MindForgeBLOCK
Production-grade lifelong memory for AI agents — 4-tier memory, knowledge graph, E2EE, federated P2P, MCP server.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A local-first, production-grade memory system for AI agents.
Maintainer — Xiao Gu (小顾), born in 2008 · GitHub: opok-ops · 抖音: shidianduo3116 · 小红书: 4406811524 · Feedback: [email protected]
MindForge gives AI agents a persistent, structured long-term memory: a four-tier lifecycle model, knowledge graphs, hybrid retrieval, end-to-end encryption, and MCP / CLI / REST interfaces. All data stays on your machine.
[](https://www.python.org/downloads/) [](LICENSE) [](https://github.com/opok-ops/MindForge/releases) [](https://github.com/opok-ops/MindForge/stargazers) [](https://github.com/opok-ops/MindForge/forks) [](https://github.com/opok-ops/MindForge/issues) [](https://github.com/opok-ops/MindForge/commits/master) [](https://github.com/opok-ops/MindForge/actions/workflows/ci.yml) [](https://opok-ops.github.io/MindForge/)
English · 中文文档 · Live Demo · Documentation · Discussions
Overview
Agent memory solutions that rely on cloud backends introduce latency, cost, and privacy trade-offs. MindForge takes the opposite approach: memory is compute
bbe21fe9217cOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mindforge-dsh-plugin --env BAIDU_PUSH_TOKEN=${BAIDU_PUSH_TOKEN} --env MINDFORGE_ALLOW_EXTERNAL_KEY_FILE=${MINDFORGE_ALLOW_EXTERNAL_KEY_FILE} --env MINDFORGE_ALLOW_NOAUTH=${MINDFORGE_ALLOW_NOAUTH} --env MINDFORGE_API_KEY=${MINDFORGE_API_KEY} -- npx -y [email protected]{
"mcpServers": {
"mindforge-dsh-plugin": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"BAIDU_PUSH_TOKEN": "${BAIDU_PUSH_TOKEN}",
"MINDFORGE_ALLOW_EXTERNAL_KEY_FILE": "${MINDFORGE_ALLOW_EXTERNAL_KEY_FILE}",
"MINDFORGE_ALLOW_NOAUTH": "${MINDFORGE_ALLOW_NOAUTH}",
"MINDFORGE_API_KEY": "${MINDFORGE_API_KEY}"
}
}
}
}Exposed tools (9)
6 read · 2 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
memory_add | write | Store info in persistent long-term memory. Survives across sessions. |
memory_delete | destructive | Delete a memory by ID. Only when user explicitly asks to forget. |
memory_get | read | Get full memory by ID. Use after memory_search for details. |
memory_list | read | List recent memories with pagination. Optionally filter by category. |
memory_search | read | Search long-term memory by natural language. Returns matching memories with relevance scores. |
memory_star | read | Star or unstar a memory for quick access. |
memory_stats | read | Memory store stats: total, categories, importance distribution, top tags. |
memory_tags | read | List all tags with usage counts. |
memory_update | write | Update a memory: change content, importance, or tags. |
Trust audit
BLOCKgrade D · trust 64/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (6 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (24)
"metadata.google.internal"):
f" • {a.get('memory_id', '')[:8]} Δimp={a.get('delta_importance', 0):+.2f} "token = "my-secret-2fa-token-123"
token = "persist-secret-token"
PASSWORD = "v566-test-password-123"
self.password = "V568-regression-pass"
PASSWORD = "v570-fallback-password-123"
memory_delete
importlib.import_module(mod)
- **Webhook SSRF 深度防护(#9)**:注册与投递双阶段校验;支持非规范 IPv4 写法(127.1 / 0x7f000001 等)、DNS 全量解析(防 rebinding)、拒绝内网/链路本地/回环/组播;投递禁止跟随 3xx 跳转(防 302 → 169.254.169.254)。
"169.254.169.254", "172.16.0.1", "172.31.255.255",
"::ffff:169.254.169.254"]:
"http://169.254.169.254/latest/meta-data/")
base = "http://127.0.0.1:%d" % port
with urllib.request.urlopen(f"http://127.0.0.1:{port}/api/stats", timeout=5) as resp:with urllib.request.urlopen(f"http://127.0.0.1:{port}/api/health", timeout=5) as resp:f"http://127.0.0.1:{self.port}/api/stats", timeout=5)f"http://127.0.0.1:{self.port}/api/stats",decoded = _b64.b64decode(auth_header[6:]).decode("utf-8")salt = _b64.b64decode(kdf.get("salt", "") or "")ciphertext=base64.b64decode(data["ciphertext"]),
nonce=base64.b64decode(data["nonce"]),
salt=base64.b64decode(data["salt"]),
@deepseek-ai/dsh-session, @deepseek-ai/dsh-tools, @types/node, typescript
Gates applied: no_behavioural_pass.
bbe21fe9217cfull audit observations/trust-audit/mcp-server/opok-ops__mindforge.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | bbe21fe9217c | BLOCK | D | 64 | first audit |
Questions
What is the MindForge MCP server?
Production-grade lifelong memory for AI agents — 4-tier memory, knowledge graph, E2EE, federated P2P, MCP server.
What tools does MindForge expose?
9 in total: 6 read-only, 2 that write, and 1 that can delete or overwrite (memory_delete). Every one is listed on this page with its risk.
Is MindForge safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (64/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does MindForge need?
It reads BAIDU_PUSH_TOKEN, MINDFORGE_ALLOW_EXTERNAL_KEY_FILE, MINDFORGE_ALLOW_NOAUTH, MINDFORGE_API_KEY, MINDFORGE_EMBEDDING_API_KEY, MINDFORGE_MCP_REQUIRE_AUTH, MINDFORGE_MCP_SECRET, MINDFORGE_NEW_PASSWORD, MINDFORGE_OLD_PASSWORD, MINDFORGE_PASSWORD, MINDFORGE_WEBHOOK_SECRET and OPENAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (bbe21fe9217c), read on 2026-10-11. The repository is watched and re-audited when it changes.