XMemo

NPM · @XMEMO/CLIENT · 2 COMPONENTS · SCANNED AUG 13

Shared, governed long-term memory for AI agents across tools and sessions via MCP and REST.

Available components

remote · xmemo.dev 39 npm · @xmemo/client 77

77 77 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security100

No malware found by supply-chain analysis.Pass
No known CVEs affecting this package version or its production dependencies.Pass
No install/post-install scripts declared.Pass
No production dependencies, so there is no dependency health to assess. View diagnostics → Pass

Provenance & Transparency100

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Cryptographically verified build provenance (signed, bound to yonro/memory-os-cli). View diagnostics → Pass
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 2 days ago).Pass
Publishes a security disclosure policy (SECURITY.md).Pass

Schema Quality & AI Usability81

100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
AI-judged instruction clarity (good).Pass
Tool/resource definitions use about 1998 tokens (~90/item across 22 items; 20 tools + 2 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management0

Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified

Tool Coverage100

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
100% of tool parameters carry a description.Pass
Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass

Capabilities20

Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28. See how to fix → Fail

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @xmemo/client

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add yonro-xmemo -- npx -y @xmemo/client

# add to Codex CLI

codex mcp add yonro-xmemo -- npx -y @xmemo/client

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "yonro-xmemo": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@xmemo/client"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add yonro-xmemo --command npx --arg -y --arg @xmemo/client

# ~/.hermes/config.yaml

mcp_servers:
  yonro-xmemo:
    command: "npx"
    args: ["-y", "@xmemo/client"]

// mcp.json

{
  "mcpServers": {
    "yonro-xmemo": {
      "command": "npx",
      "args": [
        "-y",
        "@xmemo/client"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

13 Aug 26 77

First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 13 Aug 2026 · Analysed npm/@xmemo/client@0.4.181

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result	Verified
Ecosystem	npm
Reason	Verified
Discovered via	Registry attestation endpoint
Source repo	yonro/memory-os-cli
Certificate issuer	https://token.actions.githubusercontent.com
Certificate SAN	https://github.com/yonro/memory-os-cli/.github/workflows/release.yml@refs/tags/v0.4.181
Rekor log index	2421878910
Predicate type	https://slsa.dev/provenance/v1
Subject digest	sha512:acc5fa45dff26adcfd5fd3ee5f22c3f215e21b2785b1ddc052e58b5a0af6d9d7a01996bb545519f63e5599fc2406fa24315b6970ccb6877dd858c1d87

Dependencies 0 packages

Packages resolved	0
Tree resolution	Complete

MCP tools · 20 exposed · ~1,959 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

add_expense ~421

Create one XMemo Ledger transaction and backing memory. Requires memory:write; it records a new transaction or reuses a semantic duplicate, and never deletes Ledger records. Use it for a purchase, income, refund, or transfer; use list_ledger_transactions or get_monthly_ledger_summary for reads. amount must be positive; transaction_type defaults to expense; blank transaction_date uses today's UTC date.

Input Output Examples

Name	Type	Req	Description
agent_id	string	–	Optional client-supplied agent label for memory attribution.
agent_instance_id	string	–	Optional stable, non-secret agent instance ID for per-client attribution.
amount	number	yes	Positive transaction amount; zero and negative values are rejected.
bucket	string	–	Bucket for the backing memory; defaults to private.
category	string	–	Optional Ledger category, such as food, transport, or electronics.
currency	string	–	Currency code or label; labels such as yen or RMB are normalized to codes.
device_id	string	–	Optional client-supplied device identifier for attribution.
device_label	string	–	Optional human-readable device label for attribution.
item	string	yes	Purchased item, income source, refund, or transfer label.
merchant	string	–	Optional merchant, payer, payee, or store name.
note	string	–	Optional note stored with the transaction.
path	string	–	Memory path; the default follows transaction_type for non-expenses.
payment_method	string	–	Optional payment method, such as card, cash, Alipay, or WeChat Pay.
project_id	string	–	Optional exact authorized project ID; stores the transaction in its private scope.
scope	string	–	Optional authorized scope; must match project_id when both are set.
team_id	string	–	Optional team attribution within the authorized scope.
transaction_date	string	–	YYYY-MM-DD transaction date; blank uses today's UTC date.
transaction_type	string	–	Transaction to create: expense, income, refund, or transfer.

Name	Type	Req	Description
result	string	yes	Human-readable text or JSON requested by output_json.

No examples provided.

complete_memory_todo ~33

Mark a TODO/action item completed.

