# io.github.cuemap-dev/cuemap-mcp (npm · cuemap-mcp)

Local memory and context retrieval for AI agents through CueMap.

- Trust score: 68/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-26

## Components

- npm · `cuemap-mcp`: 68/100 (this document), [markdown](https://verifymcp.io/servers/cuemap-dev-cuemap-mcp/cuemap-mcp.md), [page](https://verifymcp.io/servers/cuemap-dev-cuemap-mcp/cuemap-mcp)

## Channel facts

- Registry: `npm`
- Package: `cuemap-mcp`
- Version: `0.7.4`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-26.

- **Supply Chain Security**: 98/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 31 of 101 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 5 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 76/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 3375 tokens (~108/item across 31 items; 31 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 93/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 78% of tool parameters carry a description.
- **Tool Safety**: 75/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - 0 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "cuemap_memory_delete" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default.
  - An AI judge read all 31 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the io.github.cuemap-dev/cuemap-mcp server?

io.github.cuemap-dev/cuemap-mcp runs locally as an npm package, launched with npx -y cuemap-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add cuemap-dev-cuemap-mcp -- npx -y cuemap-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "cuemap-dev-cuemap-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "cuemap-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "cuemap-dev-cuemap-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "cuemap-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add cuemap-dev-cuemap-mcp -- npx -y cuemap-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "cuemap-dev-cuemap-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "cuemap-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add cuemap-dev-cuemap-mcp --command npx --arg -y --arg cuemap-mcp
```

### Hermes

```yaml
mcp_servers:
  cuemap-dev-cuemap-mcp:
    command: "npx"
    args: ["-y", "cuemap-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "cuemap-dev-cuemap-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "cuemap-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add cuemap-dev-cuemap-mcp -t stdio -c npx -a -y cuemap-mcp
```

### Other

```json
{
  "mcpServers": {
    "cuemap-dev-cuemap-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "cuemap-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-25 (score 68, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-09-20 (score 68)

First indexed and scored.

## MCP tools (31)

### `cuemap_init_preview` (~143 tokens)

Preview supported repository files without ingesting content. Call this before first-time repository initialization, present the grouped paths to the user, and ask them to confirm or adjust the selection before calling cuemap_init.

Input parameters:

- `ignoredExtensions` (array): Optional additional excluded extensions without a leading dot.
- `ignoredPatterns` (array): Optional additional gitignore-style exclusion patterns.
- `includedPaths` (array): Optional repository-relative files or folders to preview. Empty means every supported file allowed by ignore rules.
- `path` (string, required): Absolute path to the repository root.
- `projectName` (string): Optional project ID. Defaults to the stable repository-scoped CueMap project ID.

### `cuemap_init` (~162 tokens)

Apply a user-confirmed repository ingestion scope and start CueMap's incremental filesystem watcher. Always call cuemap_init_preview first for a new repository and obtain explicit user confirmation before setting confirmed=true.

Input parameters:

- `confirmed` (boolean, required): Must be true only after the user explicitly confirms the previewed ingestion scope.
- `ignoredExtensions` (array): Additional excluded extensions without a leading dot.
- `ignoredPatterns` (array): Additional gitignore-style exclusion patterns approved by the user.
- `includedPaths` (array): User-approved repository-relative files or folders. Empty means every supported file allowed by ignore rules.
- `path` (string, required): Absolute path to the repository root.
- `projectName` (string): Optional project ID. Defaults to the stable repository-scoped CueMap project ID.

### `cuemap_add` (~228 tokens)

Store a natural-language memory in CueMap. Uses the repository-scoped default project unless one is supplied, creates it when needed, and applies deterministic cue extraction plus any cues and metadata.

Input parameters:

- `async_ingest` (boolean): Process ingestion in the background and return immediately. Default is false.
- `content` (string, required): The natural-language memory content to store.
- `cues` (array): Normally omit: CueMap generates cues from content automatically. Optionally add deliberate reusable tags, e.g. type:conversation for an explicitly saved conversation.
- `disable_temporal_chunking` (boolean): Disable temporal chunking for this memory. Default is false.
- `embedding` (array): Optional precomputed memory embedding.
- `event_time` (number): Optional original event timestamp as Unix seconds. Defaults to ingestion time.
- `metadata` (object): Optional JSON metadata to store with the memory.
- `project` (string): Optional project ID. Defaults to a stable ID derived from the current Git repository.
- `source_key` (string): Optional stable source key for deterministic upsert/deduplication.

### `cuemap_intent_classify` (~77 tokens)

Classify text with CueMap's local intent model and return recall/memory eligibility signals. Scores are ranking signals, not calibrated probabilities.

