io.github.cuemap-dev/cuemap-mcp
NPM · CUEMAP-MCP · SCANNED SEP 26
Local memory and context retrieval for AI agents through CueMap.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 101 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 5 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability76
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3375 tokens (~108/item across 31 items; 31 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage93
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 78% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "cuemap_memory_delete" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 31 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
How do I install the io.github.cuemap-dev/cuemap-mcp server?
io.github.cuemap-dev/cuemap-mcp runs locally as an npm package, launched with npx -y cuemap-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · cuemap-mcp
claude mcp add cuemap-dev-cuemap-mcp -- npx -y cuemap-mcp
{
"mcpServers": {
"cuemap-dev-cuemap-mcp": {
"command": "npx",
"args": [
"-y",
"cuemap-mcp"
]
}
}
} {
"servers": {
"cuemap-dev-cuemap-mcp": {
"command": "npx",
"args": [
"-y",
"cuemap-mcp"
]
}
}
} codex mcp add cuemap-dev-cuemap-mcp -- npx -y cuemap-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"cuemap-dev-cuemap-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"cuemap-mcp"
],
"enabled": true
}
}
} openclaw mcp add cuemap-dev-cuemap-mcp --command npx --arg -y --arg cuemap-mcp
mcp_servers:
cuemap-dev-cuemap-mcp:
command: "npx"
args: ["-y", "cuemap-mcp"] {
"McpServers": {
"cuemap-dev-cuemap-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"cuemap-mcp"
]
}
}
} assistant mcp add cuemap-dev-cuemap-mcp -t stdio -c npx -a -y cuemap-mcp
{
"mcpServers": {
"cuemap-dev-cuemap-mcp": {
"command": "npx",
"args": [
"-y",
"cuemap-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 25 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 20 Sept 26 68
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 26 Sept 2026 · Analysed npm/cuemap-mcp@0.7.4
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 101 packages
| Packages resolved | 101 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
cuemap_add ~228
Store a natural-language memory in CueMap. Uses the repository-scoped default project unless one is supplied, creates it when needed, and applies deterministic cue extraction plus any cues and metadata.
| Name | Type | Req | Description |
|---|---|---|---|
| async_ingest | boolean | – | Process ingestion in the background and return immediately. Default is false. |
| content | string | yes | The natural-language memory content to store. |
| cues | array | – | Normally omit: CueMap generates cues from content automatically. Optionally add deliberate reusable tags, e.g. type:conversation for an explicitly saved conversation. |
| disable_temporal_chunking | boolean | – | Disable temporal chunking for this memory. Default is false. |
| embedding | array | – | Optional precomputed memory embedding. |
| event_time | number | – | Optional original event timestamp as Unix seconds. Defaults to ingestion time. |
| metadata | object | – | Optional JSON metadata to store with the memory. |
| project | string | – | Optional project ID. Defaults to a stable ID derived from the current Git repository. |
| source_key | string | – | Optional stable source key for deterministic upsert/deduplication. |
No output schema declared.
No examples provided.
cuemap_alias_add ~73
Add a manual weighted mapping from one cue to another.
| Name | Type | Req | Description |
|---|---|---|---|
| from | string | yes | – |
| project | string | – | Optional project ID. Defaults to the repository-scoped project. |
| to | string | yes | – |
| weight | number | – | Association weight from 0 to 1. Default is 1. |
No output schema declared.
No examples provided.
cuemap_alias_list ~44
List manual cue aliases associated with one cue.
| Name | Type | Req | Description |
|---|---|---|---|
| cue | string | yes | – |
| project | string | – | Optional project ID. Defaults to the repository-scoped project. |
No output schema declared.
No examples provided.
cuemap_alias_merge ~77
Merge multiple cues into one canonical cue. Set confirmed=true only after explicit user confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmed | boolean | yes | Must be true only after the user explicitly confirms the merge. |
| cues | array | yes | – |
| project | string | – | Optional project ID. Defaults to the repository-scoped project. |
| to | string | yes | – |
No output schema declared.
