LorekitBLOCK
Free, open source, local & remote, persistent memory for your AI coding agents.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Shared, persistent memory for your AI coding agents.
Your agent solves something once — a migration gotcha, a flaky-test fix, why the build breaks only on CI — and remembers it in every session after, on every machine, across every tool. One npx command to connect; works with Claude Code, Cursor, Codex, or any MCP client.
[](https://github.com/mthines/lorekit/actions/workflows/deploy.yml) [](https://www.npmjs.com/package/@lorekit/cli) [](./LICENSE)
npx @lorekit/cli install # connect your agent — full setup below
┌─ your agent, any tool, any machine ─┐
learns something │ memory.write { scope, key, value } │
in a session ───→│ │──→ one store, your call:
recalls it next │ memory.list { scope } │←── remote (shared) or local
time it needs it └─────────────────────────────────────┘The problem: your agents forget everything
Every coding agent starts each session with total amnesia. If you use them daily, that costs you:
- Every session starts from zero. The agent that just untangled a tricky bug
has no memory of it an hour later. You re-explain the same context, over and over.
- Lessons are trapped on one machine. What your agent learned on your laptop
never reaches your teammate's agent — or the same agent running in CI.
- Every tool is its own island. What Claude Code figured out, Cursor doesn't
know. What you learned locally, GitHub Actions can't see.
- Good context dies quietly. The
.claude/notes your agent writ
c338acc7c9adOBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add web --env AUTH_AUTHED_NAME=${AUTH_AUTHED_NAME} --env AUTH_AUTHED_ROLE=${AUTH_AUTHED_ROLE} --env AUTH_LOGIN_URL=${AUTH_LOGIN_URL} --env AUTH_POST_LOGIN_URL_PATTERN=${AUTH_POST_LOGIN_URL_PATTERN} -- npx -y @lorekit/[email protected]{
"mcpServers": {
"web": {
"command": "npx",
"args": [
"-y",
"@lorekit/[email protected]"
],
"env": {
"AUTH_AUTHED_NAME": "${AUTH_AUTHED_NAME}",
"AUTH_AUTHED_ROLE": "${AUTH_AUTHED_ROLE}",
"AUTH_LOGIN_URL": "${AUTH_LOGIN_URL}",
"AUTH_POST_LOGIN_URL_PATTERN": "${AUTH_POST_LOGIN_URL_PATTERN}"
}
}
}
}Exposed tools (23)
11 read · 7 write · 5 destructive. Blast radius: 5 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
groom.preview | write | Preview the lessons a saved policy or an inline condition set would archive, without changing anything |
groom.run | write | Archive every lesson a saved policy or an inline condition set matches. Soft-archive only — never hard-deletes |
lorekit.cli.invocations | read | Count of LoreKit CLI command invocations |
memory.archive | read | Soft-archive a lesson. Archived lessons are hidden from reads but can be restored via memory.restore. |
memory.delete | destructive | Soft-archive a lesson (default) or hard-delete it (force: true). Archived lessons are hidden from reads but can be restored. |
memory.list | read | List lessons, for one scope or across every scope you can see |
memory.list_archived | read | List archived (soft-deleted) lessons, for one scope or across every scope you can see |
memory.protect | read | Mark or unmark a lesson as protected — excluded from every grooming candidate set regardless of policy |
memory.purge | destructive | Permanently delete archived lessons older than retention_days (default ${PURGE_RETENTION_DAYS_DEFAULT}). Unrecoverable. |
memory.purge_expired | destructive | Permanently delete all TTL-expired memories for the current user. Unrecoverable. |
memory.read | read | Read one lesson by |
memory.restore | read | Restore an archived lesson back to active |
memory.scopes | read | List every scope in the store with how many active memories it holds and when it was last |
memory.search | read | Full-text search across lessons |
memory.write | write | Store or update a lesson |
