Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.hifriendbot/cogmemai

NPM · COGMEMAI-MCP

Memory for any Ai: remembers across sessions, enforces your rules before actions, reviews the work.

Available components

0 this week 78 Trust /100

Last scanned (5 hours ago)

Scores higher than 58% of npm servers

Category Memory and Knowledge

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security80
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • 59 of 155 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability72
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 6475 tokens (~157/item across 41 items; 41 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 42 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 24 Oct 26 −5
    • CVE-2023-54404 affects this package: high ▼ security
    • Known CVEs: pass → fail ▼ security
  • 22 Oct 26 0
    • Stability: 0.97 → pass security
  • 21 Oct 26 0
    • Stability: pass → 0.97 functional
  • 17 Oct 26 +2
    • Stability: 0.80 → pass security
    • Security disclosure: unverified → fail ▼ functional
  • 16 Oct 26 −2
    • Security disclosure: fail → unverified ▼ functional
    • Stability: pass → 0.80 functional
  • 15 Oct 26 0
    • Stability: 0.97 → pass security
  • 14 Oct 26 +1
    • Security disclosure: unverified → fail ▼ functional
  • 11 Oct 26 0
    • Security disclosure: fail → unverified ▼ functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed npm/cogmemai-mcp@3.31.2

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Vulnerabilities 1 finding
ID CVE Severity Vector Fix available
GHSA-mrhx-c7xc-m3w5 CVE-2023-54404 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 155 packages
Packages resolved 155
Deprecated 1
Stale 58
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 41 exposed · ~4,457 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
bulk_delete ~45

Delete multiple memories at once by their IDs. Maximum 100 IDs per call. This is permanent.

NameTypeReqDescription
idsarrayyesArray of memory IDs to delete (max 100)

No output schema declared.

No examples provided.

bulk_update ~47

Update multiple memories at once. Each item needs a memory_id and fields to update. Maximum 50 items per call.

NameTypeReqDescription
updatesarrayyesArray of update objects (max 50)

No output schema declared.

No examples provided.

consolidate_memories ~162

Consolidate related memories into fewer, richer memories. Finds clusters of memories sharing the same subject (3+ memories required), then uses AI to synthesize each cluster into 1-2 comprehensive facts. Originals are archived (not deleted) with full version history. Use dry_run=true to preview without making changes. Great for cleaning up memory clutter after many sessions.

NameTypeReqDescription
categorystring–Only consolidate memories in this category
dry_runboolean–When true, preview consolidation results without making changes. Recommended for first use.
memory_typestring–Only consolidate memories of this type
subjectstring–Consolidate only memories with this exact subject (e.g., "auth_system"). Omit to auto-detect all qualifying clusters.

No output schema declared.

No examples provided.

delete_memory ~53

Move a memory to the trash by its ID. Trashed memories are hidden from recall and restorable with restore_memory for 30 days, then purged permanently.

NameTypeReqDescription
memory_idintegeryesMemory ID to delete

No output schema declared.

No examples provided.

delete_rule ~42

Delete a mandatory rule by its memory ID. Use list_rules to find the ID first.

NameTypeReqDescription
memory_idintegeryesThe memory ID of the rule to delete

No output schema declared.

No examples provided.

export_memories ~28

Export all memories as JSON. Use this to back up memories or transfer them to another project.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

extract_memories ~80

Extract memories from a conversation exchange using AI. Send the developer message and assistant response, and the server identifies facts worth remembering (architecture decisions, preferences, bug fixes, etc.).

NameTypeReqDescription
assistant_responsestring–The assistant's response
previous_contextstring–Previous exchange for context
user_messagestringyesThe developer's message

No output schema declared.

No examples provided.

extract_principles ~110

Analyze memory clusters and extract underlying factual principles or patterns. Principles are observations about your project — "this codebase tends to have X" — not behavioral instructions (those are skills). Use dry_run to preview candidates first.

NameTypeReqDescription
dry_runboolean–When true, preview principle candidates without generating them
project_idstring–Project to extract principles for (auto-detected if omitted)
subjectstring–Focus on a specific subject area. Omit to scan all subjects.

No output schema declared.

