Polypack Memory
PYPI · POLYPACK-MCP · SCANNED AUG 23
MCP server exposing Polypack as persistent adaptive memory
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security32
- Malware scan not yet available for this package.Unverified
- CVE check failed: a known high-severity CVE affects mcp 1.9.4, a direct dependency. A fixed version is available. View diagnostics → Fail
- Runs setuptools.build_meta at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
- 2 of 25 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency32
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: no license is declared. See how to fix → Fail
- Actively maintained (last published 0 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability34
- 0% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Fail
- AI-judged instruction clarity (fair).Partial
- Tool/resource definitions use about 893 tokens (~55/item across 16 items; 12 tools + 4 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage67
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
Capabilities40
- Spec-recency check failed: implements MCP spec 2025-03-26; the latest is 2026-07-28. See how to fix → Fail
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
How do I install the Polypack Memory MCP server?
Polypack Memory runs locally as a PyPI package, launched with uvx polypack-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · polypack-mcp
claude mcp add imattau-polypack-mcp -- uvx polypack-mcp
{
"mcpServers": {
"imattau-polypack-mcp": {
"command": "uvx",
"args": [
"polypack-mcp"
]
}
}
} {
"servers": {
"imattau-polypack-mcp": {
"command": "uvx",
"args": [
"polypack-mcp"
]
}
}
} codex mcp add imattau-polypack-mcp -- uvx polypack-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"imattau-polypack-mcp": {
"type": "local",
"command": [
"uvx",
"polypack-mcp"
],
"enabled": true
}
}
} openclaw mcp add imattau-polypack-mcp --command uvx --arg polypack-mcp
mcp_servers:
imattau-polypack-mcp:
command: "uvx"
args: ["polypack-mcp"] {
"McpServers": {
"imattau-polypack-mcp": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"polypack-mcp"
]
}
}
} assistant mcp add imattau-polypack-mcp -t stdio -c uvx -a polypack-mcp
{
"mcpServers": {
"imattau-polypack-mcp": {
"command": "uvx",
"args": [
"polypack-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 23 Aug 26 32
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 23 Aug 2026 · Analysed pypi/polypack-mcp@0.1.16
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | setuptools.build_meta |
Vulnerabilities 8 findings
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-9h52-p55h-vw2f | CVE-2025-66416 | high | yes | |
| GHSA-j975-95f5-7wqh | CVE-2025-53365 | high | yes | |
| GHSA-jpw9-pfvf-9f58 | CVE-2026-52869 | high | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L | yes |
| GHSA-vj7q-gjh5-988w | CVE-2026-59950 | high | yes | |
| PYSEC-2026-1617 | CVE-2025-66416 | none | yes | |
| PYSEC-2026-1618 | CVE-2025-53365 | none | yes | |
| PYSEC-2026-3482 | CVE-2026-52869 | high | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L | yes |
| PYSEC-2026-3483 | CVE-2026-59950 | none | yes |
Dependencies 25 packages
| Packages resolved | 25 |
|---|---|
| Stale | 2 |
| Tree resolution | Complete |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
graph_query ~89
Inspect graph neighbors/schema or perform an advanced edge operation. Prefer memory_link for normal memory relationships. Supported operations are neighbors, add_edge, schema, and relationship_diagnostics. RESPONDS_TO graph edges are authoritative; diagnostics identifies legacy provenance-only relationships.
| Name | Type | Req | Description |
|---|---|---|---|
| id | – | – | – |
| operation | string | yes | – |
| source | – | – | – |
| target | – | – | – |
| type | – | – | – |
No output schema declared.
No examples provided.
memory_consolidate ~56
Consolidate source memories into one durable higher-level memory.
| Name | Type | Req | Description |
|---|---|---|---|
| confidence | number | – | – |
| content | string | yes | – |
| context | – | – | – |
| memory_class | string | – | – |
| source_ids | array | yes | – |
No output schema declared.
No examples provided.
memory_context ~75
Return a working-memory set selected by activation and estimated-token budget. token_budget is an estimated-token budget. Each returned memory fits wholly within the remaining budget; budgets must be greater than zero.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | yes | – |
| limit | integer | – | – |
| strict_context | boolean | – | – |
| token_budget | – | – | – |
No output schema declared.
