Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.hifriendbot/cogmemai

NPM · COGMEMAI-MCP · SCANNED SEP 20

The smart memory layer for everything Ai. 95.10% LongMemEval (highest published).

Available components

+2 this week 81 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 59 of 157 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability72
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 5793 tokens (~156/item across 37 items; 37 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
  • Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete_rule" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 38 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the io.github.hifriendbot/cogmemai MCP server?

io.github.hifriendbot/cogmemai runs locally as an npm package, launched with npx -y cogmemai-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · cogmemai-mcp

# add to Claude Code
claude mcp add hifriendbot-cogmemai -- npx -y cogmemai-mcp
// .cursor/mcp.json
{
  "mcpServers": {
    "hifriendbot-cogmemai": {
      "command": "npx",
      "args": [
        "-y",
        "cogmemai-mcp"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "hifriendbot-cogmemai": {
      "command": "npx",
      "args": [
        "-y",
        "cogmemai-mcp"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add hifriendbot-cogmemai -- npx -y cogmemai-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "hifriendbot-cogmemai": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "cogmemai-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add hifriendbot-cogmemai --command npx --arg -y --arg cogmemai-mcp
# ~/.hermes/config.yaml
mcp_servers:
  hifriendbot-cogmemai:
    command: "npx"
    args: ["-y", "cogmemai-mcp"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "hifriendbot-cogmemai": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "cogmemai-mcp"
      ]
    }
  }
}
# add to Vellum
assistant mcp add hifriendbot-cogmemai -t stdio -c npx -a -y cogmemai-mcp
// mcp.json
{
  "mcpServers": {
    "hifriendbot-cogmemai": {
      "command": "npx",
      "args": [
        "-y",
        "cogmemai-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 20 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

  • 18 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 16 Sept 26 −1
    • CVE-2026-82562 no longer affects this package security
    • CVE-2026-82417 no longer affects this package security
    • Known CVEs: fail → pass security
    • Stability: pass → 0.80 functional
    • Package version: 3.17.0 → 3.23.0 functional
  • 15 Sept 26 0
    • Stability: 0.97 → pass security
  • 14 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 11 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 10 Sept 26 −2
    • Stability: pass → 0.83 functional
    • Package version: 3.17.0 → 3.23.0 functional
  • 9 Sept 26 0
    • Stability: 0.97 → pass security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed npm/cogmemai-mcp@3.23.0

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 157 packages
Packages resolved 157
Deprecated 1
Stale 58
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 37 exposed · ~3,800 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
bulk_delete ~45

Delete multiple memories at once by their IDs. Maximum 100 IDs per call. This is permanent.

NameTypeReqDescription
idsarrayyesArray of memory IDs to delete (max 100)

No output schema declared.

No examples provided.

bulk_update ~47

Update multiple memories at once. Each item needs a memory_id and fields to update. Maximum 50 items per call.

NameTypeReqDescription
updatesarrayyesArray of update objects (max 50)

No output schema declared.

No examples provided.

consolidate_memories ~162

Consolidate related memories into fewer, richer memories. Finds clusters of memories sharing the same subject (3+ memories required), then uses AI to synthesize each cluster into 1-2 comprehensive facts. Originals are archived (not deleted) with full version history. Use dry_run=true to preview without making changes. Great for cleaning up memory clutter after many sessions.

NameTypeReqDescription
categorystringOnly consolidate memories in this category
dry_runbooleanWhen true, preview consolidation results without making changes. Recommended for first use.
memory_typestringOnly consolidate memories of this type
subjectstringConsolidate only memories with this exact subject (e.g., "auth_system"). Omit to auto-detect all qualifying clusters.

No output schema declared.

No examples provided.

delete_memory ~53

Move a memory to the trash by its ID. Trashed memories are hidden from recall and restorable with restore_memory for 30 days, then purged permanently.

NameTypeReqDescription
memory_idintegeryesMemory ID to delete

No output schema declared.

No examples provided.

delete_rule ~42

Delete a mandatory rule by its memory ID. Use list_rules to find the ID first.

NameTypeReqDescription
memory_idintegeryesThe memory ID of the rule to delete

No output schema declared.

No examples provided.

export_memories ~28

Export all memories as JSON. Use this to back up memories or transfer them to another project.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

extract_memories ~80

Extract memories from a conversation exchange using AI. Send the developer message and assistant response, and the server identifies facts worth remembering (architecture decisions, preferences, bug fixes, etc.).

NameTypeReqDescription
assistant_responsestringThe assistant's response
previous_contextstringPrevious exchange for context
user_messagestringyesThe developer's message

No output schema declared.

No examples provided.

extract_principles ~110

Analyze memory clusters and extract underlying factual principles or patterns. Principles are observations about your project — "this codebase tends to have X" — not behavioral instructions (those are skills). Use dry_run to preview candidates first.

