engramBLOCK
Engram - file-system-based memory management system for AI agents that grows with you & your teams, across agents, projects, and devices.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](LICENSE) [](https://github.com/the-long-ride/engram) [](https://the-long-ride.github.io/engram/) [](https://www.npmjs.com/package/@the-long-ride/engram)
Engram is a human-owned, file-first memory protocol for AI agents. Grow with you & your teams.
It gives agents memory without giving agents ownership of memory. Durable rules, workflows, and project knowledge live as plain Markdown, reviewed by humans, portable through Git, and usable by any agent.
Full documentation lives on the website: @the-long-ride/engram docs-site
Key Highlights
- Human in the Loop: Direct CLI saves use A/B/C approval. AI-agent chat saves use an exact-candidate
yes/audit/cancelloop before the agent writes withsave-session --force. Every candidate preview carries one deterministicVerdict:line (ADD,UPDATE,SUPERSEDE, orNOOP duplicate of); aSUPERSEDEis applied only after interactive approval, never by--forceor autosave. - Partial Force Safety:
save-session --forcesaves unrelated ready candidates, but defers candidates that need dependency or duplicate review with ID-onlyengram load --id ...guidance. - Context-Optimized: Routes meaningful task matches plus prerequisites into a compact pack (default: 8 files) to avoid context bloat.
- Tiered Load Disclosure: Agents get the top
load.expand_tophits (default 3) as bodies and every other selected hit plus up to 5 omitted candidates as one-line cards, followed byfetch: engram load --id. Fron
fa5c66aa979dOBSERVED · 2026-10-13Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add image-size --env GIT_CONFIG_KEY_0=${GIT_CONFIG_KEY_0} --env GIT_CONFIG_KEY_1=${GIT_CONFIG_KEY_1} -- npx -y [email protected]{
"mcpServers": {
"image-size": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"GIT_CONFIG_KEY_0": "${GIT_CONFIG_KEY_0}",
"GIT_CONFIG_KEY_1": "${GIT_CONFIG_KEY_1}"
}
}
}
}Exposed tools (12)
8 read · 4 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
engram | read | A skill. |
engram_load | read | Load routed Engram memory for the current task or query. Text is the agent pack; structured data lists selected_keys, body_keys, card_ids, omitted_ids, and tokens. |
engram_route | read | Preview which Engram memories match a query: task classification plus routed entries (id, type, scope, score) in load order, not sorted by score. |
engram_save | write | Preview a human-approved Engram memory save proposal. Does not write silently; returns an approval_token for engram_commit. |
engram_save_session | write | Preview multiple human-approved Engram memory save proposals. Does not write silently; returns an approval_token for engram_commit. |
engram_search | read | Search Engram memory; structured entries carry id, type, scope, and score. |
engram_set_role | write | Set active Engram role filters. |
engram_set_rule_variant | write | Set active Engram rule strictness variant. |
engram_status | read | Show Engram memory health and status. |
engram_verify | read | Verify Engram memory integrity. |
index | read | One-line cards for every visible durable memory. |
memory | read | Agent body of one Engram memory (same text as engram load --id). |
Trust audit
BLOCKgrade F · trust 43/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | FAIL |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (11 observation(s))
- Network
- declared (6 observation(s))
- Shell
- declared (9 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
payload-plan.ts
const dynamicImport = new Function('specifier', 'return import(specifier);') as (specifier: string) => Promise<any>;const dynamicImport = new Function('specifier', 'return import(specifier);') as (specifier: string) => Promise<any>;const dynamicImport = new Function('specifier', 'return import(specifier);') as (specifier: string) => Promise<any>;const dynamicImport = new Function('specifier', 'return import(specifier)') as (specifier: string) => Promise<MarkdownThemModule>;const dynamicImport = new Function('specifier', 'return import(specifier);') as (specifier: string) => Promise<any>;'.npmrc', '.pypirc', '.netrc', '.pgpass', '.git-credentials', '.htpasswd', '.dockercfg', 'credentials', 'kubeconfig',
'id_rsa', 'id_dsa', 'id_ecdsa', 'id_ed25519', 'secrets.json', 'secrets.yaml', 'secrets.yml', 'secrets.toml'
'http://127.0.0.1:' + port,
srv.listen(port, '127.0.0.1', () => resolve('http://127.0.0.1:' + port));const source = text.replace(/^/, '');
const BOM = '';
return JSON.parse(stripTrailingCommas(stripJsonComments(text.replace(/^/u, '')))) as T;
'Local database: postgres://admin:S3cretPwLocal@localhost:5432/app',
'Connect with postgres://admin:S3cretPwLocal@localhost:5432/app for local work.',
const SECRET = 'sk-live-FRESHNESS0123456789abcdef';
const SECRET = 'hunter2-fixture-secret';
.nojekyll
'.git-credentials', 'infra/prod.tfvars', 'infra/prod.tfvars.json', 'credentials.json', 'gcp-credentials-dev.json',
'secrets.toml', '.htpasswd', 'keys/putty.ppk', 'kubeconfig', '.kube/config', '.dockercfg', '.pgpass', '.netrc',
return fs.readFile(path.resolve(binDir, '../../llm.txt'), 'utf8');
import { loadForAgentWithContext } from '../../commands/read.js';import { isConvertibleDocument } from '../../integrations/markdown-them.js';import { parseFrontmatter } from '../../memory/frontmatter.js';import { loadForAgentWithContext } from '../../commands/read.js';Gates applied: no_behavioural_pass.
fa5c66aa979dfull audit observations/trust-audit/mcp-server/the-long-ride__engram.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-13 | fa5c66aa979d | BLOCK | F | 43 | first audit |
Questions
What is the engram MCP server?
Engram - file-system-based memory management system for AI agents that grows with you & your teams, across agents, projects, and devices.
What tools does engram expose?
12 in total: 8 read-only, 4 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is engram safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (43/100) and found 8 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does engram need?
It reads GIT_CONFIG_KEY_0 and GIT_CONFIG_KEY_1 from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (fa5c66aa979d), read on 2026-10-13. The repository is watched and re-audited when it changes.