NotDorySAFE
NotDory is durable memory your agents manage themselves — so every session starts where the last left off.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
NotDory — Agent Memory Platform
Your agents forget everything. NotDory doesn't.
Dory, the lovable blue tang from Finding Nemo, forgets everything a few seconds after it happens. She's charming, she means well, and she will introduce herself to you again tomorrow. Most AI agents are Dory: every new session greets your codebase like it's never seen it before, re-reading the same files, re-learning the same conventions, re-asking the same questions, and burning tokens just to get back to where they were yesterday.
NotDory is not Dory. It gives your agents a memory that sticks, so they:
- Remember. Decisions, conventions, facts, and "we tried that, it didn't work" survive across sessions,
harnesses, and projects.
- Pick up where they left off. Session start hands the agent its project's context before the first turn.
- Use fewer tokens. Recalling a note is far cheaper than re-scanning a repository to rediscover it.
- Get to outcomes faster. Less rediscovery, more doing.
- Stop repeating mistakes. A correction or preference is saved once and honored from then on.
- Share what they learn. What Claude Code learns, Codex, Cursor, Gemini, and Mux can recall.
Just keep swimming, and keep remembering.
⚠️ v0.1.0 — ALPHA. Everything is subject to change. APIs, data models, storage layouts, configuration keys, MCP tool names, database schemas, and dashboard surfaces will change — potentially in breaking ways and without migration paths between 0.1.x builds. Do not use it for production memory you cannot afford to lose, and expect to re-create data across upgrades. Pin to an exact image tag (e.g.v0.1.0) and readCHANGELOG.mdbefore updating.
NotDory gives AI agents durable memory that survives across sessions, harn
73b2b1aa47c8OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add notdory-dashboard -- npx -y [email protected]
{
"mcpServers": {
"notdory-dashboard": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (4)
4 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
Acme | read | |
Name | read | Description |
my-project | read | |
notes | read |
Trust audit
SAFEgrade B · trust 86/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (9 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (22)
streamable-http
- ../../docker/postgres/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
- ../../docker/recalldb/recalldb.json:/app/recalldb.json:ro
import { useAuth } from '../../context/AuthContext';import { HubProvider } from '../../context/HubContext';import Tabs from '../../components/Tabs';
Local server config: notdory.json at the repo root (REST 127.0.0.1:8700, Sqlite data/notdory.db, RecallDB http://127.0.0.1:8600). Values marked "override-via-env" are secrets supplied via environment
docker/compose.yaml (all ports bound to 127.0.0.1): postgres 5432; recalldb-server 8600 REST, 8620 RecallDB's own MCP (not exposed to agents), 9464 metrics; recalldb-dashboard 8601; ollama + ollama-in
`url: http://127.0.0.1:8720/mcp`, `x-access-key` header) into the agent client
- **Dashboard** — <http://127.0.0.1:8701>. Sign in with the seeded admin **`[email protected]`** /
- **REST API** — <http://127.0.0.1:8700> (direct) or <http://127.0.0.1:8080> (via nginx). OpenAPI at
i18next, i18next-browser-languagedetector, react, react-dom, react-i18next, react-markdown, react-router-dom, remark-gfm
Interactive users sign in with email + password and get a session token (Authorization: Bearer). Automation and MCP authenticate with a credential access key, sent as `x-access-key` or `Authorization:
| `NOTDORY_AUTH_SEED_ADMIN_EMAIL` / `NOTDORY_AUTH_SEED_ADMIN_PASSWORD` | Email and password of the seeded bootstrap admin user (defaults `[email protected]` / `notdoryadmin`). Log in for a session t
Watson 7.1, per-feature route registrars calling `server.Routes.{Pre,Post}Authentication.{Static,Parameter}.Add(...)`; typed DTOs; explicit status codes; `ctx.Token` threaded through; `Server.UseOpenALocal dev defaults: email `[email protected]`, password `notdoryadmin`, tenant `ten_default`,
Mux talks to NotDory through NotDory's MCP server. NotDory serves the modern **MCP Streamable HTTP + SSE** transport at `http://127.0.0.1:8720/mcp`. Mux can send only **one** auth header, so it authen
- Administration: Models (Embedding, Inference); Access (Tenants admin-only, Users, Credentials); Monitoring (Requests, Operations, API Explorer); System (Settings, Agent Onboarding, Collections).
NotDory.McpServer is a standalone process that authenticates the caller's access key (McpCallerCredentials) and proxies each tool to the NotDory REST API; it holds no business logic or database. Conse
(Models: Embedding, Inference; Access: Tenants, Users, Credentials; Monitoring: Requests, Operations, API Explorer;
NotDory serves the modern **MCP Streamable HTTP + SSE** transport at `http://127.0.0.1:8720/mcp`. Every request authenticates with a single header: `x-access-key` (a credential access key, default `no
NotDory serves the modern **MCP Streamable HTTP + SSE** transport at `http://127.0.0.1:8720/mcp`. Every request authenticates with a single header: `x-access-key` (a credential access key, default `no
Gates applied: no_behavioural_pass.
73b2b1aa47c8full audit observations/trust-audit/mcp-server/jchristn__notdory.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 73b2b1aa47c8 | SAFE | B | 86 | first audit |
Questions
What is the NotDory MCP server?
NotDory is durable memory your agents manage themselves — so every session starts where the last left off.
What tools does NotDory expose?
4 in total: 4 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is NotDory safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (86/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does NotDory need?
No credential environment variables were found in its source, so it appears to need none.
How does NotDory run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as notdory-dashboard at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (73b2b1aa47c8), read on 2026-10-11. The repository is watched and re-audited when it changes.