Mcp Memory Server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp Memory Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A semantic memory layer for AI coding agents. It allows agents to store and retrieve memories with automatic summarization, reducing token usage during long coding sessions.
include_full_text.store_memory, retrieve_memory, and delete_memory as MCP tools./store, /retrieve, /health).session_id and project_id fields for organizing memories.docker compose up -dpython -m memory_serverThe server runs at http://localhost:8000.
Open http://localhost:8000/docs in your browser to test the API.
Store a memory
curl -X POST http://localhost:8000/store \
-H "Content-Type: application/json" \
-d '{
"text": "The agent is building a memory layer using Weaviate and FastAPI.",
"source": "conversation",
"category": "project",
"session_id": "session-123",
"project_id": "mcp-memory"
}'Retrieve memories (with optional filters)
curl -X POST http://localhost:8000/retrieve \
-H "Content-Type: application/json" \
-d '{
"query": "memory layer",
"top_k": 5,
"session_id": "session-123",
"category": "project",
"source": "conversation",
"include_full_text": false
}'Note: Retrieval returns summaries and metadata by default. Set "include_full_text": true to include the original text in results. This keeps token usage low when only the summary is needed.Delete a memory
curl -X DELETE http://localhost:8000/memory/<memory-id>The server exposes tools via the Model Context Protocol at:
http://localhost:8000/mcpAvailable tools:
store_memory(text, source, category, tags, session_id, project_id) — Returns immediately; summarization runs in the background. The summary field on a freshly stored memory may be empty for a few seconds until the background task completes.retrieve_memory(query, top_k, session_id, project_id, category, source, include_full_text) — Returns summary + metadata by default. Pass include_full_text=true to include original text.delete_memory(memory_id)These can be called directly by any MCP-compatible agent.
store_memory and POST /store return as soon as the embedding is computed and the record is inserted. The LLM-generated summary is populated asynchronously a few seconds later. If you retrieve a memory immediately after storing it, the summary field may be empty.| Variable | Description | Default |
|---|---|---|
GROQ_API_KEY | Groq API key for free summarization | (required) |
ANTHROPIC_API_KEY | Anthropic API key (paid fallback only) | (optional) |
WEAVIATE_HOST | Weaviate hostname | localhost |
WEAVIATE_PORT | Weaviate HTTP port | 8080 |
WEAVIATE_GRPC_PORT | Weaviate gRPC port | 50051 |
Billing note for `ANTHROPIC_API_KEY`: Each deployer brings their own Anthropic key. The project does not supply or cover Anthropic API usage on anyone's behalf — whoever sets that env var is the one whose account gets billed if the Groq path fails and the Anthropic fallback fires.
Summarization follows a three-step fallback chain: Groq first (free), Anthropic only if Groq fails (paid, deployer's own key), plain truncation to 600 characters if both fail.
sentence-transformers/all-MiniLM-L6-v2 (ONNX backend), computed from raw textTunable constants (hardcoded in store.py, not env vars):
| Constant | Default | Purpose |
|---|---|---|
RECENCY_DECAY_WEIGHT | 0.01 | Score penalty per day of age during retrieval reranking |
DUPLICATE_DISTANCE_THRESHOLD | 0.05 | Max cosine distance to consider a new memory a duplicate of an existing one |
mcp-memory-server/
├── memory_server/
│ ├── __init__.py
│ ├── main.py
│ └── store.py
├── docker-compose.yml
├── requirements.txt
├── diagnose.py
├── test_e2e.py
├── eval_retrieval.py
└── README.mdMIT License
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.