agentmemory-rest-api

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: critical finding, no behavioural pass, undeclared transfer.

Protected endpoints require bearer authentication by default, including localhost. Liveness is public. The example uses an explicit environment secret or the generated local secret file; if the daemon

The REST API is the primary surface. All paths are under `http://localhost:3111` (override with `--port`). Send `Authorization: Bearer <secret>`: the value of `AGENTMEMORY_SECRET`, or the one generate

and do not read local credential files.

Audit 0.4.1 · source sha 2e5491e1aacf · 30 Oct 2026Report an issue or request a re-scan

• Publisherrohitg00 GitHub userOwner of the repository this skill is read from
• Source folderrohitg00/agentmemory/plugin/skills/agentmemory-rest-apiThe exact folder we audited
• LicenceApache-2.0As the repository states it
• Commit pinned for this verdict2e5491e1aacfA new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: The agentmemory HTTP REST API surface, the primary protocol for talking to the memory server. Use when calling agentmemory over HTTP, when MCP is unavailable and you need a fallback, or when integrating a host that does…

---
name: agentmemory-rest-api
description: The agentmemory HTTP REST API surface, the primary protocol for talking to the memory server. Use when calling agentmemory over HTTP, when MCP is unavailable and you need a fallback, or when integrating a host that does not speak MCP.
user-invocable: false
---

REST is agentmemory's primary surface. MCP is a bridge on top of it. Every memory operation has an HTTP endpoint under `http://localhost:3111/agentmemory/*`.

## Quick start

```bash
# liveness
curl -fsS http://localhost:3111/agentmemory/livez

# For this fixed loopback URL only. Do not print the value or enable shell tracing.
agentmemory_secret="${AGENTMEMORY_SECRET:-$(cat "$HOME/.agentmemory/secret")}"
test -n "$agentmemory_secret" || exit 1

# save
curl -fsS -X POST http://localhost:3111/agentmemory/remember \
  -H "Authorization: Bearer $agentmemory_secret" \
  -H "Content-Type: application/json" \
  -d '{"content":"chose JWT refresh rotation","concepts":["jwt-refresh-rotation"]}'

# recall
curl -fsS -X POST http://localhost:3111/agentmemory/smart-search \
  -H "Authorization: Bearer $agentmemory_secret" \
  -H "Content-Type: application/json" \
  -d '{"query":"auth token strategy","limit":5}'
```

## Auth

Protected endpoints require bearer authentication by default, including localhost. Liveness is public. The example uses an explicit environment secret or the generated local secret file; if the daemon uses a secret from its `.env`, load that value locally without displaying it. For a remote daemon, require an explicit credential for that endpoint and HTTPS. Never forward a local-file secret or follow an authenticated redirect to another host. See [TROUBLESHOOTING.md](TROUBLESHOOTING.md).

## Conventions

- Save returns `201`, reads return `200`, validation errors return `400`.
- Use documented fields only. A successful response does not prove an unsupported field was applied.
- The REST port defaults to `3111` and is configurable with `--port` or `--instance`. The viewer defaults to `3113`; the internal engine WebSocket defaults to `49134`.

## See also

- agentmemory-mcp-tools for the MCP equivalents.
- agentmemory-config for local configuration and the secret.

## Reference

The full endpoint list with methods lives in REFERENCE.md, generated from `src/triggers/api.ts`.

Excerpt, first 2,319 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

1. 2026-10-30
   ✕BLOCK D 69 / 100

   first audit · source 2e5491e1aacf

Questions about agentmemory-rest-api

• github.com/rohitg00/agentmemory/tree/main/plugin/skills/agentmem — the audited source at commit 2e5491e1aacf and every finding aboveObserved · 30 Oct 2026

Spotted something wrong? Report a correction · Methodology