Atlas / MCP servers / rohitg00 / Agentmemory

AgentmemoryBLOCK

Name: Agentmemory
Author: rohitg00

mcp/rohitg00/agentmemory

MCP server by rohitg00 · agentmemory · agents · ai · Audited 2026-10-12

⚑ Report / re-scan Source ↗

#1 Persistent memory for AI coding agents based on real-world benchmarks

Verdict

BLOCK

Grade

Trust score

38 /100

Exposed tools

64 43r · 18w · 3d

Transport

—

License

Apache-2.0

Stars

29,341

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Your coding agent remembers everything. No more re-explaining. Built on iii engine

Persistent memory for Claude Code, GitHub Copilot CLI, Cursor, Gemini CLI, Codex CLI, Hermes, OpenClaw, pi, OpenCode, and any MCP client.

🇬🇧 English • 🇨🇳 简体中文 • 🇹🇼 繁體中文 • 🇯🇵 日本語 • 🇰🇷 한국어 • 🇵🇹 Português • 🇧🇷 Português (Brasil) • 🇪🇸 Español • 🇩🇪 Deutsch • 🇫🇷 Français • 🇮🇹 Italiano • 🇳🇱 Nederlands • 🇵🇱 Polski • 🇨🇿 Čeština • 🇷🇴 Română • 🇭🇺 Magyar • 🇬🇷 Ελληνικά • 🇸🇪 Svenska • 🇩🇰 Dansk • 🇳🇴 Norsk • 🇫🇮 Suomi • 🇷🇺 Русский • 🇺🇦 Українська • 🇹🇷 Türkçe • 🇮🇱 עברית • 🇸🇦 العربية • 🇮🇳 हिन्दी • 🇧🇩 বাংলা • 🇵🇰 اردو •

Read from source at commit b7fcd1493b44OBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add agentmemory-website --env AGENTMEMORY_SECRET=${AGENTMEMORY_SECRET} --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env GEMINI_API_KEY=${GEMINI_API_KEY} --env GITHUB_TOKEN=${GITHUB_TOKEN} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "agentmemory-website": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "AGENTMEMORY_SECRET": "${AGENTMEMORY_SECRET}",
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "GEMINI_API_KEY": "${GEMINI_API_KEY}",
        "GITHUB_TOKEN": "${GITHUB_TOKEN}"
      }
    }
  }
}

Exposed tools (64)