No examples provided.

feedback_memory ~94

Signal whether a recalled memory was useful or irrelevant. Helps improve future recall quality over time. Use after recalling memories to indicate which were helpful vs noise.

NameTypeReqDescription
memory_idintegeryesThe memory ID to give feedback on
signalstringyes"useful" boosts the memory's ranking, "irrelevant" reduces its importance. For skills, "useful" boosts confidence, "irrelevant" reduces it.

No output schema declared.

No examples provided.

generate_skills ~118

Manually trigger skill generation from your corrections, preferences, and patterns. Skills are behavioral directives that auto-improve how the AI works with you. CogmemAi also generates skills automatically when enough evidence accumulates — this tool lets you trigger it manually or preview candidates.

NameTypeReqDescription
dry_runboolean–When true, preview skill candidates without generating them
project_idstring–Project to generate skills for (auto-detected if omitted)
subjectstring–Generate skills for a specific subject. Omit to scan all subjects.

No output schema declared.

No examples provided.

get_analytics ~81

Get a memory health dashboard with insights: most recalled memories, never-recalled memories, stale memories, growth trends, and breakdowns by type and category. Use this to identify cleanup opportunities and understand memory usage patterns.

NameTypeReqDescription
project_idstring–Filter analytics to a specific project. Omit for current project. Use "all" for cross-project analytics.

No output schema declared.

No examples provided.

get_file_changes ~42

Show what files changed since your last session. Compares the current git state to a snapshot saved when your previous session ended. Helps you understand what happened between sessions.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_intent ~101

Read the project's Intent document: the owner's plain-English source of truth (what the project is for, what must always hold, what was decided and why, what is out of scope). It is loaded automatically at session start; call this when you need the full text, or to confirm one exists before proposing a change to it.

NameTypeReqDescription
project_idstring–Project identifier override (auto-detected from CLAUDE_PROJECT_DIR or git remote if omitted)

No output schema declared.

No examples provided.

get_memory_links ~56

View all memories linked to a specific memory. Returns the relationship type and full memory details for each connection. Use this to explore the knowledge graph around a memory.

NameTypeReqDescription
memory_idintegeryesThe memory ID to get links for

No output schema declared.

No examples provided.

get_memory_versions ~55

View the edit history of a memory. Shows all previous versions with timestamps and what changed. Useful for understanding how a decision or fact evolved over time.

NameTypeReqDescription
memory_idintegeryesThe memory ID to get version history for

No output schema declared.

No examples provided.

get_project_context ~210

Load top memories for the current project plus relevant global memories. Use at the start of a session to get full context from previous sessions. Optionally pass context to get memories most relevant to your current task.

NameTypeReqDescription
compactboolean–When true (default), returns only formatted_context text instead of full JSON arrays. Saves ~60% tokens.
contextstring–Optional context to improve relevance ranking (e.g., current task or topic)
context_typestring–Optional context type that shifts scoring weights. debugging = boost bug/pattern memories, planning = boost architecture/decision, reviewing = boost pattern/preference.
include_globalboolean–Include global developer preferences
limitinteger–Max total memories to return (default 25). Lower values save context tokens.
project_idstring–Project identifier (auto-detected from git remote if omitted)
team_idinteger–Optional override. Team memories are automatically included for team/enterprise users.

No output schema declared.

No examples provided.

get_stale_memories ~79

Find memories that may be outdated based on age and access patterns. Returns memories that haven't been recalled or updated recently, so you can review, update, or delete them.

NameTypeReqDescription
days_thresholdinteger–Consider memories stale if not accessed in this many days (default: 30)
limitinteger–Max results to return

No output schema declared.

No examples provided.

get_tasks ~83

Get tasks for the current project. Returns tasks filtered by status — defaults to showing pending and in_progress tasks. Use at session start to pick up where you left off.

NameTypeReqDescription
include_doneboolean–When true, also include completed tasks
statusstring–Filter by task status. "all" returns pending + in_progress + blocked (excludes done).

No output schema declared.

No examples provided.

get_usage ~26

Get current usage statistics — memory count, extractions this month, tier info, projects.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

guard_check ~188

Ask before acting. Judges a proposed action (a command, a message about to be sent, a purchase, a change, anything) against the rules this person has asked their Ai to keep, plus the NEVER and MUST lines of the project intent. Returns allow, ask or deny with the rule that applies. The shell hook does this automatically for commands; call this for everything else, and always before an action that is hard to undo. Fails open: an error is an allow with judged=false.

