Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

ChainMemory

NPM · CHAINMEMORY-MCP · SCANNED SEP 24

Persistent cross-model memory for AI agents: verifiable, portable, client-side encrypted.

Available components

0 this week 79 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 32 of 104 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability79
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 3965 tokens (~110/item across 36 items; 36 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management75
  • Stability check failed: the tool surface changed between 1.0.1 and 2.7.1: 0 tool removals, 1 breaking changes, 30 additions. See how to fix → Fail
Tool Coverage98
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 95% of tool parameters carry a description.Partial
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete_project" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 36 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the ChainMemory MCP server?

ChainMemory runs locally as an npm package, launched with npx -y chainmemory-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · chainmemory-mcp

# add to Claude Code
claude mcp add chaelynet-chainmemory -- npx -y chainmemory-mcp
// .cursor/mcp.json
{
  "mcpServers": {
    "chaelynet-chainmemory": {
      "command": "npx",
      "args": [
        "-y",
        "chainmemory-mcp"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "chaelynet-chainmemory": {
      "command": "npx",
      "args": [
        "-y",
        "chainmemory-mcp"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add chaelynet-chainmemory -- npx -y chainmemory-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "chaelynet-chainmemory": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "chainmemory-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add chaelynet-chainmemory --command npx --arg -y --arg chainmemory-mcp
# ~/.hermes/config.yaml
mcp_servers:
  chaelynet-chainmemory:
    command: "npx"
    args: ["-y", "chainmemory-mcp"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "chaelynet-chainmemory": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "chainmemory-mcp"
      ]
    }
  }
}
# add to Vellum
assistant mcp add chaelynet-chainmemory -t stdio -c npx -a -y chainmemory-mcp
// mcp.json
{
  "mcpServers": {
    "chaelynet-chainmemory": {
      "command": "npx",
      "args": [
        "-y",
        "chainmemory-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 23 Sept 26 −3

    No change was recorded against any check on this day. Stability & Change Management went from 92 to 72.

  • 22 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 88 to 92.

  • 20 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 82 to 85.

  • 18 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 75 to 78.

  • 16 Sept 26 −3

    No change was recorded against any check on this day. Stability & Change Management went from 92 to 72.

  • 15 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 88 to 92.

  • 14 Sept 26 +15
    • Stability: fail → unverified ▼ security
    • Tool safety: pass → unverified ▼ security
    • Malware scan: unverified → pass ▲ security
    • Capabilities: pass → unverified ▼ functional
    • Tool coverage: 100 → unverified ▼ functional
    • First check of Schema quality: unverified functional
    • Package version: 2.7.0 → 2.7.1 functional
  • 13 Sept 26 −15
    • Malware scan: pass → unverified ▼ security
    • Schema quality: pass → fail ▼ functional
    • Package version: 2.6.1 → 2.7.0 functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 24 Sept 2026 · Analysed npm/chainmemory-mcp@2.7.1

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 104 packages
Packages resolved 104
Stale 32
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 36 exposed · ~3,965 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
add_project_from_template ~63

Create a project from a built-in template, with its auto-tagging keywords already set. Free. Call list_project_templates first: the template id is required and cannot be guessed.

NameTypeReqDescription
template_idstringyesTemplate ID (e.g. 'blockchain')

No output schema declared.

No examples provided.

archive_memory ~75

Archive a memory: it stops appearing in recall, listings and inject, but stays on-chain and keeps its proof. Free and reversible with unarchive_memory. This is what to use instead of deleting — nothing is ever removed from the chain.

NameTypeReqDescription
memory_idintegeryesYour memory number to archive (the # shown in recall)

No output schema declared.

No examples provided.

assume_role ~108

Assume a project role under its Verifiable Role Contract, opening an audited Role Session (fee 0.001 AIC). Pins contract version+hash and Brain state_hash. Only 'active' (signed) contracts are assumable; one open session per role. Call at session start; close with release_role.

NameTypeReqDescription
platformstring–Executor platform (e.g. claude, chatgpt, gemini)
projectstringyes–
role_idstringyes–

No output schema declared.

