Atlas / MCP servers / foxfire1st / Agents Remember

Agents RememberBLOCK

Name: Agents Remember
Author: foxfire1st

mcp/foxfire1st/agents-remember-1

MCP server by foxfire1st · agent memory system · agentic control plane · bitemporal · Audited 2026-10-08

A branch-aware, dual-revision epistemic ledger and control plane for AI coding agents. From requirements and isolated work to validated changes and durable, queryable project truth.

Verdict

BLOCK

Grade

Trust score

56 /100

Exposed tools

64 44r · 20w · 0d

Transport

—

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Agents Remember

Git-verified records for what your coding agents know. A control plane for what they do.

📖 Current docs: https://foxfire1st.github.io/agents-remember/ 🤖 Machine-readable summary: https://foxfire1st.github.io/agents-remember/llms.txt Note: caches and search snippets may serve an outdated copy of this README — the docs site above is canonical and always current.

Why It Exists
Core Features
What It Looks Like In Practice
Live Demo
Requirements
Quickstart
Run The Dashboard
Documentation
Repository Layout
Status
Stability
Contributing

Why It Exists

Modern coding agents can make clean, plausible edits while missing the project-specific rules that make those edits safe. A top-level instruction file can help, but it does not naturally reappear when the agent is deep in a file and deciding what to change.

Agents Remember fixes that: the matching note is reachable at the moment of the edit — most often by the very path the agent is already working in — so project rules surface exactly when a change is being made, not buried in a top-level file.

Core Features

**Agents Remember gives coding agents project memory they can v

Read from source at commit ee438f56b6a9OBSERVED · 2026-10-08

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add repository-profile-node-fixture --env AR_DAGGER_RUNTIME_AUTHORITY_DIGEST=${AR_DAGGER_RUNTIME_AUTHORITY_DIGEST} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "repository-profile-node-fixture": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "AR_DAGGER_RUNTIME_AUTHORITY_DIGEST": "${AR_DAGGER_RUNTIME_AUTHORITY_DIGEST}"
      }
    }
  }
}

Exposed tools (64)

44 read · 20 write · 0 destructive.

Tool	Risk	Description
`Model`	read	Model used by this harness session
`cgc_callees`	read	List what a function calls (its callees) from the CodeGraphContext graph. Read-only;
`cgc_callers`	read	List the callers of a function from the CodeGraphContext graph. Read-only; needs the cgc
`cgc_complexity`	read	Report complexity metrics from the CodeGraphContext graph (whole repo, or one function
`cgc_dependencies`	read	Report a module
`cgc_symbol_search`	read	Find a symbol in the CodeGraphContext code graph. Read-only; needs the
`cgc_visualize`	read	Produce a CodeGraphContext graph visualization (serves a browser view on `port`). Needs
`citation_fix`	read	Regenerate anchored citation ranges inside one leaf memory worktree. The enclosure
`closeout_queue`	read	Inspect or idempotently rebuild one sprint
`codex_benchmark_prepare`	read	Prepare resettable benchmark case workspaces (clones repos, materializes coordination).
`codex_benchmark_run`	write	Run a Codex benchmark case (executes Codex agents in a sandbox). Refused unless the MCP
`context_packet`	read	Bundle a repository
`curator_coherence`	write	Author, publish, inspect, or validate one leaf
`direct_landing`	write	Verify one series code commit and durably serialize its memory + ledger writes.
`dispatch_agent`	write	Create and durably brief one child seat on a canonical task document plus role.
`drift_check`	write	Task-start gate: classify how far onboarding has drifted from the code since it was last
`gate_decide`	read	Decide the one open gate matching an authorized child document and kind.
`gate_list`	read	List folded gates in the caller
`grepai_search`	read	Semantic search over memory/onboarding via the grepai provider. Read-only; needs the
`grepai_trace`	read	Trace relationships in the grepai semantic graph for a symbol. trace_action is
`lifecycle_end`	read	End the active lifecycle. outcome is
`lifecycle_finalize_task`	read	Finalize one parent-child task lifecycle edge. The task
`lifecycle_gate`	read	Raise a gate on the caller
`lifecycle_phase`	write	Move the active lifecycle along its phase axis (orthogonal to state): one of
`lifecycle_resume`	read	Resume the active lifecycle from blocked back to running once the gate or question
`lifecycle_start`	write	Begin a new session lifecycle and become its running owner. Guarded: rejected
`lifecycle_turn_end_notification`	write	Notify the developer the turn is complete and stop -- no wait, no gate; the next AR
`memory_baseline_adopt`	write	Create the first attributed memory baseline for an external memory repo. Mutating: commits
`memory_baseline_status`	read	Report drift and Git attribution state to decide whether an external-memory baseline can be
`memory_carryover_apply`	write	Apply an approved plan inside the exact ordinary recovery leaf, committing attributed memory
`memory_carryover_plan`	read	Plan (non-mutating) carrying richer onboarding from a source branch into the exact open
`memory_init`	read	Initialize or repair a repository
`memory_quality_check`	read	Prepare memory before certification admission using drift-integrity and style checks.
`message_child`	read	Persist and deliver one whole message to an authorized direct child seat.
`message_parent`	read	Persist and deliver one whole message to this seat
`ping`	read	Liveness check. Returns server name, version, and transport. Read-only; no side effects.
`provider_diagnostics`	read	Raw provider-native diagnostic detail (container states, ports, backend/embedder health,
`provider_status`	read	Compact provider readiness summary (per-provider state ready/degraded/stopped, watcher
`provider_watchers`	read	Control provider watchers. action:
`read_ar_files`	read	Read-only batch read of up to 5 repo-relative paths inside an AR-managed repo,
`rename_child`	write	Change the display label of the current occupant of a direct child seat.
`rename_self`	write	Change this hosted seat
`resolve_context`	read	Resolve a repository
`retire_child`	read	Retire the current occupant of one authorized direct child seat.
`route_index_refresh`	read	Regenerate the overview.index.json route indexes so they match the current onboarding
`runtime_install`	write	Install/refresh the packaged coordinator runtime into the coordination root. Safe to
`server_info`	read	Report the resolved configuration: coordination/workspace/transcript roots, allowed
`skills_install`	write	Copy the packaged skills into the harness skill root (e.g. .claude/skills) so the harness
`switch_lifecycle`	read	Leave the current lifecycle and begin a fresh one. A persistent lifecycle is paused;
`task_doc`	read	return task_doc_payload(
`task_reopen`	read	Reopen a COMPLETED leaf under its exact same leaf id (no -rN suffix). A state
`worktree_abandon`	read	Abandon a worktree-backed task WITHOUT integrating it. First prove that the enclosure
`worktree_attach`	read	Re-attach to an existing task contract without mutating git, resuming its lifecycle
`worktree_checkpoint_landing`	write	Partially PUBLISH an UNFINISHED atomic master: land its accumulated line into its super
`worktree_cleanup`	read	Archive and read back one terminal generation
`worktree_closeout_apply`	write	Start or observe an approved task-bound worktree closeout. A mutating call
`worktree_closeout_preview`	read	Non-mutating preview of the bounded closeout Git transaction.
`worktree_integrate`	write	Start or observe task-bound landing onto its source branch (strategy
`worktree_operation_control`	read	Retry, recover, resume, cancel, retire, or supersede one task generation.
`worktree_pause`	write	PAUSE an atomic master: stop it and hand control back to the developer. Publishes
`worktree_record_landing`	read	Record that this task
`worktree_start`	write	Create or load a task contract plus code (and external-memory) git worktrees. Publishes
`worktree_status`	read	Resolve the exact independent locator and enclosure-root manifest/journal, then report a
`worktree_sync`	write	Pull the moved official line into a live worktree (issue #54). Mutating: fetches

