# MemVault - Local-First Agent Memory (oci · ghcr.io/dreamor/memvault)

Local-first memory for AI agents: save, recall, dedupe, and share across MCP clients.

- Trust score: 51/100 (low)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- oci · `ghcr.io/dreamor/memvault`: 51/100 (this document), [markdown](https://verifymcp.io/servers/dreamor-memvault/ghcr-io-dreamor-memvault.md), [page](https://verifymcp.io/servers/dreamor-memvault/ghcr-io-dreamor-memvault)

## Channel facts

- Registry: `oci`
- Package: `ghcr.io/dreamor/memvault`
- Version: `v0.6.12`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 0/100
  - No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.
  - Known CVEs could not be checked: this artifact ships no SBOM or dependency manifest, so there is no dependency list to read.
  - Install-script risk not yet assessed.
  - Dependency health could not be checked: this artifact ships no SBOM or dependency manifest, so there is no dependency list to read.
- **Provenance & Transparency**: 48/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 0 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 76/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 4786 tokens (~217/item across 22 items; 20 tools + 2 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 70/100
  - Stability observed for 21 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 22 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the MemVault - Local-First Agent Memory MCP server?

MemVault - Local-First Agent Memory runs locally as a container image, launched with docker run --rm -i ghcr.io/dreamor/memvault:v0.6.12. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add dreamor-memvault -- docker run --rm -i ghcr.io/dreamor/memvault:v0.6.12
```

### Cursor

```json
{
  "mcpServers": {
    "dreamor-memvault": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/dreamor/memvault:v0.6.12"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "dreamor-memvault": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/dreamor/memvault:v0.6.12"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add dreamor-memvault -- docker run --rm -i ghcr.io/dreamor/memvault:v0.6.12
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "dreamor-memvault": {
      "type": "local",
      "command": [
        "docker",
        "run",
        "--rm",
        "-i",
        "ghcr.io/dreamor/memvault:v0.6.12"
      ],
      "enabled": true
    }
  }
}
```

### Hermes

```yaml
mcp_servers:
  dreamor-memvault:
    command: "docker"
    args: ["run", "--rm", "-i", "ghcr.io/dreamor/memvault:v0.6.12"]
```

### Netclaw

```json
{
  "McpServers": {
    "dreamor-memvault": {
      "Transport": "stdio",
      "Command": "docker",
      "Arguments": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/dreamor/memvault:v0.6.12"
      ]
    }
  }
}
```

### Other

```json
{
  "mcpServers": {
    "dreamor-memvault": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/dreamor/memvault:v0.6.12"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-04 (score 51, +1)

- [security regression] Tool safety: pass → unverified
- [security regression] Stability: 0.63 → unverified
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional] Package version: v0.6.11 → v0.6.12

### 2026-11-02 (score 50, +1)

No change was recorded against any check on this day. Stability & Change Management went from 57 to 60. That category is still filling its 30-day observation window: 17 days of observed history at the previous scan, 18 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-31 (score 49, +1)

No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-30 (score 48, 0)

- [functional] Package version: v0.6.10 → v0.6.11

### 2026-10-29 (score 48, +7)

- [security regression] Stability: 0.43 → unverified
- [security regression] Tool safety: pass → unverified
- [security improvement] Source repository: fail → pass
- [functional regression] Schema quality: 168 → 204
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional] Schema quality: excellent → good
- [functional] Destructive annotations: All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
- [functional] Package version: v0.6.8 → v0.6.10
- [functional] Package version: v0.6.8 → v0.6.9

### 2026-10-28 (score 41, 0)

- [functional] Package version: v0.6.7 → v0.6.8

### 2026-10-27 (score 41, +1)

- [functional] Package version: v0.6.4 → v0.6.7
- [functional] Package version: v0.6.4 → v0.6.6
- [functional] Package version: v0.6.4 → v0.6.5

### 2026-10-25 (score 40, +1)

- [functional] Package version: v0.6.3 → v0.6.4

## MCP tools (20)

### `add_evidence` (~325 tokens)

Record evidence for a memory. relation="supports"/"contradicts" links evidence_id → memory_id (a memory supporting or contradicting it); relation="sourced_from" records memory_id's external provenance via `source` (URL/document). Writes one relation and returns its relation_id; an identical relation is rejected rather than duplicated. Contradictions accelerate the contradicted memory's decay; superseded or archived evidence stops counting. Requires agent auth when the agent has a registered key.