Input Output Examples

Name	Type	Req	Description
todo_id	string	yes	The memory TODO/action-item ID to complete.

Name	Type	Req	Description
result	string	yes	Human-readable text or JSON requested by output_json.

No examples provided.

create_memory_todo ~45

Create a TODO/action item with an optional due time.

Input Output Examples

Name	Type	Req	Description
content	string	yes	Text body of the TODO item.
due_at	string	–	Optional due time.

Name	Type	Req	Description
result	string	yes	Human-readable text or JSON requested by output_json.

No examples provided.

explain_memory ~41

Explain why a memory exists or matched a query.

Input Output Examples

Name	Type	Req	Description
memory_id	string	yes	Exact XMemo memory reference.
query	string	–	Optional explanation query.

Name	Type	Req	Description
result	string	yes	Human-readable text or JSON requested by output_json.

No examples provided.

forget ~43

Permanently delete a memory by target.

Input Output Examples

Name	Type	Req	Description
reason	string	–	Optional deletion reason.
target	string	–	The memory to forget: current or an exact memory ID.

Name	Type	Req	Description
result	string	yes	Human-readable text or JSON requested by output_json.

No examples provided.

get_mcp_identity ~22

Check XMemo connection status and the connected account/agent.

Input Output Examples

Input schema present but exposes no named parameters.

Name	Type	Req	Description
result	string	yes	Human-readable text or JSON requested by output_json.

No examples provided.

get_monthly_ledger_summary ~35

Summarize Ledger totals by month and currency.

Input Output Examples

Name	Type	Req	Description
months	integer	–	Number of recent months to summarize.

Name	Type	Req	Description
result	string	yes	Human-readable text or JSON requested by output_json.

No examples provided.

get_project_context ~309

Read one authorized project's bounded context pack: state, TODOs, decisions, timeline, recent memories, and optional durable recall. Requires memory:read; it does not mutate project memories, and access is audit-logged. Use an exact project_id for a whole-project snapshot; otherwise use recall_context. max_items/max_tokens bound the whole pack; recent_hours affects only timeline; durable_query requires include_durable_context.

Input Output Examples

Name	Type	Req	Description
agent_id	string	–	Optional client-supplied agent label for memory attribution.
agent_instance_id	string	–	Optional stable, non-secret agent instance ID for per-client attribution.
bucket	string	–	Accessible bucket filter; % includes all accessible buckets.
durable_query	string	–	Query only for durable recall; ignored when include_durable_context is false.
include_durable_context	boolean	–	Include semantic durable recall; false omits that section.
max_items	integer	–	Whole-pack item budget from 1 to 1000.
max_tokens	integer	–	Whole-pack approximate token budget from 1 to 50000.
output_json	boolean	–	True returns the full structured pack; false returns a text summary.
project_id	string	yes	Exact authorized project ID; project names are not accepted.
recent_hours	integer	–	Timeline lookback from 1 to 8760 hours; other sections are unaffected.
team_id	string	–	Optional exact authorized team focus; other team rows are excluded.

Name	Type	Req	Description
result	string	yes	Human-readable text or JSON requested by output_json.

No examples provided.

get_timeline ~145

Read authorized timeline events newest first. Requires memory:read and makes no memory changes. Use it for recent history or session resumption; use recall_context for semantic multi-memory context. limit is clamped to 1-500; session_id and event_type are exact filters.

Input Output Examples

Name	Type	Req	Description
bucket	string	–	Accessible bucket filter; % includes all accessible buckets.
event_type	string	–	Optional exact event type after lowercase normalization.
limit	integer	–	Maximum events to return; values are clamped to 1-500.
scope	string	–	Optional authorized scope; blank uses the token default.
session_id	string	–	Optional exact session ID filter.

Name	Type	Req	Description
result	string	yes	Human-readable text or JSON requested by output_json.

No examples provided.

list_ledger_transactions ~38

Show XMemo Ledger records.

Input Output Examples

Name	Type	Req	Description
limit	integer	–	Maximum number of records.
query	string	–	Optional ledger search text.

Name	Type	Req	Description
result	string	yes	Human-readable text or JSON requested by output_json.

No examples provided.

list_memory_todos ~42

List open or completed TODO/action items.

Input Output Examples

Name	Type	Req	Description
item_status	string	–	Optional TODO status filter.
limit	integer	–	Maximum number of TODOs.

Name	Type	Req	Description
result	string	yes	Human-readable text or JSON requested by output_json.

