Cuba-MemorysBLOCK
Persistent memory MCP server for AI agents — Rust, 19 tools, knowledge graph, Hebbian learning, episodic memory, contradiction detection, prospective triggers, Bayesian calibration, zero-config Docker setup.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Formerly cuba-memorys. Same daemon, same cuba_* MCP tools, new product name.
[](https://github.com/LeandroPG19/Memorys/actions/workflows/ci.yml) [](https://pypi.org/project/memory-industry/) [](https://www.npmjs.com/package/memory-industry) [](https://registry.modelcontextprotocol.io) [](https://rust-lang.org) [](https://postgresql.org) [](https://www.apache.org/licenses/LICENSE-2.0)
Long-term memory for AI coding agents. An MCP server that gives your agent a knowledge graph it can search, reason over, and be corrected by — so it stops forgetting your codebase between sessions.
Written in Rust. Backed by PostgreSQL + pgvector. 31 MCP tools (32 with CUBA_DOCS=1), 26 CLI commands, and every number below measured on a benchmark that — as of v0.12 — actually measures what it claims to. (The previous one did not. See Measured.)
Install
pip install memory-industry # or: npm install -g memory-industry claude mcp add memory-industry -- memory-industry # Previous names still install the same binary: # pip install cuba-memorys # npm install
428144eac549OBSERVED · 2026-10-09Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add memory-industry -- npx -y [email protected]
claude mcp add memory-industry -- None memory-industry==1.30.0
claude mcp add cuba-memorys -- npx -y [email protected]
Trust audit
BLOCKgrade F · trust 51/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (7 observation(s))
- Network
- declared (11 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- found
Findings (25)
"Authorization sk-ant-api03-abcdefghijklmnopqrstuvwxyz rejected",
"sk-ant-api03-abcdefghijklmnopqrstuvwxyz",
stderr.push_str(" ghp_abcdefghijklmnopqrstuvwxyz0123456789 ");("xoxb-canary0123456789", "slack token"),("xoxp-canary0123456789", "slack token"),"http://169.254.169.254/",
Rechazado: 169.254.169.254 es donde AWS/GCP/Azure sirven credenciales, y \
let err = check("http://169.254.169.254/latest/meta-data/iam/security-credentials/")format!("{err:#}").contains("169.254.169.254"),is_forbidden(&"::ffff:169.254.169.254".parse::<IpAddr>().unwrap()),
# DATABASE_URL=postgresql://cuba:memorys2026@localhost:5488/brain
# DATABASE_URL=postgresql://cuba:memorys2026@localhost:5488/brain
memory-industry-task.xml
# MEMORY_INDUSTRY_LLM_BASE_URL=http://127.0.0.1:11434/v1
base_url: "http://127.0.0.1:11434/v1",
DATABASE_URL: postgresql://cuba:[email protected]:5488/brain
CUBA_PEER_DATABASE_URL: postgresql://cuba:[email protected]:5488/brain_ci_peer
psql "postgresql://cuba:[email protected]:5488/postgres" -q \
.bind("el token de deploy es ghp_abcdefghijklmnopqrstuvwxyz0123456789").bind("el token es ghp_0123456789abcdefghijklmnopqrstuvwxyzAB y no se puede procesar")"el token es ghp_0123456789abcdefghijklmnopqrstuvwxyzAB y no se puede procesar",
.pre-commit-config.yaml
"../../etc/passwd",
for escape in ["../elsewhere", "sub/../../elsewhere", "./../.."] {"url": "http://127.0.0.1:8787/mcp",
Gates applied: critical_finding, no_behavioural_pass.
428144eac549full audit observations/trust-audit/mcp-server/leandropg19__cuba-memorys-1.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-09 | 428144eac549 | BLOCK | F | 51 | first audit |
Questions
What is the Cuba-Memorys MCP server?
Persistent memory MCP server for AI agents — Rust, 19 tools, knowledge graph, Hebbian learning, episodic memory, contradiction detection, prospective triggers, Bayesian calibration, zero-config Docker setup.
Is Cuba-Memorys safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (51/100) and found 12 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does Cuba-Memorys need?
It reads LINKEDIN_ACCESS_TOKEN, LINKEDIN_CLIENT_SECRET, LINKEDIN_REFRESH_TOKEN, REDDIT_CLIENT_SECRET and REDDIT_REFRESH_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Cuba-Memorys run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as memory-industry at 0.28.0.
How current is this page?
The grade is for one exact copy of the source (428144eac549), read on 2026-10-09. The repository is watched and re-audited when it changes.