Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Second Brain

NPM · MIND-MRI-SECOND-BRAIN

Shared Graph-RAG memory for AI agents: markdown vault, wikilink recall, tasks, messaging.

70 Trust /100

Last scanned (22 minutes ago)

Scores higher than 38% of npm servers

Category Memory and Knowledge

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security100
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency48
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 1 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability67
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 2839 tokens (~236/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
  • Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 4 Nov 26 +26
    • Malware scan: unverified → pass ▲ security
    • Known CVEs: unverified → pass ▲ security
    • Dependency health: unverified → pass ▲ functional
  • 3 Nov 26 44

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed npm/mind-mri-second-brain@1.7.1

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 0 packages
Packages resolved 0
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 12 exposed · ~2,753 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
brain_health ~90

Check that the Second Brain server is running and get basic vault statistics: status, version, and how many notes (nodeCount) and links (edgeCount) the vault holds. Read-only and cheap. Call it first if another tool fails with a connection error, or to confirm the memory is connected. The server is started automatically on the first tool call, so a healthy answer here means everything is ready.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

brain_messages_get ~158

Read the messages addressed to an agent: unread ones by default, or the full history with unread set to false. Read-only: it does not mark anything as read; call brain_messages_mark_read with each message id once handled. All matching messages are returned at once, with no pagination and no guaranteed order. Returns { agent, count, messages: [{ id, title, type, tags, agent, content }] }. count 0 means the inbox is empty.

NameTypeReqDescription
agentstringyesWhose inbox to read, using the name senders used as toAgent (case-insensitive, spaces treated as hyphens).
unreadboolean–true (default) returns only unread messages; false returns every message including read ones.

No output schema declared.

No examples provided.

brain_messages_mark_read ~129

Mark one message as read so it no longer appears in the default (unread) inbox from brain_messages_get. Call it after you have handled a message. Safe to repeat: marking an already-read message again changes nothing. The message stays in the vault and in the full history. Returns { success: true, id }, or an error "Message not found" if the id is unknown or is not a message note.

NameTypeReqDescription
idstringyesMessage note id exactly as returned in the id field by brain_messages_get, e.g. "messages/qa-agent/[MSG] Question".

No output schema declared.

No examples provided.

brain_messages_send ~242

Send a message to another agent's inbox. The recipient reads it with brain_messages_get and clears it with brain_messages_mark_read. Use it for short hand-off context that does not belong in a task or a permanent note. Nothing is delivered in real time: the recipient has to check its inbox. Any valid name works as a recipient (the inbox is created on first use and unknown names are not rejected), so check the spelling; an invalid name such as one containing a slash is rejected with the reason. Every call creates a new message, so sending the same text twice delivers it twice. Returns { success, id } where id is the message note id.

NameTypeReqDescription
contentstringyesThe message body (markdown).
fromAgentstring–Sender name so the recipient knows who wrote. Recorded as "unknown" if omitted.
subjectstring–Short subject line. Defaults to "Message from <fromAgent>".
toAgentstringyesRecipient agent name, e.g. "reviewer". Inbox names are matched case-insensitively with spaces treated as hyphens. No slashes or other filename-invalid characters.

No output schema declared.

No examples provided.

brain_node_get ~161

Fetch one note by id: its full markdown content, metadata (type, tags, agent, importance, version, dates), the notes it links to (outLinks) and the notes that link to it (inLinks). Read-only. Use it to read a note in full before replacing its text with brain_node_update, or to follow a link found in recalled context. The whole note is returned, so a very large note is a large response. Returns an error saying "not found" for an unknown id.

NameTypeReqDescription
idstringyesNote id exactly as returned by brain_search, brain_recall or brain_remember: the path inside the vault without ".md", e.g. "agents/atlas/Decision - Use SQLite for the cache".

No output schema declared.