Trust audit

BLOCKgrade F · trust 56/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (12 observation(s))
Network: declared (14 observation(s))
Shell: declared (3 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHHard-coded secrets · secret.db_uri · CWE-798, CWE-321

mcp/src/agents_remember/providers/grepai/lifecycle/core.py:408

return f"postgres://{user}:{password}@{host}:{port}/{database}?sslmode=disable"

MEDIUMInventory / provenance · inv.binary · CWE-1104

dashboard/src/data/conversation/reducer.ts

reducer.ts

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

dashboard/src/panels/file-viewer/useFilesTree.ts

useFilesTree.ts

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

mcp/src/agents_remember/memory_quality/style/citations/grammars.py:221

return Language(getattr(importlib.import_module(module_name), attribute)())

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

dashboard/e2e-chats/support/daemon.ts:129

const baseUrl = `http://127.0.0.1:${port}`;

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

dashboard/playwright.chats-e2e.config.ts:34

baseURL: process.env.AR_CHATS_E2E_BASE_URL ?? "http://127.0.0.1:8781",

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

dashboard/playwright.config.ts:15

baseURL: "http://127.0.0.1:5173",

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

dashboard/playwright.config.ts:21

url: "http://127.0.0.1:5173",

MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94

mcp/src/agents_remember/serving/conversation/control/previews.py:26

_ZWJ = ""

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

dashboard/scripts/require-dagger-test-environment.test.mjs:7

const TOKEN = "0123456789abcdef0123456789abcdef";

LOWInventory / provenance · inv.hidden_file · CWE-1104

.git-blame-ignore-revs

.git-blame-ignore-revs

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

dashboard/.prettierignore

.prettierignore

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

dashboard/.prettierrc.json

.prettierrc.json

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

mcp/tests/test_agents_remember_quality.py:59

return importlib.import_module(DAGGER_MODULE_ID)

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

mcp/src/agents_remember/models/lifecycles/preparation.py:297

return hashlib.sha1(framed, usedforsecurity=False).hexdigest()

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

mcp/src/agents_remember/models/tokens.py:66

digest = hashlib.sha1(VENDORED_VOCABULARY_URL.encode()).hexdigest()

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

mcp/src/agents_remember/providers/current_state.py:79

digest = hashlib.sha1(