MemoFS MCP Server
NPM · @MEMOFS/MCP-SERVER · 2 COMPONENTS
Persistent memory and virtual filesystem MCP server for AI agents.
Available components
Last scanned (15 hours ago)
Scores higher than 94% of npm servers
Category Memory and Knowledge
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 30 of 94 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency74
- Repository check failed: the declared repository URL redirects; it must resolve directly. See how to fix → View diagnostics → Fail
- Cryptographically verified build provenance (signed, bound to memo-fs/memofs). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 79 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability84
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2157 tokens (~113/item across 19 items; 10 tools + 9 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage99
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 97% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 10 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 12 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Checks we ran (16)
- Malware scan
- Known CVEs
- Install scripts
- Dependency health
- Source repository
- Provenance
- License
- Maintenance
- Security disclosure
- Schema quality
- Stability
- Tool coverage
- Injection markers
- Destructive annotations
- Judged manipulation
- MCP protocol
Does not apply to this package (2)
- Endpoint SecurityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
- Transport & ReachabilityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
The score does not measure everything. What the score does not measure →
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
- Stability: 0.97 → pass security
- Security disclosure: unverified → pass ▲ functional
- 4 Nov 26 0
- Security disclosure: pass → unverified ▼ functional
- 3 Nov 26 −1
- Stability: pass → 0.93 functional
- 2 Nov 26 0
- Security disclosure: unverified → pass ▲ functional
- 31 Oct 26 0
- Security disclosure: pass → unverified ▼ functional
- 28 Oct 26 0
- Stability: 0.97 → pass security
- 27 Oct 26 0
- Stability: pass → 0.97 functional
- 21 Oct 26 +1
- Stability: 0.97 → pass security
- Security disclosure: unverified → pass ▲ functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/@memofs/mcp-server@1.3.0-beta.3
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | memo-fs/memofs |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/memo-fs/memofs/.github/workflows/release.yml@refs/heads/main |
| Rekor log index | 2498461967 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:86641ea11f52aa5c20e7e9fb1531af52ffd1c4772391717e7d005a5f3f81bee0e787cec40931b8236225102c83f01cd3bf05a7185615aa9389ab728e8 |
Background: How many MCP packages publish verified provenance →
Dependencies 94 packages
| Packages resolved | 94 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
memofs_agent_session_append Append MemoFS Agent Session File ~88
Append to an allowed working/ or output/ file in an AgentFS session.
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | yes | Content to append. |
| path | string | yes | Session file path. |
| projectId | string | – | Project id inside the workspace. |
| sessionId | string | yes | Session id. |
| workspaceId | string | – | Workspace id. The runtime decides whether this is required. |
No output schema declared.
No examples provided.
memofs_agent_session_complete Complete MemoFS Agent Session ~359
Extract, checkpoint, push, and optionally persist durable memory from an AgentFS session. Set `outcome` explicitly — the `"success"` default is for backward-compatibility only and is NOT recommended for new callers. `outcome: "success"` + `extractDurableMemory: true` promotes durable memory to notes.md and auto-cleans `working/` (output preserved). `outcome: "failure"` never promotes durable; pass `ephemeral: true` to clean `working/` + `output/`, or omit to preserve them as failure audit-trail. `outcome: "aborted"` preserves the entire workspace for resume via a future `complete({outcome:"success"|"failure"})` with the same `sessionId`. A `reason` string on `failure`/`aborted` is recorded in a `session.failed` audit event for telemetry.
| Name | Type | Req | Description |
|---|---|---|---|
| checkpointLabel | string | – | Checkpoint label. |
| ephemeral | boolean | – | On outcome: "failure", opt-in cleanup of working/ + output/ session files. Ignored for other outcomes. |
| extractDurableMemory | boolean | – | Persist output/durable-memory.md into MemoFS notes (first gate; requires outcome: "success" to promote). |
| outcome | string | – | Session outcome. Defaults to "success" for backward-compatibility. Set explicitly — new callers should NOT rely on the default. |
| projectId | string | – | Project id inside the workspace. |
| reason | string | – | Structured failure/abort audit text; carried on the session.failed audit event. |
| sessionId | string | yes | Session id. |
| workspaceId | string | – | Workspace id. The runtime decides whether this is required. |
No output schema declared.
