io.github.plur-ai/plur
NPM · @PLUR-AI/MCP · SCANNED SEP 22
Open, local-first engram memory for AI agents: read, correct, delete; shared over MCP.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 45 of 138 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 3 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability74
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 4009 tokens (~286/item across 14 items; 12 tools + 2 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
- Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 14 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.plur-ai/plur MCP server?
io.github.plur-ai/plur runs locally as an npm package, launched with npx -y @plur-ai/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @plur-ai/mcp
claude mcp add plur-ai-plur -- npx -y @plur-ai/mcp
{
"mcpServers": {
"plur-ai-plur": {
"command": "npx",
"args": [
"-y",
"@plur-ai/mcp"
]
}
}
} {
"servers": {
"plur-ai-plur": {
"command": "npx",
"args": [
"-y",
"@plur-ai/mcp"
]
}
}
} codex mcp add plur-ai-plur -- npx -y @plur-ai/mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"plur-ai-plur": {
"type": "local",
"command": [
"npx",
"-y",
"@plur-ai/mcp"
],
"enabled": true
}
}
} openclaw mcp add plur-ai-plur --command npx --arg -y --arg @plur-ai/mcp
mcp_servers:
plur-ai-plur:
command: "npx"
args: ["-y", "@plur-ai/mcp"] {
"McpServers": {
"plur-ai-plur": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@plur-ai/mcp"
]
}
}
} assistant mcp add plur-ai-plur -t stdio -c npx -a -y @plur-ai/mcp
{
"mcpServers": {
"plur-ai-plur": {
"command": "npx",
"args": [
"-y",
"@plur-ai/mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 22 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 −3
- Stability: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Security disclosure: fail → unverified ▼ functional
- Stability: pass → 0.80 functional
- Package version: 0.20.0 → 0.20.1 functional
- 17 Sept 26 +1
- Stability: 0.97 → pass security
- 16 Sept 26 +2
- Stability: 0.93 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- GHSA-rgj7-g3m4-5g8c no longer affects this package ▲ security
- GHSA-f88m-g3jw-g9cj no longer affects this package ▲ security
- CVE-2026-39244 no longer affects this package ▲ security
- Known CVEs: fail → pass ▲ security
- Schema quality: 238 → 286 ▼ functional
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Schema quality: excellent → good functional
- Package version: 0.19.3 → 0.20.0 functional
- 15 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 −3
- Stability: pass → 0.83 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 22 Sept 2026 · Analysed npm/@plur-ai/mcp@0.20.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 138 packages
| Packages resolved | 138 |
|---|---|
| Deprecated | 1 |
| Stale | 44 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
plur_admin ~359
Gateway to the 33 PLUR operations that are not top-level tools under the current profile (collapsed into one dispatch tool so Cursor's ~40-tool-per-workspace limit is not exhausted by PLUR alone). A plur_* name missing from tools/list means it moved HERE — not that the MCP is unavailable. Calling convention: { action: "<tool name>", args: { ...that tool's normal arguments } } — same arguments, same validation, same result as a direct call. Example: { action: "plur_recall_hybrid", args: { query: "deploy checklist" } }. Send { action: "help" } for every action's one-line description and argument schema. Actions, grouped — inject: plur_inject, plur_inject_hybrid · packs: plur_packs_discover, plur_packs_export, plur_packs_install, plur_packs_list, plur_packs_preview · stores: plur_stores_add, plur_stores_list · sync: plur_sync, plur_sync_status · other: plur_capture, plur_episode_to_engram, plur_extract_meta, plur_history, plur_ingest, plur_learn_batch, plur_meta_engrams, plur_outbox, plur_pin, plur_profile, plur_promote, plur_provenance, plur_recall_hybrid, plur_report_failure, plur_rescope, plur_scopes_discover, plur_session_scope, plur_similarity_search, plur_suggest_scope, plur_tensions, plur_timeline, plur_validate_meta.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Which underlying plur_* tool to invoke, or "help" to list every action with its description and argument schema |
| args | object | – | Arguments for the chosen action, matching that tool's normal input schema |
No output schema declared.
No examples provided.
plur_doctor ~263
Diagnose the PLUR ENGINE (embedder, hybrid search, remote-store auth) — not hook/MCP wiring. Reports whether the embedding model loaded, whether hybrid search is fully operational, and — for any configured enterprise/remote store — whether its auth is valid (probes /api/v1/me and decodes token expiry), so a dead or soon-to-expire token surfaces instead of hiding behind a "healthy" report. Run this first when recall feels off or team engrams stop syncing. Does NOT check .cursor/mcp.json, .cursor/hooks.json, or the live MCP tool count — for that, run the `plur doctor` CLI command in a terminal (a different, more thorough check with the same name).
| Name | Type | Req | Description |
|---|---|---|---|
| rerank_eval | boolean | – | If true and a reranker is configured (PLUR_RERANKER), run the per-store self-eval gate (#451): probes synthesized from this store's own engrams compare rerank-on vs RRF-only ordering. Verdict is cach… |
| retry | boolean | – | If true, reset cached embedder failure state and retry the model load before reporting |
No output schema declared.
