HiveMemSAFE
Personal knowledge system — MCP server with PostgreSQL semantic search and temporal knowledge graph
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Your second brain — and it stays yours. Forever. Local. A sovereign personal knowledge system. The conversations, decisions, documents, and half-formed thoughts you produce across Claude, ChatGPT, Gemini, Copilot — and the files you accumulate in real life — all come home to one place that outlives any vendor and obeys only you.
Why HiveMem exists
When you think hard today, you often think with an LLM in the loop. School, work, authorities, court cases, taxes, family, health, relationships — these conversations contain your most private thinking. More intimate than any diary.
And then they evaporate:
- Your subscription lapses or you switch providers → history gone
- The provider retires a model or rewrites their ToS → answers no longer reproducible
- An account ban, a provider going under, a country blocking the service → everything lost
- The data sits on a vendor's servers, fed into training, served on subpoena, exposed in the next breach
HiveMem is built around the opposite stance:
- Sovereignty — Your data lives in your instance. Postgres + SeaweedFS,
on hardware you control. No vendor sees the contents unless you explicitly route a single LLM call through them.
- Persistence — Everything is append-only with
valid_from/valid_until.
No subscription change can revoke access. No retention policy you didn't author can delete what's yours.
- Portability — A HiveMem instance packs into one encrypted archive
(Postgres dump + binary store + config) and restores anywhere. Vendor lock-in: zero.
- Aggregation — What you write in Claude.ai, ChatGPT, Gemini, Claude
Code, Copilot lands in HiveMem too. Those tools become front-ends; HiveMem holds the truth.
- Privacy by realm — Strict separation per life area
(legal, medical, `private
d268cc6cd08eOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add hivemem --env EMBEDDING_MAX_TOKENS=${EMBEDDING_MAX_TOKENS} --env TOKENIZER_FILE=${TOKENIZER_FILE} -- npx -y [email protected]{
"mcpServers": {
"hivemem": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"EMBEDDING_MAX_TOKENS": "${EMBEDDING_MAX_TOKENS}",
"TOKENIZER_FILE": "${TOKENIZER_FILE}"
}
}
}
}Exposed tools (1)
1 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
HiveMem | read | Local-first knowledge graph — your second brain |
Trust audit
SAFEgrade B · trust 86/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (8 observation(s))
- Network
- declared (4 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (16)
_impl = importlib.import_module(_BACKENDS[select_backend(os.environ)])
import type { GraphLink, GraphNode } from '../../graph/types'import { neighborIds, shouldShowLabel, idOf } from '../../graph/clusterForce'import type { Attachment } from '../../api/types'import App from '../../src/App.vue'
import { i18n } from '../../src/i18n'if !strings.HasPrefix(uri, "http://127.0.0.1:") {assertTrue(RedirectUriValidator.isAcceptable("http://127.0.0.1:54321/callback"));assertFalse(RedirectUriValidator.isAcceptable("http://192.168.1.1/callback"));curl -sS -X POST http://127.0.0.1:8090/llm/complete \
@codemirror/commands, @codemirror/lang-markdown, @codemirror/state, @codemirror/view, @mdi/font, @tresjs/cientos, @tresjs/core, @vscode/markdown-it-katex
| `POST /vistierie/tools/find_isolated_cells` | `hivemem.queen.webhook-token` | Returns cells that have no outbound tunnels |
| `POST /vistierie/tools/read_cell` | `hivemem.queen.webhook-token` | Returns full cell detail for a given cell ID |
| `POST /vistierie/tools/search_similar_cells` | `hivemem.queen.webhook-token` | Returns cells semantically related to the given cell across all realms (excluding the cell itself) |
| `POST /vistierie/runs/done` | `hivemem.queen.completion-webhook-token` | Receives the Queen's aggregated output and writes each proposal as a `pending` tunnel |
| `contradiction-webhook-token` | `HIVEMEM_QUEEN_CONTRADICTION_WEBHOOK_TOKEN` | `""` | Bearer token HiveMem expects Vistierie to present on both `POST /vistierie/contradiction/done` and `POST /vistier
Gates applied: no_behavioural_pass.
d268cc6cd08efull audit observations/trust-audit/mcp-server/visterion__hivemem.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | d268cc6cd08e | SAFE | B | 86 | first audit |
Questions
What is the HiveMem MCP server?
Personal knowledge system — MCP server with PostgreSQL semantic search and temporal knowledge graph
What tools does HiveMem expose?
1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is HiveMem safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (86/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does HiveMem need?
It reads EMBEDDING_MAX_TOKENS and TOKENIZER_FILE from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (d268cc6cd08e), read on 2026-10-11. The repository is watched and re-audited when it changes.