NameTypeReqDescription
actionstringyesThe action you intend to take, in plain words or as the exact command or message
contextstring–Why you want to do it, or what the person asked for
kindstring–What sort of thing the action is (default: action)
project_idstring–Project identifier override (auto-detected if omitted)

No output schema declared.

No examples provided.

import_memories ~67

Bulk import memories from a JSON array. Each memory needs at minimum a content field. Deduplication is applied automatically.

NameTypeReqDescription
memoriesstringyesJSON string containing an array of memory objects. Each must have "content", optionally: memory_type, category, subject, importance, scope.

No output schema declared.

No examples provided.

ingest_document ~90

Extract memories from a document by splitting it into chunks and processing each one. Great for onboarding — feed in READMEs, architecture docs, or API specs to quickly build project context.

NameTypeReqDescription
document_typestring–Type hint for extraction (e.g., readme, api_docs, architecture, changelog)
textstringyesThe document text to ingest (up to 50K characters)

No output schema declared.

No examples provided.

link_memories ~151

Connect two related memories with a named relationship. Use this to build a knowledge graph — e.g., linking a bug fix to the architecture decision that caused it, or connecting a preference to the pattern it led to.

NameTypeReqDescription
memory_idintegeryesThe source memory ID
related_memory_idintegeryesThe target memory ID to link to
relationshipstringyesHow the memories relate: led_to (A caused B), contradicts (A conflicts with B), extends (A builds on B), related (general connection), rejected (A is the decision, B is the option considered and turn…

No output schema declared.

No examples provided.

list_memories ~169

List stored memories with optional filters by type, category, scope, or project.

NameTypeReqDescription
categorystring–Filter by category (e.g., "backend", "frontend", or any custom category)
importance_mininteger–Only return memories with importance >= this value
limitinteger–Results per page
memory_typestring–Filter by type
offsetinteger–Pagination offset
scopestring–Filter by scope
sort_bystring–Sort order: importance (default), updated, created, referenced (most used first), least_used
tagstring–Filter by tag (e.g., "marketing-campaign")
untypedboolean–When true, only return memories with no memory_type set

No output schema declared.

No examples provided.

list_rules ~56

List all mandatory rules for the current project and/or globally. Rules are always-on memories that surface in every session.

NameTypeReqDescription
scopestring–Filter: all = project + global, project = this project only, global = global only

No output schema declared.

No examples provided.

list_tags ~35

List all tags in use across your memories, with counts. Use this to see what threads/groups exist and find related memories by tag.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_trash ~57

List trashed (deleted) memories, newest first, with days remaining before each is purged permanently. Restore any of them with restore_memory.

NameTypeReqDescription
limitinteger–Results per page
offsetinteger–Pagination offset

No output schema declared.

No examples provided.

preflight ~113

Proactive recall. Call this BEFORE making any suggestion, recommendation, or action plan. Sends the topic to a fast keyword search and returns any relevant prior context: previous attempts, decisions, contacts, evaluations. This prevents suggesting things that were already tried, rejected, or completed. Fast and cheap, use liberally.

NameTypeReqDescription
messagestringyesWhat you are about to suggest or respond about. Be specific — include names, topics, approaches.
project_idstring–Project ID (auto-detected if omitted)

No output schema declared.

No examples provided.

promote_memory ~74

Promote a project-scoped memory to global scope so it applies across all projects. Use this when you discover a preference or pattern that should be universal — e.g., "user prefers tabs over spaces" or "always use Bun instead of npm".

NameTypeReqDescription
memory_idintegeryesThe project memory ID to promote to global scope

No output schema declared.

No examples provided.

recall_memories ~230

Search stored memories using semantic search. Returns memories ranked by relevance, importance, and recency. Use this to find relevant context from past sessions.

