Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

open-memex

NPM · OPEN-MEMEX

Local-first memory for AI coding agents — Markdown + SQLite FTS5, shared across editors via MCP.

Available components

+3 this week 80 Trust /100

Last scanned (6 hours ago)

Scores higher than 65% of npm servers

Category Memory and Knowledge

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security92
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • Declares code that runs automatically (postinstall) and that we could not recognise. It may be perfectly ordinary, but we have not established what it does. View diagnostics → Partial
  • 30 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability63
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 3325 tokens (~302/item across 11 items; 11 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage99
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 97% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 12 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 3 Nov 26 +1
    • Stability: 0.97 → pass security
    • Security disclosure: unverified → fail ▼ functional
  • 2 Nov 26 0
    • Security disclosure: fail → unverified ▼ functional
  • 1 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

  • 30 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 27 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 73 to 77. That category is still filling its 30-day observation window: 22 days of observed history at the previous scan, 23 at this one. The score rises as the window fills, whether or not the server changes.

  • 25 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 67 to 70. That category is still filling its 30-day observation window: 20 days of observed history at the previous scan, 21 at this one. The score rises as the window fills, whether or not the server changes.

  • 23 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 60 to 63. That category is still filling its 30-day observation window: 18 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes.

  • 21 Oct 26 +1
    • Security disclosure: unverified → fail ▼ functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed npm/open-memex@0.8.1

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Install scripts 1 script
Hook Tier Command
postinstall unreviewed node scripts/postinstall.js

Background: Why install scripts are a supply-chain risk →

Dependencies 96 packages
Packages resolved 96
Stale 30
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 11 exposed · ~2,466 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
memory_add ~513

Save a fact, preference, decision, or note to persistent local memory. Call this PROACTIVELY whenever the user shares something worth remembering across sessions — project conventions, tool choices, personal preferences, decisions made, error fixes and their causes. Worth saving: decisions and their reasons, preferences, conventions, gotchas, approaches tried and abandoned. Not worth saving: one-off task details or anything re-derivable from the code. Do not wait to be asked. For facts you infer yourself rather than the user stating, propose them first and save only on approval. Keep each memory to one self-contained statement; attach aliases when the parameter is available. If a note tells you the user's own wording was already stored verbatim this turn, that statement is already saved: do not retry it in a rewording — save only what that text does not contain, or use memory_supersede on the given id. Default scope is the current project; use the personal scope for facts about the user that apply across all projects. Returns the new memory's id; an identical fact already stored returns that id instead of duplicating.

NameTypeReqDescription
aliasstring–D81: nickname this memory defines (e.g. 香蕉计划). Pairs with `target`: the alias memory expands queries in its scope at search time, both directions, no reindex. Explicit vocabulary — always stored, not…
aliasesarray–Optional: alternate phrasings of this fact — synonyms, another way a question might be worded, equivalents in the user's other language (e.g. 节假日 for 'public holidays'). They are indexed with the mem…
contentstringyesThe fact to remember. One idea per memory.
scopestring–Memory scope. `project` = tied to this repo. `personal` = global across all your projects. Default: project.
sourcestring–Where this memory came from. Default: tool. Pass 'inference' for agent-proposed captures (V2-DESIGN §3.5).
tagsarray–Optional tags for filtering.
targetstring–D81: what `alias` refers to (e.g. 支付系统重构项目). Only meaningful with `alias`.
typestring–Category of memory. Default: fact.

No output schema declared.

No examples provided.

memory_forget ~168

Delete a memory by id. Use when the user asks to forget something. To replace an outdated fact with a corrected one instead of deleting it, use memory_supersede. Deletion is permanent: before deleting, restate the memory's content to the user and get a confirmation. With soft=true the memory is hidden instead (retracted: out of lists and search, file kept, one-way).