No examples provided.
memofs_agent_session_extract Extract MemoFS Agent Session Memory ~71
Extract summary, durable memory, follow-ups, errors, and changes from an AgentFS session.
| Name | Type | Req | Description |
|---|---|---|---|
| projectId | string | – | Project id inside the workspace. |
| sessionId | string | yes | Session id. |
| workspaceId | string | – | Workspace id. The runtime decides whether this is required. |
No output schema declared.
No examples provided.
memofs_agent_session_read Read MemoFS Agent Session File ~69
Read one AgentFS session file.
| Name | Type | Req | Description |
|---|---|---|---|
| path | string | yes | Session file path. |
| projectId | string | – | Project id inside the workspace. |
| sessionId | string | yes | Session id. |
| workspaceId | string | – | Workspace id. The runtime decides whether this is required. |
No output schema declared.
No examples provided.
memofs_agent_session_start Start MemoFS Agent Session ~98
Create an AgentFS-backed MemoFS session workspace and return paths/resources for coding agents.
| Name | Type | Req | Description |
|---|---|---|---|
| actorId | string | – | Actor id such as assistant:codex. |
| projectId | string | – | Project id inside the workspace. |
| sessionId | string | – | Optional safe session id. |
| task | string | yes | Agent task or brief. |
| workspaceId | string | – | Workspace id. The runtime decides whether this is required. |
No output schema declared.
No examples provided.
memofs_agent_session_write Write MemoFS Agent Session File ~86
Write an allowed working/ or output/ file in an AgentFS session.
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | yes | File content. |
| path | string | yes | Session file path. |
| projectId | string | – | Project id inside the workspace. |
| sessionId | string | yes | Session id. |
| workspaceId | string | – | Workspace id. The runtime decides whether this is required. |
No output schema declared.
No examples provided.
memofs.consolidate Consolidate MemoFS Graph Memory ~201
Run a memory consolidation pass over the local graph: merge duplicate entities and retire facts superseded by a `supersedes` edge. The audit trail is preserved — nothing is deleted, only marked `deprecated`. This is the second half of v1 intelligence: extraction grows the graph, consolidation keeps it tidy. Pass apply=false to preview the plan without persisting. Hosts should authorize this write when apply is true.
| Name | Type | Req | Description |
|---|---|---|---|
| apply | boolean | – | Persist the computed plan (merges + retirements). Defaults to true; pass false to preview. |
| now | string | – | Override the `now` timestamp stamped on retirements (ISO 8601). Mainly for tests. |
| projectId | string | – | Project id inside the workspace. |
| supersedingEdgeType | string | – | Edge type expressing 'A replaces B'. Defaults to 'supersedes'. |
| workspaceId | string | – | Workspace id. The runtime decides whether this is required. |
No output schema declared.
No examples provided.
memofs.context Build MemoFS Agent Context ~466
REQUIRED at the start of every task: build task-ready memory context by combining core memory, recent memory, and recall. MemoFS is the single source of truth for project identity, architecture, constraints, and decisions — ALWAYS call this before planning or writing code so your work adheres to stored memory. The returned text already tells you how to act on it. Read-only. By default returns a COMPACT briefing (~6kb): core memory in full, the top entities and a few recall fragments, plus an `expandable` list. Each expandable entry names a section (entities/recall/recent/notes), how many more items it holds, and an opaque cursor. To pull just one section in full, call memofs.context again with the same query plus `section` and `expand` (the cursor). Expand only the sections you need, then stop — do not expand everything. Pass `detail: "full"` to get the entire context in one call instead (larger; use when you want the whole dump).
