# io.github.kaaustubh/project-memory-mcp (npm · @kaaustubh/project-memory-mcp)

Persistent memory for AI coding agents — past bugs, decisions, and your corrections, in your repo.

- Trust score: 0/100 (low)
- Change this week: 0
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-10

> **Recent critical change**: CVE-2026-41242 affects this package (2026-08-02). See the changelog below before you install this server.

## Components

- npm · `@kaaustubh/project-memory-mcp`: 0/100 (this document), [markdown](https://verifymcp.io/servers/kaaustubh-project-memory-mcp/kaaustubh-project-memory-mcp.md), [page](https://verifymcp.io/servers/kaaustubh-project-memory-mcp/kaaustubh-project-memory-mcp)

## Channel facts

- Registry: `npm`
- Package: `@kaaustubh/project-memory-mcp`
- Version: `1.6.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-10.

- **Supply Chain Security**: 73/100
  - No malware found by supply-chain analysis.
  - CVE check failed: an unpatched critical CVE affects this package; the score is capped at 0.
  - No install/post-install scripts declared.
  - 61 of 173 dependencies flagged as unhealthy (1 deprecated).
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 11 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 64/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 1406 tokens (~117/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 85/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 56% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add kaaustubh-project-memory-mcp -- npx -y @kaaustubh/project-memory-mcp
```

### Codex

```bash
codex mcp add kaaustubh-project-memory-mcp -- npx -y @kaaustubh/project-memory-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "kaaustubh-project-memory-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@kaaustubh/project-memory-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add kaaustubh-project-memory-mcp --command npx --arg -y --arg @kaaustubh/project-memory-mcp
```

### Hermes

```yaml
mcp_servers:
  kaaustubh-project-memory-mcp:
    command: "npx"
    args: ["-y", "@kaaustubh/project-memory-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "kaaustubh-project-memory-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@kaaustubh/project-memory-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-07 (score 0, 0)

- [functional] Dependency health: partial → 0.83

### 2026-08-06 (score 0, 0)

- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Schema quality: good
- [functional] First check of Tool coverage: 56
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: fail

### 2026-08-02 (score 0, −5)

- [critical regression] CVE-2026-41242 affects this package: high
- [critical regression] Known CVEs: unverified → fail
- [critical regression] Score status: scored → failed
- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] Security disclosure: fail → unverified
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional] Capabilities: Protocol version not yet verified: we do not have a sandbox capture of the MCP handshake this version of the package performs yet.
- [functional] Tool coverage: Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet.
- [functional] Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional] Licence: MIT

### 2026-07-31 (score 5, −19)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 24, 0)

- [functional] Tool coverage: Tool coverage not yet verified: our sandbox run of this package did not complete, so we have no tool definitions to assess.
- [functional] Schema quality: Schema quality not yet verified: our sandbox run of this package did not complete, so we have no schema to assess.

### 2026-07-28 (score 24, 0)

- [functional] Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional] Tool coverage: Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet.

### 2026-07-27 (score 24)

First indexed and scored.

## MCP tools (12)

### `list_projects` (~23 tokens)

List projects

List all projects under ~/code that have an AGENTS.md memory file.

### `get_project` (~36 tokens)

Get project memory

Return the full AGENTS.md memory for one project.

Input parameters:

- `project` (string, required): Project directory name, e.g. pulse_stripe

### `search_memory` (~33 tokens)

Search project memory

Case-insensitive search across every project's AGENTS.md. Returns matching lines with their project.

Input parameters:

- `query` (string, required)

### `append_decision` (~108 tokens)

Append a decision

Append a dated bullet under '## Decisions' in a project's AGENTS.md (auto-loaded memory). Call this PROACTIVELY right after a non-obvious or architectural decision is made — don't wait to be asked — then tell the user in one line what you recorded. For concise, durable decisions and WHY; not bugs (use log_issue) and not trivia.

Input parameters:

- `project` (string, required)
- `text` (string, required): One line: the decision and WHY, not just what.

### `append_learning` (~86 tokens)

Append a learning

Append a dated bullet under '## Learnings' in a project's AGENTS.md (auto-loaded memory). Call this PROACTIVELY when you discover a durable gotcha/workaround future sessions should know — don't wait to be asked — then tell the user what you recorded. For a specific bug use log_issue instead.

