Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.plur-ai/plur

NPM · @PLUR-AI/MCP · SCANNED SEP 22

Open, local-first engram memory for AI agents: read, correct, delete; shared over MCP.

Available components

+2 this week 83 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 45 of 138 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability74
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 4009 tokens (~286/item across 14 items; 12 tools + 2 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
  • Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 14 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the io.github.plur-ai/plur MCP server?

io.github.plur-ai/plur runs locally as an npm package, launched with npx -y @plur-ai/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @plur-ai/mcp

# add to Claude Code
claude mcp add plur-ai-plur -- npx -y @plur-ai/mcp
// .cursor/mcp.json
{
  "mcpServers": {
    "plur-ai-plur": {
      "command": "npx",
      "args": [
        "-y",
        "@plur-ai/mcp"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "plur-ai-plur": {
      "command": "npx",
      "args": [
        "-y",
        "@plur-ai/mcp"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add plur-ai-plur -- npx -y @plur-ai/mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "plur-ai-plur": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@plur-ai/mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add plur-ai-plur --command npx --arg -y --arg @plur-ai/mcp
# ~/.hermes/config.yaml
mcp_servers:
  plur-ai-plur:
    command: "npx"
    args: ["-y", "@plur-ai/mcp"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "plur-ai-plur": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@plur-ai/mcp"
      ]
    }
  }
}
# add to Vellum
assistant mcp add plur-ai-plur -t stdio -c npx -a -y @plur-ai/mcp
// mcp.json
{
  "mcpServers": {
    "plur-ai-plur": {
      "command": "npx",
      "args": [
        "-y",
        "@plur-ai/mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 22 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

  • 20 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 18 Sept 26 −3
    • Stability: pass → unverified security
    • Tool safety: pass → unverified security
    • Capabilities: pass → unverified functional
    • Tool coverage: 100 → unverified functional
    • Schema quality: 100 → unverified functional
    • Security disclosure: fail → unverified functional
    • Stability: pass → 0.80 functional
    • Package version: 0.20.0 → 0.20.1 functional
  • 17 Sept 26 +1
    • Stability: 0.97 → pass security
  • 16 Sept 26 +2
    • Stability: 0.93 → unverified security
    • Tool safety: pass → unverified security
    • GHSA-rgj7-g3m4-5g8c no longer affects this package security
    • GHSA-f88m-g3jw-g9cj no longer affects this package security
    • CVE-2026-39244 no longer affects this package security
    • Known CVEs: fail → pass security
    • Schema quality: 238 → 286 functional
    • Capabilities: pass → unverified functional
    • Tool coverage: 100 → unverified functional
    • Schema quality: 100 → unverified functional
    • Schema quality: excellent → good functional
    • Package version: 0.19.3 → 0.20.0 functional
  • 15 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

  • 13 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 12 Sept 26 −3
    • Stability: pass → 0.83 functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 22 Sept 2026 · Analysed npm/@plur-ai/mcp@0.20.1

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 138 packages
Packages resolved 138
Deprecated 1
Stale 44
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 12 exposed · ~3,345 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
plur_admin ~359

Gateway to the 33 PLUR operations that are not top-level tools under the current profile (collapsed into one dispatch tool so Cursor's ~40-tool-per-workspace limit is not exhausted by PLUR alone). A plur_* name missing from tools/list means it moved HERE — not that the MCP is unavailable. Calling convention: { action: "<tool name>", args: { ...that tool's normal arguments } } — same arguments, same validation, same result as a direct call. Example: { action: "plur_recall_hybrid", args: { query: "deploy checklist" } }. Send { action: "help" } for every action's one-line description and argument schema. Actions, grouped — inject: plur_inject, plur_inject_hybrid · packs: plur_packs_discover, plur_packs_export, plur_packs_install, plur_packs_list, plur_packs_preview · stores: plur_stores_add, plur_stores_list · sync: plur_sync, plur_sync_status · other: plur_capture, plur_episode_to_engram, plur_extract_meta, plur_history, plur_ingest, plur_learn_batch, plur_meta_engrams, plur_outbox, plur_pin, plur_profile, plur_promote, plur_provenance, plur_recall_hybrid, plur_report_failure, plur_rescope, plur_scopes_discover, plur_session_scope, plur_similarity_search, plur_suggest_scope, plur_tensions, plur_timeline, plur_validate_meta.

NameTypeReqDescription
actionstringyesWhich underlying plur_* tool to invoke, or "help" to list every action with its description and argument schema
argsobjectArguments for the chosen action, matching that tool's normal input schema

No output schema declared.

No examples provided.

plur_doctor ~263

Diagnose the PLUR ENGINE (embedder, hybrid search, remote-store auth) — not hook/MCP wiring. Reports whether the embedding model loaded, whether hybrid search is fully operational, and — for any configured enterprise/remote store — whether its auth is valid (probes /api/v1/me and decodes token expiry), so a dead or soon-to-expire token surfaces instead of hiding behind a "healthy" report. Run this first when recall feels off or team engrams stop syncing. Does NOT check .cursor/mcp.json, .cursor/hooks.json, or the live MCP tool count — for that, run the `plur doctor` CLI command in a terminal (a different, more thorough check with the same name).