NameTypeReqDescription
dry_runbooleanWhen true, preview principle candidates without generating them
project_idstringProject to extract principles for (auto-detected if omitted)
subjectstringFocus on a specific subject area. Omit to scan all subjects.

No output schema declared.

No examples provided.

feedback_memory ~94

Signal whether a recalled memory was useful or irrelevant. Helps improve future recall quality over time. Use after recalling memories to indicate which were helpful vs noise.

NameTypeReqDescription
memory_idintegeryesThe memory ID to give feedback on
signalstringyes"useful" boosts the memory's ranking, "irrelevant" reduces its importance. For skills, "useful" boosts confidence, "irrelevant" reduces it.

No output schema declared.

No examples provided.

generate_skills ~118

Manually trigger skill generation from your corrections, preferences, and patterns. Skills are behavioral directives that auto-improve how the AI works with you. CogmemAi also generates skills automatically when enough evidence accumulates — this tool lets you trigger it manually or preview candidates.

NameTypeReqDescription
dry_runbooleanWhen true, preview skill candidates without generating them
project_idstringProject to generate skills for (auto-detected if omitted)
subjectstringGenerate skills for a specific subject. Omit to scan all subjects.

No output schema declared.

No examples provided.

get_analytics ~81

Get a memory health dashboard with insights: most recalled memories, never-recalled memories, stale memories, growth trends, and breakdowns by type and category. Use this to identify cleanup opportunities and understand memory usage patterns.

NameTypeReqDescription
project_idstringFilter analytics to a specific project. Omit for current project. Use "all" for cross-project analytics.

No output schema declared.

No examples provided.

get_file_changes ~42

Show what files changed since your last session. Compares the current git state to a snapshot saved when your previous session ended. Helps you understand what happened between sessions.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_memory_links ~56

View all memories linked to a specific memory. Returns the relationship type and full memory details for each connection. Use this to explore the knowledge graph around a memory.

NameTypeReqDescription
memory_idintegeryesThe memory ID to get links for

No output schema declared.

No examples provided.

get_memory_versions ~55

View the edit history of a memory. Shows all previous versions with timestamps and what changed. Useful for understanding how a decision or fact evolved over time.

NameTypeReqDescription
memory_idintegeryesThe memory ID to get version history for

No output schema declared.

No examples provided.

get_project_context ~210

Load top memories for the current project plus relevant global memories. Use at the start of a session to get full context from previous sessions. Optionally pass context to get memories most relevant to your current task.

NameTypeReqDescription
compactbooleanWhen true (default), returns only formatted_context text instead of full JSON arrays. Saves ~60% tokens.
contextstringOptional context to improve relevance ranking (e.g., current task or topic)
context_typestringOptional context type that shifts scoring weights. debugging = boost bug/pattern memories, planning = boost architecture/decision, reviewing = boost pattern/preference.
include_globalbooleanInclude global developer preferences
limitintegerMax total memories to return (default 25). Lower values save context tokens.
project_idstringProject identifier (auto-detected from git remote if omitted)
team_idintegerOptional override. Team memories are automatically included for team/enterprise users.

No output schema declared.

No examples provided.

get_stale_memories ~79

Find memories that may be outdated based on age and access patterns. Returns memories that haven't been recalled or updated recently, so you can review, update, or delete them.

NameTypeReqDescription
days_thresholdintegerConsider memories stale if not accessed in this many days (default: 30)
limitintegerMax results to return

No output schema declared.

No examples provided.

get_tasks ~83

Get tasks for the current project. Returns tasks filtered by status — defaults to showing pending and in_progress tasks. Use at session start to pick up where you left off.

NameTypeReqDescription
include_donebooleanWhen true, also include completed tasks
statusstringFilter by task status. "all" returns pending + in_progress + blocked (excludes done).

No output schema declared.

No examples provided.

get_usage ~26

Get current usage statistics — memory count, extractions this month, tier info, projects.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

import_memories ~67

Bulk import memories from a JSON array. Each memory needs at minimum a content field. Deduplication is applied automatically.

NameTypeReqDescription
memoriesstringyesJSON string containing an array of memory objects. Each must have "content", optionally: memory_type, category, subject, importance, scope.

No output schema declared.

No examples provided.

ingest_document ~90

Extract memories from a document by splitting it into chunks and processing each one. Great for onboarding — feed in READMEs, architecture docs, or API specs to quickly build project context.

NameTypeReqDescription
document_typestringType hint for extraction (e.g., readme, api_docs, architecture, changelog)
textstringyesThe document text to ingest (up to 50K characters)

No output schema declared.