43 read · 18 write · 3 destructive. Blast radius: 3 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`agentmemory`	read	Shared cross-session memory via the local agentmemory server.
`detect_patterns`	read	Detect recurring patterns across sessions for a project
`embed`	read	Deterministic fake OpenAI-compatible embeddings, LLM disabled, automatic compression off.
`embed-llm`	read	Fake embeddings plus a fake OpenAI-compatible chat model with AGENTMEMORY_AUTO_COMPRESS=true.
`keyless`	read	No provider keys. BM25 only, zero-LLM synthetic compression.
`memory_action_create`	write	Create an actionable work item with typed dependencies. Actions track what agents need to do and how work items relate to each other.
`memory_action_update`	write	Update an action
`memory_audit`	read	View the audit trail of memory operations.
`memory_checkpoint`	write	Create or resolve an external checkpoint (CI result, approval, deploy status) that gates action progress.
`memory_claude_bridge_sync`	write	Sync memory state to/from Claude Code
`memory_commit_lookup`	write	Look up the agent session(s) that produced a specific git commit, given its SHA. Returns the commit metadata and linked sessions.
`memory_commits`	read	List recent commits linked to agent sessions, optionally filtered by branch or repo.
`memory_compress_file`	read	Compress a markdown file to reduce token usage while preserving headings, URLs, and code blocks. Creates a .original.md backup before writing.
`memory_consolidate`	write	Run the 4-tier memory consolidation pipeline (working -> episodic -> semantic -> procedural).
`memory_crystallize`	read	Compress completed action chains into compact crystal digests using LLM summarization. Extracts narrative, key outcomes, files affected, and lessons.
`memory_diagnose`	write	Run health checks across all subsystems (actions, leases, sentinels, sketches, signals, sessions, memories, mesh). Identifies stuck, orphaned, and inconsistent state.
`memory_export`	read	Export all memory data as JSON.
`memory_facet_query`	read	Query targets by facet tags with AND/OR logic. Find all actions tagged priority:urgent AND team:backend.
`memory_facet_tag`	read	Attach a structured tag (dimension:value) to an action, memory, or observation for multi-dimensional categorization.
`memory_file_history`	read	Get past observations about specific files.
`memory_frontier`	read	Get all unblocked actions ranked by priority and urgency. Returns the frontier of actionable work with no unsatisfied dependencies.
`memory_governance_delete`	destructive	Delete specific memories with audit trail.
`memory_graph_query`	read	Query the knowledge graph for entities and relationships.
`memory_heal`	read	Auto-fix all fixable issues found by diagnostics. Unblocks stuck actions, expires stale leases, cleans up orphaned data.
`memory_insight_list`	write	List synthesized insights — higher-order observations derived from patterns across memories, lessons, and crystals.
`memory_lease`	read	Acquire, release, or renew an exclusive lease on an action. Prevents multiple agents from working on the same thing.
`memory_lesson_delete`	destructive	Soft-delete a lesson by id. Deleted lessons are excluded from recall and list; re-saving the same content creates a fresh lesson.
`memory_lesson_recall`	read	Search lessons by query. Returns lessons sorted by confidence and recency. Use to check what the agent has learned before making decisions.
`memory_lesson_save`	write	Save a lesson learned from this session. Lessons have confidence scores that strengthen when reinforced and decay when not used. Duplicate content auto-strengthens the existing lesson.
`memory_mesh_sync`	write	Sync memories and actions with peer agentmemory instances for multi-agent collaboration.
`memory_next`	read	Get the single most important next action to work on. Combines dependency resolution, priority, and recency into a score.
`memory_obsidian_export`	read	Export memories, lessons, and crystals as Obsidian-compatible Markdown files with YAML frontmatter and wikilinks for graph view.
`memory_patterns`	read	Detect recurring patterns across sessions.
`memory_profile`	read	User/project profile with top concepts and file patterns.
`memory_recall`	read	Search stored memories and session observations for relevant context. Use when you need to recall what happened in previous sessions, find past decisions, or look up how a file was modified before.
`memory_reflect`	read	Traverse the knowledge graph, group related memories by concept clusters, and synthesize higher-order insights via LLM. Returns new and reinforced insights.
`memory_relations`	read	Query the memory relationship graph.
`memory_routine_run`	write	Instantiate a frozen workflow routine, creating actions for each step with proper dependencies.
`memory_save`	write	Explicitly save an important insight, decision, or pattern to long-term memory.
`memory_sentinel_create`	write	Create an event-driven sentinel that watches for conditions (webhook, timer, threshold, pattern, approval) and auto-unblocks gated actions when triggered.
`memory_sentinel_trigger`	write	Externally fire a sentinel, providing an optional result payload. Unblocks any gated actions.
`memory_sessions`	read	List recent sessions with their status and observation counts.
`memory_signal_read`	read	Read messages for an agent. Marks delivered messages as read.
`memory_signal_send`	write	Send a message to another agent or broadcast. Supports threading, typed messages, and TTL expiration.
`memory_sketch_create`	write	Create an ephemeral action graph for exploratory work. Auto-expires after TTL. Can be promoted to permanent actions or discarded.
`memory_sketch_promote`	read	Promote a sketch
`memory_slot_append`	read	Append text to an existing slot. Fails with 413 if the append would exceed the slot
`memory_slot_create`	write	Create a new slot. Reject if a slot with the same label already exists.
`memory_slot_delete`	destructive	Delete a slot. Seeded default slots can be deleted unless marked readOnly.
`memory_slot_get`	read	Read a single slot by label.
`memory_slot_list`	read	List all memory slots (pinned + project + global). Slots are editable, size-limited memory units the agent can read and modify across sessions.
`memory_slot_replace`	read	Replace slot content in place. Fails if content exceeds sizeLimit.
`memory_smart_search`	read	Hybrid semantic+keyword search with progressive disclosure. Pass query to search, or expandIds to recover full results.
`memory_snapshot_create`	write	Create a git-versioned snapshot of current memory state.
`memory_team_feed`	read	Get recent shared items from all team members.
`memory_team_share`	read	Share a memory or observation with team members.
`memory_timeline`	read	Chronological observations around an anchor point.
`memory_verify`	read	Verify a memory or observation by tracing its citation chain back to source observations and session context. Returns provenance information including confidence scores.
`memory_vision_search`	read	Cross-modal image search via CLIP embeddings. Pass queryText to find screenshots matching a description, or queryImageBase64/queryImageRef to find similar images. Requires AGENTMEMORY_IMAGE_EMBEDDINGS=true.
`project`	read	Project path to analyze (optional)
`recall_context`	read	Search observations and memories to build context for a task
`session_handoff`	read	Generate a handoff summary for continuing work in a new session
`session_id`	read	Session ID to hand off from
`task_description`	read	What you are working on

Trust audit

BLOCKgrade F · trust 38/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (16 observation(s))
Network: declared (10 observation(s))
Shell: declared (5 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/functions/compress-file.ts:14

"id_rsa",

Why it matters. touches a credential store

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/functions/replay.ts:38

/(^|[\\/_.-])id_rsa([\\/_.-]|$)/i,

Why it matters. touches a credential store

HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319

src/functions/mesh.ts:25

if (ip === "169.254.169.254") return true;

Why it matters. cloud metadata endpoint: the classic SSRF credential grab

HIGHPrompt injection · prompt.credential_read · CWE-94, CWE-1427

plugin/skills/agentmemory-config/SKILL.md:27

Only the local secret is read from the daemon's `.env`; other settings are not

Why it matters. asks the agent to read credentials

HIGHPrompt injection · prompt.override · CWE-94, CWE-1427

READMEs/README.id-ID.md:586

Panel ready saat startup memperhitungkan keempat port: REST/MCP HTTP di 3111, stream iii di 3112, viewer di 3113, dan WebSocket worker iii di 49134. `status` mengonfirmasi kesehatan agentmemory dan mo