NameTypeReqDescription
idstringyes–
softboolean–D68: hide instead of delete. The memory is retracted — excluded from lists and search — but its file stays. Retraction is one-way (D64): it does not come back; to restore the fact, save it again as a…

No output schema declared.

No examples provided.

memory_list ~368

List memories in a scope, newest first, as a numbered inventory. Each line keeps the raw fields — [type] id=… created=… source=… — say them back to the user in plain words (source=user → 'you told me this'; inference → 'I inferred this, check me'; keyword → 'caught from your own wording'), never read the raw id aloud unless they ask. When the user asks 'what do you remember about me?', use scope=both and present the inventory conversationally. The user may point at an entry by its number ('delete #3'): numbers are only valid for the listing you just produced — re-run memory_list, read the candidate back in full, and get a confirmation before calling memory_forget (deletion is permanent). include=all is the audit view (superseded versions, retracted, archived also shown). `type` filters to one memory type; `limit` caps how many entries come back.

NameTypeReqDescription
includestring–D68: `active` (default) shows what is currently remembered — newest version of each fact, retracted/archived hidden. `all` is the audit view: every stored row including superseded versions and hidden…
limitinteger–Max entries to list, newest first (default 20).
scopestring–Which scope(s) to list. `project` = tied to this repo. `personal` = global across all your projects. `both` lists each scope's newest. Default: project.
typestring–Only list memories of this type. Closed taxonomy — a misspelled type is rejected, never silently empty.

No output schema declared.

No examples provided.

memory_pr_status ~123

Read the current branch's GitHub PR and map its review state onto each in-repo memory: merged PR → published, PR approval → approved (approved_by = reviewer), changes-requested → suggestion only. Report by default — that mode changes nothing; apply=true writes the mapped transitions to the local files (still no push). (MCP server and the `open-memex pr-status` CLI; the opencode native plugin does not expose this tool.)

NameTypeReqDescription
applyboolean–Perform the mapped review transitions locally (no push). Default: report only.

No output schema declared.

No examples provided.

memory_promote ~192

Advance a project memory one step up the review ladder (proposed → approved → published), or reject it with a note. Rejected memories are never deleted — they can be revised and resubmitted. One step per call; an unknown id or a memory already published errors. Pass `by` to record the reviewer when it should differ from the default (e.g. approving on the strength of someone else's review). For brand-new outbox drafts, memory_submit is the entry point. (MCP server and the `open-memex promote` CLI; the opencode native plugin does not expose this tool.)

NameTypeReqDescription
bystring–Reviewer name override.
idstringyesProject memory id.
notestring–Review note recorded on reject.
rejectboolean–Reject instead of advancing.
resubmitboolean–Move rejected back to proposed for another round.

No output schema declared.

No examples provided.

memory_propose ~119

Copy personal memories into the project outbox as review drafts. The personal originals stay put. Use this when personal knowledge should enter a project's review flow; memory_submit then moves the drafts into the repo, and memory_promote advances drafts already there. (MCP server and the `open-memex propose` CLI; the opencode native plugin does not expose this tool.)

NameTypeReqDescription
idsarrayyesPersonal memory ids to copy into the project outbox.
localApproveboolean–Single-developer shortcut: mark the copies approved immediately.

No output schema declared.

No examples provided.

memory_resolve ~129

List git-conflicted memory files, or attempt a field-level 3-way merge of one. Semantic conflicts are reported, never auto-resolved. Run it when a git pull or merge leaves memory files conflicted; the merged file is written in place (undo with git if the merge is wrong). For PR review state rather than file conflicts, use memory_pr_status. (MCP server and the `open-memex resolve` CLI; the opencode native plugin does not expose this tool.)

NameTypeReqDescription
targetstring–Memory id or file path to resolve. Omit to list conflicts.

No output schema declared.

