signetaiBLOCK
Sync and store memories, shared identity files (AGENTS.md, CLAUDE.md), session transcripts, institutional knowledge, and secrets between all of your favorite harnesses and models.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Signet gives your AI agents a shared memory. You can use it to store, sync, and share memories, system prompts, transcripts, institutional knowledge, and secrets across all the AI tools and models you use.
Quick start · How it works · Harnesses · Docs · Discord
English · Deutsch · 한국어 · 简体中文 · 日本語
Signet creates memories automatically from your transcripts, imported files, and other sources. In the background, a process called "dreaming" builds and maintains a structured map of the people, projects, facts, and relationships in your history. Every connection links back to its source, so you can see where it came from.
If you switch models or agent tools, Signet brings your context with you. Your agent gets what's relevant before the next prompt begins, and it can trace the memory back to the raw source when it needs more details. You can run Signet on your own machine or as a server for your team.
Quick start
Pick one installation method. They all install the same compiled Signe
01d6db0c218dOBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add signet-reviews-worker --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env GOOGLE_API_KEY=${GOOGLE_API_KEY} --env HEADLESS_KEY=${HEADLESS_KEY} --env MEM0_API_KEY=${MEM0_API_KEY} -- npx -y [email protected]{
"mcpServers": {
"signet-reviews-worker": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
"GOOGLE_API_KEY": "${GOOGLE_API_KEY}",
"HEADLESS_KEY": "${HEADLESS_KEY}",
"MEM0_API_KEY": "${MEM0_API_KEY}"
}
}
}
}Exposed tools (20)
15 read · 3 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
Ada | read | coding assistant |
Obsidian | read | Connect a vault of notes |
astro-portfolio-site | read | Build Astro portfolio websites from brand assets. |
changelog-writer | read | Draft release notes from merged pull requests. Use when preparing a release or summarizing a sprint. |
custom | write | User-selected startup files and explicit order. |
hermes | read | Hermes-style SOUL.md primary identity with project-context discovery handled by Hermes. |
meeting-notes | read | Turn a meeting transcript into decisions, owners, and follow-ups. |
memory_forget | destructive | Forget a memory by ID (soft-delete) |
memory_modify | write | Modify an existing memory by ID |
memory_search | read | Search the agent |
memory_store | read | Store information in the agent |
minimal | read | AGENTS.md only for normal startup, plus DREAMING.md for dreaming sessions. |
openclaw | read | OpenClaw-style rich identity stack for character-forward agents. |
recipe-scaler | read | Scale a recipe to a new serving count and convert units. |
research-brief | write | Collect sources on a question and write a short, cited brief. Use for quick literature scans. |
sessions_spawn | read | Spawn a new session |
shared-skill | read | same metadata |
signet_code_briefing | read | |
signet_code_clear | destructive | |
source-native-skill | read | A skill that ships its own SKILL.md frontmatter. |
Trust audit
BLOCKgrade F · trust 26/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (10 observation(s))
- Network
- declared (14 observation(s))
- Shell
- declared (10 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
exec(sql: string): void;
exec(sql: string): void;
exec(sql: string): void;
exec(sql: string): void;
exec(sql: string): void;
{ ...process.env } ... curlhost === "metadata.google.internal" ||
- Never read credentials out of a user's own Signet install (`~/.agents`) or copy its secrets store into a bench workspace.
> temporary working directory and may update your user PATH. It never writes
hero-bg.avif
icon.icns
UI01.avif
UI02.avif
UI03.avif
.claude/skills
console.log(token);
console.log(chalk.yellow(`\n Secret "${chalk.bold(name)}" exists, but values are never exposed directly.`));console.log(` signet secret exec --secret ${name} "your-command-here"\n`);console.log(` api_key: $secret:${name}\n`);console.log(`Secret exec queued: ${chalk.cyan(jobId ?? "unknown")}`);const base = `http://127.0.0.1:${port}`;3. Run the dashboard with `SIGNET_DAEMON_URL=http://127.0.0.1:3851 bun run dev` in `surfaces/dashboard`.
const res = await fetch(`http://127.0.0.1:${port}/health`, {["anthropic sk-ant-api03-abcdefghijklmnopqrstuvwxyz rotated", "provider_key"],
const secret = "config-redaction-sentinel";
Gates applied: no_behavioural_pass.
01d6db0c218dfull audit observations/trust-audit/mcp-server/signet-ai__signetai.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 01d6db0c218d | BLOCK | F | 26 | first audit |
Questions
What is the signetai MCP server?
Sync and store memories, shared identity files (AGENTS.md, CLAUDE.md), session transcripts, institutional knowledge, and secrets between all of your favorite harnesses and models.
What tools does signetai expose?
20 in total: 15 read-only, 3 that write, and 2 that can delete or overwrite (memory_forget, signet_code_clear). Every one is listed on this page with its risk.
Is signetai safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (26/100) and found 9 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does signetai need?
It reads ANTHROPIC_API_KEY, GOOGLE_API_KEY, HEADLESS_KEY, MEM0_API_KEY, OFFLINE_KEY, OPENAI_API_KEY, OPENROUTER_API_KEY, SHORT_KEY, SIGNET_ADMIN_PASSWORD, SIGNET_API_KEY, SIGNET_API_KEYS_SECTION_CHILD and SIGNET_BENCH_DREAMING_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does signetai run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as signet-reviews-worker at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (01d6db0c218d), read on 2026-10-12. The repository is watched and re-audited when it changes.