No examples provided.

audit_memory ~133

Full forensic audit of ONE memory: recomputes its event_hash from the stored plaintext, compares it against the hash anchored on-chain, and reports its anchoring coordinates and seal state. COSTS 0.1 AIC unless dry_run is true. ALWAYS call it with dry_run first — the dry run returns the identical result without charging, so paying only makes sense when you need the paid receipt on record.

NameTypeReqDescription
dry_runboolean–true = validate and return the full result WITHOUT charging (default false). Prefer true.
memory_numberintegeryesYour memory number (the #N shown in recall)

No output schema declared.

No examples provided.

audit_state ~136

Full audit of a Project Brain: recomputes the state_hash of the current version with the deterministic engine, compares it against the stored one, and returns the on-chain anchor plus the version history. COSTS 5 AIC unless dry_run is true — the most expensive operation in the system. Do NOT call it without dry_run unless the user explicitly asked for the paid audit.

NameTypeReqDescription
dry_runboolean–true = validate and return the full result WITHOUT charging (default false). Strongly prefer true: a paid run costs 5 AIC.
projectstringyesProject name, e.g. 'chainmemory'

No output schema declared.

No examples provided.

chainmemory_new_seed ~66

Generate a fresh 12-word BIP-39 phrase for the blind vault. Created locally, never sent anywhere and never stored by this server: write it down on paper. Losing it means losing every memory sealed with it, for you and for everyone. Free, no fee.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

chainmemory_open_sealed ~64

Read a sealed memory: fetches the encrypted blob and decrypts it locally with CHAINMEMORY_SEED_PHRASE. Only works for memories sealed with that same phrase. Free, read-only.

NameTypeReqDescription
memory_idintegeryesMemory number to open

No output schema declared.

No examples provided.

chainmemory_profile ~104

Get this AI's identity and memory counters: name, model, owner wallet, reputation, active status, and four counts that mean different things — chain_memories (anchored on-chain), local_memories (written), synced_memories and pending_sync. Free, read-only. Use it to check that writes are reaching the chain: pending_sync above zero means memories exist locally but are not anchored yet.

NameTypeReqDescription
ai_idinteger–AI ID (omit for own)

No output schema declared.

No examples provided.

chainmemory_recall ~82

Recall the user's most recent memories, newest first. Use at conversation start for continuity. IMPORTANT: this returns an 80-character PREVIEW of each memory, not the full text — to read one in full use get_memory(#N), and to find something by meaning use search_memories.

NameTypeReqDescription
countinteger–Number of memories (default 10)

No output schema declared.

No examples provided.

chainmemory_register ~83

Register an AI identity on-chain. Free, once per identity. Most users never need it: an identity is created automatically the first time an API key writes. Use it only if you want to register explicitly before the first write.

NameTypeReqDescription
modelstringyesModel name (e.g. claude-opus-4)
namestringyesAI name

No output schema declared.

No examples provided.

chainmemory_remember ~394

Write a permanent memory. FEE: 0.001 AIC. Auto-tags by content; importance 1-10. Use it for decisions, learnings and milestones worth keeping, not for small talk. Pass sealed:true to encrypt it in this client before sending (needs CHAINMEMORY_SEED_PHRASE): the server then stores a blob it cannot read. NOTE ON EVIDENCE: the event_hash of a plain memory is computed when it syncs to the chain (~30 s), not at write time, so a memory written just now CANNOT yet be cited in update_project_state — that call would be rejected with 422. Sealed memories carry their hash from the client and are citable immediately.

NameTypeReqDescription
categorystring–Memory category
contentstring–Optional alias of summary. If present it OVERRIDES summary as the stored memory text. 'summary' is the required field: send it always, and use 'content' only when you need a longer body than the summ…
importanceinteger–1-10 importance (default 5)
platformstring–Platform source (e.g. claude, chatgpt). Optional.
projectstring–Project to file this memory under (added as first tag)
sealedboolean–Encrypt this memory in the client before sending it (blind vault). Requires CHAINMEMORY_SEED_PHRASE. The server stores a blob it cannot read. NOTE: a sealed memory has no searchable text, so it will…
summarystringyesWhat happened (will be encrypted before chain anchoring)
tagsarray–Explicit tags; auto-tagging only used as fallback

No output schema declared.