NameTypeReqDescription
categorystring–Filter by category (e.g., "backend", "frontend", or any custom category)
context_typestring–Optional context type that shifts scoring weights. debugging = boost bug/pattern memories, planning = boost architecture/decision, reviewing = boost pattern/preference.
importance_mininteger–Only return memories with importance >= this value
limitinteger–Max results
memory_typestring–Filter by type
querystringyesWhat to search for (natural language)
scopestring–Filter by scope
synthesizeboolean–When true and 3+ results are found, returns an AI-synthesized summary combining all memories into a coherent answer.
tagstring–Filter by tag (e.g., "marketing-campaign")
team_idinteger–Optional override. Team memories are automatically included for team/enterprise users.

No output schema declared.

No examples provided.

restore_memory ~60

Restore a trashed (deleted) memory by its ID. Works within 30 days of deletion, before the trash is purged. Use list_trash to find restorable memories.

NameTypeReqDescription
memory_idintegeryesMemory ID to restore from the trash

No output schema declared.

No examples provided.

review_work ~164

Review finished work against the intent: what the person set out to have done, what must always hold, what was decided. Pass a description, output, message or transcript of what you did; the project intent document is used, or pass intent inline when there is none. Returns a plain summary, what the intent covers, what it does not, and any violations. The Stop hook does this automatically for code changes in a repository; call this for everything else.

NameTypeReqDescription
intentstring–Inline intent to judge against, used only when the project has no stored intent document
project_idstring–Project identifier override (auto-detected if omitted)
workstringyesWhat was done: a description, the output, a message, or a transcript

No output schema declared.

No examples provided.

save_correction ~160

Save a correction pattern — what went wrong and what the right approach is. These are surfaced automatically when similar situations arise in future sessions, helping avoid repeated mistakes.

NameTypeReqDescription
contextstring–When/where this applies (e.g., "package management in monorepo")
project_idstring–Project identifier override (auto-detected from CLAUDE_PROJECT_DIR or git remote if omitted)
right_approachstringyesThe correct approach (e.g., "Always use bun add for this project")
scopestring–global = applies everywhere, project = specific to this codebase
wrong_approachstringyesWhat was done incorrectly (e.g., "Used npm install instead of bun add")

No output schema declared.

No examples provided.

save_memory ~412

Store a developer memory (fact, preference, decision, architecture detail). Memories persist across all Claude Code sessions and are available in future conversations.

NameTypeReqDescription
categorystring–Category: frontend, backend, database, devops, testing, security, performance, tooling, api, general. Custom categories also accepted for non-developer domains.
contentstringyesThe fact to remember (complete sentence)
importanceinteger–1-10 (10 = core architecture, 1 = trivial)
memory_typestring–Type: identity, preference, architecture, decision, bug, dependency, pattern, context. Custom types also accepted for non-developer domains.
project_idstring–Project identifier override (auto-detected from CLAUDE_PROJECT_DIR or git remote if omitted)
scopestring–global = applies everywhere, project = specific to this codebase, team = shared with team members
subjectstring–What this is about, e.g. "auth_system", "react_version", "tab_width"
tagsarray–Optional tags for grouping/threading memories (max 5 tags, each max 30 chars). E.g., ["marketing-campaign", "feb-2026"]
team_idinteger–Team ID (required when scope is "team"). The memory will be shared with all team members.
ttlstring–Set an expiration time. Use for temporary context like current task status. Format: "24h", "7d", "30d". Memory auto-archives after expiry.
verifiedboolean–Set true ONLY if you directly observed this: you ran the command, read the file, or saw the query result. Leave it unset when you inferred, assumed, or were told it. Recall reports this back, so a la…

No output schema declared.

No examples provided.

save_rule ~198

Save a mandatory rule that will ALWAYS be followed in every session. Rules bypass scoring and decay — they are injected into every conversation, every time. Use for absolute requirements like "NEVER do X" or "ALWAYS do Y".

NameTypeReqDescription
categorystring–Category for organization: frontend, backend, security, general, etc.
contentstringyesThe rule to enforce (e.g., "NEVER use -latest model aliases", "ALWAYS apply changes to both class-chat.php AND class-maas.php")
project_idstring–Project identifier override (auto-detected from CLAUDE_PROJECT_DIR or git remote if omitted)
scopestring–global = applies to all projects, project = only this codebase
subjectstring–Short label for the rule, e.g. "model_aliases", "companions_parity"
tagsarray–Optional tags for grouping rules

No output schema declared.