NameTypeReqDescription
rerank_evalbooleanIf true and a reranker is configured (PLUR_RERANKER), run the per-store self-eval gate (#451): probes synthesized from this store's own engrams compare rerank-on vs RRF-only ordering. Verdict is cach…
retrybooleanIf true, reset cached embedder failure state and retry the model load before reporting

No output schema declared.

No examples provided.

plur_feedback ~114

Rate an engram's usefulness — trains injection relevance over time. Supports single or batch mode.

NameTypeReqDescription
idstringEngram ID (single mode)
scopestringStore scope to target directly, e.g. "primary" for the local store or a remote scope like "group:plur/plur-ai/engineering". Required when the same engram ID exists in multiple stores (#850).
signalstringFeedback signal (single mode)
signalsarrayBatch feedback signals

No output schema declared.

No examples provided.

plur_forget ~196

Retire an engram by ID or search term — marks it as no longer active without deleting history

NameTypeReqDescription
idstringExact engram ID to retire
reasonstringWhy this is being retired. Recorded in the history log and on the engram (#959). Say what changed, not just that something did.
scopestringWhich store holds it (#831). Ids are minted per store, so one id can name several unrelated engrams. Pass "primary" to stay on disk — the local primary store and any local secondary stores, never a r…
searchstringSearch term to find engram to retire

No output schema declared.

No examples provided.

plur_learn ~1,310

Create an engram — record a reusable learning, preference, or correction. A write is never suppressed by similarity: exact content-hash duplicates NOOP, and anything merely SIMILAR is written and reported back in `dedup.near_duplicates` (closest existing engrams, their cosine scores, and a preview of each neighbour's own statement — read them before moving on; that is what they are for) so you can supersede or merge deliberately. High similarity is a reason to look, not a decision — cosine cannot tell a duplicate from a correction of it. Multi-agent note: in an orchestration that spawns subagents, have the PARENT session own plur_learn writes — spawned subagents should return their findings as text for the parent to persist, rather than each calling plur_learn (tool availability is not guaranteed in every subagent context). See plur-ai/plur#281.

NameTypeReqDescription
attributionobjectWho is answerable for this memory (#961). Every sub-field optional; OMIT rather than guess — a memory with no agent is honest, one with an invented agent is worse than none. Set asserted_by to "unide…
claim_classstringWhat KIND of claim this is (#963), and the most useful single field for anyone later deciding how much to trust it. Use "asserted" when a PERSON stated it outright, "inferred" when YOU worked it out,…
commitmentstringHow firmly the user has committed to this belief (default: leaning). `draft` marks the engram as pending human approval: core stores and RECALLS it normally but NEVER injects it (#1141), so an unappr…
domainstringDomain tag, e.g. software.deployment
licensestringWhich licence governs reuse of this memory, as an SPDX-style identifier such as "cc-by-4.0" or "apache-2.0". Set it only when the user has actually said which licence applies — do NOT guess one. Left…
locked_reasonstringWhy this engram is locked (only meaningful when commitment=locked)
measured_underobjectMeasurement context for numeric or benchmark-derived claims (#869). Records the conditions under which the asserted value was measured — model, source_type, hardware, dataset, date. When present, the…
pinnedbooleanAlways-load flag. If true, this engram bypasses the keyword-relevance gate at injection time. Use sparingly: meta-rules, safety conventions, core operating principles only.
rationalestringThe mechanism that makes the statement true, and therefore the condition under which it would STOP being true. One sentence. "Because the user said so on <date>" is a citation, not a mechanism: that…
scopestringNamespace, e.g. global, project:myapp
session_idstringSession this write belongs to (from plur_session_start). Resolves the session default scope (incl. mid-session plur_session_scope changes) when no explicit scope is passed. Optional when one session…
sourcestringOrigin of this knowledge (URL, conversation ref, etc.)
statementstringyesONE assertion, written so someone who was not there can act on it. Route the rest to the field whose job it is: the mechanism that makes it true goes in `rationale`, where it came from in `source`, w…
supersedesarrayEngram IDs this statement intentionally replaces (#240). Writes relations.supersedes on the new engram and the reverse superseded_by edge on each local target. Supersedes-linked pairs are skipped by…
tagsarraySearchable keyword tags — contribute to BM25/embedding recall, so concrete keywords pay off
typestringCategory of the engram
valid_fromstringISO date (YYYY-MM-DD) the knowledge becomes valid — inject/recall skip the engram before this date (#347)
valid_untilstringISO date (YYYY-MM-DD) the knowledge expires — inject/recall skip the engram after this date. Set this for any time-bound fact (offers, deadlines, temporary endpoints). When omitted, an explicit expir…
visibilitystringWhether this memory may leave this machine. Defaults to "private", which means it is EXCLUDED from every exported pack. Set "public" only when the user has said this is shareable with others — it is…

No output schema declared.

No examples provided.

plur_packs_uninstall ~49

Uninstall an engram pack by name — removes the pack and all its engrams

NameTypeReqDescription
namestringyesPack name to uninstall (use plur_packs_list to see names)

No output schema declared.

