# io.github.hifriendbot/cogmemai (npm · cogmemai-mcp)

95.10% LongMemEval (highest published). Encrypted persistent memory for Ai coding assistants.

- Trust score: 60/100 (medium)
- Change this week: +36
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `cogmemai-mcp`: 60/100 (this document), [markdown](https://verifymcp.io/servers/hifriendbot-cogmemai/cogmemai-mcp.md), [page](https://verifymcp.io/servers/hifriendbot-cogmemai/cogmemai-mcp)

## Channel facts

- Registry: `npm`
- Package: `cogmemai-mcp`
- Version: `3.17.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (156 of 158), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (156 of 158), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 52 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 27/100
  - AI-judged instruction clarity (poor).
  - Context-footprint check failed: tool/resource definitions use about 5439 tokens (~155/item across 35 items; 35 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add hifriendbot-cogmemai -- npx -y cogmemai-mcp
```

### Codex

```bash
codex mcp add hifriendbot-cogmemai -- npx -y cogmemai-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "hifriendbot-cogmemai": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "cogmemai-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add hifriendbot-cogmemai --command npx --arg -y --arg cogmemai-mcp
```

### Hermes

```yaml
mcp_servers:
  hifriendbot-cogmemai:
    command: "npx"
    args: ["-y", "cogmemai-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "hifriendbot-cogmemai": {
      "command": "npx",
      "args": [
        "-y",
        "cogmemai-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 60, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 59, +33)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] License: unverified → pass
- [functional] Licence: MIT

### 2026-07-31 (score 26, −2)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 28, −40)

- [security regression] Malware scan: pass → unverified
- [functional regression] Security disclosure: fail → unverified
- [functional regression] Tool coverage: 100 → unverified

### 2026-07-29 (score 68, +43)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [functional regression] Security disclosure: unverified → fail
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Tool coverage: 100
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: poor
- [functional] First check of Schema quality: fail
- [functional] Licence: MIT

### 2026-07-28 (score 25, +1)

- [functional regression] Security disclosure: fail → unverified
- [functional improvement] Dependency health: unverified → partial

### 2026-07-27 (score 24)

First indexed and scored.

## MCP tools (35)

### `save_memory` (~304 tokens)

Store a developer memory (fact, preference, decision, architecture detail). Memories persist across all Claude Code sessions and are available in future conversations.

Input parameters:

- `category` (string): Category: frontend, backend, database, devops, testing, security, performance, tooling, api, general. Custom categories also accepted for non-developer domains.
- `content` (string, required): The fact to remember (complete sentence)
- `importance` (integer): 1-10 (10 = core architecture, 1 = trivial)
- `memory_type` (string): Type: identity, preference, architecture, decision, bug, dependency, pattern, context. Custom types also accepted for non-developer domains.
- `scope` (string): global = applies everywhere, project = specific to this codebase, team = shared with team members
- `subject` (string): What this is about, e.g. "auth_system", "react_version", "tab_width"
- `tags` (array): Optional tags for grouping/threading memories (max 5 tags, each max 30 chars). E.g., ["marketing-campaign", "feb-2026"]
- `team_id` (integer): Team ID (required when scope is "team"). The memory will be shared with all team members.
- `ttl` (string): Set an expiration time. Use for temporary context like current task status. Format: "24h", "7d", "30d". Memory auto-archives after expiry.

### `save_rule` (~172 tokens)

Save a mandatory rule that will ALWAYS be followed in every session. Rules bypass scoring and decay — they are injected into every conversation, every time. Use for absolute requirements like "NEVER do X" or "ALWAYS do Y".

Input parameters:

- `category` (string): Category for organization: frontend, backend, security, general, etc.
- `content` (string, required): The rule to enforce (e.g., "NEVER use -latest model aliases", "ALWAYS apply changes to both class-chat.php AND class-maas.php")
- `scope` (string): global = applies to all projects, project = only this codebase
- `subject` (string): Short label for the rule, e.g. "model_aliases", "companions_parity"
- `tags` (array): Optional tags for grouping rules

### `list_rules` (~56 tokens)

List all mandatory rules for the current project and/or globally. Rules are always-on memories that surface in every session.

Input parameters:

- `scope` (string): Filter: all = project + global, project = this project only, global = global only

### `delete_rule` (~42 tokens)

Delete a mandatory rule by its memory ID. Use list_rules to find the ID first.