Input parameters:

- `project` (string, required)
- `text` (string, required)

### `remember_preference` (~255 tokens)

Remember a preference

Append a dated bullet under '## Preferences' in an AGENTS.md (auto-loaded memory), turning a user correction or stated habit into a remembered pattern that comes back next session. Call this PROACTIVELY when the user corrects HOW you work or states a durable preference — code style, workflow habit, a 'from now on' rule (e.g. 'never add a co-author trailer', 'always run the typecheck before committing') — don't wait to be asked, then tell the user in one line what you saved. Use scope 'global' (root AGENTS.md, applies to EVERY project) for a cross-project habit; scope 'project' for a preference about one project. This is about agent behaviour/preferences; for a project DECISION use append_decision, for a bug use log_issue.

Input parameters:

- `project` (string): Required when scope is 'project'.
- `scope` (string): 'global' = root AGENTS.md (every project). 'project' = one project. Defaults to global, unless only a project is given.
- `text` (string, required): The preference as a durable rule, ideally with a short WHY. Phrase it as guidance for next time, not a one-off.

### `log_issue` (~156 tokens)

Log a bug/issue

Append a structured bug/issue to <project>/issues.jsonl (high-volume memory, NOT auto-loaded). Call this PROACTIVELY whenever you resolve (or get blocked by) a non-trivial bug — don't wait to be asked — then tell the user in one line what you logged. Skip trivial/transient issues.

Input parameters:

- `cause` (string): Root cause, if known.
- `files` (array)
- `fix` (string): How it was fixed, if resolved.
- `project` (string, required)
- `status` (string): Defaults to 'resolved' if a fix is given, else 'open'.
- `symptom` (string, required): What went wrong / the observable failure.
- `tags` (array)

### `search_issues` (~163 tokens)

Search issues

Search bug/issue history across all projects (or one) over the TEXT FIELDS only (symptom, cause, fix, id, tags) — not the raw JSON, so you won't get false hits on field names like 'fix' or 'status'. Optionally filter by tags (issue must carry all of them). Either query or tags may be given. Call this PROACTIVELY when the user reports an error or you hit a familiar-looking failure, BEFORE debugging from scratch, to check for a prior fix ('have we hit this before?').

Input parameters:

- `project` (string)
- `query` (string): Text to match against symptom/cause/fix/id/tags.
- `tags` (array): Only return issues carrying ALL of these tags.

### `list_open_issues` (~27 tokens)

List open issues

List unresolved issues across all projects (or one).

Input parameters:

- `project` (string)

### `resolve_issue` (~42 tokens)

Resolve an issue

Mark an issue resolved and record the fix.

Input parameters:

- `fix` (string, required)
- `id` (string, required): Issue id, e.g. pulse_stripe-003

### `sync_registry` (~146 tokens)

Sync project registry

Reconcile the root AGENTS.md projects table with what's actually on disk: list projects that have an AGENTS.md but no table row (and add a stub row for each), flag rows whose directory no longer exists, and show live open-issue counts. Automates the 'new project → add a row' step so the cross-project index never silently drifts. Hand-curated columns (Stack, Status, descriptions) are preserved — stubs use the project's '## What this is' line and leave Stack/Status as '?'. Set apply=false to report drift without writing.

Input parameters:

- `apply` (boolean): Write stub rows for new projects (default true). false = report only.

### `find_by_file` (~120 tokens)

Find memory by file

Given a file path or filename fragment, return the issues (matched via their 'files' field) and the decisions/learnings (matched via AGENTS.md bullets that mention it) that touch that file — i.e. 'why is this code the way it is?' answered from memory. Searches all projects unless one is given. Useful when you land on confusing code and want the history behind it.

Input parameters:

- `file` (string, required): A path or filename fragment, e.g. 'index.js' or 'auth/login'.
- `project` (string)

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/kaaustubh-project-memory-mcp/kaaustubh-project-memory-mcp#diagnostics

## Score history

- 2026-08-10: 0
- 2026-08-09: 0
- 2026-08-08: 0
- 2026-08-07: 0
- 2026-08-06: 0
- 2026-08-05: 0
- 2026-08-04: 0
- 2026-08-03: 0
- 2026-08-02: 0
- 2026-08-01: 5
- 2026-07-31: 5
- 2026-07-30: 24
- 2026-07-28: 24
- 2026-07-27: 24

## Links

- npm package: https://www.npmjs.com/package/@kaaustubh/project-memory-mcp
- Socket report: https://socket.dev/npm/package/@kaaustubh/project-memory-mcp
- Repository: https://github.com/kaaustubh/project-memory-mcp
- Changelog RSS feed: https://verifymcp.io/servers/kaaustubh-project-memory-mcp/kaaustubh-project-memory-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/kaaustubh-project-memory-mcp/kaaustubh-project-memory-mcp.json
- HTML version of this page: https://verifymcp.io/servers/kaaustubh-project-memory-mcp/kaaustubh-project-memory-mcp