Atlas / MCP servers / munhq / chat-recall

chat-recallBLOCK

Name: chat-recall
Author: munhq

mcp/munhq/chat-recall

MCP server by munhq · agent memory · ai agents · antigravity · Audited 2026-10-12

Memory, secret alerts, ranked code findings and tracked tasks across every AI coding tool. Indexes Claude Code, Codex, OpenCode, Antigravity and Cursor sessions into one searchable history, and exposes it to your agent over MCP.

Verdict

BLOCK

Grade

Trust score

35 /100

Exposed tools

57 44r · 11w · 2d

Transport

stdio · streamable-http

License

NOASSERTION

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://www.npmjs.com/package/chat-recall) [](https://www.npmjs.com/package/chat-recall) [](https://registry.modelcontextprotocol.io/v0/servers?search=chat-recall) [](https://smithery.ai/servers/munhq/chat-recall) [](https://glama.ai/mcp/servers/munhq/chat-recall)

[](cursor://anysphere.cursor-deeplink/mcp/install?name=chat-recall&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIi1wIiwiY2hhdC1yZWNhbGwiLCJjaGF0LXJlY2FsbC1tY3AiXX0=) [](vscode:mcp/install?%7B%22name%22%3A%22chat-recall%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22-p%22%2C%22chat-recall%22%2C%22chat-recall-mcp%22%5D%7D)

[chatrecall.dev](https://chatrecall.dev) · How it works · MCP tools · Pricing · Self-host · Security

Turn what your AI coding tools already write into shared team knowledge, leaked-secret alerts, ranked code findings and tracked tasks.

Your agents wrote it all down. Nobody read it.

Every coding agent you run keeps a full transcript of its work: the decisions, the reasoning, the keys somebody pasted, the problems it found and never filed. Each one writes to its own directory in its own format, none can read another's

Read from source at commit 9ad8608e758aOBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (npm)

claude mcp add chat-recall -- npx -y [email protected]

Exposed tools (57)