Input parameters:

- `memory_id` (integer, required): The memory ID of the rule to delete

### `preflight` (~114 tokens)

Think Before You Speak. Call this BEFORE making any suggestion, recommendation, or action plan. Sends the topic to a fast keyword search and returns any relevant prior context — previous attempts, decisions, contacts, evaluations. This prevents suggesting things that were already tried, rejected, or completed. Fast and cheap — use liberally.

Input parameters:

- `message` (string, required): What you are about to suggest or respond about. Be specific — include names, topics, approaches.
- `project_id` (string): Project ID (auto-detected if omitted)

### `recall_memories` (~230 tokens)

Search stored memories using semantic search. Returns memories ranked by relevance, importance, and recency. Use this to find relevant context from past sessions.

Input parameters:

- `category` (string): Filter by category (e.g., "backend", "frontend", or any custom category)
- `context_type` (string): Optional context type that shifts scoring weights. debugging = boost bug/pattern memories, planning = boost architecture/decision, reviewing = boost pattern/preference.
- `importance_min` (integer): Only return memories with importance >= this value
- `limit` (integer): Max results
- `memory_type` (string): Filter by type
- `query` (string, required): What to search for (natural language)
- `scope` (string): Filter by scope
- `synthesize` (boolean): When true and 3+ results are found, returns an AI-synthesized summary combining all memories into a coherent answer.
- `tag` (string): Filter by tag (e.g., "marketing-campaign")
- `team_id` (integer): Optional override. Team memories are automatically included for team/enterprise users.

### `extract_memories` (~80 tokens)

Extract memories from a conversation exchange using AI. Send the developer message and assistant response, and the server identifies facts worth remembering (architecture decisions, preferences, bug fixes, etc.).

Input parameters:

- `assistant_response` (string): The assistant's response
- `previous_context` (string): Previous exchange for context
- `user_message` (string, required): The developer's message

### `get_project_context` (~210 tokens)

Load top memories for the current project plus relevant global memories. Use at the start of a session to get full context from previous sessions. Optionally pass context to get memories most relevant to your current task.

Input parameters:

- `compact` (boolean): When true (default), returns only formatted_context text instead of full JSON arrays. Saves ~60% tokens.
- `context` (string): Optional context to improve relevance ranking (e.g., current task or topic)
- `context_type` (string): Optional context type that shifts scoring weights. debugging = boost bug/pattern memories, planning = boost architecture/decision, reviewing = boost pattern/preference.
- `include_global` (boolean): Include global developer preferences
- `limit` (integer): Max total memories to return (default 25). Lower values save context tokens.
- `project_id` (string): Project identifier (auto-detected from git remote if omitted)
- `team_id` (integer): Optional override. Team memories are automatically included for team/enterprise users.

### `list_memories` (~169 tokens)

List stored memories with optional filters by type, category, scope, or project.

Input parameters:

- `category` (string): Filter by category (e.g., "backend", "frontend", or any custom category)
- `importance_min` (integer): Only return memories with importance >= this value
- `limit` (integer): Results per page
- `memory_type` (string): Filter by type
- `offset` (integer): Pagination offset
- `scope` (string): Filter by scope
- `sort_by` (string): Sort order: importance (default), updated, created, referenced (most used first), least_used
- `tag` (string): Filter by tag (e.g., "marketing-campaign")
- `untyped` (boolean): When true, only return memories with no memory_type set

### `delete_memory` (~32 tokens)

Delete a specific memory by its ID. This is permanent.

Input parameters:

- `memory_id` (integer, required): Memory ID to delete

### `update_memory` (~131 tokens)

Update an existing memory's content, importance, or scope.

Input parameters:

- `category` (string): New category (e.g., "backend", "frontend", or any custom category)
- `content` (string): New content
- `importance` (integer): New importance (1-10)
- `memory_id` (integer, required): Memory ID to update
- `memory_type` (string): New memory type
- `scope` (string): New scope
- `subject` (string): New subject (e.g., "auth_system", "react_version")
- `tags` (array): New tags (replaces existing tags)

### `bulk_delete` (~45 tokens)

Delete multiple memories at once by their IDs. Maximum 100 IDs per call. This is permanent.