No examples provided.

chainmemory_seal ~120

Seal a memory permanently with a direct contract call. FEE: 0.001 AIC, and it is the ONLY tool that needs a wallet private key in AICHAIN_KEY. Irreversible. Most memories never need this: chainmemory_remember already anchors them through the API. Use it only when you want to seal one yourself, without trusting the server to do it.

NameTypeReqDescription
ai_idintegeryesAI ID owning the memory
memory_idintegeryesYour memory number to seal (the # shown in recall)

No output schema declared.

No examples provided.

chainmemory_stats ~65

Public network statistics: chain id, current block, registered AIs, total and episodic memories, AIC supply. Free and needs NO API key. Use it to check the network is alive — not to count your own memories, which is what chainmemory_profile is for.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

create_project ~110

Create a project to group memories. Free. The project name becomes the FIRST TAG of every memory written under it, which is how list_memories_filtered finds them later — and the only way to find a sealed memory, whose content is not searchable. Call list_projects first to avoid duplicates.

NameTypeReqDescription
keywordsarray–Auto-tag keywords (optional)
namestringyesDisplay name
project_idstringyesShort slug (e.g. 'blockchain', 'work_2026')

No output schema declared.

No examples provided.

delete_project ~65

Delete a project. Free. Takes the NUMERIC id from list_projects — passing the slug returns 400 'invalid id'. Memories keep their tag and stay findable; only the project metadata disappears, so nothing is lost.

NameTypeReqDescription
project_idstringyesProject ID to delete

No output schema declared.

No examples provided.

get_inject_balance ~50

Check the user's AIC balance. Selective inject costs 0.1 AIC per call (Fee Schedule v1.0; split 50/50: half burned, half to treasury).

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_inject_history ~79

History of selective injects: timestamps, how many memories, cost in AIC and transaction hashes. Free, read-only. Use it to audit what was injected and what it cost; for the current balance use get_inject_balance, and to price an injection before paying use quote_inject.

NameTypeReqDescription
limitinteger–Default 20

No output schema declared.

No examples provided.

get_memory ~107

Read ONE memory in full, decrypted from chain, with an integrity check: the server recomputes the event_hash from the plaintext and compares it against the hash anchored on-chain. Use it when a preview is not enough, or to prove a specific memory has not been altered. Requires the memory to be anchored already (freshly written memories anchor in ~30s).

NameTypeReqDescription
memory_numberintegeryesYour memory number — the #N shown by recall/remember. Not a global id.

No output schema declared.

No examples provided.

get_memory_proof ~86

Get the shareable anchoring proof of one of your memories: event_hash plus its on-chain coordinates. A third party can verify that hash in the contract WITHOUT your API key, and the content is never exposed. This is the primitive behind 'verifiable without trusting the operator'. Free.

NameTypeReqDescription
memory_numberintegeryesYour memory number (the #N shown in recall)

No output schema declared.

No examples provided.

get_my_context ~140

Retrieve the user's portable conversation history ACROSS PROVIDERS: a condensed summary plus recent memories from ChatGPT, Claude, Gemini, Perplexity and others, with their verification status. Free, read-only. Use it ONCE when starting with a model that has no history of its own, to carry context between providers. For the latest memories of a specific project, or to keep working inside a session already under way, use chainmemory_recall instead — this one is broader and slower.

NameTypeReqDescription
limitinteger–Maximum memories (default 10)
verified_onlyboolean–If true, only return memories anchored on-chain (default false)

No output schema declared.

