memexBLOCK
Persistent memory for AI coding agents via MCP: a bitemporal knowledge graph of your codebase, served to Claude Code, Cursor, Gemini CLI, and any MCP client. Tree-sitter and Gemini Flash into Neo4j via Graphiti. 14 MCP tools, hierarchical clusters, three-regime confidence decay.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Keeps your AI coding agents' engineering context current as the code changes. memex builds a bitemporal knowledge graph of your repository (modules, symbols, decisions, problems, evidence, and code evolution). In v1 it also hooks into Claude Code and Codex: each session starts with the right context, each edit is checked against the current code, and the agent is told exactly what changed.
[memex.stifler.in](https://memex.stifler.in)
A daemon, hook service and MCP server that turn commits and file changes into structured engineering knowledge and deliver it to agents with freshness and provenance preserved, without making memex a source of personal memory or raw session state.
[](https://memex.stifler.in) [](https://pypi.org/project/memex-mcp/) [](https://pypistats.org/packages/memex-mcp) [](https://www.npmjs.com/package/stifler-memex-mcp) [](https://www.npmjs.com/package/stifler-memex-mcp) [](https://github.com/STiFLeR7/claude-plugins) [](https://glama.ai/mcp/servers/STiFLeR7/memex) [](https://github.com/STiFLeR7/memex/stargazers) [](https://github.com/STiFLeR7/memex/actions/workflows/ci.yml) [](
5869b5c83529OBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add stifler-memex-mcp --env NEO4J_PASSWORD=${NEO4J_PASSWORD} --env GEMINI_API_KEY=${GEMINI_API_KEY} --env NEO4J_PASSWORD=${NEO4J_PASSWORD} --env GEMINI_API_KEY=${GEMINI_API_KEY} -- npx -y [email protected] serve .claude mcp add memex-mcp --env NEO4J_PASSWORD=${NEO4J_PASSWORD} --env GEMINI_API_KEY=${GEMINI_API_KEY} --env NEO4J_PASSWORD=${NEO4J_PASSWORD} --env GEMINI_API_KEY=${GEMINI_API_KEY} -- uvx memex-mcp==1.0.2 serve .Exposed tools (16)
13 read · 3 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
echo_principal | read | Echoes the ambient principal_ctx principal_id |
explain_change | write | Cross-references a git commit |
get_engineering_context | read | Returns a bounded, provenance-aware engineering ContextPacket projection using the shared memex selector. |
get_open_problems | read | Returns currently open technical problems and TODOs sorted by severity as a Markdown string. |
get_project_context | read | Returns a compressed briefing of the project as a Markdown string: active modules, recent decisions, and open problems. |
get_recent_decisions | read | Returns architectural and technical decisions from the past N days as a Markdown string. |
get_stale_context | read | Returns relationships that have decayed in confidence and may be outdated as a Markdown string. |
get_symbol_context | read | Returns detailed information about a specific function or class as a Markdown string including callers/callees. |
guard_read | write | Read a worktree file and the sha256 a guarded write must expect. |
guard_write | write | Apply file changes as one fenced commit, or refuse and change nothing. |
invalidate_edge | read | Explicitly invalidates a graph edge when it is discovered to be stale or incorrect. Returns a status string. |
predict_impact | read | Returns a ranked Markdown list of modules likely affected by changes to a file, based on graph coupling (calls + imports + decision links). No LLM call. |
record_decision | read | Creates a Decision node in the graph. Call this when making or discovering architectural choices. Returns a status string. Phase 9: pass corroborates=<id> to reinforce, supersedes=<id> to replace, or force=true to bypass duplicate detection. |
record_problem | read | Creates a Problem node in the graph. Call this when discovering bugs or technical debt. Returns a status string. |
resolve_problem | read | Marks a Problem as closed and records the resolution. Returns a status string. |
search_context | read | Semantic + keyword + graph traversal search across all node types. Use for broad discovery. Returns a Markdown string. |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (6 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
return str(v).replace('\x00', '').replace('', '')return val.replace('\x00', '').replace('', '')[:2000].coverage
f"http://127.0.0.1:{port}/notify",_candidate(summary="Use token=ghp_abcdefghijklmnopqrstuvwxyz1234567890"),
"ref": "token=ghp_abcdefghijklmnopqrstuvwxyz1234567890",
.coverage
.vscodeignore
repo_hash = hashlib.md5(repo_path.encode()).hexdigest()[:8]
"../../etc/passwd",
"/report?repo=../../../../etc",
validate_memory_path("/memories/scratch/../../etc/passwd")assert called_req.full_url == "http://127.0.0.1:8899/notify"
return json.loads(zlib.decompress(base64.b64decode(text)))
@types/node, @types/react, @types/react-dom, eslint, typescript, wrangler
@types/vscode, @types/node, typescript, esbuild
Untrusted hooks do not run in app-server threads. memex never writes hook trust: a user trusts its hooks through Codex's own `/hooks` review. The two hosts' state is namespaced, so identical native se
The fixture environment variable names are inherited deliberately so all three phases share one isolated server. The fabricated Neo4j and Gemini values exist only to let legacy configuration construct
assets/brand/memex-brand-board.jpg
assets/memex-v1.mp4
memex-site/public/memex-v1.mp4
cat > .env <<'ENV'
cat > .env <<EOF
**Goal:** Add a FastAPI-based SSE transport for remote team access with named API keys.
cat > .env <<EOF
Gates applied: no_behavioural_pass.
5869b5c83529full audit observations/trust-audit/mcp-server/stifler7__memex.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | 5869b5c83529 | BLOCK | D | 69 | first audit |
Questions
What is the memex MCP server?
Persistent memory for AI coding agents via MCP: a bitemporal knowledge graph of your codebase, served to Claude Code, Cursor, Gemini CLI, and any MCP client. Tree-sitter and Gemini Flash into Neo4j via Graphiti. 14 MCP tools, hierarchical clusters, three-regime confidence decay.
What tools does memex expose?
16 in total: 13 read-only, 3 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is memex safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does memex need?
It reads GEMINI_API_KEY, MEMEX_LLM_API_KEY, MEMEX_SESSION_SECRET, NEO4J_PASSWORD, NVIDIA_API_KEY and NVIDIA_NIM_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does memex run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as stifler-memex-mcp at 1.0.2.
How current is this page?
The grade is for one exact copy of the source (5869b5c83529), read on 2026-10-10. The repository is watched and re-audited when it changes.