agent-memoryBLOCK
One memory for every AI agent — self-hosted long-term memory over MCP/REST for Claude Code, Codex, Cursor, Gemini CLI, VS Code, OpenClaw, and more.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
One memory. Every agent.
A self-hosted long-term memory layer shared by Claude Code, Codex CLI, Cursor, Gemini CLI, Grok Build, ChatOnSteroids, VS Code agents, OpenClaw, and any MCP-capable client.
[](https://github.com/Masikomoore/agent-memory/actions/workflows/ci.yml) [](LICENSE) [](docs/AGENT_CLIENTS.md) [](https://lancedb.com/) [](https://github.com/Masikomoore/agent-memory/stargazers)
Quick Start · Connect Agents · Architecture · Roadmap · Contributing · Discussions · 中文
[!TIP] If you use more than one AI coding agent, Agent Memory is for you. Star the repository if you want an open, self-hosted memory layer that stays with you instead of one vendor, IDE, or model.
Why I built this
Agent Memory started with a painful lesson: my Codex Pro account was suspended, and I discovered that I had never kept a complete copy of my history. The local Codex project files were still on my machine, but some browser conversations, planning discussions, and the back-and-forth that shaped development decisions were simply gone.
It was the first time I had personally experienced what losing access to an AI account could mean. I use products from nearly every major AI company—Claude, Codex, Grok, Gemini, and others—and that immediately made the problem feel much bigger than one account. If each agent keeps the only copy of part of my working memory, then changing tools, losing an
74d4d4a59836OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add agent-memory-service --env MEMORY_PRO_OAUTH_AUTHORIZE_URL=${MEMORY_PRO_OAUTH_AUTHORIZE_URL} --env MEMORY_PRO_OAUTH_CLIENT_ID=${MEMORY_PRO_OAUTH_CLIENT_ID} --env MEMORY_PRO_OAUTH_REDIRECT_URI=${MEMORY_PRO_OAUTH_REDIRECT_URI} --env MEMORY_PRO_OAUTH_TOKEN_URL=${MEMORY_PRO_OAUTH_TOKEN_URL} -- npx -y [email protected]{
"mcpServers": {
"agent-memory-service": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"MEMORY_PRO_OAUTH_AUTHORIZE_URL": "${MEMORY_PRO_OAUTH_AUTHORIZE_URL}",
"MEMORY_PRO_OAUTH_CLIENT_ID": "${MEMORY_PRO_OAUTH_CLIENT_ID}",
"MEMORY_PRO_OAUTH_REDIRECT_URI": "${MEMORY_PRO_OAUTH_REDIRECT_URI}",
"MEMORY_PRO_OAUTH_TOKEN_URL": "${MEMORY_PRO_OAUTH_TOKEN_URL}"
}
}
}
}Exposed tools (9)
6 read · 0 write · 3 destructive. Blast radius: 3 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
memory-lancedb-pro.memory-reflection.command-new | read | Generate reflection log before /new |
memory-lancedb-pro.memory-reflection.command-reset | destructive | Generate reflection log before /reset |
memory-lancedb-pro.self-improvement.agent-bootstrap | read | Inject self-improvement reminder on agent bootstrap |
memory-lancedb-pro.self-improvement.before-prompt-build | destructive | Inject self-improvement reminder silently after /new or /reset |
memory-lancedb-pro.self-improvement.command-new | read | Queue self-improvement reminder before /new |
memory-lancedb-pro.self-improvement.command-reset | destructive | Queue self-improvement reminder before /reset |
memory_capture | read | |
memory_health | read | |
memory_recall | read |
Trust audit
BLOCKgrade D · trust 64/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (6 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (22)
eval(...args: unknown[]): Promise<unknown>;
Inject self-improvement reminder silently after /new or /reset
CMD ["node", "-e", "fetch('http://127.0.0.1:7337/health').then((r)=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]embedding: { apiKey: "embedding-provider-key" },embedding: { apiKey: "embedding-provider-key" },Inject self-improvement reminder on agent bootstrap
memory-lancedb-pro.memory-reflection.command-reset, memory-lancedb-pro.self-improvement.before-prompt-build, memory-lancedb-pro.self-improvement.command-reset
const digest = createHash("sha1")await coldIndexer.readFile("memory/dreaming/../../SECRET.md", 1, 1),const mod = jiti("../../cli.ts");outputDir: "../../outside//skills",
curl http://127.0.0.1:7337/health
http://127.0.0.1:7337/mcp
curl http://127.0.0.1:7337/health
http://127.0.0.1:7337/mcp
const INVISIBLES = ["", "͏", "", "", "", "", "", ""];
const ZERO_WIDTHS = ["", "", "", ""];
/**
// test/lock-recovery.test.mjs
// test/store-write-queue.test.mjs
@lancedb/lancedb, @modelcontextprotocol/node, @modelcontextprotocol/server, json5, openai, proper-lockfile, zod, @modelcontextprotocol/client
> Help me install and configure Agent Memory from https://github.com/Masikomoore/agent-memory as my shared long-term memory service. First inspect my OS, existing Agent Memory deployment, installed AI
Gates applied: no_behavioural_pass.
74d4d4a59836full audit observations/trust-audit/mcp-server/masikomoore__agent-memory.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 74d4d4a59836 | BLOCK | D | 64 | first audit |
Questions
What is the agent-memory MCP server?
One memory for every AI agent — self-hosted long-term memory over MCP/REST for Claude Code, Codex, Cursor, Gemini CLI, VS Code, OpenClaw, and more.
What tools does agent-memory expose?
9 in total: 6 read-only, 0 that write, and 3 that can delete or overwrite (memory-lancedb-pro.memory-reflection.command-reset, memory-lancedb-pro.self-improvement.before-prompt-build, memory-lancedb-pro.self-improvement.command-reset). Every one is listed on this page with its risk.
Is agent-memory safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (64/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 3 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does agent-memory need?
It reads MEMORY_PRO_OAUTH_AUTHORIZE_URL, MEMORY_PRO_OAUTH_CLIENT_ID, MEMORY_PRO_OAUTH_REDIRECT_URI, MEMORY_PRO_OAUTH_TOKEN_URL and OPENAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does agent-memory run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as agent-memory-service at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (74d4d4a59836), read on 2026-10-11. The repository is watched and re-audited when it changes.