Input parameters:

- `project` (string): Optional project ID. Defaults to the repository-scoped project.
- `target` (string): Classification target. Default is query.
- `text` (string, required)

### `cuemap_status` (~72 tokens)

Check CueMap background ingestion progress for a project. After cuemap_init, poll this tool until verified_complete is true. An initial idle status with 0/0 writes is not proof that ingestion completed.

Input parameters:

- `project` (string): Optional project ID. Defaults to the stable repository-scoped CueMap project ID.

### `cuemap_projects` (~27 tokens)

List CueMap projects, summary metadata, and whether each project is currently loaded in RAM.

### `cuemap_project_save` (~58 tokens)

Persist the current state of a CueMap project without unloading it. Package operations save automatically; use this only when an explicit durable checkpoint is useful.

Input parameters:

- `project` (string): Project ID to save. Defaults to the repository-scoped project.

### `cuemap_project_load` (~57 tokens)

Load a persisted CueMap project into RAM before a latency-sensitive operation. Normal project requests load automatically, so use this for explicit warm-up.

Input parameters:

- `project` (string): Project ID to load. Defaults to the repository-scoped project.

### `cuemap_project_unload` (~68 tokens)

Persist and unload a CueMap project from RAM to reduce memory use. Use only when the user explicitly asks to unload or free inactive project memory; active projects return a retryable busy error.

Input parameters:

- `project` (string): Project ID to unload. Defaults to the repository-scoped project.

### `cuemap_project_pack` (~119 tokens)

Write a ready-to-query .cuemap package for one project to a local file. The package contains sensitive project content; use only after the user explicitly approves the exact output path.

Input parameters:

- `confirmed` (boolean): Must be true after explicit user approval of the output path and any overwrite.
- `output_path` (string, required): Absolute local path for the .cuemap file.
- `overwrite` (boolean): Replace an existing output file. Default is false.
- `project` (string): Project ID to package. Defaults to the repository-scoped project.

### `cuemap_project_package_load` (~74 tokens)

Install and warm a local .cuemap package. Use only after the user explicitly approves the exact package path; existing projects are never overwritten.

Input parameters:

- `confirmed` (boolean): Must be true after explicit user approval of the package path.
- `package_path` (string, required): Absolute local path to the .cuemap package.

### `cuemap_project_push` (~100 tokens)

Pack and upload a CueMap project with the engine host's configured AWS CLI. Use only after explicit approval of the exact S3 destination; an existing object at that URI may be replaced.

Input parameters:

- `confirmed` (boolean): Must be true after explicit user approval of the S3 destination.
- `destination` (string, required): Exact S3 object URI or prefix.
- `project` (string): Project ID to push. Defaults to the repository-scoped project.

### `cuemap_project_pull` (~85 tokens)

Download, install, and warm a .cuemap package with the engine host's configured AWS CLI. Use only after explicit approval of the exact S3 source; existing projects are never overwritten.

Input parameters:

- `confirmed` (boolean): Must be true after explicit user approval of the S3 source.
- `source` (string, required): Exact S3 object URI for a .cuemap package.

### `cuemap_project_sync` (~116 tokens)

Fast-forward a project through immutable history at an S3 sync root. Pushes local-only changes, pulls remote-only changes, and refuses divergent histories or stale concurrent writes. Use only after explicit approval of the project and exact S3 root.

Input parameters:

- `confirmed` (boolean): Must be true after explicit user approval of the project and S3 sync root.
- `project` (string): Project ID to synchronize. Defaults to the repository-scoped project.
- `remote` (string, required): Exact S3 root used for this project's sync history.

### `cuemap_stats` (~62 tokens)

Read CueMap statistics for the repository-scoped project or globally across the engine.

Input parameters:

- `global` (boolean): Return global engine statistics instead of project statistics. Default is false.
- `project` (string): Optional project ID. Defaults to the repository-scoped project.

### `cuemap_memory_get` (~73 tokens)

Get one stored memory as readable text with source metadata. Pass the memory_id and owning project_id from recall as memory_id and project. Does not expand neighbors or read live source files.

Input parameters:

- `memory_id` (integer, required)
- `project` (string): Optional project ID. Defaults to the repository-scoped project.

### `cuemap_memory_reinforce` (~58 tokens)

Reinforce one CueMap memory, optionally along specific cue pathways.

Input parameters:

- `cues` (array)
- `memory_id` (integer, required)
- `project` (string): Optional project ID. Defaults to the repository-scoped project.

### `cuemap_memory_delete` (~71 tokens)

Permanently delete one CueMap memory. Set confirmed=true only after explicit user confirmation.

Input parameters:

- `confirmed` (boolean, required): Must be true only after the user explicitly confirms permanent deletion.
- `memory_id` (integer, required)
- `project` (string): Optional project ID. Defaults to the repository-scoped project.

### `cuemap_ingest_url` (~99 tokens)

Explicitly ingest content from a URL, optionally crawling same-domain links. Use only when the user asks to ingest that URL.