No examples provided.
plur_feedback ~114
Rate an engram's usefulness — trains injection relevance over time. Supports single or batch mode.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | – | Engram ID (single mode) |
| scope | string | – | Store scope to target directly, e.g. "primary" for the local store or a remote scope like "group:plur/plur-ai/engineering". Required when the same engram ID exists in multiple stores (#850). |
| signal | string | – | Feedback signal (single mode) |
| signals | array | – | Batch feedback signals |
No output schema declared.
No examples provided.
plur_forget ~196
Retire an engram by ID or search term — marks it as no longer active without deleting history
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | – | Exact engram ID to retire |
| reason | string | – | Why this is being retired. Recorded in the history log and on the engram (#959). Say what changed, not just that something did. |
| scope | string | – | Which store holds it (#831). Ids are minted per store, so one id can name several unrelated engrams. Pass "primary" to stay on disk — the local primary store and any local secondary stores, never a r… |
| search | string | – | Search term to find engram to retire |
No output schema declared.
No examples provided.
plur_learn ~1,310
Create an engram — record a reusable learning, preference, or correction. A write is never suppressed by similarity: exact content-hash duplicates NOOP, and anything merely SIMILAR is written and reported back in `dedup.near_duplicates` (closest existing engrams, their cosine scores, and a preview of each neighbour's own statement — read them before moving on; that is what they are for) so you can supersede or merge deliberately. High similarity is a reason to look, not a decision — cosine cannot tell a duplicate from a correction of it. Multi-agent note: in an orchestration that spawns subagents, have the PARENT session own plur_learn writes — spawned subagents should return their findings as text for the parent to persist, rather than each calling plur_learn (tool availability is not guaranteed in every subagent context). See plur-ai/plur#281.
| Name | Type | Req | Description |
|---|---|---|---|
| attribution | object | – | Who is answerable for this memory (#961). Every sub-field optional; OMIT rather than guess — a memory with no agent is honest, one with an invented agent is worse than none. Set asserted_by to "unide… |
| claim_class | string | – | What KIND of claim this is (#963), and the most useful single field for anyone later deciding how much to trust it. Use "asserted" when a PERSON stated it outright, "inferred" when YOU worked it out,… |
| commitment | string | – | How firmly the user has committed to this belief (default: leaning). `draft` marks the engram as pending human approval: core stores and RECALLS it normally but NEVER injects it (#1141), so an unappr… |
| domain | string | – | Domain tag, e.g. software.deployment |
| license | string | – | Which licence governs reuse of this memory, as an SPDX-style identifier such as "cc-by-4.0" or "apache-2.0". Set it only when the user has actually said which licence applies — do NOT guess one. Left… |
| locked_reason | string | – | Why this engram is locked (only meaningful when commitment=locked) |
| measured_under | object | – | Measurement context for numeric or benchmark-derived claims (#869). Records the conditions under which the asserted value was measured — model, source_type, hardware, dataset, date. When present, the… |
| pinned | boolean | – | Always-load flag. If true, this engram bypasses the keyword-relevance gate at injection time. Use sparingly: meta-rules, safety conventions, core operating principles only. |
| rationale | string | – | The mechanism that makes the statement true, and therefore the condition under which it would STOP being true. One sentence. "Because the user said so on <date>" is a citation, not a mechanism: that… |
| scope | string | – | Namespace, e.g. global, project:myapp |
| session_id | string | – | Session this write belongs to (from plur_session_start). Resolves the session default scope (incl. mid-session plur_session_scope changes) when no explicit scope is passed. Optional when one session… |
| source | string | – | Origin of this knowledge (URL, conversation ref, etc.) |
| statement | string | yes | ONE assertion, written so someone who was not there can act on it. Route the rest to the field whose job it is: the mechanism that makes it true goes in `rationale`, where it came from in `source`, w… |
| supersedes | array | – | Engram IDs this statement intentionally replaces (#240). Writes relations.supersedes on the new engram and the reverse superseded_by edge on each local target. Supersedes-linked pairs are skipped by… |
| tags | array | – | Searchable keyword tags — contribute to BM25/embedding recall, so concrete keywords pay off |
| type | string | – | Category of the engram |
| valid_from | string | – | ISO date (YYYY-MM-DD) the knowledge becomes valid — inject/recall skip the engram before this date (#347) |
| valid_until | string | – | ISO date (YYYY-MM-DD) the knowledge expires — inject/recall skip the engram after this date. Set this for any time-bound fact (offers, deadlines, temporary endpoints). When omitted, an explicit expir… |
| visibility | string | – | Whether this memory may leave this machine. Defaults to "private", which means it is EXCLUDED from every exported pack. Set "public" only when the user has said this is shareable with others — it is… |
No output schema declared.
No examples provided.
plur_packs_uninstall ~49
Uninstall an engram pack by name — removes the pack and all its engrams
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Pack name to uninstall (use plur_packs_list to see names) |
No output schema declared.
