Claude MemorySAFE
Local citation-backed recall for Pi, OMP, Claude Code, Codex, and ChatGPT history.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Mooncite lets coding agents recover past context without asking you to explain it again. It searches authorized Pi, OMP, Claude Code, Codex, and ChatGPT history stored on this machine. Before an agent relies on a result, mooncite_inspect checks the citation against the original file. That confirms where the text came from. It does not prove the text is still true.
Mooncite was formerly Claude Memory MCP. The repository keeps its old claude-memory-mcp URL.
flowchart LR H[Human] -->|installs| M[Mooncite] A[Coding agentPi, OMP, Codex, Claude Code] -->|recall and inspect| M M -->|reads only| S[Local historyPi, OMP, Claude Code, Codex, ChatGPT] M I[(Search index)] M -->|cited context| A
Install
Mooncite requires Linux with procfs, Node.js 24 or newer, npm, and access to GitHub. Packaged local embeddings are Linux x64 only. Other Linux architectures still install and search lexically.
npx --yes github:WhenMoon-afk/claude-memory-mcp#v4.0.7 install
Tagged v4.0.7 is the current stable release. After installation, check the launcher. Then fully restart or reload each client whose registration is exact:
"$HOME/.local/bin/mooncite" status
The installer configures available Pi, OMP, Codex, and Claude Code clients. ChatGPT is a source, not a client. See operations for source setup, ChatGPT exports, removal commands, and quick fixes.
First search
Recall runs inside a configured client. It is not a shell command. Give the agent one distinctive phrase:
Callmooncite_recallwith "". Start without a scope. If it returns a candidate, inspect that candidate'sevidence_idwithmooncite_inspect. Treatverifiedas proof that the cited text still matches its source file. It does not prove the text is true.
Mooncite exposes exactly three tools:
mooncite_recallsearches bounded local evidence. An unquoted query of at least two terms may a
8befd32e4bdfOBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add mooncite -- npx -y @whenmoon-afk/[email protected]
{
"mcpServers": {
"mooncite": {
"command": "npx",
"args": [
"-y",
"@whenmoon-afk/[email protected]"
]
}
}
}Exposed tools (3)
3 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
mooncite_inspect | read | |
mooncite_recall | read | |
mooncite_status | read |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (2)
@types/node, typescript, vitest
Mooncite does not transport or upload history. It has no telemetry, account login, or remote-copy command. It does not read ChatGPT credentials or browser cookies. It does not scrape opaque applicatio
Gates applied: no_behavioural_pass.
8befd32e4bdffull audit observations/trust-audit/mcp-server/whenmoon-afk__claude-memory.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | 8befd32e4bdf | SAFE | B | 89 | first audit |
Questions
What is the Claude Memory MCP server?
Local citation-backed recall for Pi, OMP, Claude Code, Codex, and ChatGPT history.
What tools does Claude Memory expose?
3 in total: 3 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Claude Memory safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Claude Memory need?
No credential environment variables were found in its source, so it appears to need none.
How does Claude Memory run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @whenmoon-afk/mooncite at 4.0.7.
How current is this page?
The grade is for one exact copy of the source (8befd32e4bdf), read on 2026-10-07. The repository is watched and re-audited when it changes.