No examples provided.

brain_node_update ~366

Update an existing note in place instead of creating a near-duplicate. mode "append" (default) adds your text to the end and keeps everything already there; mode "replace" overwrites the whole body, so only use it when you have the full corrected text (read it with brain_node_get first). Tags and importance, if given, replace the existing values. Safe against concurrent edits: it checks the note version and retries once if another writer changed it in between. Returns { success: true, id, mode } (mode is omitted when only tags or importance changed). Errors: "not found" for an unknown id, "Nothing to update" if you pass only an id, and a conflict error if two other writers keep racing; in that case read the note again and retry. No credentials are needed from you: if the server was started with BRAIN_KEY, this MCP server sends it automatically.

NameTypeReqDescription
contentstring–In append mode, the text to add after the existing body. In replace mode, the complete new body (it overwrites everything, so include whatever you want to keep). Omit to change only tags or importanc…
idstringyesNote id exactly as returned by brain_search, brain_recall or brain_remember, e.g. "agents/my-project/Decision - Use SQLite".
importanceinteger–New importance, 1 to 10 (see brain_remember).
modestring–"append" (default) keeps the existing text and adds yours at the end. "replace" overwrites the whole body: read the note first with brain_node_get.
tagsarray–The note's new complete tag list; it replaces the old tags rather than adding to them.

No output schema declared.

No examples provided.

brain_recall ~262

Recall relevant memory for a query from the shared Second Brain vault. It finds the best-matching notes (keyword and recency, plus semantic similarity when embeddings are configured), then follows their [[wikilinks]] outward for the requested number of hops, and packs the result into a token budget. Call this before answering anything that earlier work may already cover: past decisions, constraints, research, project background. Read-only. Returns { nodeCount, tokenEstimate, systemPrompt, nodes }: systemPrompt is a ready-to-use context block in which the notes are marked as reference data, not instructions. Use brain_search instead when you only need a ranked list of matching notes.

NameTypeReqDescription
hopsinteger–How many [[wikilink]] steps to follow from the matching notes. 0 = matches only; 1 (default) adds directly linked notes; values above 3 are capped at 3.
maxTokensinteger–Token budget for the returned context. Notes that do not fit are left out. Values above 8000 are capped at 8000.
querystringyesWhat you need to know, in plain words, e.g. "why did we choose SQLite for the cache". Specific queries recall better than broad ones.

No output schema declared.

No examples provided.

brain_remember ~474

Write a new memory/research note into the shared Second Brain vault so future sessions, in this or any other project, can recall it later. Only for a genuine, reusable learning: a fact, pattern, constraint or decision that would change future behavior or save someone from re-deriving it. Not for routine task completions, raw output or status updates (the task queue records those). Test: would a future session be worse off without this note? If not, skip it. Prefer updating an existing relevant note over creating a near-duplicate one (use brain_search first, then brain_node_update). Creates a new note and never overwrites an existing one (a title clash gets a numbered filename). Returns { success, id, title, type, version }; keep the id to refer to the note later.

NameTypeReqDescription
agentstring–Name of the calling project or agent; the note is stored under agents/<agent>/, which keeps each project's notes together. Same filename rules as title, so no slashes. If omitted, the note is stored…
contentstringyesMarkdown body. Link related notes with [[Note Title]] so recall can follow the graph. Never include secrets, credentials or personal data: notes are plain files and may be synced to git.
importanceinteger–How long the note stays prominent in recall, 1 to 10. Recency only re-ranks, so old notes are never hidden, but 8-10 fades over months, 5-7 (default) over weeks, and 1-4 within days.
tagsarray–Short lowercase labels, e.g. ["database", "cache"]. Used by search and filtering.
titlestringyesSpecific, searchable title that becomes the note's filename, e.g. "Decision - Use SQLite for the cache". Must not contain : / \ ? * " < > | , start or end with a space, or end with a period; invalid…
typestring–Kind of note: decision (a choice and its reason), insight (a non-obvious finding or fix), research (gathered findings), memory (general fact), note (anything else).

No output schema declared.

No examples provided.

brain_search ~167

Search the vault for notes matching a query: keyword search over titles, tags and content, combined with semantic similarity when embeddings are configured, then lightly re-ranked by recency. Use it to check whether a note already exists (before brain_remember) or to find a note id for brain_node_get / brain_node_update. Read-only. Returns { query, results: [{ id, title, type, tags, agent, score, preview }] }, best first; an empty list means nothing matched. Use brain_recall instead when you want assembled context to answer a question.