No examples provided.
cuemap_ingest_content ~195
Explicitly ingest supplied raw content into CueMap. Use only when the user asks to persist that content.
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | yes | – |
| embeddings | array | – | Optional one-vector-per-produced-chunk embeddings. |
| filename | string | – | Logical source filename used for type detection. Default is content.txt. |
| metadata | object | – | – |
| project | string | – | Optional project ID. Defaults to the repository-scoped project. |
| segment_max_chunk_chars | integer | – | – |
| segment_min_chunk_chars | integer | – | – |
| segment_overlap | integer | – | – |
| segment_window_size | integer | – | – |
| segmenter | string | – | – |
| source_key | string | – | Stable source key for deterministic replacement or deduplication. |
| structural_cues | array | – | Normally omit: CueMap extracts structural cues automatically. Optionally add reliable source structure or a reusable category such as type:conversation. |
No output schema declared.
No examples provided.
cuemap_ingest_file ~70
Explicitly ingest one local file into CueMap. Use only for a file the user has placed in scope and asked to ingest.
| Name | Type | Req | Description |
|---|---|---|---|
| path | string | yes | Absolute or repository-relative path to the file. |
| project | string | – | Optional project ID. Defaults to the repository-scoped project. |
No output schema declared.
No examples provided.
cuemap_ingest_url ~99
Explicitly ingest content from a URL, optionally crawling same-domain links. Use only when the user asks to ingest that URL.
| Name | Type | Req | Description |
|---|---|---|---|
| depth | integer | – | Crawl depth. Zero ingests only the supplied page. |
| project | string | – | Optional project ID. Defaults to the repository-scoped project. |
| same_domain_only | boolean | – | Restrict recursive crawling to the starting domain. Default is true. |
| url | string | yes | – |
No output schema declared.
No examples provided.
cuemap_init ~162
Apply a user-confirmed repository ingestion scope and start CueMap's incremental filesystem watcher. Always call cuemap_init_preview first for a new repository and obtain explicit user confirmation before setting confirmed=true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmed | boolean | yes | Must be true only after the user explicitly confirms the previewed ingestion scope. |
| ignoredExtensions | array | – | Additional excluded extensions without a leading dot. |
| ignoredPatterns | array | – | Additional gitignore-style exclusion patterns approved by the user. |
| includedPaths | array | – | User-approved repository-relative files or folders. Empty means every supported file allowed by ignore rules. |
| path | string | yes | Absolute path to the repository root. |
| projectName | string | – | Optional project ID. Defaults to the stable repository-scoped CueMap project ID. |
No output schema declared.
No examples provided.
cuemap_init_preview ~143
Preview supported repository files without ingesting content. Call this before first-time repository initialization, present the grouped paths to the user, and ask them to confirm or adjust the selection before calling cuemap_init.
| Name | Type | Req | Description |
|---|---|---|---|
| ignoredExtensions | array | – | Optional additional excluded extensions without a leading dot. |
| ignoredPatterns | array | – | Optional additional gitignore-style exclusion patterns. |
| includedPaths | array | – | Optional repository-relative files or folders to preview. Empty means every supported file allowed by ignore rules. |
| path | string | yes | Absolute path to the repository root. |
| projectName | string | – | Optional project ID. Defaults to the stable repository-scoped CueMap project ID. |
No output schema declared.
No examples provided.
cuemap_intent_classify ~77
Classify text with CueMap's local intent model and return recall/memory eligibility signals. Scores are ranking signals, not calibrated probabilities.
| Name | Type | Req | Description |
|---|---|---|---|
| project | string | – | Optional project ID. Defaults to the repository-scoped project. |
| target | string | – | Classification target. Default is query. |
| text | string | yes | – |
No output schema declared.
