Graph-MIND
PYPI · GRAPH-MIND-MEMORY
Local-first memory for Claude Code, Codex and Claude Desktop, kept verbatim on your own PC.
Available components
Last scanned (23 hours ago)
Scores higher than 63% of PyPI servers
Category Memory and Knowledge
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security50
- Malware scan not yet available for this package.Unverified
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs setuptools.build_meta at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- 2 of 50 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to goyohan0611-png/graph-mind). View diagnostics → Pass
- Clear OSI-approved license (AGPL-3.0-only).Pass
- Actively maintained (last published 0 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability50
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 3463 tokens (~494/item across 7 items; 7 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management7
- Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage71
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety50
- Injection-marker check failed: the server instructions contains an instruction to conceal the call from the user, the text "never tell the user", at byte 512 of that field, plus 1 further marker(s) of the same kind. See how to fix → Fail
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 8 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 16 Oct 26 +1
- Stability: unverified → 0.07 ▲ functional
- Package version: 0.8.0 → 0.9.0 functional
- 14 Oct 26 +7
- Injection markers: unverified → fail ▼ security
- Malware scan: pass → unverified ▼ security
- First check of Judged manipulation: pass security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Tool coverage: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- First check of Tool coverage: 0 functional
- First check of Schema quality: fail functional
- First check of Schema quality: fail functional
- First check of Destructive annotations: 100 functional
- First check of Schema quality: good functional
- First check of Tool coverage: 100 functional
- Package version: 0.7.0 → 0.8.0 functional
- 13 Oct 26 +26
- Malware scan: unverified → pass ▲ security
- Known CVEs: unverified → pass ▲ security
- Dependency health: unverified → 0.99 ▲ functional
- Dependency health: unverified → 0.97 ▲ functional
- Package version: 0.6.4 → 0.7.0 functional
- 12 Oct 26 24
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 16 Oct 2026 · Analysed pypi/graph-mind-memory@0.9.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | pypi |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | goyohan0611-png/graph-mind |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/goyohan0611-png/graph-mind/.github/workflows/publish.yml@refs/tags/v0.9.0 |
| Rekor log index | 3274261066 |
| Predicate type | PyPI publish attestation https://docs.pypi.org/attestations/publish/v1 |
| Subject digest | sha256:2942d25355e05b5f09dfe9ac82f4c8e10cd22dee00f62cfc8c60ca2d3b1d5879 |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | setuptools.build_meta |
Background: Why install scripts are a supply-chain risk →
Dependencies 50 packages
| Packages resolved | 50 |
|---|---|
| Stale | 1 |
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
brain_checkpoint ~962
Team project brains: decisions and progress shared with teammates' AIs, per project. Not for the user's own memory or their other PCs: that is brain_folder. A project brain holds what a team's AIs need to know about a project, apart from the user's personal memory and from every other project. Nothing personal is shared through this; only what is published here, when the user asks. Files and notifications stay in Slack, drives and GitHub; a project brain keeps the decisions, the progress, the context and links to where the work is. Always pass `workspace` = your current working folder: a folder bound to a project makes it the default `project`. Publish only when the user asks ("공유해", "프로젝트에 올려줘", "체크포인트 남겨"): that request is the approval, so do not ask again; ask only if the project is ambiguous. Afterwards say exactly what went where. - `projects`: the project brains the user takes part in, with when each was last shared. - `create_project` + `project` (+ `path` = folder to bind): only when the user names one. - `publish` + `type` + `summary` (one line, user's language) + `details` (a handover note: what changed and why, files and functions, test results, links, what is left). Never paste conversation text. `supersedes`=<id> replaces an earlier decision. - `context` (with publish or attach): what changed, where (pages, sections, files, functions), why, verification (test or check results), remaining, review_focus, and the ids it answers (`addresses`) and its `evidence` (commit, PR, test log, Slack or document links). Write only what you know; what is left out reads "not recorded". - `attach` + `path`: a git folder links its commit at the stage it really reached (committed / pushed / pr_open / merged / released; never call work done when the stage says otherwise); a URL (a Slack message, a drive document) is kept as a link. Files are not stored here: if the user wants a file shared, share it in Slack or a drive (with the tools for those) and at…
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | – |
| checkpoint_id | – | – | – |
| code | – | – | – |