Input parameters:

- `depth` (integer): Crawl depth. Zero ingests only the supplied page.
- `project` (string): Optional project ID. Defaults to the repository-scoped project.
- `same_domain_only` (boolean): Restrict recursive crawling to the starting domain. Default is true.
- `url` (string, required)

### `cuemap_ingest_content` (~195 tokens)

Explicitly ingest supplied raw content into CueMap. Use only when the user asks to persist that content.

Input parameters:

- `content` (string, required)
- `embeddings` (array): Optional one-vector-per-produced-chunk embeddings.
- `filename` (string): Logical source filename used for type detection. Default is content.txt.
- `metadata` (object)
- `project` (string): Optional project ID. Defaults to the repository-scoped project.
- `segment_max_chunk_chars` (integer)
- `segment_min_chunk_chars` (integer)
- `segment_overlap` (integer)
- `segment_window_size` (integer)
- `segmenter` (string)
- `source_key` (string): Stable source key for deterministic replacement or deduplication.
- `structural_cues` (array): Normally omit: CueMap extracts structural cues automatically. Optionally add reliable source structure or a reusable category such as type:conversation.

### `cuemap_ingest_file` (~70 tokens)

Explicitly ingest one local file into CueMap. Use only for a file the user has placed in scope and asked to ingest.

Input parameters:

- `path` (string, required): Absolute or repository-relative path to the file.
- `project` (string): Optional project ID. Defaults to the repository-scoped project.

### `cuemap_project_export` (~80 tokens)

Export a cursor-paginated page of memories from a CueMap project.

Input parameters:

- `cursor`
- `include_content` (boolean)
- `include_cues` (boolean)
- `include_metadata` (boolean)
- `limit` (integer)
- `project` (string): Optional project ID. Defaults to the repository-scoped project.

### `cuemap_project_artifacts` (~47 tokens)

Inspect CueBridge artifact metadata for a CueMap project without reloading or mutating it.

Input parameters:

- `project` (string): Optional project ID. Defaults to the repository-scoped project.

### `cuemap_alias_list` (~44 tokens)

List manual cue aliases associated with one cue.

Input parameters:

- `cue` (string, required)
- `project` (string): Optional project ID. Defaults to the repository-scoped project.

### `cuemap_alias_add` (~73 tokens)

Add a manual weighted mapping from one cue to another.

Input parameters:

- `from` (string, required)
- `project` (string): Optional project ID. Defaults to the repository-scoped project.
- `to` (string, required)
- `weight` (number): Association weight from 0 to 1. Default is 1.

### `cuemap_alias_merge` (~77 tokens)

Merge multiple cues into one canonical cue. Set confirmed=true only after explicit user confirmation.

Input parameters:

- `confirmed` (boolean, required): Must be true only after the user explicitly confirms the merge.
- `cues` (array, required)
- `project` (string): Optional project ID. Defaults to the repository-scoped project.
- `to` (string, required)

### `cuemap_lexicon_inspect` (~47 tokens)

Inspect one cue and its Lexicon relationships.

Input parameters:

- `cue` (string, required)
- `project` (string): Optional project ID. Defaults to the repository-scoped project.

### `cuemap_lexicon_graph` (~40 tokens)

Read the current Lexicon graph for a project.

Input parameters:

- `project` (string): Optional project ID. Defaults to the repository-scoped project.

### `cuemap_lexicon_wire` (~56 tokens)

Manually wire a token to a canonical Lexicon cue.

Input parameters:

- `canonical` (string, required)
- `project` (string): Optional project ID. Defaults to the repository-scoped project.
- `token` (string, required)

### `cuemap_lexicon_delete` (~71 tokens)

Permanently delete one Lexicon entry. Set confirmed=true only after explicit user confirmation.

Input parameters:

- `confirmed` (boolean, required): Must be true only after the user explicitly confirms permanent deletion.
- `entry_id` (required)
- `project` (string): Optional project ID. Defaults to the repository-scoped project.

### `cuemap_recall` (~826 tokens)

Recall evidence for a focused question; follow up with narrower queries as needed. Returns engine JSON with project_id and memory_id handles, source metadata, and requested diagnostics in text and structuredContent. Use handles with cuemap_memory_get when the stored record is needed. Hybrid locally reranks lexical candidates. Start with a small limit and depth 1; enable reconstruction only when surrounding evidence is needed.