No examples provided.

get_project_state ~200

Get the consolidated, verifiable STATE of a project from Project Brain: a structured object (phase, current_focus, vocabulary, constraints, decisions with confidence and cited memory IDs, open_risks, next_priorities, and `environment` — where and how the owner works: hosts, services, repositories and operating rules) distilled from your atomic memories. Use it at the START of work on a known project to load its current state instead of re-deriving context. Owner-scoped (returns only your own state). Includes state_hash (SHA3-256) for integrity.

NameTypeReqDescription
include_rolesboolean–Embed the FULL text of every active Verifiable Role Contract in the response (default true). Set to false when you only need the state: on projects with several signed VRCs the contracts can add thou…
namestringyesProject name, e.g. 'chainmemory'

No output schema declared.

No examples provided.

get_role_contract ~111

Get a project's Verifiable Role Contract (VRC): purpose, rules with checks and severity, working protocol. Read it BEFORE working under a role. Human-authored and owner-signed; models read it, never write it.

NameTypeReqDescription
projectstringyesProject name
role_idstringyesRole id, e.g. 'charly'
versioninteger–Read a specific contract version instead of the latest. Use it to audit what a past Role Session was actually bound to.

No output schema declared.

No examples provided.

get_role_session ~78

Read one Role Session in full, including the contract version and hash it was pinned to, the Brain version and state_hash at the moment it opened, and its event_hash. Use it to verify exactly what a given session was bound to. Free, read-only.

NameTypeReqDescription
session_idintegeryesSession id (as returned by assume_role)

No output schema declared.

No examples provided.

inject_memories ~139

Inject selected memories into the current conversation context. Costs 0.1 AIC per call (Fee Schedule v1.0; regardless of memory count, up to 50). Returns plaintexts ready to be used as context. The AIC charge is deflationary: 50% burned forever, 50% to ecosystem treasury. Optimistic mode: returns immediately, transactions confirm in background.

NameTypeReqDescription
memory_idsarrayyes1-50 memory IDs to inject
project_filterstring–Optional: tag/project context
target_platformstring–Optional: target platform (claude, chatgpt, etc)

No output schema declared.

No examples provided.

list_memories_filtered ~105

List memories filtered by project tag and archived status, newest first. Returns metadata plus an 80-character PREVIEW of each memory — not the full text. Use get_memory(#N) to read one in full, or search_memories to find by meaning.

NameTypeReqDescription
archivedboolean–Include archived memories (default false)
limitinteger–Default 50
projectstring–Filter by project tag (use 'general' for untagged)

No output schema declared.

No examples provided.

list_project_templates ~43

List the built-in project templates with their ids. Free. Call it before add_project_from_template: that tool needs one of these ids and they are not guessable.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_projects ~55

List the user's projects with their numeric id, slug, keywords and colour. Free, read-only. Call it before create_project to avoid duplicates, and before delete_project, which needs the NUMERIC id from here and rejects the slug.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_role_contracts ~91

List the roles defined for a project, with their status and version. Call this BEFORE get_role_contract or assume_role when you do not already know the role_id — role ids are not guessable and a wrong guess costs a failed call. Only roles with status 'active' (signed by the owner) can be assumed.

NameTypeReqDescription
projectstringyesProject name, e.g. 'chainmemory'

No output schema declared.

No examples provided.

list_role_sessions ~66

Audit trail of a project's Role Sessions: who assumed which role, on which platform, when, how it closed (manual or auto) and the closing summary. This is the record the VRC exists to produce. Free, read-only.

NameTypeReqDescription
projectstringyesProject name

No output schema declared.

No examples provided.

quote_inject ~103

Price an inject BEFORE paying for it: which memory ids exist, which do not, total characters, estimated tokens, the exact AIC cost with its burn/treasury split, and whether the wallet balance covers it. Free. Call it before inject_memories whenever the ids are not certain — inject charges 0.1 AIC even if you picked the wrong ones.

NameTypeReqDescription
memory_idsarrayyes1-50 memory numbers (#N) to price

No output schema declared.

No examples provided.

release_role ~58

Release an open Role Session with a closing summary (what was done, what is pending, next step). Sessions auto-release after 60 minutes.

NameTypeReqDescription
session_idintegeryes–
summarystring–Closing summary for the audit trail

No output schema declared.

