Memora MCP Server

Findings (12)

• highHigh. Something risky that needs a close look before you install.
  credential-access issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  credential-access issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  secrets issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @fastify/busboy@2.1.1: 2 known vulnerabilities

  GHSA-gxm5-99cw-xjw9, GHSA-x8mw-p69m-v3mx

  memora-graph/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  defu@6.1.4: 1 known vulnerability

  GHSA-737v-mqg7-c878

  memora-graph/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  sharp@0.33.5: 3 known vulnerabilities

  GHSA-f88m-g3jw-g9cj, GHSA-rgj7-g3m4-5g8c, GHSA-wq5f-xc86-pv6w

  memora-graph/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  undici@5.29.0: 16 known vulnerabilities

  GHSA-2m5v-pch6-74hx, GHSA-2mjp-6q6p-2qxm, GHSA-35p6-xmwp-9g52, GHSA-4992-7rv2-5pvq, GHSA-8xcm-r25x-g524 +11 more

  memora-graph/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  ws@8.18.0: 2 known vulnerabilities

  GHSA-58qx-3vcg-4xpx, GHSA-96hv-2xvq-fx4p

  memora-graph/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@3.24.2: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  memora-graph/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  tests/test_watchdog.py:808
• lowLow. Minor, or common in normal tools. Shown for information.
  esbuild@0.17.19: 1 known vulnerability

  GHSA-67mh-4wv8-2f99

  memora-graph/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  No manifest declaring network access and environment variables (agent.json)

Network activity

Tools exposed (44)

• memory_create

  Create a new memory entry. Args: content: The memory content text metadata: Optional metadata dictionary tags: Optional list of tags suggest_similar: If True, find similar memories and suggest consolidation (default: True) similarity_threshold: Minimum si

• memory_create_issue

  Create a new issue/bug memory. Args: content: Description of the issue status: Issue status - "open" (default) or "closed" closed_reason: If closed, the reason - "complete" or "not_planned" severity: Issue severity - "critical", "major", "minor" (default)

• memory_create_todo

  Create a new TODO/task memory. Args: content: Description of the task status: Task status - "open" (default) or "closed" closed_reason: If closed, the reason - "complete" or "not_planned" priority: Task priority - "high", "medium" (default), "low" categor

• memory_create_section

  Create a new section/subsection header memory. Section memories are organizational placeholders that: - Are NOT visible in the graph visualization - Are NOT included in duplicate detection - Do NOT compute embeddings or cross-references Args: content: Title/description

• memory_list

  List memories, optionally filtering by substring query or metadata. Returns compact previews by default to reduce context usage. Use ``content_mode="full"`` when you need the complete content. Use ``memory_get`` to fetch full content for specific IDs. Args: query: Optional

• memory_list_compact

  [Deprecated] List memories in compact format (id, preview, tags only). Prefer ``memory_list`` which now defaults to compact previews with richer fields and configurable ``content_mode``/``preview_chars``. Returns minimal fields: id, content preview (first 80 chars), tags, and created_a

• memory_create_batch

  Create multiple memories in one call.

• memory_delete_batch

  Delete multiple memories by id. Args: ids: Memory IDs to delete reason: Optional tombstone reason (default "deleted")

• memory_absorb

  Intelligently absorb facts into memory with dedup and consolidation. For each fact: searches for similar existing memories, classifies the relationship via LLM (duplicate/update/contradict/related/new), then takes the appropriate action. Related new facts are automatically consolida

• memory_store_document

  Store a structured document as a root memory + searchable fragments. Parses markdown into typed fragments (claims, plan items, references, risks, section chunks) that are individually searchable while the full document remains retrievable as a unit. Args: content: Full mark

• memory_get_document

  Retrieve a stored document and its fragments by document key. Args: document_key: The document identifier used during storage content_mode: "preview" (default) or "full" for fragment content preview_chars: Max chars for preview mode (default: 120) node_kinds: Opt

• memory_delete_document

  Delete a stored document and all its fragments. Args: document_key: The document identifier version: Optional — delete only this version. If omitted, deletes all versions. Returns: {deleted_roots: count, deleted_fragments: count, deleted_ids: [...]}

• memory_get

  Retrieve a single memory by id (full content by default). Args: memory_id: ID of the memory to retrieve include_images: If False, strip image data from metadata to reduce response size fields: Optional list of fields to return (e.g. ["id","content","tags"]). None returns

• memory_update

  Update an existing memory. Metadata updates merge into existing metadata by default. Set a metadata key to null/None to delete that key. Pass replace_metadata=True only when intentionally replacing the whole metadata object.

• memory_delete

  Delete a memory by id. Deleting any version of a supersession lineage retires EVERY version (so a deleted fact cannot reappear as an older version): follow=latest/active hide them, memory_get on one says it was retired by deleting this id, and a later supersedes edge does not restor

• memory_tags

  Return the allowlisted tags.

• memory_tag_hierarchy

  Return stored tags organised as a namespace hierarchy.

• memory_validate_tags

  Validate stored tags against the allowlist and report invalid entries.

• memory_hierarchy

  Return memories organised into a hierarchy derived from their metadata. Args: compact: If True (default), return only id, preview (first 80 chars), and tags per memory to reduce response size. Set to False for full memory data.

