m3-memoryBLOCK
Local-first Memory Framework for AI Agents · 99.2% LongMemEval-S retrieval @ k=10 · Supports Claude · Antigravity · LangChain · Hermes · Gemini · OpenCode · OpenClaw · MCP-native and plugins · Hybrid search (FTS5 + vector + MMR) · GDPR · FIPS 140-3 ready · 100% local (fully offline) or cloud capable
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A memory layer that outlives your agents. You switch from Claude Code to Cursor, upgrade your model, start fresh next week — and everything your tools learned about your project is gone. You re-explain the same decisions, the same preferences, the same hard-won context, over and over.
m3 fixes that. It's a private, local-first memory your agents share and build on — so your project's knowledge accumulates instead of resetting every time the agent does. One memory store, on your machine, that your tools and agents read from and write to — whether that's Claude Code, Cursor, Gemini CLI, or any MCP-compatible agent.
Building something yourself? m3 is a memory backend, not a framework, and MCP is optional — every tool is a JSON-in/JSON-out CLI call, scriptable from any language, hook or CI job. Jump to the developer section ↓
Under the hood, m3 treats agent memory as a distributed-systems infrastructure problem, not a simple retrieval feature — a shared, evolving, bitemporal, contradiction-aware knowledge base that multiple heterogeneous agents and machines read and write, built to stay consistent over months and years.
The memory improves without being asked. m3 is not only a store you write to and read back. An autonomous Cognitive Loop (m3_cognitive_loop.py) runs in the background and keeps working on what you already saved: deferred enrichment — classification, embedding, and entity extraction — runs off the hot path, so a write stays fast while the understanding of it deepens afterwards, and the loop builds an entity relationship graph from memories that arrived as plain text. Curation is m3's own work, not an LLM's. Near-duplicate detection is cosine similarity over emb
87e4e7388898OBSERVED · 2026-10-09Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add m3-memory -- python m3-memory==2026.10.7.1
Exposed tools (27)
19 read · 6 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
files_corpus_create | write | Register a new corpus with optional default overrides. |
files_corpus_delete | destructive | Delete a corpus |
files_corpus_get | read | Fetch a single corpus |
files_corpus_list | read | Enumerate corpora with row counts. |
files_corpus_set | write | Update settings for an existing corpus. None args are no-ops. |
files_dedup | read | Scan leaf embeddings for near-duplicates. Detection only — |
files_dedup_list | read | List near-duplicate candidate pairs with text snippets and paths. |
files_dedup_review | read | Record a review decision: |
files_entity_coalesce | read | Detect provisional-entity coalescing candidates (quarantine noise + |
files_entity_coalesce_apply | write | Apply the reversible same_as/cluster overlay. Union of explicit |
files_entity_coalesce_list | read | List entity-coalescing candidate pairs (name + score + band). |
files_entity_coalesce_review | read | Record review decisions in BULK: pass a list of {uuid, action} where |
files_entity_coalesce_unapply | destructive | Reverse one coalescence cluster (drop edges, clear flags, strip |
files_extract_pending | read | Drain leaves with extraction_status= |
files_get | read | Fetch one record by UUID. Tries file_nodes then leaves. |
files_health | write | DB integrity + FTS5 sync check. Set rebuild=True to fix drift. |
files_index | read | Return file-level summaries for triage. |
files_ingest | read | Walk a directory and ingest supported files into files.db. |
files_link_rename | write | Re-point an existing file_node at a new path (rename / move). |
files_promotable | read | List top promotion candidates by usage-weighted heuristic score. |
files_promote | read | Promote (ascend) a fact / leaf / file_summary from files.db to |
files_promotion_list | read | List existing promotions. source_superseded=True surfaces |
files_search | read | Hybrid FTS5 + vector search over leaves. |
files_staleness_review | read | Compare filesystem against files.db. Surfaces stale, touched-only, |
files_stats | read | Corpus-level counters: file_nodes, leaves, embed coverage. |
files_watch_once | read | Single-pass staleness check + notification dispatch. Suitable |
save_handoff | write | Saves the current AI session state for another agent to resume. |
Trust audit
BLOCKgrade F · trust 28/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (16 observation(s))
- Network
- declared (8 observation(s))
- Shell
- declared (7 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
result = scrub("sk-ant-foobar12345678901234567890", cfg_off)assert result == ("sk-ant-foobar12345678901234567890", 0, [])"here is sk-ant-api03-ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890 keep it safe",
exec(src, ns) # nosec B102 - src is built from static ToolSpec catalog, not user input
exec(code, {"__file__": str(bridge), "__name__": "__main__"}) # nosec B102os.environ.copy() ... socket.create_connection
M3_DATABASE=postgresql://u:p@host:5432/agent_memory
If your host agent ships with a built-in memory system — Claude Code's auto-memory (flat `.md` files under `.claude/projects/*/memory/` with a `MEMORY.md` index), a proprietary scratchpad, or any othe
mod = importlib.import_module(self.module_name)
importlib.import_module(module_name)
val = importlib.import_module(f"memory.{real_sub}")val = getattr(importlib.import_module(mod_name), "sha256_hex")
val = getattr(importlib.import_module(mod_name), name)
print(f" http://{display_host}:{resolved_port}/?token={token}\n")print(f" {token}\n")print(f" Value : Bearer {token}")#M3_EMBED_FALLBACK_URL=http://127.0.0.1:8082 # tier-2 CPU HTTP embed service
"sk-ant-api03-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 and the CI token is "
content = "My key is sk-ant-abc123def456xyz789ab"
M3_PRIMARY_PG_URL: postgresql://m3dev:m3devpass@localhost:5432/m3_citest
M3_PRIMARY_PG_URL: postgresql://m3dev:m3devpass@localhost:5432/m3_citest
M3_PRIMARY_PG_URL: postgresql://m3dev:m3devpass@localhost:5432/m3_citest
M3_PRIMARY_PG_URL: postgresql://m3dev:m3devpass@localhost:5432/m3_citest
secret = "super-secret-token-value-0123456789abc"
content = "Token: ghp_abcdefghijklmnopqrstuvwxyz1234"
Gates applied: critical_finding, instruction_override, no_behavioural_pass.
87e4e7388898full audit observations/trust-audit/mcp-server/skynetcmd__m3-memory.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-09 | 87e4e7388898 | BLOCK | F | 28 | first audit |
Questions
What is the m3-memory MCP server?
Local-first Memory Framework for AI Agents · 99.2% LongMemEval-S retrieval @ k=10 · Supports Claude · Antigravity · LangChain · Hermes · Gemini · OpenCode · OpenClaw · MCP-native and plugins · Hybrid search (FTS5 + vector + MMR) · GDPR · FIPS 140-3 ready · 100% local (fully offline) or cloud capable
What tools does m3-memory expose?
27 in total: 19 read-only, 6 that write, and 2 that can delete or overwrite (files_corpus_delete, files_entity_coalesce_unapply). Every one is listed on this page with its risk.
Is m3-memory safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (28/100) and found 8 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does m3-memory need?
It reads AGENT_OS_MASTER_KEY, ANTHROPIC_API_KEY, DD_PASSWORD, DD_TOKEN, GEMINI_API_KEY, GH_TOKEN, GITHUB_TOKEN, GROK_API_KEY, LM_API_TOKEN, LM_STUDIO_API_KEY, M3_BYPASS_SURFACE_CAP and M3_CLOUD_AUTH_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does m3-memory run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as frontend at 0.0.0.
How current is this page?
The grade is for one exact copy of the source (87e4e7388898), read on 2026-10-09. The repository is watched and re-audited when it changes.