open-memexBLOCK
Local-first memory layer for AI coding agents — Markdown as source of truth, MCP server + CLI, human-reviewed capture, team knowledge via git PRs.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Persistent memory for your AI coding agents — on your machine, in plain Markdown, shared by every tool you code with.
[](https://www.npmjs.com/package/open-memex) [](./LICENSE) [](https://glama.ai/mcp/servers/stoneskin/open-memex)
中文文档
Every AI coding session starts from zero: you re-explain the project, the agent rediscovers the same gotchas, and yesterday's decisions vanish when the chat ends. open-memex gives your agents a memory that survives the session. Say "remember: we deploy on Fridays" once, and next week Copilot, Cursor, opencode, or Claude Code already knows — because they all read and write the same local memory on your machine.
- Free and open source (Apache-2.0). No account, no cloud, no telemetry —
everything lives on your machine, in files you can open and edit.
- Local-first: memories are plain Markdown files (the source of truth) with
a rebuildable SQLite keyword index. Nothing leaves your machine unless you explicitly share it.
- One memory, every agent: wire up several editors with one command; they
share the same memory instead of keeping separate silos.
- Precise synonym search:
shipfindsdeploy,单点登录findsSSO—
a curated multilingual map of equivalents is indexed with every memory at write time, so no related wording misses the right answer. Deterministic and auditable, no embedding model required.
New here? This README takes you from install to a working memory in about a minute. The concept guide explains the mental model in depth once you're up and runn
fe70a845cf10OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add open-memex -- npx -y [email protected] mcp
Exposed tools (11)
9 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
memory_add | write | |
memory_forget | read | |
memory_list | read | |
memory_pr_status | read | |
memory_promote | read | |
memory_propose | read | |
memory_resolve | read | |
memory_search | read | |
memory_status | read | |
memory_submit | write | |
memory_supersede | read |
Trust audit
BLOCKgrade D · trust 62/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (6 observation(s))
- Network
- declared (3 observation(s))
- Shell
- declared (3 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (15)
["aws-access-key-id", "id=AKIA1234567890ABCDEF"],
["github-oauth-token", "tok=gho_12345678901234567890123456789012"],
["github-fine-grained-pat", "tok=github_pat_1234567890123456789012345678901234567890"],
["private-key-block", "-----BEGIN RSA PRIVATE KEY-----\nQUJD\n-----END RSA PRIVATE KEY-----"],
["private-key-truncated", "-----BEGIN RSA PRIVATE KEY-----"],
["slack-token", "tok=xoxb-123456789012-abcdefghij"],
const rawFm = yaml.load(m[1]!) as Record<string, unknown>;
console.log(` secret hit: ${r.hadSecret ? `yes (${r.matchedPattern}) — will be masked` : "no"}`);console.log(`[open-memex] keyword capture masked secret (${matchedPattern})`);["generic-secret-assignment", 'password = "hunter2hunter2hunter2"'],
const r11 = redact('api_key = "supersecretvalue123456"', []);fs.writeFileSync(file, JSON.stringify({ memoryDir: "../../shared" }));@modelcontextprotocol/sdk, better-sqlite3, js-yaml, zod, @opencode-ai/plugin, @types/better-sqlite3, @types/js-yaml, @types/node
sync. The server also tells the agent on its own: at session start the
retires. Now: session start, server-reported drafts, or explicit "sync
Gates applied: critical_finding, no_behavioural_pass.
fe70a845cf10full audit observations/trust-audit/mcp-server/stoneskin__open-memex.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | fe70a845cf10 | BLOCK | D | 62 | first audit |
Questions
What is the open-memex MCP server?
Local-first memory layer for AI coding agents — Markdown as source of truth, MCP server + CLI, human-reviewed capture, team knowledge via git PRs.
What tools does open-memex expose?
11 in total: 9 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is open-memex safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (62/100) and found 7 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does open-memex need?
No credential environment variables were found in its source, so it appears to need none.
How does open-memex run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as open-memex at 0.8.1.
How current is this page?
The grade is for one exact copy of the source (fe70a845cf10), read on 2026-10-11. The repository is watched and re-audited when it changes.