NameTypeReqDescription
limitinteger–Maximum number of results to return (default 10).
querystringyesWords to look for, e.g. "sqlite cache decision". Matches titles, tags and note text.

No output schema declared.

No examples provided.

brain_tasks_list ~153

List the tasks in the shared queue, optionally only those in one state. Use status "pending" to find work waiting for you, "blocked" to see what is waiting on dependencies. Read-only. Returns every matching task with no pagination and no guaranteed order: { count, tasks: [{ id, title, tags, content, createdAt }] }, where content holds the prompt and any result written so far, and id is what brain_tasks_update takes. An empty list means no tasks match. Add tasks with brain_tasks_submit; change the state of a task, or record its outcome, with brain_tasks_update.

NameTypeReqDescription
statusstring–Only return tasks in this state. Omit to list all tasks.

No output schema declared.

No examples provided.

brain_tasks_submit ~265

Add a task to the shared, markdown-backed task queue so another agent (or a later session) can pick it up. A task with dependencies starts as "blocked" and moves to "pending" automatically when all of them complete; otherwise it starts as "pending". This only records the task: it is a coordination list, not a runner, so something else must watch for pending tasks (brain_tasks_list) and report back (brain_tasks_update). Returns { taskId, nodeId, status } where status is "pending" or "blocked". Write the prompt so it is self-contained: goal, relevant files, constraints and what "done" means.

NameTypeReqDescription
agentsarray–Names of the agents this task is for, e.g. ["reviewer"]. Defaults to ["coordinator"].
dependenciesarray–Node ids (nodeId values returned by earlier brain_tasks_submit calls) that must complete first.
priorityinteger–Urgency, 1 (lowest) to 10 (highest).
promptstringyesComplete, self-contained description of the work to be done.
titlestring–Short title. If omitted, one is made from the first 60 characters of the prompt, prefixed "Task - ".

No output schema declared.

No examples provided.

brain_tasks_update ~286

Change the status of a task and, optionally, record its outcome. Use it to claim a task ("running"), finish it ("completed" or "failed") or withdraw it ("cancelled"). Completing a task releases the tasks that were blocked on it: once all the dependencies of a blocked task are completed it becomes "pending"; if a dependency failed or was cancelled, the dependent task is marked "failed" too. The result text is written to the Final Result section of the task, replacing any earlier result; the prompt and sub-results are kept. Setting the same status again is harmless. Returns { success, id, status, releasedDependents } where releasedDependents counts the blocked tasks that moved. Errors: "Task not found" for an id that is not a task note. Find ids with brain_tasks_list; create tasks with brain_tasks_submit.

NameTypeReqDescription
idstringyesTask note id: the id field from brain_tasks_list, or the nodeId returned by brain_tasks_submit, e.g. "tasks/Task - Review the migration".
resultstring–What was done or why it failed, in markdown. Stored in the Final Result section of the task. Omit to change only the status.
statusstringyesThe new state. Use "running" when you start, "completed" or "failed" when you finish.

No output schema declared.

No examples provided.

Install

How do I install the Second Brain MCP server?

Second Brain runs locally as an npm package, launched with npx -y mind-mri-second-brain. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · mind-mri-second-brain

# add to Claude Code
claude mcp add ara-5-second-brain -- npx -y mind-mri-second-brain
Common questions

What is the Second Brain MCP server?

Second Brain is an MCP server listed in the public MCP registry as io.github.ara-5/second-brain. Shared Graph-RAG memory for AI agents: markdown vault, wikilink recall, tasks, messaging. This page covers its npm package (mind-mri-second-brain).

Is the Second Brain MCP server safe to use?

Second Brain scores 70 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Second Brain MCP server expose?

Second Brain exposes 12 tools: brain_recall, brain_remember, brain_search, brain_node_get, brain_tasks_submit, and 7 more. Their descriptions and schemas cost roughly 2,753 tokens of context every time the server is loaded.

Is the Second Brain MCP server still maintained?

Second Brain is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Second Brain MCP server under?

Second Brain declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.