Input parameters:

- `agent_id` (string): ID of the requesting agent
- `api_key` (string|null): API key for agent authentication (required if agent has a registered key)
- `confidence` (number|null): Evidence confidence, 0.0-1.0 (default 0.8).
- `evidence_id` (string|null): The memory providing evidence (required for supports/contradicts).
- `memory_id` (string, required): The memory this evidence statement is ABOUT, or that the subject memory supports/contradicts — see `relation` for direction. For supports/contradicts: the memory being supported/contradicted. For sou…
- `relation` (string, required): Evidence relation: "supports" | "contradicts" | "sourced_from". supports/contradicts link two memories (`evidence_id` = the memory providing evidence); sourced_from records an external source text.
- `source` (string|null): External source: URL, document path, conversation reference (required for sourced_from).

### `confirm_read` (~125 tokens)

Confirm that one or more memories have been read by the agent. Increments access_count and sets last_read_at for the specified memory IDs; unknown IDs are skipped and the response reports how many rows were confirmed. Repeated calls increment the counters again (not idempotent). Requires agent auth when the agent has a registered key.

Input parameters:

- `agent_id` (string): ID of the requesting agent
- `api_key` (string|null): API key for agent authentication (required if agent has a registered key)
- `memory_ids` (array, required): List of memory IDs to confirm as read

### `delete_memory` (~148 tokens)

Soft-delete one memory by its ID: removes its live row, FTS entry, and cascaded evidence relations so it is no longer searchable or injected. A full snapshot is written to memory_history first; restore is available through the CLI (`memvault restore`), not through this MCP tool. Use forget_memory for an irreversible GDPR-style purge. Requires agent auth when the agent has a registered key; a second delete of the same ID returns NotFound.

Input parameters:

- `agent_id` (string): ID of the requesting agent
- `api_key` (string|null): API key for agent authentication (required if agent has a registered key)
- `memory_id` (string, required): ID of the memory to delete

### `extract_memories` (~398 tokens)

Extract structured memories from conversation text. mode="rule" (default) detects preferences, facts, and skills via keyword pattern matching. mode="llm" instead understands the full context (optionally pairing assistant_text) semantically — uses the configured LLM extraction provider, and degrades to rule-based extraction (reported via fallback_used/fallback_reason) when no provider is configured or the LLM call fails. Returns extracted items; with auto_save=true it also writes them through delta-write (near-identical memories are merged or skipped, not duplicated) and requires agent auth when the agent has a registered key. Use save_memory instead when you already know the exact memory to store. Invalid occurred_at is an error, never a silent drop.

Input parameters:

- `agent_id` (string): Agent ID to attribute saved memories to
- `api_key` (string|null): API key for agent authentication (required if agent has a registered key)
- `assistant_text` (string|null): Optional paired assistant/response text for mode="llm" — passing both sides of the exchange lets the model resolve references and implicit preferences a single text can't.
- `auto_save` (boolean): Whether to auto-save extracted memories
- `mode` (string|null): Extraction mode: "rule" (default, keyword pattern matching) or "llm" (semantic extraction over the full context; uses the configured LLM extraction provider, falling back to rule-based when none is c…
- `occurred_at` (string|null): When the extracted facts actually happened in the source conversation (RFC 3339), stored as `occurred_at` on saved memories — distinct from `created_at` (ingestion time). Invalid input is an error, n…
- `text` (string, required): Text to extract memories from (conversation content, e.g. the user's turn)

### `forget_memory` (~386 tokens)

Permanently erase (GDPR-style) one memory by id or a bulk set matched by criteria (namespace/namespace_prefix/source_agent_id/tag/memory_type/before_days). Unlike delete_memory, this also purges memory_history snapshots and any orphaned compliance rows, leaving only a content-hash audit entry in the forgotten-log — irreversible. dry_run defaults to true: call once to preview, then again with dry_run=false to execute. Priority::Must memories are excluded unless allow_must=true. Gated by the same per-agent API-key auth as delete_memory — there is no separate admin tier at the MCP layer.