No examples provided.

search_memories ~110

SEMANTIC search over the user's memories (cosine similarity over cached embeddings, blended with recency and importance). Returns the FULL text of each match — unlike chainmemory_recall and list_memories_filtered, which return 80-character previews. Use this whenever you need to FIND something rather than list the latest.

NameTypeReqDescription
limitinteger–Max results (default 10, server caps at 20)
qstringyesNatural-language query. Searched semantically, not by keyword.

No output schema declared.

No examples provided.

unarchive_memory ~57

Restore an archived memory so it shows up again in recall, listings and inject. Free. Nothing was ever deleted: archiving only hides it.

NameTypeReqDescription
memory_idintegeryesYour memory number to restore (the # shown in recall)

No output schema declared.

No examples provided.

update_memory_tags ~105

Replace the tags of an existing memory. Free. Tags are what keeps a memory findable by project, and the ONLY way to find a sealed one, since its content cannot be indexed. The project of a memory is stored as its first tag.

NameTypeReqDescription
memory_idintegeryesYour memory number (the # shown in recall/remember, e.g. 489) — personal to your api key
tagsarrayyesNew tag list (replaces current)

No output schema declared.

No examples provided.

update_project_state ~412

Apply operations to a project's consolidated state (Project Brain). FEE: 0.05 AIC plus 0.005 per applied op. Ops come from the 29-op grammar (add_decision, add_milestone, add_risk, set_focus, add_env_host...); the server validates invariants, applies them with a deterministic builder and computes the new state_hash. Use after get_project_state + list_memories_filtered to see what actually changed. EVIDENCE IS WHAT MAKES THE STATE WORTH ANYTHING: cite the memories backing each op with evidence_memory_ids. An op with no evidence is stored with evidence_root 0x000...0 — state with no provenance, indistinguishable from your own opinion, and the chain seals it just the same because it verifies hashes, not correctness. If any cited memory cannot be resolved the WHOLE call is rejected with 422 and nothing is written or charged; the usual cause is citing a memory before it anchors. CLOSED VALUE SETS, a wrong one costs a rejected op: severity is low, med or high (NOT medium, NOT critical); risk status open or closed; milestone status planned, in_progress or done; decision status proposed, confirmed, rejected or superseded.

NameTypeReqDescription
consolidated_until_eventinteger–Highest memory ID included in this consolidation (advances the watermark)
opsarrayyesArray of operations from the 29-op grammar. Each op has 'op' (type) + arguments. Use 'evidence_memory_ids' (array of memory IDs) instead of 'evidence' — the server resolves event_hashes automatically…
projectstringyesProject name, e.g. 'chainmemory'

No output schema declared.

No examples provided.

verify_project_state ~102

PUBLIC verification of a Project Brain: returns every anchored version with its state_hash and on-chain coordinates (anchor id, tx, block), plus the instructions to check them independently in the ProjectStateAnchor contract. Exposes no content — only hashes that are already public on-chain. Free, and the answer does not depend on trusting this server: call it, then verify on-chain yourself.

NameTypeReqDescription
namestringyesProject name, e.g. 'chainmemory'

No output schema declared.

No examples provided.

Common questions

What is the ChainMemory MCP server?

ChainMemory is an MCP server listed in the public MCP registry as io.github.chaelynet/chainmemory. Persistent cross-model memory for AI agents: verifiable, portable, client-side encrypted. This page covers its npm package (chainmemory-mcp).

Is the ChainMemory MCP server safe to use?

ChainMemory scores 79 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 24 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the ChainMemory MCP server expose?

ChainMemory exposes 36 tools: chainmemory_remember, chainmemory_new_seed, chainmemory_open_sealed, chainmemory_recall, search_memories, and 31 more. Their descriptions and schemas cost roughly 3,965 tokens of context every time the server is loaded.

Is the ChainMemory MCP server still maintained?

ChainMemory is still listed as active in the MCP registry. We last reached this channel on 24 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the ChainMemory MCP server under?

ChainMemory declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.