Memento (JoyciAkira) MCP Server
memento-mcp
PyPI
v1.2.1
Published by joyciakira — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
The Autonomous Nervous System for AI Agents — local-first MCP middleware with temporal graph memory, active coercion, and proactive goal alignment.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 7 = 93. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 10
high Shell/command execution in server code (memento/active_coercion_hook.py)MTC-SRC-002
In the server's implementation (`memento/active_coercion_hook.py:30`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: return 0 paths = subprocess.check_output( ["git", "diff", "--cached", "--name-only", "--diff-filter=ACMR"
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server memento/active_coercion_hook.py
high Shell/command execution in server code (memento/git_context.py)MTC-SRC-002
In the server's implementation (`memento/git_context.py:19`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: dProcess.""" return subprocess.run( # noqa: S603 ["git", *args], capture_output=True, text=
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server memento/git_context.py
high Shell/command execution in server code (memento/git_ingestion.py)MTC-SRC-002
In the server's implementation (`memento/git_ingestion.py:17`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: r: try: r = subprocess.run( ["git", *args], capture_output=True, text=True, timeout=15, cwd=cwd
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server memento/git_ingestion.py
high Shell/command execution in server code (memento/tools/coercion.py)MTC-SRC-002
In the server's implementation (`memento/tools/coercion.py:113`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: "message": "exec() is a security risk and makes code hard to analyze.", "severity": "block",
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server memento/tools/coercion.py
high Shell/command execution in server code (memento/updater.py)MTC-SRC-002
In the server's implementation (`memento/updater.py:40`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: try: result = subprocess.run( cmd, capture_output=True, text=True,
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server memento/updater.py
low Shell/command execution in packaging/dev tooling (benchmarks/run_benchmarks.py)MTC-SRC-002
In a packaging/dev/install script (shipped, but not the server runtime) (`benchmarks/run_benchmarks.py:26`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: --tb=short"] return subprocess.call(cmd, cwd=root) if __name__ == "__main__": raise SystemExit(main())
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server benchmarks/run_benchmarks.py
low Shell/command execution in packaging/dev tooling (tests/test_active_coercion.py)MTC-SRC-002
In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_active_coercion.py:135`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: epo_root) blocked = subprocess.run( [sys.executable, "-m", "memento.active_coercion_hook"], cwd=repo
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server tests/test_active_coercion.py
low Shell/command execution in packaging/dev tooling (tests/test_active_coercion_hook.py)MTC-SRC-002
In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_active_coercion_hook.py:32`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: ]}}, f) os.system(f"cd {repo} && git init && git add . && git commit -m 'init'") bad_file =
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server tests/test_active_coercion_hook.py
low Shell/command execution in packaging/dev tooling (tests/test_mcp_tool_contracts.py)MTC-SRC-002
In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_mcp_tool_contracts.py:27`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: ws = tmp_path subprocess.run( ["git", "init"], cwd=str(ws), check=False, stdou
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server tests/test_mcp_tool_contracts.py
low Shell/command execution in packaging/dev tooling (tests/test_tools_smoke.py)MTC-SRC-002
In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_tools_smoke.py:44`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: ws = tmp_path subprocess.run( ["git", "init"], cwd=str(ws), check=False,
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server tests/test_tools_smoke.py
Tools 74
Each tool and what it can reach — statically extracted from the published source.