Input parameters:

- `ids` (array, required): Array of memory IDs to delete (max 100)

### `bulk_update` (~47 tokens)

Update multiple memories at once. Each item needs a memory_id and fields to update. Maximum 50 items per call.

Input parameters:

- `updates` (array, required): Array of update objects (max 50)

### `get_usage` (~26 tokens)

Get current usage statistics — memory count, extractions this month, tier info, projects.

### `export_memories` (~28 tokens)

Export all memories as JSON. Use this to back up memories or transfer them to another project.

### `import_memories` (~67 tokens)

Bulk import memories from a JSON array. Each memory needs at minimum a content field. Deduplication is applied automatically.

Input parameters:

- `memories` (string, required): JSON string containing an array of memory objects. Each must have "content", optionally: memory_type, category, subject, importance, scope.

### `ingest_document` (~90 tokens)

Extract memories from a document by splitting it into chunks and processing each one. Great for onboarding — feed in READMEs, architecture docs, or API specs to quickly build project context.

Input parameters:

- `document_type` (string): Type hint for extraction (e.g., readme, api_docs, architecture, changelog)
- `text` (string, required): The document text to ingest (up to 50K characters)

### `save_session_summary` (~63 tokens)

Save a summary of the current coding session. Captures what was accomplished, decisions made, and next steps. Stored as a session_summary memory for future reference.

Input parameters:

- `summary` (string, required): Summary of the session — what was done, key decisions, and next steps

### `list_tags` (~35 tokens)

List all tags in use across your memories, with counts. Use this to see what threads/groups exist and find related memories by tag.

### `link_memories` (~118 tokens)

Connect two related memories with a named relationship. Use this to build a knowledge graph — e.g., linking a bug fix to the architecture decision that caused it, or connecting a preference to the pattern it led to.

Input parameters:

- `memory_id` (integer, required): The source memory ID
- `related_memory_id` (integer, required): The target memory ID to link to
- `relationship` (string, required): How the memories relate: led_to (A caused B), contradicts (A conflicts with B), extends (A builds on B), related (general connection)

### `get_memory_links` (~56 tokens)

View all memories linked to a specific memory. Returns the relationship type and full memory details for each connection. Use this to explore the knowledge graph around a memory.

Input parameters:

- `memory_id` (integer, required): The memory ID to get links for

### `get_memory_versions` (~55 tokens)

View the edit history of a memory. Shows all previous versions with timestamps and what changed. Useful for understanding how a decision or fact evolved over time.

Input parameters:

- `memory_id` (integer, required): The memory ID to get version history for

### `get_analytics` (~81 tokens)

Get a memory health dashboard with insights: most recalled memories, never-recalled memories, stale memories, growth trends, and breakdowns by type and category. Use this to identify cleanup opportunities and understand memory usage patterns.

Input parameters:

- `project_id` (string): Filter analytics to a specific project. Omit for current project. Use "all" for cross-project analytics.

### `promote_memory` (~74 tokens)

Promote a project-scoped memory to global scope so it applies across all projects. Use this when you discover a preference or pattern that should be universal — e.g., "user prefers tabs over spaces" or "always use Bun instead of npm".

Input parameters:

- `memory_id` (integer, required): The project memory ID to promote to global scope

### `consolidate_memories` (~162 tokens)

Consolidate related memories into fewer, richer memories. Finds clusters of memories sharing the same subject (3+ memories required), then uses AI to synthesize each cluster into 1-2 comprehensive facts. Originals are archived (not deleted) with full version history. Use dry_run=true to preview without making changes. Great for cleaning up memory clutter after many sessions.

Input parameters:

- `category` (string): Only consolidate memories in this category
- `dry_run` (boolean): When true, preview consolidation results without making changes. Recommended for first use.
- `memory_type` (string): Only consolidate memories of this type
- `subject` (string): Consolidate only memories with this exact subject (e.g., "auth_system"). Omit to auto-detect all qualifying clusters.

### `save_task` (~105 tokens)

Create a task that persists across sessions. Tasks are tracked with status (pending, in_progress, done, blocked) and priority (high, medium, low). Use this to maintain continuity on multi-session work.

Input parameters:

- `description` (string): Detailed description of what needs to be done
- `priority` (string): Task priority
- `status` (string): Initial task status
- `title` (string, required): Short task title (e.g., "Fix auth bug in login flow")

### `get_tasks` (~83 tokens)

Get tasks for the current project. Returns tasks filtered by status — defaults to showing pending and in_progress tasks. Use at session start to pick up where you left off.