| context | – | – | – |
| details | – | – | – |
| hub | – | – | – |
| instructions | – | – | – |
| member | – | – | – |
| name | – | – | – |
| path | – | – | – |
| project | – | – | – |
| projects | – | – | – |
| role | – | – | – |
| source_refs | – | – | – |
| summary | – | – | – |
| supersedes | – | – | – |
| type | – | – | – |
| workspace | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
brain_context ~487
Answer from the user's past: one bounded text packet to read before replying. The default memory call: use it whenever a request may depend on earlier conversations, facts, preferences, decisions or work. It returns `context`, a size-capped text of the relevant memories and conversation turns, each with its date and source. For structured rows, ids or one thing's history use brain_recall instead. Set `recent=true` whenever the question is about what happened lately or what the user was just doing: "what was I working on?", "where did we leave off?", "what did I do yesterday?", "최근에", "아까", "어제", "지금 뭐 하고 있었지?". Results then come newest first instead of by word overlap; naming something ("what did Kongi do lately") keeps them about that. Set `since` (ISO date or time) to drop anything earlier, e.g. "this week". Set `about_assistant=true` when the user asks what YOU said earlier: "which restaurant did you recommend?", "what were the steps you gave me?", "네가 아까 뭐라고 했지?". Your own past answers are then searched by meaning too, not only by their words. Set `around` when the question is about WHEN WE TALKED: "what did we discuss last week?", "지난달에 얘기한 거" -> resolve it yourself to a date or "start..end" (e.g. "2026-09-23" or "2026-09-01..2026-09-30"). Conversations from then rank first; nothing is dropped. Do not set it for when something HAPPENED ("the event I went to two weeks ago"): people mention events days or weeks before or after, so that date misleads (measured: on dev2 it pushed the answering turn out in 2 of 11 questions and helped 2).
| Name | Type | Req | Description |
|---|---|---|---|
| about_assistant | boolean | – | – |
| around | – | – | – |
| as_of | – | – | – |
| knowledge_cutoff | – | – | – |
| limit | integer | – | – |
| max_chars | integer | – | – |
| policy | string | – | – |
| query | string | yes | – |
| recent | boolean | – | – |
| scopes | – | – | – |
| since | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
brain_folder ~533
Where the user's own personal memory lives, and which of their own PCs share it. Not for teams: project brains shared with teammates are brain_checkpoint. Call it with `path` when the user names a folder for their memory, e.g. "use my Google Drive's Graph-MIND folder as my brain". A folder that OneDrive, Google Drive or Dropbox syncs makes the same memory available on every PC where the user chooses it too; nothing else is needed. Without `path` it reports the current folder and the devices writing to it. `path="local"` keeps the brain in this PC's own Postgres instead, shared the instant it is written (no sync delay). Other PCs: when the user asks to let their other PCs use this brain ("다른 PC도 붙게 해줘"), call it with `path="share"`. It opens this PC's Postgres to the local network and Tailscale (Windows may ask the user to approve a firewall rule once) and returns a `connection_code`. Show the user that code and tell them to paste it to the AI on the other PC; it contains the password, so say not to post it anywhere public. Codes: when the user pastes any Graph-MIND code ("gm1." for their own other PC, "gmt1." for a team invite), call this with `path=<the code>`; it does the right thing for either, so never ask the user which kind it is. `share_existing=true` sends what this PC remembers and the shared memory lacks (only that: it also repairs turns that missed a hub that was down). It uploads it to wherever the folder syncs. Set it only when the user has explicitly agreed to that. `reindex=true` brings the search index up to date (links new memories, embeds unembedded ones). Saving already does this; it is for a large imported backlog. Moving a whole memory as one file ("내 기억 파일로 내보내줘", "이 기억 파일 가져와"): `export_to=<file path>` writes every memory and conversation turn into that file; `import_from=<file path>` adds such a file's contents to this memory, skipping what is already here. Only when the user asks. Tell them the file holds their entire memory (secrets…
| Name | Type | Req | Description |
|---|---|---|---|
| export_to | – | – | – |
| import_from | – | – | – |
| path | – | – | – |
| reindex | boolean | – | – |
| share_existing | boolean | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
brain_forget ~182
Delete what the user wants gone from memory: "delete the password I typed earlier", "그 토큰 지워줘", "forget what I said about my ex". Always two calls. First `query`: what to look for, in general words ("password", "wifi", "DB login"); never repeat a secret the user typed. It returns numbered candidates with masked previews. Show the user exactly those previews and ask which to delete; never quote the original text. Then call again with the `ids` the user picked, and only those. Deleting removes them from this PC, its search indexes, the shared memory and the user's other PCs. This exchange about deleting is not saved either. The AI app's own chat history is separate and untouched (Claude Code keeps ~/.claude/projects).