org.create | write | Create a new organization. You become its owner automatically. The slug must be globally unique and lowercase. |
org.delete | destructive | Delete an organization. Requires owner role. Soft-deletes the org — all org lore is immediately hidden from reads. Unrecoverable via MCP. |
org.list | read | List all organizations you are a member of, with your role in each. |
org.rename | write | Rename an organization |
policy.create | write | Create a scoped retention policy that auto-archives (never hard-deletes) matching lessons |
policy.delete | destructive | Delete a retention policy. Deletes the rule only — never touches the lessons it matched |
policy.list | read | List every retention policy you own |
policy.update | write | Update a retention policy. Every field but id is optional |
Trust audit
BLOCKgrade F · trust 56/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (9 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
* node scripts/seed/seed-preview.mjs --psql postgresql://postgres:[email protected]:54322/postgres \
explorer-instruments.ts
[ -n "$DB_URL" ] || DB_URL="postgresql://postgres:[email protected]:54322/postgres"
--psql postgresql://postgres:[email protected]:54322/postgres
{ token: 'custom_token_from_a_self_host' },const der = pemToDer('-----BEGIN PRIVATE KEY-----\nTWFu\n-----END PRIVATE KEY-----\n');memory.delete, memory.purge, memory.purge_expired, org.delete, policy.delete
.mcp.example.json
.release-please-manifest.json
test("taskById refuses a stub instead of running an empty eval (AC-3.4)", () => {new URL('../../../../supabase/byod/bootstrap.sql', import.meta.url),return JSON.parse(fs.readFileSync(new URL('../../package.json', import.meta.url), 'utf8')).version;export const PKG_ROOT = fileURLToPath(new URL('../../', import.meta.url));const WEB_PACKAGE_DIR = fileURLToPath(new URL('../../web', import.meta.url));'../../web/src/components/lore/LoreExplorer.tsx',
-X POST http://127.0.0.1:54321/functions/v1/mcp \
SUPABASE_URL: http://127.0.0.1:54321
LOREKIT_REST_BASE_URL: http://127.0.0.1:54321/functions/v1
LOREKIT_REST_BASE_URL: http://127.0.0.1:54321/functions/v1
LOREKIT_REST_BASE_URL: http://127.0.0.1:54321/functions/v1
const parsed: unknown = JSON.parse(atob(b64 + '='.repeat(pad)));
const parsed: unknown = JSON.parse(atob(b64 + '='.repeat(pad)));
const d = JSON.parse(atob(p + '='.repeat(pad)));
const d = JSON.parse(atob(p + '='.repeat(pad)));
const json = atob(padded + '='.repeat((4 - (padded.length % 4)) % 4));
Gates applied: no_behavioural_pass.
c338acc7c9adfull audit observations/trust-audit/mcp-server/mthines__lorekit.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | c338acc7c9ad | BLOCK | F | 56 | first audit |
Questions
What is the @lorekit/cli MCP server?
Free, open source, local & remote, persistent memory for your AI coding agents.
What tools does @lorekit/cli expose?
23 in total: 11 read-only, 7 that write, and 5 that can delete or overwrite (memory.delete, memory.purge, memory.purge_expired, org.delete, policy.delete). Every one is listed on this page with its risk.
Is @lorekit/cli safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (56/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 5 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does @lorekit/cli need?
It reads AUTH_AUTHED_NAME, AUTH_AUTHED_ROLE, AUTH_LOGIN_URL, AUTH_POST_LOGIN_URL_PATTERN, AUTH_PROXY_SERVER, AUTH_STORAGE_STATE, AUTH_TIMEOUT_MS, LOREKIT_SMOKE_PASSWORD, LOREKIT_SMOKE_TOKEN, LOREKIT_SWEEP_SERVICE_ROLE_KEY, LOREKIT_TELEMETRY_TOKEN and LOREKIT_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @lorekit/cli run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as @lorekit/web at 0.0.2.
How current is this page?
The grade is for one exact copy of the source (c338acc7c9ad), read on 2026-10-12. The repository is watched and re-audited when it changes.