No examples provided.
cuemap_lexicon_delete ~71
Permanently delete one Lexicon entry. Set confirmed=true only after explicit user confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmed | boolean | yes | Must be true only after the user explicitly confirms permanent deletion. |
| entry_id | – | yes | – |
| project | string | – | Optional project ID. Defaults to the repository-scoped project. |
No output schema declared.
No examples provided.
cuemap_lexicon_graph ~40
Read the current Lexicon graph for a project.
| Name | Type | Req | Description |
|---|---|---|---|
| project | string | – | Optional project ID. Defaults to the repository-scoped project. |
No output schema declared.
No examples provided.
cuemap_lexicon_inspect ~47
Inspect one cue and its Lexicon relationships.
| Name | Type | Req | Description |
|---|---|---|---|
| cue | string | yes | – |
| project | string | – | Optional project ID. Defaults to the repository-scoped project. |
No output schema declared.
No examples provided.
cuemap_lexicon_wire ~56
Manually wire a token to a canonical Lexicon cue.
| Name | Type | Req | Description |
|---|---|---|---|
| canonical | string | yes | – |
| project | string | – | Optional project ID. Defaults to the repository-scoped project. |
| token | string | yes | – |
No output schema declared.
No examples provided.
cuemap_memory_delete ~71
Permanently delete one CueMap memory. Set confirmed=true only after explicit user confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmed | boolean | yes | Must be true only after the user explicitly confirms permanent deletion. |
| memory_id | integer | yes | – |
| project | string | – | Optional project ID. Defaults to the repository-scoped project. |
No output schema declared.
No examples provided.
cuemap_memory_get ~73
Get one stored memory as readable text with source metadata. Pass the memory_id and owning project_id from recall as memory_id and project. Does not expand neighbors or read live source files.
| Name | Type | Req | Description |
|---|---|---|---|
| memory_id | integer | yes | – |
| project | string | – | Optional project ID. Defaults to the repository-scoped project. |
No output schema declared.
No examples provided.
cuemap_memory_reinforce ~58
Reinforce one CueMap memory, optionally along specific cue pathways.
| Name | Type | Req | Description |
|---|---|---|---|
| cues | array | – | – |
| memory_id | integer | yes | – |
| project | string | – | Optional project ID. Defaults to the repository-scoped project. |
No output schema declared.
No examples provided.
cuemap_project_artifacts ~47
Inspect CueBridge artifact metadata for a CueMap project without reloading or mutating it.
| Name | Type | Req | Description |
|---|---|---|---|
| project | string | – | Optional project ID. Defaults to the repository-scoped project. |
No output schema declared.
No examples provided.
cuemap_project_export ~80
Export a cursor-paginated page of memories from a CueMap project.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | – | – | – |
| include_content | boolean | – | – |
| include_cues | boolean | – | – |
| include_metadata | boolean | – | – |
| limit | integer | – | – |
| project | string | – | Optional project ID. Defaults to the repository-scoped project. |
No output schema declared.
No examples provided.
cuemap_project_load ~57
Load a persisted CueMap project into RAM before a latency-sensitive operation. Normal project requests load automatically, so use this for explicit warm-up.
| Name | Type | Req | Description |
|---|---|---|---|
| project | string | – | Project ID to load. Defaults to the repository-scoped project. |
No output schema declared.
No examples provided.
cuemap_project_pack ~119
Write a ready-to-query .cuemap package for one project to a local file. The package contains sensitive project content; use only after the user explicitly approves the exact output path.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmed | boolean | – | Must be true after explicit user approval of the output path and any overwrite. |
| output_path | string | yes | Absolute local path for the .cuemap file. |
| overwrite | boolean | – | Replace an existing output file. Default is false. |
| project | string | – | Project ID to package. Defaults to the repository-scoped project. |
No output schema declared.
No examples provided.
cuemap_project_package_load ~74
Install and warm a local .cuemap package. Use only after the user explicitly approves the exact package path; existing projects are never overwritten.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmed | boolean | – | Must be true after explicit user approval of the package path. |
| package_path | string | yes | Absolute local path to the .cuemap package. |
No output schema declared.