44 read · 11 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`a`	read	b
`recall_analytics_summary`	read	Cross-tool spend & activity overview. Returns total sessions, total cost, weekly delta, top tools/projects/models, and how many sessions had unknown pricing (Gemini/Ollama/custom). Same data as the web Dashboard, available to the agent so it can answer
`recall_claude_suggestions`	read	Every finding that turns into an agent-instruction change, in one list — the
`recall_code_actions`	read	The ranked, actionable plan for a codebase — prioritised tasks synthesised from the findings, each with a ready agent prompt. This is the
`recall_code_findings`	read	List code findings (security / hardcoded literals / copy-paste clones / reinvention / dead code / coupling / cycles). Each finding carries a concrete, ready-to-run agent prompt that references codeindex tools. Filter by project/severity/category.
`recall_code_index`	write	Index a code repository with codeindex and sync its findings/hotspots/actions to your chat-recall server. Runs the codeindex analyzer LOCALLY (needs the repo files + git history), then ships the result. Use before recall_code_findings/actions if a repo hasn
`recall_code_projects`	read	List code-indexed projects on your server with health score, finding count, and label (poc/production/engineering).
`recall_commits`	read	Find git commits that landed during a session
`recall_context`	read	Get structured context from a session for continuation. Returns: - Your requests/inputs - Claude
`recall_decision_record`	read	Record an explicit decision so it shows up in wake-up context. Writes a KG triple (subject → decided → decision) plus a diary entry. Use this when you and the user agree on something non-obvious that future sessions should remember. PASS \
`recall_decision_scan`	read	What THIS repository
`recall_diary_read`	read	Read your recent diary entries. See what past versions of yourself recorded across sessions.
`recall_diary_write`	write	Write to your agent diary. Record observations, decisions, what you worked on, what matters. Each agent gets their own persistent diary across sessions. Use this at the end of sessions or when you learn something important that should persist.
`recall_diff`	read	Replay a session
`recall_edits_timeline`	read	Chronological list of file edits across recent sessions, spanning every AI tool chat-recall indexes — Claude Code, Codex, Cursor, OpenCode and Antigravity. Returns rows shaped like (timestamp, tool, session_id, project, file, op) sorted newest first. Pulls live from each tool
`recall_exclude_path`	write	Stop syncing a project path. Nothing under it leaves the machine from the next sync on. Use it when the user says
`recall_forget`	destructive	Delete one conversation from chat-recall, everywhere, permanently. Use it when the user says
`recall_get`	read	Read a key/value pair previously written with recall_set — or, when \
`recall_improvements`	read	Every improvement worth doing, ranked highest-priority first — the
`recall_index`	read	Index all Claude Code sessions for semantic search. Scans ~/.claude/projects/ and creates embeddings for all sessions. By default, only indexes new or changed sessions.
`recall_kg_add`	write	Add a fact to the knowledge graph. Subject → predicate → object with optional time window. E.g. (
`recall_kg_invalidate`	read	Mark a fact as no longer true. Use when things change — tools replaced, decisions reversed, people leave.
`recall_kg_query`	read	Query the knowledge graph for an entity
`recall_kg_stats`	read	Knowledge graph overview: entities, triples, current vs expired facts, relationship types.
`recall_kg_timeline`	read	Get chronological timeline of facts. Shows the story of an entity (or everything) in order.
`recall_markers`	read	Tag every user prompt in a session with sentiment / corrective markers: • interrupt — user hit ESC mid-response • frustrated — caps, profanity,
`recall_memory_item`	read	Fetch ONE memory item, its full text, or its links — or browse a whole source type. Complements recall_memory_search: search finds candidates, this reads the specific item. mode=browse lists a type (e.g. every skill, every plan) without a query.
`recall_memory_search`	read	Search across all memory types: sessions, plans, tasks, CLAUDE.md files, history, paste cache, and agent diaries. Returns results from any memory source, ranked by relevance. Use source_types to filter. Plans and tasks are found here (source_types: [
`recall_outcome_summary`	read	Aggregate session outcomes (shipped / interrupted / abandoned / in_progress) over the last N days —
`recall_recent`	read	List recent sessions across every AI tool chat-recall indexes. Shows your most recent conversations across all projects or filtered by project. Use this when the user says
`recall_reclassify`	write	Re-run the memory classifier over already-indexed chunks so classifier improvements reach old data. Idempotent — only rewrites tags that actually changed.
`recall_recommendation_apply`	write	Apply a recommendation: add its rule to the repo
`recall_recommendations`	read	Actionable recommendations, two scopes on one tool: - scope
`recall_redundant_files`	read	Before creating a file, check whether you have written one like it before. Scores the filename against every file touched in your synced history. Answers
`recall_regenerate_summary`	destructive	Force a fresh AI summary for one session — use when its stored summary is missing, stale, or plainly wrong.
`recall_rename_session`	write	Give a conversation a memorable name — or rename it — so you (and the user) can find and resume it later. Mirrors Claude Code
`recall_search`	read	Search for relevant past sessions to resume. Find past conversations matching your current task. Returns session IDs that can be used to resume that session in the tool that produced it. Three modes on one tool: - \
`recall_security_dismiss`	read	Mark a secret finding as rotated, false_positive, or dismissed. Use when the user confirms a key was rotated or that the match is not a real secret. The dismissal syncs across devices.
`recall_security_rules`	read	List tenant custom secret-detection rules, or test a regex in the sandbox. Tenant rules are configured in the chat-recall dashboard; this tool exposes them to the agent and lets you test new regexes without persisting them.
`recall_security_session`	read	Get secret findings for a specific session. Use after recall_search or recall_security_summary to show exactly which lines in a session matched which detector.
`recall_security_summary`	read	Get a security overview from the synced chat-recall server. Returns the action-required list of distinct leaked secrets (grouped by redacted preview), plus per-detector totals and top rules. Use this when the user asks
`recall_set`	write	Persist a small key/value pair across sessions. Use this for state that doesn
`recall_shares`	read	Which projects are shared into your team. scope=mine for your own shares, scope=all for every share visible to you. Private by default — nothing is visible to teammates until shared.
`recall_show`	read	Get conversation content from a specific session — or the full text of a plan. Use this after recall_search to get full context from a session. Also accepts a plan id (the plan filename without .md, as returned by recall_memory_search(source_types:[
`recall_smart_resume`	read	Get structured resume context for recent work — by default the last 3 sessions. Call it with NO arguments to resume. That is the common case:
`recall_status`	read	Show index status and statistics: synced sessions, chunks, freshness, top projects, plus the full memory-system breakdown (items/chunks per source type, per AI tool, link count).
`recall_subagent_search`	read	Search inside SUBAGENT transcripts — the explore/compact/aside sub-tasks that run within a session and whose work never appears in the main conversation. Use when a session
`recall_task_comment`	read	Leave a progress note on a team task — a comment visible to everyone on the board. Use it to record what you did, what is blocked, or why a status changed, without editing the task itself. Pass the task id (t_...) from recall_tasks.
`recall_task_create`	write	Create a collaborative team task. Optionally assign it to a teammate and attach it to a project. Returns the new task id. When you then START working on a task, use recall_task_update to set status
`recall_task_update`	write	Update a team task: change status, reassign, rename, link a session, and/or add a comment. Pass the task id (t_...) from recall_tasks. WORKFLOW — do this whenever the user asks you to work on a task from the board: 1. When you start, set status
`recall_tasks`	read	List the task board — and, with detail, the work itself. Without \
`recall_team_activity`	read	See what each teammate did, grouped by project — the team activity view. Returns a per-member × per-project rollup (session counts + last activity) for your team. Scoped to what you
`recall_toolkit_status`	read	Which MCP servers, skills, commands and agents exist, on which AI tool, on which device. Use it before recall_toolkit_sync to see what is missing where, and after, to confirm what landed. Counts are per (type, tool) and rows name the device that uploaded them, so you can tell
`recall_toolkit_sync`	write	Install the account
`recall_user_prompts`	read	List the human-typed prompts from a session (or recent sessions), newest first. Tool results and system banners are stripped — you get only what the user actually wrote. Useful for
`recall_wake_up`	read	Build startup context for an AI session: identity blurb + the top classifier-flagged facts (decisions/preferences/milestones at importance >=4) + current knowledge-graph facts. Replaces a manual context dump. Call this once at the start of a session to
`recall_weekly_digest`	read	Get a weekly activity digest across all projects. Returns: - Session count, total cost, coding time - Top projects by activity - Cost trend vs previous week - Open tasks across projects - Git activity summary Use to understand overall productivity and spending.

