Atlas / MCP servers / memtomem / memtomem-stm

memtomem-stmBLOCK

Name: memtomem-stm
Author: memtomem

mcp/memtomem/memtomem-stm

MCP server by memtomem · agent harness · agent memory · ai agents · Audited 2026-10-11

⚑ Report / re-scan Source ↗

Short-term memory proxy gateway with proactive memory surfacing for AI agents

Verdict

BLOCK

Grade

Trust score

61 /100

Exposed tools

14 14r · 0w · 0d

Transport

sse · stdio · streamable-http

License

Apache-2.0

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Official website & docs: [https://memtomem.com](https://memtomem.com)

[](https://pypi.org/project/memtomem-stm/) [](https://python.org) [](LICENSE) [](CLA.md)

🚧 Alpha — APIs and defaults may change between 0.x minor releases. Feedback and issue reports are especially welcome: Issues · Discussions.

Spend fewer tokens. Remember more. Ship faster.

memtomem-stm is an MCP proxy that can substantially reduce the model-visible size of large tool responses and surface cross-session memory from a configured memtomem LTM — with no changes to your upstream MCP servers. The actual reduction depends on response shape, compression strategy, and whether the call travels through MCP; verify it against your workload with the repository's deterministic bench_qa suite.

It sits between your AI agent and its upstream MCP servers, compressing tool responses, caching repeated calls, and automatically surfacing relevant context from prior sessions via a memtomem LTM server.

What memtomem-stm does:

Cuts token spend on repeated reads — compresses and caches tool responses, so the agent doesn't re-pay for the same file or search result. Works with Claude Code, Cursor, Claude Desktop, or any MCP client.
Carries context across sessions — surfaces prior decisions from memtomem LTM automatically, so the agent picks up where it left off rather than re-discovering what it already knew.
Drops in front of any MCP server — adds compression, caching, and observability as a proxy layer, without changes to upstream code.

flowchart TB
Agent["Agent(Claude Code, Cursor, ...)"]

Read from source at commit ff7574d9f9f8OBSERVED · 2026-10-11

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add memtomem-stm --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env MEMTOMEM_STM_SURFACING__MIN_QUERY_TOKENS=${MEMTOMEM_STM_SURFACING__MIN_QUERY_TOKENS} --env OPENAI_API_KEY=${OPENAI_API_KEY} -- uvx memtomem-stm

claude-desktop

{
  "mcpServers": {
    "memtomem-stm": {
      "command": "uvx",
      "args": [
        "memtomem-stm"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "MEMTOMEM_STM_SURFACING__MIN_QUERY_TOKENS": "${MEMTOMEM_STM_SURFACING__MIN_QUERY_TOKENS}",
        "OPENAI_API_KEY": "${OPENAI_API_KEY}"
      }
    }
  }
}

Exposed tools (14)

14 read · 0 write · 0 destructive.

Tool	Risk	Description
`describe`	read	Return a short description of what this fixture exposes.
`eligible_tools`	read	Canned ``eligible_tools`` consult mirroring the real structured shape.
`get_document`	read	Return the full structured document as a JSON object.
`greet`	read	return f
`mem_do`	read	Stand-in for the ``mem_do`` meta-tool.
`mem_search`	read	Return two canned search hits in core
`rank_features`	read	Canned ``rank_features`` consult mirroring the real per-candidate shape.
`say`	read	Return the input text prefixed with a greeting.
`stm_compression_feedback`	read	Report missing information from a compressed proxy response.
`stm_proxy_describe_tool`	read	Read bounded pages of a registered tool
`stm_proxy_read_more`	read	Read more content from a progressive delivery response.
`stm_proxy_select_chunks`	read	Retrieve selected sections from a TOC response.
`stm_surfacing_feedback`	read	Provide feedback on proactively surfaced memories.
`unrelated_tool`	read	return

Trust audit

BLOCKgrade D · trust 61/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: none-observed
Network: declared (5 observation(s))
Shell: declared (1 observation(s))
Dependencies: pinned
Secrets in source: found

Findings (25)

CRITICALHard-coded secrets · secret.anthropic · CWE-798, CWE-321

src/memtomem_stm/proxy/privacy.py:166

# "sk-ant-api03-release-notes-2026-migration-guide". The terminal guard is

MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

src/memtomem_stm/cli/proxy.py:1537

loaded = getattr(importlib.import_module(module_name), attr)

MEDIUMHard-coded secrets · secret.anthropic · CWE-798, CWE-321

tests/test_privacy.py:281

"sk-ant-api03-release-notes-2026-migration-guide",  # Anthropic kebab slug

MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321

tests/cli/test_proxy_cli.py:11385

"env": {"DATABASE_URL": "postgres://u:pw-DO-NOT-PRINT@h/db"},

MEDIUMHard-coded secrets · secret.github · CWE-798, CWE-321

tests/test_surfacing_persist_query_text.py:212

"gh ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789",

MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321

tests/test_config_persistence.py:621

assert contains_sensitive_content("-----BEGIN RSA PRIVATE KEY-----")

MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321

tests/test_privacy.py:208

"-----BEGIN RSA PRIVATE KEY-----",

MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321

tests/test_privacy.py:209

"-----BEGIN DSA PRIVATE KEY-----",

MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321

tests/test_privacy.py:210

"-----BEGIN PGP PRIVATE KEY-----",

MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321

tests/test_privacy.py:364

"-----BEGIN RSA PRIVATE KEY-----",

MEDIUMHard-coded secrets · secret.slack · CWE-798, CWE-321

tests/test_privacy.py:163

"xoxb-123456-abcdef",  # Slack bot

MEDIUMHard-coded secrets · secret.slack · CWE-798, CWE-321

tests/test_privacy.py:164

"xoxp-123456-abcdef",  # Slack user

LOWCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

tests/cli/test_health_doctor_value_audit.py:505

httpx_mod = importlib.import_module(module_name)

LOWCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

tests/cli/test_health_doctor_value_audit.py:893

mod = importlib.import_module(module)

LOWCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

tests/test_sqlite_init_cleanup.py:51

mod = importlib.import_module(module_path)

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/memtomem_stm/surfacing/cache.py:62

return hashlib.md5(

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

tests/test_surfacing_cache.py:122

== hashlib.md5(

LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59

tests/test_privacy.py:177

"aws_session_token = FAKEFwoGZXIvYXdzFAKE",  # ~/.aws/credentials form

Why it matters. touches a credential store

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

tests/test_memory_ops.py:229

server="../../tmp/evil",

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

tests/test_memory_ops.py:381

server="../../tmp/evil",