No examples provided.
cuemap_project_pull ~85
Download, install, and warm a .cuemap package with the engine host's configured AWS CLI. Use only after explicit approval of the exact S3 source; existing projects are never overwritten.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmed | boolean | – | Must be true after explicit user approval of the S3 source. |
| source | string | yes | Exact S3 object URI for a .cuemap package. |
No output schema declared.
No examples provided.
cuemap_project_push ~100
Pack and upload a CueMap project with the engine host's configured AWS CLI. Use only after explicit approval of the exact S3 destination; an existing object at that URI may be replaced.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmed | boolean | – | Must be true after explicit user approval of the S3 destination. |
| destination | string | yes | Exact S3 object URI or prefix. |
| project | string | – | Project ID to push. Defaults to the repository-scoped project. |
No output schema declared.
No examples provided.
cuemap_project_save ~58
Persist the current state of a CueMap project without unloading it. Package operations save automatically; use this only when an explicit durable checkpoint is useful.
| Name | Type | Req | Description |
|---|---|---|---|
| project | string | – | Project ID to save. Defaults to the repository-scoped project. |
No output schema declared.
No examples provided.
cuemap_project_sync ~116
Fast-forward a project through immutable history at an S3 sync root. Pushes local-only changes, pulls remote-only changes, and refuses divergent histories or stale concurrent writes. Use only after explicit approval of the project and exact S3 root.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmed | boolean | – | Must be true after explicit user approval of the project and S3 sync root. |
| project | string | – | Project ID to synchronize. Defaults to the repository-scoped project. |
| remote | string | yes | Exact S3 root used for this project's sync history. |
No output schema declared.
No examples provided.
cuemap_project_unload ~68
Persist and unload a CueMap project from RAM to reduce memory use. Use only when the user explicitly asks to unload or free inactive project memory; active projects return a retryable busy error.
| Name | Type | Req | Description |
|---|---|---|---|
| project | string | – | Project ID to unload. Defaults to the repository-scoped project. |
No output schema declared.
No examples provided.
cuemap_projects ~27
List CueMap projects, summary metadata, and whether each project is currently loaded in RAM.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cuemap_recall ~826
Recall evidence for a focused question; follow up with narrower queries as needed. Returns engine JSON with project_id and memory_id handles, source metadata, and requested diagnostics in text and structuredContent. Use handles with cuemap_memory_get when the stored record is needed. Hybrid locally reranks lexical candidates. Start with a small limit and depth 1; enable reconstruction only when surrounding evidence is needed.
| Name | Type | Req | Description |
|---|---|---|---|
| auto_reinforce | boolean | – | Automatically reinforce retrieved memories. Default is false. |
| cuebridge_gap_limit | number | – | Maximum CueBridge gap expansions. Default is 6. |
| cues | array | – | Normally omit: CueMap generates cues from the query. Supply known tags only to deliberately narrow lexical/hybrid recall, e.g. type:conversation to search tagged conversations. |
| depth | number | – | Depth of multi-hop recall. Default is 1. |
| disable_alias_expansion | boolean | – | Disable alias expansion during querying. Default is true. |
| disable_cuebridge_artifacts | boolean | – | Disable CueBridge artifact expansion. Default is false. |
| disable_salience_bias | boolean | – | Disable salience bias scoring. Default is false. |
| evidence_coverage | string | – | Evidence coverage mode for multi-evidence answers. Default is off. |
| evidence_coverage_limit | number | – | Result scan limit for evidence coverage. Default is 100. |
| evidence_coverage_max_sessions | number | – | Maximum sessions considered for evidence coverage. Default is 3. |
| evidence_coverage_session_scan_limit | number | – | Per-session scan limit for evidence coverage. Default is 4096. |