Input parameters:

- `include_done` (boolean): When true, also include completed tasks
- `status` (string): Filter by task status. "all" returns pending + in_progress + blocked (excludes done).

### `update_task` (~90 tokens)

Update a task's status, title, description, or priority. Use this to mark tasks as in_progress, done, or blocked as you work.

Input parameters:

- `description` (string): New description
- `priority` (string): New priority
- `status` (string): New status
- `task_id` (integer, required): The task memory ID (from get_tasks)
- `title` (string): New title

### `save_correction` (~134 tokens)

Save a correction pattern — what went wrong and what the right approach is. These are surfaced automatically when similar situations arise in future sessions, helping avoid repeated mistakes.

Input parameters:

- `context` (string): When/where this applies (e.g., "package management in monorepo")
- `right_approach` (string, required): The correct approach (e.g., "Always use bun add for this project")
- `scope` (string): global = applies everywhere, project = specific to this codebase
- `wrong_approach` (string, required): What was done incorrectly (e.g., "Used npm install instead of bun add")

### `set_reminder` (~102 tokens)

Set a reminder that surfaces automatically at the start of your next session. Use for follow-ups, things to check, or deferred work. Reminders auto-archive after being shown.

Input parameters:

- `content` (string, required): What to remind about (e.g., "Check if PR #42 was merged")
- `ttl` (string): How long to keep the reminder alive. Format: "24h", "7d", "30d". Default: 7 days.

### `get_stale_memories` (~79 tokens)

Find memories that may be outdated based on age and access patterns. Returns memories that haven't been recalled or updated recently, so you can review, update, or delete them.

Input parameters:

- `days_threshold` (integer): Consider memories stale if not accessed in this many days (default: 30)
- `limit` (integer): Max results to return

### `get_file_changes` (~42 tokens)

Show what files changed since your last session. Compares the current git state to a snapshot saved when your previous session ended. Helps you understand what happened between sessions.

### `feedback_memory` (~94 tokens)

Signal whether a recalled memory was useful or irrelevant. Helps improve future recall quality over time. Use after recalling memories to indicate which were helpful vs noise.

Input parameters:

- `memory_id` (integer, required): The memory ID to give feedback on
- `signal` (string, required): "useful" boosts the memory's ranking, "irrelevant" reduces its importance. For skills, "useful" boosts confidence, "irrelevant" reduces it.

### `generate_skills` (~118 tokens)

Manually trigger skill generation from your corrections, preferences, and patterns. Skills are behavioral directives that auto-improve how the AI works with you. CogmemAi also generates skills automatically when enough evidence accumulates — this tool lets you trigger it manually or preview candidates.

Input parameters:

- `dry_run` (boolean): When true, preview skill candidates without generating them
- `project_id` (string): Project to generate skills for (auto-detected if omitted)
- `subject` (string): Generate skills for a specific subject. Omit to scan all subjects.

### `extract_principles` (~110 tokens)

Analyze memory clusters and extract underlying factual principles or patterns. Principles are observations about your project — "this codebase tends to have X" — not behavioral instructions (those are skills). Use dry_run to preview candidates first.

Input parameters:

- `dry_run` (boolean): When true, preview principle candidates without generating them
- `project_id` (string): Project to extract principles for (auto-detected if omitted)
- `subject` (string): Focus on a specific subject area. Omit to scan all subjects.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/hifriendbot-cogmemai/cogmemai-mcp#diagnostics

## Score history

- 2026-08-03: 60
- 2026-08-02: 59
- 2026-08-01: 26
- 2026-07-31: 26
- 2026-07-30: 28
- 2026-07-29: 68
- 2026-07-28: 25
- 2026-07-27: 24

## Links

- npm package: https://www.npmjs.com/package/cogmemai-mcp
- Socket report: https://socket.dev/npm/package/cogmemai-mcp
- Repository: https://github.com/hifriendbot/cogmemai-mcp
- Changelog RSS feed: https://verifymcp.io/servers/hifriendbot-cogmemai/cogmemai-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/hifriendbot-cogmemai/cogmemai-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/hifriendbot-cogmemai/cogmemai-mcp