cairntirCAUTION
Local-first persistent memory MCP server for Claude Code, Codex, Cursor, Qwen Code, and AI coding agents. Cross-session, cross-agent SQLite memory.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Persistent, local-first memory for AI coding agents. Claude Code, Codex, Cursor, Qwen Code, and other MCP clients share one searchable project history.
[](https://pypi.org/project/cairntir/) [](https://github.com/pnmcguire480/cairntir/actions/workflows/ci.yml) [](https://www.python.org/downloads/) [](LICENSE)
Cairntir stores decisions, facts, unfinished work, and outcomes as verbatim drawers in a SQLite database you own. A budgeted handoff restores complete drawers across sessions; semantic and file-anchored recall find deeper evidence.
Current release: 1.12.3. See the release evidence and changelog. Published downloads are on PyPI and GitHub Releases.
Install
pip install --upgrade cairntir cairntir setup
Python 3.11+ is required. Setup initializes the store and configures supported hosts it detects. Restart your agent afterward.
cairntir version cairntir doctor
The diagnostic changes below are unreleased; pip install currently selects published 1.12.3. That release's doctor/status/version may still run registration and update callbacks, and status may open the store for writing. See the change record before treating an installed diagnostic as read-only.
In this candidate, version reports this CLI's version. status and doctor inspect the store and configuration without registering hosts or checking for updates. A configured MCP entry does not prove a live connection. Setup's local write/read check does not prove host delivery or semantic retrieval: require an actual save receipt, then recover the exact task in a fresh
ac3c74d2360dOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add cairntir -- uvx cairntir
{
"mcpServers": {
"cairntir": {
"command": "uvx",
"args": [
"cairntir"
]
}
}
}Exposed tools (4)
3 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
cairntir_audit | write | Run the Quality skill over a wing. |
cairntir_crucible | read | Stress-test a claim with the Crucible skill. |
cairntir_discoveries | read | List the current leaves of the append-only Discovery Ledger. |
cairntir_timeline | read | Chronological view of drawers in a wing mentioning an entity. |
Trust audit
CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (6 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- found
Findings (7)
portable-v2-v6.fixture
r"\b(reveal|print|return|exfiltrate)\b.{0,30}"SECRET = "confidential-foundation-canary-9db2" # noqa: S105
.pre-commit-config.yaml
proposer = OllamaProposer(model="m", endpoint="http://10.0.0.5:9999/")
assert captured == ["http://10.0.0.5:9999/api/generate"]
**Risk:** The entire tiering model is decorative. Any user on community tier has full access to all features. If monetization is ever needed, every command would need retrofit gating.
Gates applied: no_behavioural_pass.
ac3c74d2360dfull audit observations/trust-audit/mcp-server/pnmcguire480__cairntir.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | ac3c74d2360d | CAUTION | B | 89 | first audit |
Questions
What is the cairntir MCP server?
Local-first persistent memory MCP server for Claude Code, Codex, Cursor, Qwen Code, and AI coding agents. Cross-session, cross-agent SQLite memory.
What tools does cairntir expose?
4 in total: 3 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is cairntir safe to connect to an agent?
With care. The audit graded it B (89/100) and found 7 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does cairntir need?
No credential environment variables were found in its source, so it appears to need none.
How does cairntir run?
It speaks stdio, so it runs as a local process your client starts. It is published on PyPI as cairntir.
How current is this page?
The grade is for one exact copy of the source (ac3c74d2360d), read on 2026-10-11. The repository is watched and re-audited when it changes.