Trust audit

BLOCKgrade F · trust 35/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (3 observation(s))
Network: declared (4 observation(s))
Shell: declared (6 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

CRITICALPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

chatgpt-plugin/skills/chat-recall/SKILL.md:99

**Removing things** — `recall_forget` (delete one conversation from the server, permanently, tombstoned so no later sync restores it), `recall_exclude_path` (stop syncing a path, on this machine and o

Why it matters. an instruction to move sensitive data to an outside destination

Fix. remove; a skill never needs the user's secrets off the machine

CRITICALPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

packages/cli/skills/chat-recall/SKILL.md:99

**Removing things** — `recall_forget` (delete one conversation from the server, permanently, tombstoned so no later sync restores it), `recall_exclude_path` (stop syncing a path, on this machine and o

Why it matters. an instruction to move sensitive data to an outside destination

Fix. remove; a skill never needs the user's secrets off the machine

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/cli/src/self-restart.ts:142

log(`[self-restart] could not re-exec (${err instanceof Error ? err.message : err}) — staying on the OLD code`);

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/engine/src/core/store/knowledge-graph.ts:109

await exec(

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/engine/src/core/store/knowledge-graph.ts:161

await exec(`INSERT INTO kg_entities (tenant,id,name) VALUES ${tuples.join(',')} ON CONFLICT (tenant,id) DO NOTHING`, vals);

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532

packages/cli/src/cli.ts:3854

console.log(chalk.green('✓ Logged in.') + chalk.dim(`  server: ${serverUrl} (token verified)`));

MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319

packages/engine/src/core/secret-classify.ts:73

impact: 'Read messages, post as bot/user, exfiltrate channel content.',

MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321

.github/CONTRIBUTING.md:59

DATABASE_URL=postgres://chat_recall:chat_recall@localhost:5432/chat_recall \

MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321

.github/workflows/ci.yml:122

DATABASE_URL: postgres://chat_recall:[email protected]:5432/chat_recall

MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321

packages/engine/src/core/secret-redactor.test.ts:44

const url = 'connstr postgres://app_user:[email protected]:5432/maindb end';