No examples provided.

list_memory_versions ~29

List available versions for a memory.

Input Output Examples

Name	Type	Req	Description
memory_id	string	yes	Exact XMemo memory reference.

Name	Type	Req	Description
result	string	yes	Human-readable text or JSON requested by output_json.

No examples provided.

memory_stats ~16

Show aggregate statistics for XMemo memories.

Input Output Examples

Input schema present but exposes no named parameters.

Name	Type	Req	Description
result	string	yes	Human-readable text or JSON requested by output_json.

No examples provided.

recall ~29

Recall the most relevant saved memories before answering.

Input Output Examples

Name	Type	Req	Description
query	string	yes	Natural-language question or search text.

Name	Type	Req	Description
result	string	yes	Human-readable text or JSON requested by output_json.

No examples provided.

recall_context ~282

Read a multi-memory context pack. Requires memory:read and does not change content. Use when many memories need explicit budgets; use recall for lightweight answer or get_project_context for project snapshot. max_items/max_tokens bound rendered output.

Input Output Examples

Name	Type	Req	Description
agent_id	string	–	Optional client-supplied agent label for memory attribution.
agent_instance_id	string	–	Optional stable, non-secret agent instance ID for per-client attribution.
bucket	string	–	Accessible bucket filter; % includes all accessible buckets.
limit	integer	–	Candidate-result limit; 0 derives it from the item/token budgets.
max_items	integer	–	Maximum memories rendered in the context pack.
max_tokens	integer	–	Approximate token budget for the rendered context pack.
memory_type	string	–	Memory type filter; auto searches the normal mixed set.
output_json	boolean	–	True returns the full structured pack; false returns rendered context text.
path_filter	string	–	Case-insensitive memory-path pattern; % matches all paths.
prefer_working	boolean	–	True prioritizes active working/session-state signals.
query	string	yes	Natural-language query used to rank memories for the context pack.
scope	string	–	Optional authorized scope; blank uses the token default.
team_id	string	–	Optional exact authorized team filter.

Name	Type	Req	Description
result	string	yes	Human-readable text or JSON requested by output_json.

No examples provided.

record_event ~31

Record a significant session event, milestone, or decision.

Input Output Examples

Name	Type	Req	Description
content	string	yes	Text body of the event.

Name	Type	Req	Description
result	string	yes	Human-readable text or JSON requested by output_json.

No examples provided.

remember ~48

Save a memory so it can be recalled in future conversations.

Input Output Examples

Name	Type	Req	Description
content	string	yes	Text body to save.
path	string	yes	Category path, e.g. preferences, projects/xmemo.

Name	Type	Req	Description
result	string	yes	Human-readable text or JSON requested by output_json.

No examples provided.

restore_memory ~37

Restore a previously deleted memory.

Input Output Examples

Name	Type	Req	Description
memory_id	string	yes	Exact XMemo memory reference.
reason	string	–	Optional restore reason.

Name	Type	Req	Description
result	string	yes	Human-readable text or JSON requested by output_json.

No examples provided.

update_memory ~51

Update the content or metadata of an existing memory.

Input Output Examples

Name	Type	Req	Description
content	string	–	Replacement memory content.
memory_id	string	yes	Exact XMemo memory reference.
path	string	–	Replacement memory path.

Name	Type	Req	Description
result	string	yes	Human-readable text or JSON requested by output_json.

No examples provided.

update_state ~262

Create or replace one scoped working-state record for resuming a task, next action, or blocker. Requires memory:write; it versions that state slot and refreshes its expiry without deleting other memories. Use remember for durable facts or record_event for history. Provide content or a structured state field; ttl_seconds=0 means no expiry.

Input Output Examples

Name	Type	Req	Description
blocked_reason	string	–	Blocker; used to build the state body when content is blank.
bucket	string	–	Bucket containing the working-state slot; defaults to work.
content	string	–	Free-form state body; otherwise provide at least one structured state field.
current_task	string	–	Current task; used to build the state body when content is blank.
metadata_json	string	–	JSON object merged into the working-state metadata.
next_action	string	–	Next action; used to build the state body when content is blank.
scope	string	–	Scope containing the working-state slot; blank uses the token default.
state_key	string	–	Normalized state slot; the same owner, bucket, scope, and key updates that slot.
ttl_seconds	integer	–	Expiry in seconds from 0 to 2592000; 0 means no expiry.

Name	Type	Req	Description
result	string	yes	Human-readable text or JSON requested by output_json.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

13 Aug 13 Aug