| expansion_depth | number | – | Neighbor context expansion. 1 returns the matched chunk; values above 1 include nearby parent chunks or source-ordered context with radius expansion_depth - 1 when linkage exists. Default is 1. |
| explain | boolean | – | Include explain component for debug information in results. Default is false. |
| limit | number | – | Optional limit on the number of results to return. Default is 10. |
| min_intersection | number | – | Minimum intersection count for retrieval. Default is 0. |
| ordered_max_sessions | number | – | Maximum sessions considered for ordered reconstruction. Default is 3. |
| ordered_reconstruction | string | – | Ordered session reconstruction mode. Default is off. |
| ordered_reconstruction_limit | number | – | Result scan limit for ordered reconstruction. Default is 80. |
| ordered_session_scan_limit | number | – | Per-session scan limit for ordered reconstruction. Default is 4096. |
| parent_fusion | string | – | Parent fusion mode for chunk-parent reconstruction. Default is off. |
| parent_fusion_limit | number | – | Candidate limit for parent fusion. Default is 80. |
| parent_fusion_min_chunks | number | – | Minimum sibling chunks required for parent fusion. Default is 2. |
| preview_chars | integer | – | Maximum leading content length per hit in preview mode (100–2000 UTF-16 code units; default 200). Does not cap metadata or diagnostics. Ignored in full mode. |
| projects | array | – | Optional list of project IDs to scope the search to. Provide multiple for cross-project recall. If not provided, searches the default project. |
| query | string | yes | The natural language query to search the codebase memory for. |
| query_embedding | array | – | Optional precomputed query vector. Use this when the application owns the embedding provider. |
| query_time | string | – | Optional timestamp or natural-language time anchor used by v0.7 temporal query intent. |
| response_mode | string | – | Default full. Use preview for broad discovery to return only a leading excerpt per hit, with IDs and source metadata. Fetch promising stored memories with cuemap_memory_get; previews are not complete… |
| semantic_mode | string | – | Query signal mode. lexical uses cue recall only, semantic uses vector candidate discovery, and hybrid reranks lexical candidates. Default is hybrid. |
| trace_timing | boolean | – | Include v0.7 timing diagnostics in the response. Default is false. |
No output schema declared.
No examples provided.
cuemap_stats ~62
Read CueMap statistics for the repository-scoped project or globally across the engine.
| Name | Type | Req | Description |
|---|---|---|---|
| global | boolean | – | Return global engine statistics instead of project statistics. Default is false. |
| project | string | – | Optional project ID. Defaults to the repository-scoped project. |
No output schema declared.
No examples provided.
cuemap_status ~72
Check CueMap background ingestion progress for a project. After cuemap_init, poll this tool until verified_complete is true. An initial idle status with 0/0 writes is not proof that ingestion completed.
| Name | Type | Req | Description |
|---|---|---|---|
| project | string | – | Optional project ID. Defaults to the stable repository-scoped CueMap project ID. |
No output schema declared.
No examples provided.
What is the io.github.cuemap-dev/cuemap-mcp server?
io.github.cuemap-dev/cuemap-mcp is listed in the public MCP registry as io.github.cuemap-dev/cuemap-mcp. Local memory and context retrieval for AI agents through CueMap. This page covers its npm package (cuemap-mcp).
Is the io.github.cuemap-dev/cuemap-mcp server safe to use?
io.github.cuemap-dev/cuemap-mcp scores 68 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 26 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.cuemap-dev/cuemap-mcp server expose?
io.github.cuemap-dev/cuemap-mcp exposes 31 tools: cuemap_init_preview, cuemap_init, cuemap_add, cuemap_intent_classify, cuemap_status, and 26 more. Their descriptions and schemas cost roughly 3,375 tokens of context every time the server is loaded.
Is the io.github.cuemap-dev/cuemap-mcp server still maintained?
io.github.cuemap-dev/cuemap-mcp is still listed as active in the MCP registry. We last reached this channel on 26 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.cuemap-dev/cuemap-mcp server under?
io.github.cuemap-dev/cuemap-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.