EngramSAFE
Memory engine for AI agents — time axis (3-layer decay/promotion) + space axis (self-organizing topic tree). Hybrid search, LLM consolidation. Single Rust binary.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/kael-bit/engram-rs/actions/workflows/ci.yml) [](LICENSE) [](https://www.rust-lang.org) [](https://github.com/kael-bit/engram-rs) [](https://ghcr.io/kael-bit/engram-rs)
Memory engine for AI agents. Two axes: time (three-layer decay & promotion) and space (self-organizing topic tree). Important memories get promoted, noise fades, related knowledge clusters automatically.
Most agent memory is a flat store — dump everything in, keyword search to get it back. No forgetting, no organization, no lifecycle. engram-rs adds the part that makes memory actually useful: the ability to forget what doesn't matter and surface what does.
Single Rust binary, one SQLite file, zero external dependencies. No Python, no Redis, no vector DB — curl | bash and it runs. ~10 MB binary, ~100 MB RSS, single-digit ms search latency.
Quick Start
# Install (interactive — will prompt for embedding provider config)
curl -fsSL https://raw.githubusercontent.com/kael-bit/engram-rs/main/install.sh | bash
# Store a memory
curl -X POST http://localhost:3917/memories \
-d '{"content": "Always run tests before deploying", "tags": ["deploy"]}'
# Recall by meaning
curl -X POST http://localhost:3917/recall \
-d '{"query": "deployment checklist"}'
# Restore full context (session start)
curl http://localhost:3917/resumeWhat It Does
Thr
a1baad63cf62OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add engram-rs-mcp --env ENGRAM_API_KEY=${ENGRAM_API_KEY} -- npx -y [email protected]Exposed tools (16)
11 read · 4 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
engram_consolidate | write | Run a memory consolidation cycle. Promotes important memories upward, |
engram_delete | destructive | Delete a memory by ID. Use when a memory is outdated, incorrect, or redundant. |
engram_extract | read | Extract structured memories from raw text using LLM. |
engram_health | read | Detailed health check: uptime, RSS memory, embed cache stats, AI config status. |
engram_recall | read | Hybrid semantic + keyword search with budget-aware retrieval. |
engram_recent | read | List recent memories by creation time. Good for session context recovery. |
engram_repair | read | Repair FTS search index. Removes orphaned entries and rebuilds missing ones. |
engram_restore | read | Restore a soft-deleted memory from trash back to its original layer. |
engram_resume | read | Full memory bootstrap for session recovery. Returns core (permanent knowledge), |
engram_search | read | Quick keyword search. Lighter than recall — no scoring or budget logic. |
engram_stats | read | Get memory statistics: counts per layer, AI status, version. |
engram_store | write | Store a memory. All memories start in Buffer and promote to Working/Core through |
engram_topic | read | Drill into topic clusters by ID. Use after /resume to explore specific topics from the knowledge index. |
engram_trash | read | List soft-deleted memories. Recently deleted items can be restored. |
engram_triggers | write | Fetch trigger memories for a specific action. Call before performing an action (e.g. git-push, deploy) to recall relevant lessons and rules. |
engram_update | write | Update a memory |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (8 observation(s))
- Network
- declared (10 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (10)
engram_delete
axum::response::Html(include_str!("../../web/index.html"))include_str!("../../web/style.css"),include_str!("../../web/app.js"),@modelcontextprotocol/sdk, zod, typescript, @types/node
Single Rust binary, one SQLite file, zero external dependencies. No Python, no Redis, no vector DB — `curl | bash` and it runs. ~10 MB binary, ~100 MB RSS, single-digit ms search latency.
curl -fsSL https://raw.githubusercontent.com/kael-bit/engram-rs/main/install.sh | bash
curl -fsSL https://raw.githubusercontent.com/kael-bit/engram-rs/main/install.sh | bash
单个 Rust 二进制,一个 SQLite 文件,零外部依赖。不需要 Python、Redis、向量数据库——`curl | bash` 即装即用。~10 MB 二进制,~100 MB 内存占用,毫秒级搜索延迟。一台 $5 VPS 就能跑。
curl -fsSL https://raw.githubusercontent.com/kael-bit/engram-rs/main/install.sh | bash
Gates applied: no_behavioural_pass.
a1baad63cf62full audit observations/trust-audit/mcp-server/kael-bit__engram-4.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | a1baad63cf62 | SAFE | B | 89 | first audit |
Questions
What is the Engram MCP server?
Memory engine for AI agents — time axis (3-layer decay/promotion) + space axis (self-organizing topic tree). Hybrid search, LLM consolidation. Single Rust binary.
What tools does Engram expose?
16 in total: 11 read-only, 4 that write, and 1 that can delete or overwrite (engram_delete). Every one is listed on this page with its risk.
Is Engram safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Engram need?
It reads ENGRAM_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Engram run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as engram-rs-mcp at 0.14.0.
How current is this page?
The grade is for one exact copy of the source (a1baad63cf62), read on 2026-10-08. The repository is watched and re-audited when it changes.