No examples provided.

save_session_summary ~63

Save a summary of the current coding session. Captures what was accomplished, decisions made, and next steps. Stored as a session_summary memory for future reference.

NameTypeReqDescription
summarystringyesSummary of the session — what was done, key decisions, and next steps

No output schema declared.

No examples provided.

save_task ~131

Create a task that persists across sessions. Tasks are tracked with status (pending, in_progress, done, blocked) and priority (high, medium, low). Use this to maintain continuity on multi-session work.

NameTypeReqDescription
descriptionstring–Detailed description of what needs to be done
prioritystring–Task priority
project_idstring–Project identifier override (auto-detected from CLAUDE_PROJECT_DIR or git remote if omitted)
statusstring–Initial task status
titlestringyesShort task title (e.g., "Fix auth bug in login flow")

No output schema declared.

No examples provided.

set_intent ~204

Create or replace the project's Intent document in the owner's own words: a short markdown document with the sections Purpose, Invariants (NEVER and ALWAYS sentences the guard will enforce), Decisions (with the why), and Out of scope. Every session loads it, the end-of-turn review checks changes against it, and every replacement is versioned. Use it when the owner describes what the project is for, or agrees to record a change of intent. Ask before replacing an existing document, and pass changed_by "agent" when you drafted the text.

NameTypeReqDescription
changed_bystring–user = the owner wrote or approved these exact words; agent = the assistant drafted them
contentstringyesThe full intent document (markdown, at most 8000 characters). This replaces the previous version; the previous text is kept as a version.
project_idstring–Project identifier override (auto-detected from CLAUDE_PROJECT_DIR or git remote if omitted)

No output schema declared.

No examples provided.

set_reminder ~102

Set a reminder that surfaces automatically at the start of your next session. Use for follow-ups, things to check, or deferred work. Reminders auto-archive after being shown.

NameTypeReqDescription
contentstringyesWhat to remind about (e.g., "Check if PR #42 was merged")
ttlstring–How long to keep the reminder alive. Format: "24h", "7d", "30d". Default: 7 days.

No output schema declared.

No examples provided.

update_memory ~131

Update an existing memory's content, importance, or scope.

NameTypeReqDescription
categorystring–New category (e.g., "backend", "frontend", or any custom category)
contentstring–New content
importanceinteger–New importance (1-10)
memory_idintegeryesMemory ID to update
memory_typestring–New memory type
scopestring–New scope
subjectstring–New subject (e.g., "auth_system", "react_version")
tagsarray–New tags (replaces existing tags)

No output schema declared.

No examples provided.

update_task ~90

Update a task's status, title, description, or priority. Use this to mark tasks as in_progress, done, or blocked as you work.

NameTypeReqDescription
descriptionstring–New description
prioritystring–New priority
statusstring–New status
task_idintegeryesThe task memory ID (from get_tasks)
titlestring–New title

No output schema declared.

No examples provided.

Install

How do I install the io.github.hifriendbot/cogmemai MCP server?

io.github.hifriendbot/cogmemai runs locally as an npm package, launched with npx -y cogmemai-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · cogmemai-mcp

# add to Claude Code
claude mcp add hifriendbot-cogmemai -- npx -y cogmemai-mcp
Common questions

What is the io.github.hifriendbot/cogmemai MCP server?

io.github.hifriendbot/cogmemai is an MCP server listed in the public MCP registry as io.github.hifriendbot/cogmemai. Memory for any Ai: remembers across sessions, enforces your rules before actions, reviews the work. This page covers its npm package (cogmemai-mcp).

Is the io.github.hifriendbot/cogmemai MCP server safe to use?

io.github.hifriendbot/cogmemai scores 78 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.hifriendbot/cogmemai MCP server expose?

io.github.hifriendbot/cogmemai exposes 41 tools: save_memory, save_rule, list_rules, get_intent, set_intent, and 36 more. Their descriptions and schemas cost roughly 4,457 tokens of context every time the server is loaded.

Is the io.github.hifriendbot/cogmemai MCP server still maintained?

io.github.hifriendbot/cogmemai is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.hifriendbot/cogmemai MCP server under?

io.github.hifriendbot/cogmemai declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.