Input parameters:

- `agent_id` (string): ID of the requesting agent
- `allow_must` (boolean): Explicit override to include Priority::Must memories (otherwise excluded by default)
- `api_key` (string|null): API key for agent authentication (required if agent has a registered key)
- `before_days` (integer|null): Bulk: not updated in this many days
- `dry_run` (boolean): Preview matches without purging anything (default: true — forgetting is irreversible, so a caller must explicitly set this to false to execute)
- `memory_id` (string|null): ID of a single memory to permanently erase. Mutually exclusive with the criteria fields below — when set, every criteria field is ignored.
- `memory_type` (string|null): Bulk: memory type (preference, fact, episode, entity, skill)
- `namespace` (string|null): Bulk: exact namespace match
- `namespace_prefix` (string|null): Bulk: namespace starts with this (e.g. "archived:")
- `reason` (string|null): Audit-trail reason recorded in the forgotten-log
- `source_agent_id` (string|null): Bulk: source agent id
- `tag` (string|null): Bulk: memories carrying this tag

### `get_compliance_report` (~189 tokens)

Get a compliance report for injection sessions: with inject_session_id, followed/violated/pending counts plus compliance_rate for that session; without it, an aggregate summary (total_sessions, overall_rate, must_rate, recent_sessions) filtered by optional agent_id and limit (default 10). compliance_rate/overall_rate/must_rate are null when no real MUST verdict exists yet (all pending/unknown); null never means 100%. Use report_compliance to record follow/violation status — this tool only reads it.

Input parameters:

- `agent_id` (string|null): Filter aggregate summary by agent
- `api_key` (string|null): API key for agent authentication (required if agent has a registered key)
- `inject_session_id` (string|null): Get report for a specific injection session
- `limit` (integer): Maximum number of recent sessions in the aggregate summary (default: 10)

### `get_effectiveness_report` (~122 tokens)

Get automatic effectiveness judgments for injected memories: useful/neutral/harmful/insufficient_context rates, judged automatically from record_outcome — independent of manual report_compliance. Optional agent_id filters the summary and limit defaults to 10. Read-only; returns JSON and does not change records.

Input parameters:

- `agent_id` (string|null): Filter by agent
- `api_key` (string|null): API key for agent authentication (required if agent has a registered key)
- `limit` (integer): Maximum number of recent judgments in the summary (default: 10)

### `get_memory_evidence` (~153 tokens)

Get the raw-evidence chain a memory was distilled from (its L0 trace rows), plus its evidence profile. Read-only grounding: lets an agent quote the original session text and name its sources. Use add_evidence to write a new relation or source — this tool only reads the existing chain. Missing or pruned evidence yields an empty chain rather than a write; requires agent auth when the agent has a registered key.

Input parameters:

- `agent_id` (string): ID of the requesting agent
- `api_key` (string|null): API key for agent authentication (required if agent has a registered key)
- `memory_id` (string, required): The memory whose raw-evidence chain (L0 trace rows) to expand

### `import_skills` (~197 tokens)

Import skills from a Markdown SOP document. Each #/## heading becomes a skill (trigger:/verification: metadata lines + list-item steps). Sections without steps are skipped. Imported skills enter the review inbox unless approve=true. Writes new skill memories; repeating the same import can create duplicates. Requires agent auth when the agent has a registered key.

Input parameters:

- `agent_id` (string): ID of the requesting agent
- `api_key` (string|null): API key for agent authentication (required if agent has a registered key)
- `approve` (boolean): Mark imported skills as human-reviewed (skip the inbox). Default false.
- `fallback_title` (string): Fallback skill title when the document has no headings.
- `markdown` (string, required): Markdown SOP text. Each #/## heading becomes a skill; `trigger:` / `verification:` lines and list items become the skill metadata.
- `namespace` (string): Namespace for the imported skills.

### `infer_outcome` (~341 tokens)

Classify and record a task outcome from host-provided evidence rather than raw transcript text — for hosts whose event model doesn't produce a Claude-Code-shaped JSONL transcript (e.g. dsh/Cordis session events). Pass pre-computed friction counts and terminal state in `evidence`; this runs the same rule-floor-plus-optional-LLM-judge classification as the Claude Code Stop hook's `outcome --infer`, then records exactly like record_outcome. Returns status 'skipped' (not an error) when nothing was inferred — a clean session, below the friction threshold, or no task evidence at all. Repeated calls for the same session/evidence are deduped. Requires agent auth when the agent has a registered key.

