ZettelForgeBLOCK
Agentic memory for CTI in Python — STIX knowledge graphs, threat-actor alias resolution, offline-first RAG, MCP server for Claude Code and LangChain agents
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
The only agentic memory system built for cyber threat intelligence.
When a senior analyst leaves, two or three years of context walks out with them — customer environments, prior investigations, actor TTPs, false-positive patterns, every hard-won "wait, we've seen this before." ZettelForge is an agentic memory system built so that context stays with the team.
It extracts CVEs, threat actors, IOCs, and ATT&CK techniques from analyst notes and threat reports, resolves aliases (APT28 = Fancy Bear = STRONTIUM = Sofacy), builds a STIX 2.1 knowledge graph, and serves every past investigation back to your analysts — and to Claude Code via MCP — in natural language. Runs entirely in-process. No API keys. No cloud. No data leaves the host.
[](https://pypi.org/project/zettelforge/) [](https://pepy.tech/projects/zettelforge) [](https://star-history.com/#rolandpg/zettelforge&Date) [](https://www.python.org/downloads/) [](https://opensource.org/licenses/MIT) [](https://github.com/rolandpg/zettelforge/actions) [](https://github.com/rolandpg/zettelforge/issues) [](https://deepwiki.com/ThreatRecall/zettelforge)
**Star · `pip install zettelforge` · Docs ·
46594f0ec11bOBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add zettelforge -- None zettelforge==2.4.0
Trust audit
BLOCKgrade D · trust 66/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (8 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- found
Findings (25)
| Role rewrite | "you are now", "developer mode", jailbreak framing |
Neuropol.otf
r"\b(reveal|print|dump|show|exfiltrate|leak|return)\b.{0,80}"# url: http://127.0.0.1:11434
# url: http://127.0.0.1:11434
url: http://127.0.0.1:11434
# url: http://127.0.0.1:11434
# url: http://127.0.0.1:11434
secret = "SECRET_CONTENT_DO_NOT_LEAK"
Neuropol.otf
h = int(hashlib.md5(text.encode()).hexdigest(), 16)
key = (hashlib.sha1(text.encode(), usedforsecurity=False).hexdigest(), int(ngram_size))
"query_id": hashlib.md5(query.encode(), usedforsecurity=False).hexdigest()[:12],
h = int(hashlib.md5(text.encode(), usedforsecurity=False).hexdigest(), 16)
"content": """Scattered Spider (also known as UNC3944 or Octo Tempest) is a financially motivated threat group known for social engineering attacks against large enterprises. The group specializes in
s.src = 'https://static.cloudflareinsights.com/beacon.min.js';
s.setAttribute('data-cf-beacon', '{"token": "7740fa0d6ecf41abb3c7bc06803e7ed3"}');title="Cobalt Strike Beacon",
| Instruction override | "ignore previous instructions", "override system rules" |
- suspicious instruction phrases such as "ignore previous", "system prompt",
# A-MEM Benchmark Report\n\n## Ingestion Performance\n- A-MEM: 7.037s\n- Naive Vector Memory: 0.007s\n\n## Query Performance\n\n### Query: What malware does APT28 use?\n**Expected Logic:** APT28 is Fa
**Operational impact.** Causal extraction at 8000 tokens runs 60–140 s per call on a 9B-Q4_K_M reasoning model; `remember(sync=True)` therefore blocks 1–3 minutes per note. The default async path (bac
**14 config sections** exist: `storage` (data directory), `typedb` (Enterprise TypeDB connection parameters), `backend` (community default: sqlite), `embedding` (vector model and server), `llm` (langu
benchmarks/enterprise-attack.json
Gates applied: instruction_override, no_behavioural_pass.
46594f0ec11bfull audit observations/trust-audit/mcp-server/threatrecall__zettelforge-1.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | 46594f0ec11b | BLOCK | D | 66 | first audit |
Questions
What is the ZettelForge MCP server?
Agentic memory for CTI in Python — STIX knowledge graphs, threat-actor alias resolution, offline-first RAG, MCP server for Claude Code and LangChain agents
Is ZettelForge safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (66/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does ZettelForge need?
It reads OPENCTI_TOKEN, THREATENGRAM_LICENSE_KEY, TYPEDB_PASSWORD, ZETTELFORGE_LLM_API_KEY and ZETTELFORGE_WEB_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does ZettelForge run?
It speaks stdio, so it runs as a local process your client starts. It is published on PyPI as zettelforge.
How current is this page?
The grade is for one exact copy of the source (46594f0ec11b), read on 2026-10-08. The repository is watched and re-audited when it changes.