Input parameters:

- `auto_reinforce` (boolean): Automatically reinforce retrieved memories. Default is false.
- `cuebridge_gap_limit` (number): Maximum CueBridge gap expansions. Default is 6.
- `cues` (array): Normally omit: CueMap generates cues from the query. Supply known tags only to deliberately narrow lexical/hybrid recall, e.g. type:conversation to search tagged conversations.
- `depth` (number): Depth of multi-hop recall. Default is 1.
- `disable_alias_expansion` (boolean): Disable alias expansion during querying. Default is true.
- `disable_cuebridge_artifacts` (boolean): Disable CueBridge artifact expansion. Default is false.
- `disable_salience_bias` (boolean): Disable salience bias scoring. Default is false.
- `evidence_coverage` (string): Evidence coverage mode for multi-evidence answers. Default is off.
- `evidence_coverage_limit` (number): Result scan limit for evidence coverage. Default is 100.
- `evidence_coverage_max_sessions` (number): Maximum sessions considered for evidence coverage. Default is 3.
- `evidence_coverage_session_scan_limit` (number): Per-session scan limit for evidence coverage. Default is 4096.
- `expansion_depth` (number): Neighbor context expansion. 1 returns the matched chunk; values above 1 include nearby parent chunks or source-ordered context with radius expansion_depth - 1 when linkage exists. Default is 1.
- `explain` (boolean): Include explain component for debug information in results. Default is false.
- `limit` (number): Optional limit on the number of results to return. Default is 10.
- `min_intersection` (number): Minimum intersection count for retrieval. Default is 0.
- `ordered_max_sessions` (number): Maximum sessions considered for ordered reconstruction. Default is 3.
- `ordered_reconstruction` (string): Ordered session reconstruction mode. Default is off.
- `ordered_reconstruction_limit` (number): Result scan limit for ordered reconstruction. Default is 80.
- `ordered_session_scan_limit` (number): Per-session scan limit for ordered reconstruction. Default is 4096.
- `parent_fusion` (string): Parent fusion mode for chunk-parent reconstruction. Default is off.
- `parent_fusion_limit` (number): Candidate limit for parent fusion. Default is 80.
- `parent_fusion_min_chunks` (number): Minimum sibling chunks required for parent fusion. Default is 2.
- `preview_chars` (integer): Maximum leading content length per hit in preview mode (100–2000 UTF-16 code units; default 200). Does not cap metadata or diagnostics. Ignored in full mode.
- `projects` (array): Optional list of project IDs to scope the search to. Provide multiple for cross-project recall. If not provided, searches the default project.
- `query` (string, required): The natural language query to search the codebase memory for.
- `query_embedding` (array): Optional precomputed query vector. Use this when the application owns the embedding provider.
- `query_time` (string): Optional timestamp or natural-language time anchor used by v0.7 temporal query intent.
- `response_mode` (string): Default full. Use preview for broad discovery to return only a leading excerpt per hit, with IDs and source metadata. Fetch promising stored memories with cuemap_memory_get; previews are not complete…
- `semantic_mode` (string): Query signal mode. lexical uses cue recall only, semantic uses vector candidate discovery, and hybrid reranks lexical candidates. Default is hybrid.
- `trace_timing` (boolean): Include v0.7 timing diagnostics in the response. Default is false.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/cuemap-dev-cuemap-mcp/cuemap-mcp#diagnostics

## Score history

- 2026-09-26: 68
- 2026-09-25: 68
- 2026-09-24: 68
- 2026-09-23: 68
- 2026-09-22: 68
- 2026-09-21: 68
- 2026-09-20: 68

## Common questions

### What is the io.github.cuemap-dev/cuemap-mcp server?

io.github.cuemap-dev/cuemap-mcp is listed in the public MCP registry as io.github.cuemap-dev/cuemap-mcp. Local memory and context retrieval for AI agents through CueMap. This page covers its npm package (cuemap-mcp).

### Is the io.github.cuemap-dev/cuemap-mcp server safe to use?

io.github.cuemap-dev/cuemap-mcp scores 68 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 26 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the io.github.cuemap-dev/cuemap-mcp server expose?

io.github.cuemap-dev/cuemap-mcp exposes 31 tools: cuemap_init_preview, cuemap_init, cuemap_add, cuemap_intent_classify, cuemap_status, and 26 more. Their descriptions and schemas cost roughly 3,375 tokens of context every time the server is loaded.

### Is the io.github.cuemap-dev/cuemap-mcp server still maintained?

io.github.cuemap-dev/cuemap-mcp is still listed as active in the MCP registry. We last reached this channel on 26 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the io.github.cuemap-dev/cuemap-mcp server under?

io.github.cuemap-dev/cuemap-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/cuemap-mcp
- Socket report: https://socket.dev/npm/package/cuemap-mcp
- Repository: https://github.com/cuemap-dev/cuemap-mcp
- Changelog RSS feed: https://verifymcp.io/servers/cuemap-dev-cuemap-mcp/cuemap-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/cuemap-dev-cuemap-mcp/cuemap-mcp.json
- HTML version of this page: https://verifymcp.io/servers/cuemap-dev-cuemap-mcp/cuemap-mcp