No examples provided.

plur_recall ~399

Search engrams by topic. Default mode is hybrid (BM25 + local embeddings via RRF) — set mode:"keyword" for BM25-only. Local search plus, when a configured enterprise store is part of the current project/work, one live timeout-bounded recall per remote host merged in (a `remote_stores` block + warning appears when a host is degraded; no host configured or implicated = fully local). Note: a project-scope filter also returns personal-family engrams (local, global, user:*, agent:*); an explicit scope=global recall returns ALL personal-family engrams — wider than scope=global INJECT, which is targeted to the global namespace only.

NameTypeReqDescription
budgetobjectBudget constraints for sub-agents. Hybrid mode only — ignored when mode:"keyword".
caller_session_idstringSession ID of calling agent for budget enforcement. Hybrid mode only — ignored when mode:"keyword".
domainstringFilter by domain prefix
include_episodesbooleanIf true, include linked episode summaries for each engram (SP2 episodic anchoring). Hybrid mode only — ignored when mode:"keyword".
limitnumberMax results to return (default 20)
modestringSearch mode — hybrid (default): BM25 + embeddings via RRF; keyword: BM25-only (faster, embeddings-independent). budget, caller_session_id and include_episodes apply to hybrid mode only — in keyword m…
querystringyesSearch query to find relevant engrams
scopestringFilter by scope (also includes global)
session_idstringSession this recall belongs to (from plur_session_start). Its default scope (incl. mid-session plur_session_scope changes) sets the remote dialing context when no explicit scope filter is passed. Opt…

No output schema declared.

No examples provided.

plur_receipt ~185

Counted report of what your memory retrieved for you: engrams stored, how many were retrieved and how often, which are most relied on, and how much of the store is dormant. Local and read-only; every figure is directly counted, never estimated. IMPORTANT when relaying to the user: `activation_rate` is COVERAGE over the logging window (≈ how much of the store was surfaced), NOT a quality or effectiveness score — it is naturally low and FALLS as more engrams are added, so never present it as "memory is N% effective". A `summary` line is included; prefer relaying that. NOT plur_provenance: this counts usage across the whole store; plur_provenance says where a single memory came from.

NameTypeReqDescription
daysnumberRestrict to the last N days (integer). Omit for all recorded history.

No output schema declared.

No examples provided.

plur_session_end ~230

End a session. BEFORE calling this tool, review the conversation and extract learnings: 1. Corrections the user made ("no, use X not Y") → type: behavioral 2. Preferences stated ("always X", "never Y") → type: behavioral 3. Codebase patterns discovered (naming, structure, conventions) → type: architectural 4. Technical facts learned (API quirks, config, gotchas) → type: procedural 5. Terminology defined or clarified → type: terminological Include at least one engram_suggestion if ANYTHING was learned. An empty suggestions array means nothing worth remembering happened — this should be rare.

NameTypeReqDescription
engram_suggestionsarrayyesLearnings from this session. Preferred shape is {statement: "...", type?: "..."}; bare strings are also accepted and treated as the statement. Review the conversation for corrections, preferences, pa…
session_idstringSession ID from plur_session_start
summarystringyesWhat happened in this session (1-3 sentences)

No output schema declared.

No examples provided.

plur_session_start ~113

Start a session — inject relevant engrams for your task. Call at the beginning of every session.

NameTypeReqDescription
default_scopestringDefault scope for plur_learn calls this session when no explicit scope is provided. Only set this if you want ALL engrams to route to a specific store. Usually, leave unset and pass scope per-engram…
tagsarrayTags to filter injected engrams
taskstringyesWhat you are working on (triggers engram injection)

No output schema declared.

No examples provided.

plur_status ~94

Return system health — running version, engram count, episode count, pack count, storage root. Optionally filter engram counts by domain prefix and/or creation date.

NameTypeReqDescription
created_afterstringISO-8601 date (YYYY-MM-DD). Only count engrams learned on or after this date.
domainstringOnly count engrams whose domain starts with this prefix (e.g. "meridian")

No output schema declared.

No examples provided.

plur_tensions_purge ~33

Purge all conflict relations from local engrams — removes accumulated false positives from the legacy tension-detection system

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

Common questions

What is the io.github.plur-ai/plur MCP server?

io.github.plur-ai/plur is an MCP server listed in the public MCP registry as io.github.plur-ai/plur. Open, local-first engram memory for AI agents: read, correct, delete; shared over MCP. This page covers its npm package (@plur-ai/mcp).

Is the io.github.plur-ai/plur MCP server safe to use?

io.github.plur-ai/plur scores 83 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 22 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.plur-ai/plur MCP server expose?

io.github.plur-ai/plur exposes 12 tools: plur_learn, plur_recall, plur_feedback, plur_forget, plur_packs_uninstall, and 7 more. Their descriptions and schemas cost roughly 3,345 tokens of context every time the server is loaded.

Is the io.github.plur-ai/plur MCP server still maintained?

io.github.plur-ai/plur is still listed as active in the MCP registry. We last reached this channel on 22 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.plur-ai/plur MCP server under?

io.github.plur-ai/plur declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.