create-ai-memoryCAUTION
Persistent, agent-agnostic session memory for AI coding CLIs (Claude Code, Codex, Gemini, Cursor, opencode). One Markdown vault, any agent.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
The persistent memory layer for AI coding agents. One Markdown vault, every CLI.
Your agent forgets everything the moment a session ends. create-ai-memory gives Claude Code, Codex, Gemini, Cursor, and opencode a shared second brain: a plain-Markdown vault that carries your profile, each project's context, and where you left off into every new session, on its own.
No daemon. No database. No API key. Just zsh and Markdown you can read.
npm create ai-memory@latest
[](https://www.npmjs.com/package/create-ai-memory) [](https://github.com/rambaarde/create-ai-memory/actions/workflows/ci.yml) [](https://github.com/rambaarde/create-ai-memory/actions/workflows/publish.yml)
The problem
Every AI coding session starts from zero. The moment a thread ends, the agent forgets what was built, why each choice was made, and where you left off.
You pay it again on the next run: re-explaining the stack, re-litigating settled decisions, losing "where I was". Switching agents makes it worse — each CLI is its own island, so what Claude learned never reaches Codex.
How it works
Keep the memory outside the chat, in plain Markdown on disk, and inject it into whichever agent you launch. A thread is disposable; the vault
bc3185997954OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add create-ai-memory -- npx -y [email protected]
{
"mcpServers": {
"create-ai-memory": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (6)
4 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
add_lesson | write | Record a problem and its solution as a cross-project lesson. Use only for something that will matter in a different project. |
add_note | write | Append a timestamped note to today\ |
get_context | read | REQUIRED FIRST ACTION. Returns the user\ |
open_graph | read | Open the vault as a browsable graph in the user\ |
read_note | read | Read one vault note by path. |
search_memory | read | Search all past sessions, project notes and lessons. Literal, case-insensitive, newest first. |
Trust audit
CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (3 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (12)
return { ok: true, text: 'Opened the memory graph at http://127.0.0.1:' + port + ' (a browser tab should be opening).' };const url = 'http://127.0.0.1:' + server.address().port;
const url = 'http://127.0.0.1:' + PORT;
.release-please-manifest.json
const md = new Function("nodes", escSrc + mdSrc + "; return md;")([]);ai-lesson "../../etc/evil" "problem" "should not escape the vault" >/dev/null
NOTE_BAD="$(curl -s "http://127.0.0.1:$GPORT/api/note?path=../../../etc/passwd" 2>/dev/null)"
print -r -- '{"jsonrpc":"2.0","id":5,"method":"tools/call","params":{"name":"read_note","arguments":{"path":"../../../etc/passwd"}}}'print -rl -- "---" "mirror_of: ../../../etc/hosts" "---" "content survives" > "$MIRRORVAULT/escape.md"
ai-mem-ingest --source-id "../../etc/evil" --title "t" --date "d" >/dev/null
ai-mem-serve # opens a browser at http://127.0.0.1:7777
curl -sf -o /dev/null "http://127.0.0.1:$GPORT/api/graph" 2>/dev/null && break
Gates applied: no_behavioural_pass.
bc3185997954full audit observations/trust-audit/mcp-server/rambaarde__create-ai-memory.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | bc3185997954 | CAUTION | B | 89 | first audit |
Questions
What is the create-ai-memory MCP server?
Persistent, agent-agnostic session memory for AI coding CLIs (Claude Code, Codex, Gemini, Cursor, opencode). One Markdown vault, any agent.
What tools does create-ai-memory expose?
6 in total: 4 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is create-ai-memory safe to connect to an agent?
With care. The audit graded it B (89/100) and found 12 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does create-ai-memory need?
No credential environment variables were found in its source, so it appears to need none.
How current is this page?
The grade is for one exact copy of the source (bc3185997954), read on 2026-10-11. The repository is watched and re-audited when it changes.