Why it matters. asks the agent to drop prior instructions or safety

Fix. remove the instruction

HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427

READMEs/README.bn-BD.md:1152

| `memory_frontier` | প্রায়োরিটি অনুযায়ী র্যাংকড আনব্লকড অ্যাকশন |

Why it matters. invisible characters in instruction text

Fix. strip non-printing characters

HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427

READMEs/README.bn-BD.md:1785

**অথেন্টিকেশন ডিফল্টভাবে চালু।** `AGENTMEMORY_SECRET` সেট না থাকলে (শেলে বা `~/.agentmemory/.env`-এ), সার্ভার প্রথম স্টার্টে একটি র্যান্ডম সিক্রেট জেনারেট করে এবং `0600` মোডে `~/.agentmemory/secret`-এ

Why it matters. invisible characters in instruction text

Fix. strip non-printing characters

MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319

eval/runner/lifecycle-fixture.ts:8

disposable: "The temporary kestrel beacon for the preview environment is lavender. Delete this diagnostic note after testing.",

MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319

eval/runner/lifecycle.ts:90

assert.ok((await search("kestrel beacon")).some((hit) => id(hit) === disposable.id));

MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319

eval/runner/lifecycle.ts:95

assert.ok((await search("kestrel beacon")).every((hit) => id(hit) !== disposable.id));

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

deploy/coolify/Dockerfile:34

CMD curl -fsS http://127.0.0.1:3111/agentmemory/livez || exit 1

MEDIUMHard-coded secrets · secret.anthropic · CWE-798, CWE-321

test/privacy.test.ts:16

expect(stripPrivateData("api_key=sk-ant-1234567890abcdefghij")).toBe(

MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321

test/engine-launch.test.ts:221

"Failed to connect to redis://user:s3cr3t@localhost:6379: connection refused",

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

test/codex-local-package.test.ts:12

const secret = "synthetic-review-secret";

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

test/observation-source.test.ts:98

const secret = "sk-proj-abcdefghijklmnopqrstuvwxyz0123456789";

MEDIUMHard-coded secrets · secret.github · CWE-798, CWE-321

test/privacy.test.ts:23

stripPrivateData("token: ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefgh"),

MEDIUMHard-coded secrets · secret.github · CWE-798, CWE-321

test/privacy.test.ts:29

stripPrivateData("found ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghij here"),

MEDIUMHard-coded secrets · secret.github · CWE-798, CWE-321

test/privacy.test.ts:67

stripPrivateData("ghs_1234567890abcdefghijklmnopqrstuvwxyzAB"),

MEDIUMHard-coded secrets · secret.github · CWE-798, CWE-321

test/privacy.test.ts:81

"sk-abcdefghijklmnopqrstuv and ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghij";

MEDIUMHard-coded secrets · secret.slack · CWE-798, CWE-321

test/privacy.test.ts:34

expect(stripPrivateData("xoxb-123456-789012-abcdef")).toBe(

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

memory_governance_delete, memory_lesson_delete, memory_slot_delete

Why it matters. 3 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.hidden_file · CWE-1104

plugin/.mcp.codex.json

.mcp.codex.json

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

plugin/.mcp.copilot.json

.mcp.copilot.json

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

test/antigravity-runtime.test.ts:64

const child = exec(

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

test/context-escaping.test.ts:137

const esc = new Function(`${source}\nreturn esc;`)() as (s: unknown) => string;

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

Gates applied: instruction_override, no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha b7fcd1493b44full audit observations/trust-audit/mcp-server/rohitg00__agentmemory.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-10-12	`b7fcd1493b44`	BLOCK	F	38	first audit

Questions

What is the @agentmemory/mcp MCP server?

#1 Persistent memory for AI coding agents based on real-world benchmarks

What tools does @agentmemory/mcp expose?

64 in total: 43 read-only, 18 that write, and 3 that can delete or overwrite (memory_governance_delete, memory_lesson_delete, memory_slot_delete). Every one is listed on this page with its risk.

Is @agentmemory/mcp safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (38/100) and found 7 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 3 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does @agentmemory/mcp need?

It reads AGENTMEMORY_SECRET, ANTHROPIC_API_KEY, GEMINI_API_KEY, GITHUB_TOKEN, MINIMAX_API_KEY and OPENAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How current is this page?

The grade is for one exact copy of the source (b7fcd1493b44), read on 2026-10-12. The repository is watched and re-audited when it changes.

Source	rohitg00/agentmemory
npm	`agentmemory-website@0.1.0`
Credentials it reads	`AGENTMEMORY_SECRETANTHROPIC_API_KEYGEMINI_API_KEYGITHUB_TOKENMINIMAX_API_KEYOPENAI_API_KEY`
License	Apache-2.0
Activity	pushed 0d ago