Input parameters:

- `agent_id` (string): ID of the agent reporting this outcome
- `agent_type` (string): Type of the agent (e.g., coding-assistant)
- `api_key` (string|null): API key for agent authentication (required if agent has a registered key)
- `evidence` (required): Structural evidence computed by the caller from its own event stream
- `judge_context` (string): Conversation excerpt handed to the LLM judge, if one is configured (DATA to analyze, not instructions). Optional — when empty, only the rule-based floor runs.
- `namespace` (string): Namespace for the episode memory (default: global)
- `session_id` (string|null): Session the task ran in, for traceability
- `tags` (array): Tags for categorization — "auto-inferred" and "inferred:rule"/"inferred:llm" are added automatically

### `list_inbox` (~127 tokens)

List memories pending human review, sorted by created_at ascending (oldest first). Read-only. Supports an optional namespace and limit (default 20); there is no offset/pagination, so a full page silently truncates older pending memories. Requires agent auth when the agent has a registered key.

Input parameters:

- `agent_id` (string): ID of the requesting agent
- `api_key` (string|null): API key for agent authentication (required if agent has a registered key)
- `limit` (integer): Maximum number of results to return
- `namespace` (string|null): Filter by namespace

### `record_outcome` (~356 tokens)

Record the outcome of a task you just executed (episodic memory). Call this after finishing a task so past successes and failures can inform future sessions. Status must be 'success', 'failure', or 'partial'. Failures with a cause are reflected into lessons that get injected into similar future tasks. Repeated calls for the same session/outcome are deduped rather than creating a second episode. Use infer_outcome instead when the host supplies structured evidence rather than a transcript; use add_evidence to attach provenance to an existing memory. Returns status (recorded | duplicate), the episode id, and any distilled lesson. Requires agent auth when the agent has a registered key.

Input parameters:

- `agent_id` (string): ID of the agent reporting this outcome
- `agent_type` (string): Type of the agent (e.g., coding-assistant)
- `api_key` (string|null): API key for agent authentication (required if agent has a registered key)
- `cause` (string|null): Attribution of the outcome, when known
- `namespace` (string): Namespace for the episode memory (default: global)
- `session_id` (string|null): Session the task ran in, for traceability
- `skill_id` (string|null): ID of the skill memory the agent followed, if any — attributes this outcome to the skill's success/failure statistics
- `status` (string, required): Outcome status: success, failure, or partial
- `tags` (array): Tags for categorization
- `task` (string, required): What task was executed (kept verbatim for retrieval)
- `task_type` (string|null): Coarse task category for lesson matching (e.g. deploy, debug, refactor)

### `report_compliance` (~162 tokens)

Report compliance for a previous injection session returned by session_start. Call this to mark which injected memories were followed or violated, with optional evidence. Reports are processed item by item: a bad item is logged and skipped while the call still succeeds, so the response's updated/total counts must be checked rather than assuming all reports were stored. Requires a compliance-enabled server; no agent API key is required by this tool.

Input parameters:

- `agent_id` (string): ID of the agent reporting compliance
- `api_key` (string|null): API key for agent authentication (required if agent has a registered key)
- `inject_session_id` (string, required): The inject_session_id from a previous session_start call
- `reports` (array, required): List of compliance reports, one per memory

### `review_memory` (~189 tokens)

Review or edit a memory. action='approve' marks it human-reviewed; action='edit' updates content/instruction and re-embeds or clears the stale vector (this also works on already-approved memories); action='reject' soft-deletes a pending memory and is rejected for already-approved memories (use delete_memory instead). Approved memories rank higher in future injections. Writes immediately; requires agent auth when the agent has a registered key.

