# Fireweed (pypi · fireweed-mcp)

Agent memory where every fact carries a receipt, and deletion is provable.

- Trust score: 76/100 (medium)
- Change this week: +18
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-21

## Components

- pypi · `fireweed-mcp`: 76/100 (this document), [markdown](https://verifymcp.io/servers/starksood-fireweed-mcp/fireweed-mcp.md), [page](https://verifymcp.io/servers/starksood-fireweed-mcp/fireweed-mcp)

## Channel facts

- Registry: `pypi`
- Package: `fireweed-mcp`
- Version: `0.5.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-21.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it.
  - No production dependencies, so there is no dependency health to assess.
- **Provenance & Transparency**: 32/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - License check failed: no license is declared.
  - Actively maintained (last published 23 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 79/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 712 tokens (~71/item across 10 items; 10 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 93/100
  - Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 90/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 69% of tool parameters carry a description.
- **Tool Safety**: 75/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "forget" implies "erase" and declares no destructiveHint at all, which the MCP spec reads as destructive by default.
  - An AI judge read all 10 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 20/100
  - Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28.

## Install

### How do I install the Fireweed MCP server?

Fireweed runs locally as a PyPI package, launched with uvx fireweed-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add starksood-fireweed-mcp -- uvx fireweed-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "starksood-fireweed-mcp": {
      "command": "uvx",
      "args": [
        "fireweed-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "starksood-fireweed-mcp": {
      "command": "uvx",
      "args": [
        "fireweed-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add starksood-fireweed-mcp -- uvx fireweed-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "starksood-fireweed-mcp": {
      "type": "local",
      "command": [
        "uvx",
        "fireweed-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add starksood-fireweed-mcp --command uvx --arg fireweed-mcp
```

### Hermes

```yaml
mcp_servers:
  starksood-fireweed-mcp:
    command: "uvx"
    args: ["fireweed-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "starksood-fireweed-mcp": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "fireweed-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add starksood-fireweed-mcp -t stdio -c uvx -a fireweed-mcp
```

### Other

```json
{
  "mcpServers": {
    "starksood-fireweed-mcp": {
      "command": "uvx",
      "args": [
        "fireweed-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-20 (score 76, +1)

No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-18 (score 75, +1)

No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-16 (score 74, +1)

No change was recorded against any check on this day. Stability & Change Management went from 73 to 77. That category is still filling its 30-day observation window: 22 days of observed history at the previous scan, 23 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-15 (score 73, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-09-14 (score 58, −15)

- [security regression] Malware scan: pass → unverified

### 2026-09-13 (score 73, +1)

No change was recorded against any check on this day. Stability & Change Management went from 63 to 67. That category is still filling its 30-day observation window: 19 days of observed history at the previous scan, 20 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-11 (score 72, +1)

No change was recorded against any check on this day. Stability & Change Management went from 57 to 60. That category is still filling its 30-day observation window: 17 days of observed history at the previous scan, 18 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-09 (score 71, +1)

No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.

## MCP tools (10)

### `remember` (~143 tokens)

Commit a fact to memory. The claim is admitted ONLY if the evidence you cite supports it — you are the proposer, a deterministic gate decides. Refusals are typed and explain what to fix. Evidence must be text you are quoting verbatim, not a paraphrase.

Input parameters:

- `claim` (string, required): the fact to remember
- `evidence` (string, required): verbatim text supporting it
- `source_id` (string): source this came from (default: agent)
- `source_text` (string): the full document this evidence was quoted from. Pass it and the claim binds to a verifiable BYTE RANGE in it — the receipt. Optional, but this is the point.

### `add_source` (~121 tokens)

Register a source document so claims remembered against it bind to verifiable byte ranges.

Input parameters:

- `origin` (string): where these bytes came from (path, URL, endpoint). RECORDED BUT NOT VERIFIED.
- `origin_kind` (string): the kind of origin. Recorded but not verified.
- `source_id` (string, required)
- `supplied_by` (string): who handed these bytes over. Recorded but not verified.
- `text` (string, required)
- `validated_by` (string): what checked these bytes before ingest, if anything. Recorded but not verified.