No examples provided.
memory_feedback ~54
Record whether a retrieved memory helped this task. Call this after using a recalled memory when it was useful or misleading.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_id | string | – | – |
| memory_id | string | yes | – |
| useful | boolean | yes | – |
No output schema declared.
No examples provided.
memory_link ~80
Connect two memories with an explicit graph relationship. Use RESPONDS_TO when a new handoff, verification, or fix addresses an earlier memory. Use memory_recall(include_neighbors=true) to retrieve linked memories with relationship metadata.
| Name | Type | Req | Description |
|---|---|---|---|
| relationship | string | – | – |
| source_memory_id | string | yes | – |
| target_memory_id | string | yes | – |
No output schema declared.
No examples provided.
memory_link_batch ~65
Connect multiple pairs of memories with explicit graph relationships in a single batch. Each item in the list should be a dict with 'source_memory_id', 'target_memory_id', and optional 'relationship' (defaults to 'RESPONDS_TO') keys.
| Name | Type | Req | Description |
|---|---|---|---|
| links | array | yes | – |
No output schema declared.
No examples provided.
memory_recall ~162
Search memories by text, context, activation, and confidence. Use this for a targeted question. Use memory_context to assemble working context. Context is soft by default; use strict_context=true for isolation. With include_neighbors=true, bounded graph neighbors are hydrated into the result. Filter relationships with edge_types such as RESPONDS_TO. The neighbor_limit bounds hydrated neighbors; limit remains the total result count. Metadata reports when additional neighbors were available.
| Name | Type | Req | Description |
|---|---|---|---|
| context | – | – | – |
| depth | integer | – | – |
| edge_types | – | – | – |
| include_neighbors | boolean | – | – |
| limit | integer | – | – |
| neighbor_limit | integer | – | – |
| query | string | yes | – |
| strict_context | boolean | – | – |
| token_budget | – | – | – |
No output schema declared.
No examples provided.
memory_store ~94
Store durable project memory. Use procedural for preferences, conventions, and decisions; semantic for stable facts; episodic for events or task outcomes; and entity for named people, projects, or objects. Use a stable context for project memory.
| Name | Type | Req | Description |
|---|---|---|---|
| confidence | number | – | – |
| content | string | yes | – |
| context | – | – | – |
| memory_class | string | – | – |
| metadata | – | – | – |
| provenance | – | – | – |
No output schema declared.
No examples provided.
memory_store_batch ~63
Store multiple durable project memories in a single batch. Each item in the list should be a dict with 'content' and optional 'memory_class', 'context', 'confidence', 'provenance', and 'metadata' keys.
| Name | Type | Req | Description |
|---|---|---|---|
| memories | array | yes | – |
No output schema declared.
No examples provided.
memory_supersede ~37
Replace an outdated fact while retaining its history.
| Name | Type | Req | Description |
|---|---|---|---|
| new_memory_id | string | yes | – |
| old_memory_id | string | yes | – |
No output schema declared.
No examples provided.
memory_suppress ~37
Inhibit a stale or unhelpful memory without deleting it.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | number | – | – |
| memory_id | string | yes | – |
No output schema declared.
No examples provided.
memory_thread ~60
Walk the RESPONDS_TO chain from a starting memory ID and return the thread. Retrieves connected memories in both directions along RESPONDS_TO edges, returning them sorted chronologically.
| Name | Type | Req | Description |
|---|---|---|---|
| max_depth | integer | – | – |
| start_id | string | yes | – |
No output schema declared.
No examples provided.
What is the Polypack Memory MCP server?
Polypack Memory is an MCP server listed in the public MCP registry as io.github.imattau/polypack-mcp. MCP server exposing Polypack as persistent adaptive memory. This page covers its PyPI package (polypack-mcp).
Is the Polypack Memory MCP server safe to use?
Polypack Memory scores 32 out of 100 on VerifyMCP. We recorded 8 known advisories against it as of 23 August 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Polypack Memory MCP server expose?
Polypack Memory exposes 12 tools: memory_store, memory_recall, memory_thread, memory_context, memory_feedback, and 7 more. Their descriptions and schemas cost roughly 872 tokens of context every time the server is loaded.
Is the Polypack Memory MCP server still maintained?
Polypack Memory is still listed as active in the MCP registry. We last reached this channel on 23 August 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.