| Name | Type | Req | Description |
|---|---|---|---|
| ids | – | – | – |
| query | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
brain_recall ~281
Raw lookup: the matching memories and turns as structured rows, not a ready context. To answer the user's question from their past, use brain_context instead; it returns one bounded text packet ready to read. Use brain_recall to inspect or list: the ids and fields of what matched (e.g. before brain_forget or `supersedes_memory_id`), one thing's history in order, or what the store knows about. `entity` answers "what happened to X, in order": every memory about that one thing (the auth module, this project, my address), oldest first, with replaced entries marked and the current one picked out. Similarity search returns only the nearest one or two of four decisions made about one thing in four sessions; this returns all four. With neither `query` nor `entity`, it lists what the store knows about, busiest first. `recent`, `since`, `about_assistant` and `around` mean the same as in brain_context.
| Name | Type | Req | Description |
|---|---|---|---|
| about_assistant | boolean | – | – |
| around | – | – | – |
| as_of | – | – | – |
| entity | – | – | – |
| knowledge_cutoff | – | – | – |
| limit | integer | – | – |
| query | string | – | – |
| recent | boolean | – | – |
| scopes | – | – | – |
| since | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
brain_remember ~527
Save what the user just told you, in their own words. Call this proactively. A fact that can change later (where they live or work, a pet, a preference, a plan, a number they track): also pass `about` (who or what, e.g. "Kongi", "me") and `attribute` (which property, a short English snake_case name, e.g. "breed", "home_city", "favorite_coffee"). A later value with the same `about` and `attribute` replaces this one and recall shows both: the value now and what it was before. Use the same `attribute` names every time, and never put the value in the name: "last_trip", not "last_trip_paris", or the next trip will not replace it. Use it the moment the user mentions anything about their life, work, plans, preferences, people, places, meals, purchases, health, decisions or events, e.g. "I had kimchi fried rice today", "my dog is called Kongi", "we moved the meeting to Tuesday". Do not ask whether to save it and do not wait to be told "remember this". Only `content` is required: put the user's own sentence there verbatim. Add `entities` (who or what it is about) and `effective_at` (when it happened, ISO time) when you know them. If it updates something remembered earlier, pass that memory's id as `supersedes_memory_id`. Decisions and their reasons are memories too: `memory_type="decision"`, the reason in `content`, the project or component in `entities`. Save silently. Do not tell the user you saved it ("I've noted that", "저장해 뒀어"); just carry on with the conversation. Talk about memory only if the user asks what you remember or whether something was saved.
| Name | Type | Req | Description |
|---|---|---|---|
| about | – | – | – |
| attribute | – | – | – |
| attributes | – | – | – |
| confidence | – | – | – |
| content | string | yes | – |
| effective_at | – | – | – |
| entities | – | – | – |
| importance | – | – | – |
| memory_class | – | – | – |
| memory_id | – | – | – |
| memory_type | string | – | – |
| modality | – | – | – |
| related_memory_ids | – | – | – |
| retention | – | – | – |
| scope | string | – | – |
| source_ref | string | – | – |
| source_type | string | – | – |
| supersedes_memory_id | – | – | – |
| tags | – | – | – |
| title | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
code_activity ~137
Code changes the capture service recorded, with diff excerpts, filtered by project, time range (`happened_from`/`happened_to`, ISO), file, symbol or kind. For "what did I change in auth.py last week?" or "when did the parser change?". Empty unless a code folder is being watched (automatic-capture.json, code_workspaces).
| Name | Type | Req | Description |
|---|---|---|---|
| change_kind | – | – | – |
| file_path | – | – | – |
| happened_from | – | – | – |
| happened_to | – | – | – |
| limit | integer | – | – |
| max_diff_chars | integer | – | – |
| project_id | – | – | – |
| symbol | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
How do I install the Graph-MIND MCP server?
Graph-MIND runs locally as a PyPI package, launched with uvx graph-mind-memory. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · graph-mind-memory
claude mcp add goyohan0611-png-graph-mind -- uvx graph-mind-memory
What is the Graph-MIND MCP server?
Graph-MIND is an MCP server listed in the public MCP registry as io.github.goyohan0611-png/graph-mind. Local-first memory for Claude Code, Codex and Claude Desktop, kept verbatim on your own PC. This page covers its PyPI package (graph-mind-memory).
Is the Graph-MIND MCP server safe to use?
Graph-MIND scores 58 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 16 October 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Graph-MIND MCP server expose?
Graph-MIND exposes 7 tools: brain_remember, brain_recall, brain_context, brain_folder, brain_checkpoint, and 2 more. Their descriptions and schemas cost roughly 3,109 tokens of context every time the server is loaded.
Is the Graph-MIND MCP server still maintained?
Graph-MIND is still listed as active in the MCP registry. We last reached this channel on 16 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Graph-MIND MCP server under?
Graph-MIND declares the AGPL-3.0-only licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.