Input parameters:

- `action` (string, required): Action: approve, reject, or edit
- `agent_id` (string): ID of the requesting agent
- `api_key` (string|null): API key for agent authentication (required if agent has a registered key)
- `edited_content` (string|null): New content if action is edit
- `edited_instruction` (string|null): New instruction if action is edit
- `memory_id` (string, required): ID of the memory to review

### `run_decay` (~152 tokens)

Run a memory decay cycle: reduces decay_score for old memories and archives memories that fall below the threshold. MUST memories are exempt from decay. This is not purely reversible: if MEMVAULT_FORGET_AUTO_ENABLED=1, the same run also permanently forgets archived memories older than MEMVAULT_FORGET_RETENTION_DAYS (default 90); otherwise auto-forget is off. Requires agent auth when the agent has a registered key. Returns updated/archived/contradicted/harmful_flagged/auto_forgotten counts.

Input parameters:

- `agent_id` (string): ID of the requesting agent
- `api_key` (string|null): API key for agent authentication (required if agent has a registered key)

### `run_dedup` (~117 tokens)

Scan for duplicate memories and report findings. Uses lexical text similarity (Jaccard) to detect near-duplicates in one namespace or all namespaces. Read-only: reports existing_id/new_content/similarity/action but does not merge or delete anything. Returns at most 20 duplicate findings.

Input parameters:

- `agent_id` (string): ID of the requesting agent
- `api_key` (string|null): API key for agent authentication (required if agent has a registered key)
- `namespace` (string|null): Namespace to scan (null for all)

### `run_promote` (~220 tokens)

Run the promote pipeline: consolidates atomic L1 memories into L2 scenario summaries, and promotes stable L2 memories into L3 core persona rules. Requires L1 memories to exist; run run_dedup first so near-duplicates don't become separate scenarios. Source memories are archived to L0 after promotion (not deleted). A maintenance step, not a substitute for run_decay. Mutates the store, is not idempotent, and requires agent auth when the agent has a registered key. Returns promoted/consolidated/merged/source counts.

Input parameters:

- `agent_id` (string): ID of the requesting agent
- `api_key` (string|null): API key for agent authentication (required if agent has a registered key)
- `min_l1` (integer|null): Minimum L1 memories to consolidate into L2 (default: 3)
- `min_l2` (integer|null): Minimum L2 memories to promote to L3 (default: 2)
- `namespace` (string|null): Namespace to scan (currently the promote pipeline scans all namespaces)

### `save_memory` (~448 tokens)

Save a new memory. Memories are persistent user preferences, facts, episodes, or skills that should be recalled in future conversations. Embeddings are generated automatically for semantic search. Delta-write is on by default: near-duplicate saves are skipped and similar existing memories absorb the new content instead of a new row being created (status in the response: saved | merged | skipped). Pass force_insert=true to bypass. Writes persist immediately; requires agent auth when the agent has a registered key.

Input parameters:

- `agent_id` (string): ID of the agent saving this memory
- `agent_type` (string): Type of the agent (e.g., coding-assistant)
- `api_key` (string|null): API key for agent authentication (required if agent has a registered key)
- `confidence` (number): Confidence score (0.0 to 1.0)
- `content` (string, required): The content of the memory to save
- `force_insert` (boolean): Force insert, skipping delta-write dedup/merge. By default a save is checked against similar memories in the same namespace: near-duplicates are skipped, similar memories absorb the new content's res…
- `instruction` (string|null): Optional instruction format for the memory
- `layer` (string|null): Memory layer: L0 (raw), L1 (atom), L2 (scenario), L3 (persona). Auto-assigned if omitted.
- `namespace` (string): Namespace for the memory (default: global)
- `priority` (string): Priority level: MUST, REFERENCE, or BACKGROUND
- `skill_steps` (array): Skill execution steps (only for type=skill)
- `skill_trigger` (string|null): Skill trigger pattern (only for type=skill)
- `skill_verification` (string|null): Skill verification criteria (only for type=skill)
- `tags` (array): Tags for categorization
- `type` (string): Memory type: preference, fact, episode, entity, or skill
- `visibility` (string|null): Sharing scope: "scoped" (default, namespace rules) or "shared" (team pool).

### `search_memory` (~345 tokens)

Search stored memories. mode defaults to 'hybrid' (keyword + vector via RRF); 'keyword' is text-only and 'semantic' is vector-only. Semantic/hybrid need an embedding provider — when embeddings are unavailable the query falls back to keyword and each result reports search_mode='keyword'. Supports namespace, type_filter, priority_filter, top_k (default 10), min_score, and optional expand_relations for one-hop relation context. Read-only; does not mutate memories.

