sqlite3, pg, @electric-sql/pglite, @electric-sql/pglite-pgvector, @langchain/core, @langchain/langgraph, @mastra/core, @types/better-sqlite3
bench/results/2026-09-29-lme-full-all.json
bench/results/2026-09-29-longmemeval-full.json
bench/results/2026-09-30-lme-full-fast.json
keeps facts that read like secrets (passwords, keys, tokens) classified Sensitive and out of every
its terms, like anything else you type. Facts that read like passwords or keys are kept out of
Gates applied: no_behavioural_pass.
ccd873dea1b6full audit observations/trust-audit/mcp-server/flytomoon__al-buddy-memory.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | ccd873dea1b6 | BLOCK | D | 69 | first audit |
Questions
What is the al-buddy-memory MCP server?
Portable, governed, model-agnostic memory for AI agents: facts invalidated never deleted, raw text as truth, one documented export format.
What tools does al-buddy-memory expose?
12 in total: 11 read-only, 0 that write, and 1 that can delete or overwrite (invalidate). Every one is listed on this page with its risk.
Is al-buddy-memory safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does al-buddy-memory need?
It reads AL_BUDDY_MEMORY_AUDIT_KEY and OPENAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does al-buddy-memory run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as al-buddy-memory at 0.11.0.
How current is this page?
The grade is for one exact copy of the source (ccd873dea1b6), read on 2026-10-11. The repository is watched and re-audited when it changes.