No examples provided.

link_memories ~151

Connect two related memories with a named relationship. Use this to build a knowledge graph — e.g., linking a bug fix to the architecture decision that caused it, or connecting a preference to the pattern it led to.

NameTypeReqDescription
memory_idintegeryesThe source memory ID
related_memory_idintegeryesThe target memory ID to link to
relationshipstringyesHow the memories relate: led_to (A caused B), contradicts (A conflicts with B), extends (A builds on B), related (general connection), rejected (A is the decision, B is the option considered and turn…

No output schema declared.

No examples provided.

list_memories ~169

List stored memories with optional filters by type, category, scope, or project.

NameTypeReqDescription
categorystringFilter by category (e.g., "backend", "frontend", or any custom category)
importance_minintegerOnly return memories with importance >= this value
limitintegerResults per page
memory_typestringFilter by type
offsetintegerPagination offset
scopestringFilter by scope
sort_bystringSort order: importance (default), updated, created, referenced (most used first), least_used
tagstringFilter by tag (e.g., "marketing-campaign")
untypedbooleanWhen true, only return memories with no memory_type set

No output schema declared.

No examples provided.

list_rules ~56

List all mandatory rules for the current project and/or globally. Rules are always-on memories that surface in every session.

NameTypeReqDescription
scopestringFilter: all = project + global, project = this project only, global = global only

No output schema declared.

No examples provided.

list_tags ~35

List all tags in use across your memories, with counts. Use this to see what threads/groups exist and find related memories by tag.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_trash ~57

List trashed (deleted) memories, newest first, with days remaining before each is purged permanently. Restore any of them with restore_memory.

NameTypeReqDescription
limitintegerResults per page
offsetintegerPagination offset

No output schema declared.

No examples provided.

preflight ~113

Proactive recall. Call this BEFORE making any suggestion, recommendation, or action plan. Sends the topic to a fast keyword search and returns any relevant prior context: previous attempts, decisions, contacts, evaluations. This prevents suggesting things that were already tried, rejected, or completed. Fast and cheap, use liberally.

NameTypeReqDescription
messagestringyesWhat you are about to suggest or respond about. Be specific — include names, topics, approaches.
project_idstringProject ID (auto-detected if omitted)

No output schema declared.

No examples provided.

promote_memory ~74

Promote a project-scoped memory to global scope so it applies across all projects. Use this when you discover a preference or pattern that should be universal — e.g., "user prefers tabs over spaces" or "always use Bun instead of npm".

NameTypeReqDescription
memory_idintegeryesThe project memory ID to promote to global scope

No output schema declared.

No examples provided.

recall_memories ~230

Search stored memories using semantic search. Returns memories ranked by relevance, importance, and recency. Use this to find relevant context from past sessions.

NameTypeReqDescription
categorystringFilter by category (e.g., "backend", "frontend", or any custom category)
context_typestringOptional context type that shifts scoring weights. debugging = boost bug/pattern memories, planning = boost architecture/decision, reviewing = boost pattern/preference.
importance_minintegerOnly return memories with importance >= this value
limitintegerMax results
memory_typestringFilter by type
querystringyesWhat to search for (natural language)
scopestringFilter by scope
synthesizebooleanWhen true and 3+ results are found, returns an AI-synthesized summary combining all memories into a coherent answer.
tagstringFilter by tag (e.g., "marketing-campaign")
team_idintegerOptional override. Team memories are automatically included for team/enterprise users.

No output schema declared.

No examples provided.

restore_memory ~60

Restore a trashed (deleted) memory by its ID. Works within 30 days of deletion, before the trash is purged. Use list_trash to find restorable memories.

NameTypeReqDescription
memory_idintegeryesMemory ID to restore from the trash

No output schema declared.

No examples provided.

save_correction ~160

Save a correction pattern — what went wrong and what the right approach is. These are surfaced automatically when similar situations arise in future sessions, helping avoid repeated mistakes.

NameTypeReqDescription
contextstringWhen/where this applies (e.g., "package management in monorepo")
project_idstringProject identifier override (auto-detected from CLAUDE_PROJECT_DIR or git remote if omitted)
right_approachstringyesThe correct approach (e.g., "Always use bun add for this project")
scopestringglobal = applies everywhere, project = specific to this codebase
wrong_approachstringyesWhat was done incorrectly (e.g., "Used npm install instead of bun add")

No output schema declared.

No examples provided.

save_memory ~412

Store a developer memory (fact, preference, decision, architecture detail). Memories persist across all Claude Code sessions and are available in future conversations.