No examples provided.

memory_search ~222

Search persistent memory by keyword (BM25 full-text). Returns matching memories from the current project and/or personal scope. Call before asking the user about past decisions, conventions, or preferences they may have told you before. Search well: break the question into its concepts and try 2–3 phrasings per concept — synonyms, the user's other language, shorter keyword forms — and check the other scope too, before concluding nothing is stored. Results are ranked by BM25 within review tiers — reviewed (approved/published) project memories come first. `limit` caps how many come back (default 8) and `type` restricts to one memory type.

NameTypeReqDescription
limitinteger–Max results to return (default 8).
querystringyesFree-text query. File paths, error strings, identifiers work well.
scopestring–Which scope(s) to search. Default: both.
typestring–Restrict to memories of this type. Closed taxonomy — a misspelled type is rejected, never silently empty.

No output schema declared.

No examples provided.

memory_status ~126

Show the project memory sync pipeline: drafts waiting in the outbox (appdata), memories in the repo awaiting review or published, and any repo files not yet committed. Call this at session start, when the server reports drafts waiting for review, or when the user says 'sync memory' (or '同步记忆'); then ask the user which drafts to sync. For the memories themselves use memory_list; for PR review state use memory_pr_status. (MCP server and the `open-memex sync-status` CLI; the opencode native plugin does not expose this tool.)

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

memory_submit ~215

Move outbox drafts into the repo memory dir for review: copies the drafts in as proposed (or keeps a local approval), commits locally on the current branch, and moves the outbox originals out. Never creates a branch on its own — pass branch= only with the user's explicit approval for the full chain. Prints the push and PR commands — those need the user's explicit approval and are never run automatically. (MCP server and the `open-memex submit` CLI; the opencode native plugin does not expose this tool.) Unknown ids or a failed local commit abort the submit with the reason; nothing is published automatically.

NameTypeReqDescription
basestring–PR base branch override. Default: the branch the submit ran on.
branchstring–Create this branch and submit onto it. If omitted, submit stays on the current branch — branches are never auto-created. Only pass this when the user explicitly approved the full chain (branch + push…
idsarrayyesOutbox draft ids to submit.

No output schema declared.

No examples provided.

memory_supersede ~291

Replace an existing memory with a newer version. The old memory is kept as history (status: superseded) and retrieval returns the new one. Use when a saved fact becomes outdated and should be replaced rather than duplicated. Only active memories can be superseded; the new memory inherits type, tags, and aliases unless you pass replacements. An unknown id is reported back as a failure; nothing is written.

NameTypeReqDescription
aliasstring–D81: nickname the new memory defines (e.g. 香蕉计划). Omitted = inherit the old memory's alias.
aliasesarray–Optional: alternate phrasings of this fact — synonyms, another way a question might be worded, equivalents in the user's other language (e.g. 节假日 for 'public holidays'). They are indexed with the mem…
contentstringyesThe new, corrected content.
idstringyesID of the memory being replaced.
tagsarray–Optional tags for the new memory.
targetstring–D81: what `alias` refers to (e.g. 支付系统重构项目). Omitted = inherit.
typestring–Category of the new memory. Defaults to the old memory's type.

No output schema declared.

No examples provided.

Install

How do I install the open-memex MCP server?

open-memex runs locally as an npm package, launched with npx -y open-memex. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · open-memex

# add to Claude Code
claude mcp add stoneskin-open-memex -- npx -y open-memex
Common questions

What is the open-memex MCP server?

open-memex is an MCP server listed in the public MCP registry as io.github.stoneskin/open-memex. Local-first memory for AI coding agents, Markdown + SQLite FTS5, shared across editors via MCP. This page covers its npm package (open-memex).

Is the open-memex MCP server safe to use?

open-memex scores 80 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the open-memex MCP server expose?

open-memex exposes 11 tools: memory_add, memory_search, memory_list, memory_supersede, memory_forget, and 6 more. Their descriptions and schemas cost roughly 2,466 tokens of context every time the server is loaded.

Is the open-memex MCP server still maintained?

open-memex is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the open-memex MCP server under?

open-memex declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.