• memory_verify_integrity

  Read-only embedding integrity doctor with bounded offending ids. record_model=true (explicit, E1b): on a store with NO recorded embedding model (written before E1) whose vectors are what the current model produces, record the current model -- one memories_meta row (on a live primary

• memory_semantic_search

  Perform a semantic search using vector embeddings. Returns compact previews by default. Use content_mode="full" for complete content. Args: query: Search query text top_k: Maximum number of results (legacy name; default 5 if neither limit nor top_k) limit: Alias for

• memory_hybrid_search

  Perform a hybrid search combining keyword (FTS) and semantic (vector) search. Uses Reciprocal Rank Fusion (RRF) to merge results from both search methods, providing better results than either method alone. Returns compact previews by default. Use content_mode="full" for complete conten

• memory_digest

  Return a deterministic digest of memories related to a topic. The digest is an aggregation surface for agents that need current context, not a narrative generator. It combines active hybrid-search hits, optional supersession lineage, related memory ids, and matching TODO/issue memories.

• memory_rebuild_embeddings

  Recompute embeddings for all memories. Rate limited: 300s cooldown. The ONLY way embeddings are rebuilt: a search never does (it reports a needed repair once, in the log and in /health/db). It rewrites every embedding row -- on a D1 store directly on D1, on a replicated local primar

• memory_related

  Return cross-referenced memories for a given entry. Consistency: the ``related`` graph is **eventually consistent**. When a new memory A is created or updated with references to an existing B, A.related is computed fresh but B.related is not re-cascaded — it stays valid until either

• memory_rebuild_crossrefs

  Recompute cross-reference links for all memories. Rate limited: 300s cooldown. Use this periodically (or after bulk imports) to close the eventual-consistency gap in the ``related`` graph — see ``memory_related`` for the consistency model.

• memory_stats

  Get statistics and analytics about stored memories. Also reports WHICH DATABASE this session is bound to (memora #997). A valid-but-wrong database name in a workspace's .mcp.json is otherwise undetectable: every tool works, reads succeed, and writes land silently in another project'

• memory_insights

  Analyze stored memories and produce actionable insights. Returns activity summary, open items, consolidation suggestions, and optional LLM-powered pattern detection. Args: period: Time period to analyze (e.g., "7d", "1m", "1y") include_llm_analysis: If True, use LLM to

• memory_boost

  Boost a memory's importance score. Manually increase a memory's base importance to make it rank higher in importance-sorted searches. The boost is permanent and cumulative. Args: memory_id: ID of the memory to boost boost_amount: Amount to add to base importance (defaul

• memory_link

  Create an explicit typed link between two memories. Args: from_id: Source memory ID to_id: Target memory ID edge_type: Type of relationship. Options: - "references" (default): General reference - "implements": Source implements/realizes target

• memory_unlink

  Remove a link between two memories. Args: from_id: Source memory ID to_id: Target memory ID bidirectional: If True, also remove reverse link (default: True) Returns: Dict with removed links

• memory_clusters

  Detect clusters of related memories. Args: min_cluster_size: Minimum memories to form a cluster (default: 2) min_score: Minimum similarity score to consider connected (default: 0.3) algorithm: "connected_components" (default) or "louvain" Louvain uses

• memory_find_duplicates

  Find potential duplicate memory pairs with optional LLM-powered comparison. Scans cross-references to find memory pairs with similarity >= threshold, then optionally uses LLM to semantically compare them. Uses the same threshold (0.85) as the graph UI duplicate detection. Args:

• memory_detect_supersessions

  Detect memories that supersede (update/replace) other memories. Scans existing memories for pairs where one is an evolved/updated version of another, then creates 'supersedes' edges between them. Complements memory_absorb which only catches supersessions at write time. Uses neutral

• memory_backfill_tags

  Re-tag existing memories with project-prefixed tags. Uses deterministic normalization to prefix generic tags (e.g. "plan" → "memora/plan") when the memory content clearly belongs to a specific project. No LLM calls. Idempotent: re-running produces the same result. Args: dr

• memory_merge

  Merge source memory into target, then delete source. Combines two memories into one, preserving content and metadata. Args: source_id: Memory ID to merge from (will be deleted) target_id: Memory ID to merge into (will be updated) merge_strategy: How to combine conte

• memory_export

  Export all memories to JSON format for backup or transfer. Rate limited: 60s cooldown.

• memory_upload_image

  Upload an image file directly to R2 storage. Uploads a local image file to R2 and returns the r2:// reference URL that can be used in memory metadata. Args: file_path: Absolute path to the image file to upload memory_id: Memory ID this image belongs to (used for organiz

• memory_migrate_images

  Migrate existing base64 images to R2 storage. Scans all memories and uploads any base64-encoded images to R2, replacing the data URIs with R2 URLs. Args: dry_run: If True, only report what would be migrated without making changes Returns: Dictionary with migration

• memory_export_graph

  Export memories as interactive HTML knowledge graph. Args: output_path: Path to save HTML file (default: ~/memories_graph.html) min_score: Minimum similarity score for edges (default: 0.25) Returns: Dictionary with path, node count, edge count, and tags

• memory_import

  Import memories from JSON format. Rate limited: 60s cooldown. Args: data: List of memory dictionaries with content, metadata, tags, created_at strategy: "replace" (clear all first), "merge" (skip duplicates), or "append" (add all)

• memory_import_sweep

  Admin: finish or remove rows an interrupted import left behind. A D1 import marks each row it writes (metadata.import_attempt) until the row is complete. A crash, or a cleanup that failed, can leave a marked row; reads hide it. A row whose import still holds a live lease is never to

• memory_events_poll

  Poll for memory events (e.g., shared-cache notifications). Args: since_timestamp: Only return events after this timestamp (ISO format) tags_filter: Only return events with these tags (e.g., ["shared-cache"]) unconsumed_only: Only return unconsumed events (default: True)

• memory_events_clear

  Mark events as consumed. Args: event_ids: List of event IDs to mark as consumed Returns: Dictionary with count of cleared events