Input parameters:

- `agent_id` (string|null): ID of the requesting agent
- `api_key` (string|null): API key for agent authentication (required if agent has a registered key)
- `expand_relations` (boolean): Attach each result's one-hop relation neighborhood (semantic graph expansion, C5). Default off.
- `min_score` (number|null): Drop results whose final (post-rerank) relevance score is below this threshold. Unset = return the full top_k regardless of score, the pre-existing behavior. Lets callers distinguish "no confident ma…
- `mode` (string): Search mode: "hybrid" (default; keyword + vector via RRF), "keyword" (text-only), or "semantic" (vector-only). Semantic/hybrid fall back to keyword when embeddings are unavailable.
- `namespace` (string|null): Filter by namespace
- `priority_filter` (string|null): Filter by priority
- `query` (string, required): Search query string
- `top_k` (integer): Maximum number of results to return
- `type_filter` (string|null): Filter by memory type

### `session_start` (~184 tokens)

Start an agent session. Returns relevant memories filtered by agent identity, formatted as MUST/REF instructions ready for injection into the conversation context; overflow memories are summarized with a hint to use search_memory for details. If this agent's canonical inject channel is not MCP, returns a skip explanation instead of injecting. When compliance tracking is enabled, records the injected memories and returns inject_session_id in structured_content for a later report_compliance call. Not read-only; requires agent auth when the agent has a registered key.

Input parameters:

- `agent_id` (string): ID of the agent starting the session
- `agent_type` (string): Type of the agent
- `api_key` (string|null): API key for agent authentication (required if agent has a registered key)
- `context_hint` (string|null): Hint about the current conversation context
- `project` (string|null): Current project name

## Diagnostics

Captured diagnostic sections: Provenance. The full working is on the page: https://verifymcp.io/servers/dreamor-memvault/ghcr-io-dreamor-memvault#diagnostics

## Score history

- 2026-11-05: 51
- 2026-11-04: 51
- 2026-11-03: 50
- 2026-11-02: 50
- 2026-11-01: 49
- 2026-10-31: 49
- 2026-10-30: 48
- 2026-10-29: 48
- 2026-10-28: 41
- 2026-10-27: 41
- 2026-10-26: 40
- 2026-10-25: 40
- 2026-10-24: 39
- 2026-10-23: 39
- 2026-10-22: 38
- 2026-10-21: 38
- 2026-10-20: 38
- 2026-10-19: 37
- 2026-10-18: 37
- 2026-10-17: 37
- 2026-10-16: 36
- 2026-10-15: 36

## Common questions

### What is the MemVault - Local-First Agent Memory MCP server?

MemVault - Local-First Agent Memory is an MCP server listed in the public MCP registry as io.github.dreamor/memvault. Local-first memory for AI agents: save, recall, dedupe, and share across MCP clients. This page covers its container image (ghcr.io/dreamor/memvault).

### Is the MemVault - Local-First Agent Memory MCP server safe to use?

MemVault - Local-First Agent Memory scores 51 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the MemVault - Local-First Agent Memory MCP server expose?

MemVault - Local-First Agent Memory exposes 20 tools: add_evidence, confirm_read, delete_memory, extract_memories, forget_memory, and 15 more. Their descriptions and schemas cost roughly 4,684 tokens of context every time the server is loaded.

### Is the MemVault - Local-First Agent Memory MCP server still maintained?

MemVault - Local-First Agent Memory is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the MemVault - Local-First Agent Memory MCP server under?

MemVault - Local-First Agent Memory declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- GitHub Container Registry: https://ghcr.io/dreamor/memvault
- Repository: https://github.com/dreamor/memvault
- Changelog RSS feed: https://verifymcp.io/servers/dreamor-memvault/ghcr-io-dreamor-memvault.xml
- Changelog JSON feed: https://verifymcp.io/servers/dreamor-memvault/ghcr-io-dreamor-memvault.json
- HTML version of this page: https://verifymcp.io/servers/dreamor-memvault/ghcr-io-dreamor-memvault