| Name | Type | Req | Description |
|---|---|---|---|
| detail | string | – | Disclosure level. "compact" (default): a small briefing with expandable sections. "full": the entire context in one call. |
| expand | string | – | Opaque expansion cursor returned by a prior compact call. Set together with `section`. |
| filters | object | – | Runtime-specific JSON filters. |
| includeCore | boolean | – | Include core memory. |
| includeGraph | boolean | – | Ask runtime for graph-aware context. |
| includeNotes | boolean | – | Include notes memory. |
| includeRecent | boolean | – | Include recent memory events. |
| includeSources | boolean | – | Include source references. |
| limit | integer | – | Maximum recall items to include. |
| maxBytes | integer | – | Maximum context text bytes. |
| projectId | string | – | Project id inside the workspace. |
| query | string | yes | Current user task or context query. |
| section | string | – | Expand a single section: set together with `expand` to the cursor a compact call returned. |
| taskType | string | – | Kind of task the agent is performing. The strategist tailors the recall query per task type. Defaults to "general". |
| workspaceId | string | – | Workspace id. The runtime decides whether this is required. |
No output schema declared.
No examples provided.
memofs.recall Recall MemoFS Memory ~207
Semantic + lexical memory search. Use this proactively — before answering, when unsure, or when a fact might already be known. Phrases it understands: synonyms and paraphrases, not just exact keywords. Call it instead of guessing or re-deriving facts. Read-only; never modifies memory. Each returned item may carry an optional `anchor` (the code file + hash this fact is bound to) and a `stale` flag (true when the anchored file changed since write — re-verify before trusting).
| Name | Type | Req | Description |
|---|---|---|---|
| filters | object | – | Runtime-specific JSON filters. |
| includeGraph | boolean | – | Whether to include graph-aware recall if supported. |
| includeSources | boolean | – | Whether to include source references. |
| limit | integer | – | Maximum results to return. |
| projectId | string | – | Project id inside the workspace. |
| query | string | yes | Natural language recall query. |
| workspaceId | string | – | Workspace id. The runtime decides whether this is required. |
No output schema declared.
No examples provided.
memofs.remember Remember MemoFS Memory ~237
Persist a durable fact so future agents benefit — call this WITHOUT being asked whenever you discover a decision, constraint, preference, or architectural fact. Use kind to classify (decision/constraint/goal/preference/reference/summary/note). Set confidence to reflect certainty. Hosts may require user consent; never store secrets. This is what makes memory accumulate intelligently.
| Name | Type | Req | Description |
|---|---|---|---|
| anchor | object | – | Code anchor: bind this memory to a file's bytes for drift detection. When set, recall recomputes the file's SHA-256 and flags this memory stale if the bytes changed or the file was deleted. |
| confidence | number | – | Confidence score. |
| content | string | yes | Memory note content. |
| kind | string | – | Memory kind. Defaults to note. |
| metadata | object | – | JSON metadata. |
| projectId | string | – | Project id inside the workspace. |
| source | string | – | Source actor or origin label. |
| sourceRefs | array | – | – |
| tags | array | – | – |
| title | string | – | Optional title. |
| workspaceId | string | – | Workspace id. The runtime decides whether this is required. |
No output schema declared.
No examples provided.
How do I install the MemoFS MCP Server server?
MemoFS MCP Server runs locally as an npm package, launched with npx -y @memofs/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @memofs/mcp-server
claude mcp add dev-memofs-mcp-server -- npx -y @memofs/mcp-server
What is the MemoFS MCP Server server?
MemoFS MCP Server is listed in the public MCP registry as dev.memofs/mcp-server. Persistent memory and virtual filesystem MCP server for AI agents. This page covers its npm package (@memofs/mcp-server).
Is the MemoFS MCP Server server safe to use?
MemoFS MCP Server scores 91 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the MemoFS MCP Server server expose?
MemoFS MCP Server exposes 10 tools: memofs_agent_session_start, memofs_agent_session_read, memofs_agent_session_write, memofs_agent_session_append, memofs_agent_session_extract, and 5 more. Their descriptions and schemas cost roughly 1,882 tokens of context every time the server is loaded.
Is the MemoFS MCP Server server still maintained?
MemoFS MCP Server is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the MemoFS MCP Server server under?
MemoFS MCP Server declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.
What did VerifyMCP test on the MemoFS MCP Server server?
VerifyMCP ran 16 checks on MemoFS MCP Server, covering Malware scan, Known CVEs, Install scripts, Dependency health and 12 more. Endpoint Security and Transport & Reachability do not apply to an npm package, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.