Mcp Memory Service
mcp-memory-service · by doobidoo
Open-source persistent memory for AI agent pipelines (LangGraph, CrewAI, AutoGen) and Claude. REST API + knowledge graph + autonomous consolidation.
No known CVEs
Apache-2.0 license
Maintained
Last commit 31d ago
Works with most clients
Transport: stdio, sse, http
2 tools · ~194 tok
Grade A · 0.1% of 200K ctx
Step 1
Install in your client
Config is the same across clients — only the file and path differ.
CD
Supported in Claude Desktopstdio, sse, http · Node 18+
Paste into ~/Library/Application Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"memory": {
"args": [
"server"
],
"command": "memory"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Embed in your READMEAbout badges →
[](https://mcppedia.org/s/mcp-memory-service)
Read me
What Mcp Memory Service does
Open-source memory backend for multi-agent systems. Agents store decisions, share causal knowledge graphs, and retrieve context in 5ms — without cloud lock-in or API costs.
Test This Server
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
uvx 'mcp-memory-service' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Scored, not listed
Why this score
Five weighted categories — click any category to see the underlying evidence.
Score breakdown
89/100across 5 weighted dimensions
0255075100
30
14
20
15
10
−11
Security
Maintenance
Efficiency
Documentation
Compatibility
Categoriesclick a row to see evidence
Security
OSV.dev3 fixed
CVE-2026-49291high · fixedCVSS 8.1
mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call
## Summary The HTTP MCP JSON-RPC endpoint at `/mcp` requires only OAuth `read` scope for all requests, then dispatches `tools/call` directly to handlers that include mutating tools. A read-only OAuth client can call `store_memory` and `delete_memory` through MCP even though the corresponding REST endpoints require `write` scope. ## Technical Details `src/mcp_memory_service/web/api/mcp.py` declares `mcp_endpoint` with `user: AuthenticationResult = Depends(require_read_access)`. For `tools/call
CVE-2026-33010high · fixedCVSS 8.1
mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft
### Summary When the HTTP server is enabled (`MCP_HTTP_ENABLED=true`), the application configures FastAPI's CORSMiddleware with `allow_origins=['*']`, `allow_credentials=True`, `allow_methods=["*"]`, and `allow_headers=["*"]`. The wildcard `Access-Control-Allow-Origin: *` header permits any website to read API responses cross-origin. When combined with anonymous access (`MCP_ALLOW_ANONYMOUS_ACCESS=true`) - the simplest way to get the HTTP dashboard working without OAuth - no credentials are need
CVE-2026-29787medium · fixedCVSS 5.3
mcp-memory-service Vulnerable to System Information Disclosure via Health Endpoint
### Summary The `/api/health/detailed` endpoint returns detailed system information including OS version, Python version, CPU count, memory totals, disk usage, and the full database filesystem path. When `MCP_ALLOW_ANONYMOUS_ACCESS=true` is set (required for the HTTP server to function without OAuth/API key), this endpoint is accessible without authentication. Combined with the default `0.0.0.0` binding, this exposes sensitive reconnaissance data to the entire network. ### Details ### Vulnerabl
Inventory
Tools (2)
Click any tool to inspect its schema.
~194 tokens total
Community
Reviews
Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
How easy was setup?Did it work reliably?How was the documentation?
Sign in to write a review.
Frequently Asked Questions
- Is Mcp Memory Service safe to use?
- Mcp Memory Service has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under Apache-2.0.
- How do I install Mcp Memory Service?
- Mcp Memory Service supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
- What can Mcp Memory Service do?
- Mcp Memory Service provides 2 tools: store_memory, search_memories. See the full tools list on the server page for descriptions and parameters.
- What AI clients work with Mcp Memory Service?
- Mcp Memory Service is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
- Is Mcp Memory Service actively maintained?
- Mcp Memory Service is recently maintained — last commit was 31 days ago. It has 1,895 GitHub stars.
Related
Similar servers
Others in ai-ml / productivity
Sequential Thinking MCP Server96Dynamic problem-solving through sequential thought chains
87.8k 1
Memory MCP Server96Persistent memory using a knowledge graph
87.7k 5
Antigravity Workspace Template96Workspace template + MCP server for Claude Code, Codex CLI, Cursor & Windsurf. Multi-agent knowledge engine (ag-refresh / ag-ask) that turns any codebase into a queryable AI assistant.
1.3k 2
Qmd95mini cli search engine for your docs, knowledge bases, meeting notes, whatever. Tracking current sota approaches while being all local
27.1k 4
MCP Security Weekly
Get CVE alerts and security updates for Mcp Memory Service and similar servers.
Community
Discussion
Start a conversation
Ask a question, share a tip, or report an issue.
Has anyone used this with Cursor?How do you handle auth?Any alternatives?
Sign in to join the discussion.