NameTypeReqDescription
categorystringCategory: frontend, backend, database, devops, testing, security, performance, tooling, api, general. Custom categories also accepted for non-developer domains.
contentstringyesThe fact to remember (complete sentence)
importanceinteger1-10 (10 = core architecture, 1 = trivial)
memory_typestringType: identity, preference, architecture, decision, bug, dependency, pattern, context. Custom types also accepted for non-developer domains.
project_idstringProject identifier override (auto-detected from CLAUDE_PROJECT_DIR or git remote if omitted)
scopestringglobal = applies everywhere, project = specific to this codebase, team = shared with team members
subjectstringWhat this is about, e.g. "auth_system", "react_version", "tab_width"
tagsarrayOptional tags for grouping/threading memories (max 5 tags, each max 30 chars). E.g., ["marketing-campaign", "feb-2026"]
team_idintegerTeam ID (required when scope is "team"). The memory will be shared with all team members.
ttlstringSet an expiration time. Use for temporary context like current task status. Format: "24h", "7d", "30d". Memory auto-archives after expiry.
verifiedbooleanSet true ONLY if you directly observed this: you ran the command, read the file, or saw the query result. Leave it unset when you inferred, assumed, or were told it. Recall reports this back, so a la…

No output schema declared.

No examples provided.

save_rule ~198

Save a mandatory rule that will ALWAYS be followed in every session. Rules bypass scoring and decay — they are injected into every conversation, every time. Use for absolute requirements like "NEVER do X" or "ALWAYS do Y".

NameTypeReqDescription
categorystringCategory for organization: frontend, backend, security, general, etc.
contentstringyesThe rule to enforce (e.g., "NEVER use -latest model aliases", "ALWAYS apply changes to both class-chat.php AND class-maas.php")
project_idstringProject identifier override (auto-detected from CLAUDE_PROJECT_DIR or git remote if omitted)
scopestringglobal = applies to all projects, project = only this codebase
subjectstringShort label for the rule, e.g. "model_aliases", "companions_parity"
tagsarrayOptional tags for grouping rules

No output schema declared.

No examples provided.

save_session_summary ~63

Save a summary of the current coding session. Captures what was accomplished, decisions made, and next steps. Stored as a session_summary memory for future reference.

NameTypeReqDescription
summarystringyesSummary of the session — what was done, key decisions, and next steps

No output schema declared.

No examples provided.

save_task ~131

Create a task that persists across sessions. Tasks are tracked with status (pending, in_progress, done, blocked) and priority (high, medium, low). Use this to maintain continuity on multi-session work.

NameTypeReqDescription
descriptionstringDetailed description of what needs to be done
prioritystringTask priority
project_idstringProject identifier override (auto-detected from CLAUDE_PROJECT_DIR or git remote if omitted)
statusstringInitial task status
titlestringyesShort task title (e.g., "Fix auth bug in login flow")

No output schema declared.

No examples provided.

set_reminder ~102

Set a reminder that surfaces automatically at the start of your next session. Use for follow-ups, things to check, or deferred work. Reminders auto-archive after being shown.

NameTypeReqDescription
contentstringyesWhat to remind about (e.g., "Check if PR #42 was merged")
ttlstringHow long to keep the reminder alive. Format: "24h", "7d", "30d". Default: 7 days.

No output schema declared.

No examples provided.

update_memory ~131

Update an existing memory's content, importance, or scope.

NameTypeReqDescription
categorystringNew category (e.g., "backend", "frontend", or any custom category)
contentstringNew content
importanceintegerNew importance (1-10)
memory_idintegeryesMemory ID to update
memory_typestringNew memory type
scopestringNew scope
subjectstringNew subject (e.g., "auth_system", "react_version")
tagsarrayNew tags (replaces existing tags)

No output schema declared.

No examples provided.

update_task ~90

Update a task's status, title, description, or priority. Use this to mark tasks as in_progress, done, or blocked as you work.

NameTypeReqDescription
descriptionstringNew description
prioritystringNew priority
statusstringNew status
task_idintegeryesThe task memory ID (from get_tasks)
titlestringNew title

No output schema declared.

No examples provided.

Common questions

What is the io.github.hifriendbot/cogmemai MCP server?

io.github.hifriendbot/cogmemai is an MCP server listed in the public MCP registry as io.github.hifriendbot/cogmemai. The smart memory layer for everything Ai. 95.10% LongMemEval (highest published). This page covers its npm package (cogmemai-mcp).

Is the io.github.hifriendbot/cogmemai MCP server safe to use?

io.github.hifriendbot/cogmemai scores 81 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.hifriendbot/cogmemai MCP server expose?

io.github.hifriendbot/cogmemai exposes 37 tools: save_memory, save_rule, list_rules, delete_rule, preflight, and 32 more. Their descriptions and schemas cost roughly 3,800 tokens of context every time the server is loaded.

Is the io.github.hifriendbot/cogmemai MCP server still maintained?

io.github.hifriendbot/cogmemai is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.hifriendbot/cogmemai MCP server under?

io.github.hifriendbot/cogmemai declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.