mementono sensitive capabilitymemento_add_active_coercion_ruleno sensitive capabilitymemento_add_memoryno sensitive capabilitymemento_apply_active_coercion_presetno sensitive capabilitymemento_audit_dependenciesno sensitive capabilitymemento_autonomy_decisionsno sensitive capabilitymemento_autonomy_statusno sensitive capabilitymemento_begin_sessionno sensitive capabilitymemento_check_goal_alignmentno sensitive capabilitymemento_coercionno sensitive capability
Show 64 more tools ↓
memento_cognitiveno sensitive capabilitymemento_compactno sensitive capabilitymemento_configureno sensitive capabilitymemento_configure_enforcementno sensitive capabilitymemento_configure_notificationsno sensitive capabilitymemento_consolidate_memoriesno sensitive capabilitymemento_delete_project_stateno sensitive capabilitymemento_dismiss_notificationno sensitive capabilitymemento_explain_retrievalno sensitive capabilitymemento_explain_searchno sensitive capabilitymemento_extract_kgno sensitive capabilitymemento_generate_tasksno sensitive capabilitymemento_get_cross_workspace_statsno sensitive capabilitymemento_get_pending_notificationsno sensitive capabilitymemento_get_predictive_cache_statsno sensitive capabilitymemento_get_project_stateno sensitive capabilitymemento_get_quality_reportno sensitive capabilitymemento_get_relevance_statsno sensitive capabilitymemento_get_warningsno sensitive capabilitymemento_graphno sensitive capabilitymemento_handoffno sensitive capabilitymemento_healthno sensitive capabilitymemento_install_git_hooksno sensitive capabilitymemento_kgno sensitive capabilitymemento_kg_healthno sensitive capabilitymemento_list_active_coercion_presetsno sensitive capabilitymemento_list_active_coercion_rulesno sensitive capabilitymemento_list_goalsno sensitive capabilitymemento_list_sessionsno sensitive capabilitymemento_memory_statsno sensitive capabilitymemento_migrate_workspace_memoriesno sensitive capabilitymemento_notificationsno sensitive capabilitymemento_pmg_add_entityno sensitive capabilitymemento_pmg_add_relationno sensitive capabilitymemento_pmg_entity_contextno sensitive capabilitymemento_pmg_summaryno sensitive capabilitymemento_pmg_what_might_breakno sensitive capabilitymemento_projectno sensitive capabilitymemento_project_state_summaryno sensitive capabilitymemento_record_memory_hitno sensitive capabilitymemento_record_quality_evaluationno sensitive capabilitymemento_rememberno sensitive capabilitymemento_remove_active_coercion_ruleno sensitive capabilitymemento_resume_sessionno sensitive capabilitymemento_searchno sensitive capabilitymemento_search_memoryno sensitive capabilitymemento_search_vnextno sensitive capabilitymemento_sessionno sensitive capabilitymemento_session_statusno sensitive capabilitymemento_set_autonomyno sensitive capabilitymemento_set_goalsno sensitive capabilitymemento_set_project_stateno sensitive capabilitymemento_share_memory_to_workspaceno sensitive capabilitymemento_statusno sensitive capabilitymemento_synthesize_dreamsno sensitive capabilitymemento_system_healthno sensitive capabilitymemento_toggle_accessno sensitive capabilitymemento_toggle_active_coercionno sensitive capabilitymemento_toggle_consolidation_schedulerno sensitive capabilitymemento_toggle_dependency_trackerno sensitive capabilitymemento_toggle_kg_extraction_schedulerno sensitive capabilitymemento_toggle_precognitionno sensitive capabilitymemento_toggle_superpowersno sensitive capabilitymemento_warm_predictive_cacheno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (74 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v1.2.1 latest |
A 93/100 | 10 | 1.13.0 | 2026-08-25 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan memento-mcp --online --registry pypiOther implementations of Memento 5
Independent packages implementing the same tool, scanned with the same engine. Compare all 6 side by side →
Knowledge graph memory system that gives LLMs persistent, structured memory.
MCP memory server using SQLite + FTS5 + sqlite-vec
Memento MCP: Knowledge graph memory system for LLMs
Local-first, LLM-agnostic memory layer for AI assistants. Run via npx @psraghuveer/memento.
Intelligent persistent memory for AI agents and IDEs via Model Context Protocol (MCP).
More in Developer Tools
Hotel booking MCP server — 300K+ properties, real confirmation numbers, loyalty programs. Builders monetize every booking via Stripe Connect. The first MCP server that completes real hotel reservations inside AI conversations.
Manage AdGuard Home through AI assistants
Read-only Azure DevOps for MCP clients using only your existing browser session — no PAT, no Azure CLI. Browse work items, pull requests, comments, attachments and Artifacts feeds across every project, repo and feed you can access.
MCP server for Adobe Experience Manager Assets integration development
Servidor MCP para el tiempo oficial de España (API pública OpenData de AEMET). Predicción, observación y avisos como herramientas MCP tipadas.
A standalone MCP stdio bridge for Affinity by Canva's local MCP SSE server.