No examples provided.
plur_recall ~399
Search engrams by topic. Default mode is hybrid (BM25 + local embeddings via RRF) — set mode:"keyword" for BM25-only. Local search plus, when a configured enterprise store is part of the current project/work, one live timeout-bounded recall per remote host merged in (a `remote_stores` block + warning appears when a host is degraded; no host configured or implicated = fully local). Note: a project-scope filter also returns personal-family engrams (local, global, user:*, agent:*); an explicit scope=global recall returns ALL personal-family engrams — wider than scope=global INJECT, which is targeted to the global namespace only.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | object | – | Budget constraints for sub-agents. Hybrid mode only — ignored when mode:"keyword". |
| caller_session_id | string | – | Session ID of calling agent for budget enforcement. Hybrid mode only — ignored when mode:"keyword". |
| domain | string | – | Filter by domain prefix |
| include_episodes | boolean | – | If true, include linked episode summaries for each engram (SP2 episodic anchoring). Hybrid mode only — ignored when mode:"keyword". |
| limit | number | – | Max results to return (default 20) |
| mode | string | – | Search mode — hybrid (default): BM25 + embeddings via RRF; keyword: BM25-only (faster, embeddings-independent). budget, caller_session_id and include_episodes apply to hybrid mode only — in keyword m… |
| query | string | yes | Search query to find relevant engrams |
| scope | string | – | Filter by scope (also includes global) |
| session_id | string | – | Session this recall belongs to (from plur_session_start). Its default scope (incl. mid-session plur_session_scope changes) sets the remote dialing context when no explicit scope filter is passed. Opt… |
No output schema declared.
No examples provided.
plur_receipt ~185
Counted report of what your memory retrieved for you: engrams stored, how many were retrieved and how often, which are most relied on, and how much of the store is dormant. Local and read-only; every figure is directly counted, never estimated. IMPORTANT when relaying to the user: `activation_rate` is COVERAGE over the logging window (≈ how much of the store was surfaced), NOT a quality or effectiveness score — it is naturally low and FALLS as more engrams are added, so never present it as "memory is N% effective". A `summary` line is included; prefer relaying that. NOT plur_provenance: this counts usage across the whole store; plur_provenance says where a single memory came from.
| Name | Type | Req | Description |
|---|---|---|---|
| days | number | – | Restrict to the last N days (integer). Omit for all recorded history. |
No output schema declared.
No examples provided.
plur_session_end ~230
End a session. BEFORE calling this tool, review the conversation and extract learnings: 1. Corrections the user made ("no, use X not Y") → type: behavioral 2. Preferences stated ("always X", "never Y") → type: behavioral 3. Codebase patterns discovered (naming, structure, conventions) → type: architectural 4. Technical facts learned (API quirks, config, gotchas) → type: procedural 5. Terminology defined or clarified → type: terminological Include at least one engram_suggestion if ANYTHING was learned. An empty suggestions array means nothing worth remembering happened — this should be rare.
| Name | Type | Req | Description |
|---|---|---|---|
| engram_suggestions | array | yes | Learnings from this session. Preferred shape is {statement: "...", type?: "..."}; bare strings are also accepted and treated as the statement. Review the conversation for corrections, preferences, pa… |
| session_id | string | – | Session ID from plur_session_start |
| summary | string | yes | What happened in this session (1-3 sentences) |
No output schema declared.
No examples provided.
plur_session_start ~113
Start a session — inject relevant engrams for your task. Call at the beginning of every session.
| Name | Type | Req | Description |
|---|---|---|---|
| default_scope | string | – | Default scope for plur_learn calls this session when no explicit scope is provided. Only set this if you want ALL engrams to route to a specific store. Usually, leave unset and pass scope per-engram… |
| tags | array | – | Tags to filter injected engrams |
| task | string | yes | What you are working on (triggers engram injection) |
No output schema declared.
No examples provided.
plur_status ~94
Return system health — running version, engram count, episode count, pack count, storage root. Optionally filter engram counts by domain prefix and/or creation date.
| Name | Type | Req | Description |
|---|---|---|---|
| created_after | string | – | ISO-8601 date (YYYY-MM-DD). Only count engrams learned on or after this date. |
| domain | string | – | Only count engrams whose domain starts with this prefix (e.g. "meridian") |
No output schema declared.
No examples provided.
plur_tensions_purge ~33
Purge all conflict relations from local engrams — removes accumulated false positives from the legacy tension-detection system
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
What is the io.github.plur-ai/plur MCP server?
io.github.plur-ai/plur is an MCP server listed in the public MCP registry as io.github.plur-ai/plur. Open, local-first engram memory for AI agents: read, correct, delete; shared over MCP. This page covers its npm package (@plur-ai/mcp).
Is the io.github.plur-ai/plur MCP server safe to use?
io.github.plur-ai/plur scores 83 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 22 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.plur-ai/plur MCP server expose?
io.github.plur-ai/plur exposes 12 tools: plur_learn, plur_recall, plur_feedback, plur_forget, plur_packs_uninstall, and 7 more. Their descriptions and schemas cost roughly 3,345 tokens of context every time the server is loaded.
Is the io.github.plur-ai/plur MCP server still maintained?
io.github.plur-ai/plur is still listed as active in the MCP registry. We last reached this channel on 22 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.plur-ai/plur MCP server under?
io.github.plur-ai/plur declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.