### `review_reads` (~75 tokens)

What has been asked of this substrate and what it answered. Off unless FIREWEED_MCP_READ_AUDIT=1; query text is recorded only if FIREWEED_MCP_READ_AUDIT_TEXT=1 as well, otherwise queries appear as salted fingerprints.

Input parameters:

- `limit` (integer): how many recent reads to show

### `trace_evidence` (~87 tokens)

Audit BACKWARDS from a stored memory to the arrival of the evidence it rests on: the byte range it binds, whether those bytes still match, whether the document's arrival is in the append-only ledger, and whether the chain verifies. States plainly which fields are attested and which are caller-declared.

Input parameters:

- `claim` (string, required): any distinctive substring of the stored claim to trace

### `recall` (~59 tokens)

Search memory. Returns grounded claims with the byte ranges they came from. If the substrate cannot answer, it ABSTAINS and says which term it could not ground — treat that as a real answer, not an empty result.

Input parameters:

- `query` (string, required)

### `verify_receipts` (~40 tokens)

Re-hash every held source and re-slice every receipt. Tamper-evident: change one byte of a source and its receipts stop verifying.

### `forget` (~61 tokens)

Erase everything about a subject and issue a SIGNED CERTIFICATE: exact closure, a probe battery that must all abstain, and bystanders left intact. This is the artifact for a 'delete me and prove it' request.

Input parameters:

- `subject` (string, required)

### `export_memory` (~44 tokens)

Export the whole substrate as a portable open-format blob. Readable without this server, without any model, with a stdlib-only reference reader.

Input parameters:

- `path` (string)

### `memory_stats` (~20 tokens)

Substrate size, entities, sources held, and mode.

### `review_quarantine` (~62 tokens)

List claims the firewall held for review rather than storing. These were NOT written to memory; a QUARANTINE verdict means the claim could not be classified confidently, not that it was rejected.

Input parameters:

- `limit` (integer): most recent N (default 20)

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Dependencies. The full working is on the page: https://verifymcp.io/servers/starksood-fireweed-mcp/fireweed-mcp#diagnostics

## Score history

- 2026-09-21: 76
- 2026-09-20: 76
- 2026-09-19: 75
- 2026-09-18: 75
- 2026-09-17: 74
- 2026-09-16: 74
- 2026-09-15: 73
- 2026-09-14: 58
- 2026-09-13: 73
- 2026-09-12: 72
- 2026-09-11: 72
- 2026-09-10: 71
- 2026-09-09: 71
- 2026-09-08: 70
- 2026-09-07: 70
- 2026-09-06: 69
- 2026-09-05: 69
- 2026-09-04: 68
- 2026-09-03: 68
- 2026-09-02: 67
- 2026-09-01: 67
- 2026-08-31: 66
- 2026-08-30: 66
- 2026-08-29: 66
- 2026-08-28: 65
- 2026-08-27: 64
- 2026-08-26: 63
- 2026-08-25: 62
- 2026-08-24: 46

## Common questions

### What is the Fireweed MCP server?

Fireweed is an MCP server listed in the public MCP registry as io.github.Starksood/fireweed-mcp. Agent memory where every fact carries a receipt, and deletion is provable. This page covers its PyPI package (fireweed-mcp).

### Is the Fireweed MCP server safe to use?

Fireweed scores 76 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Fireweed MCP server expose?

Fireweed exposes 10 tools: remember, add_source, review_reads, trace_evidence, recall, and 5 more. Their descriptions and schemas cost roughly 712 tokens of context every time the server is loaded.

### Is the Fireweed MCP server still maintained?

Fireweed is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- PyPI project: https://pypi.org/project/fireweed-mcp/
- Socket report: https://socket.dev/pypi/package/fireweed-mcp
- Repository: https://github.com/Starksood/fireweed-mcp
- Changelog RSS feed: https://verifymcp.io/servers/starksood-fireweed-mcp/fireweed-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/starksood-fireweed-mcp/fireweed-mcp.json
- HTML version of this page: https://verifymcp.io/servers/starksood-fireweed-mcp/fireweed-mcp