Skills/Glama/memcp

memcp@0.1.0

CAUTION· not started

Publisher claims: "Gives AI agents a durable, locally hosted temporal memory built from a markdown vault you own, exposing hybrid semantic/lexical/entity search over events, threads, transcripts, entity relationships with validity dates, and patterns with confidence decay. Writes are approval-gated, so agents can draft, commit, and sync new memories while keeping every index rebuildable and nothing leaving your machine." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher haitham72 · publishing for 1 daysInstalls 0Last detonated 18 h ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
HF_TOKENMEMCP_PG_DSNPGPASSWORDConfiguration, not credentials: HF_HOME, MEMCP_DATA, MEMCP_MIGRATIONS_DIR, MEMCP_OWNER, MEMCP_REPO, MEMCP_SELF_THREAD, MEMCP_VAULT, MODEL_TIER, PGDATABASE, PGHOST, PGPORT, PGUSER, TN_AUTO_REBUILD, TN_AUTO_REBUILD_INTERVAL, TN_AUTO_REBUILD_MIN_INTERVAL, TN_CALL_LOG, TN_INCLUDE_FIXTURES, TN_INDEX_DEVICE, TN_INDEX_ROOTS, TN_MIGRATIONS_DIR, TN_RERANK_MODEL, TN_ROUTING_BOOST, TN_ROUTING_BOOST_MODE
Where it talks to
no vendor host named in the code
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard. It asks for HF_TOKEN, MEMCP_PG_DSN, PGPASSWORD and talks to its vendor. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-13 and scored it 71/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; HTML comment carrying imperative instructions to the agent; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run

Static findings

MEDIUM
Process kill commandsrc/memcp/transport.py:784 · Process kill command — agent can terminate processes# waiting for `initialize`, kill the server, and respawn — theFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/memcp/init.py:96 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Write .env from the packaged example (never overwrite without force)."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
HTML comment carrying imperative instructions to the agentsrc/memcp/templates/vault/patterns.md:8 · HTML comment carrying imperative instructions to the agentThe example is indented so the vault parser (which only matches `##` sections at column 0) never reads it. ## AB1 — Short pattern name **Entity:** `Person One` Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Access to sensitive file pathssrc/memcp/init.py:100 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileslog.append("kept .env (exists; --force to overwrite)")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/memcp/config.py:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files`.env` files are loaded from (first match wins per key): $MEMCP_REPO/.env,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_mcp_tools.py:174 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesresult = read_file("threads/../../.env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_mcp_tools.py:485 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
CRITICAL
HTML comment carrying imperative instructions to the agentsrc/memcp/templates/vault/entities.md:7 · HTML comment carrying imperative instructions to the agentThe example is indented so the vault parser (which only matches `##` cards at column 0) never reads it. ## `Person One` **Role:** their job or relationship to yFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
CRITICAL
HTML comment carrying imperative instructions to the agentsrc/memcp/templates/vault/timeline.md:7 · HTML comment carrying imperative instructions to the agentThe example is indented so the vault parser (which only matches fenced blocks at column 0) never reads it. A fresh scaffold syncs with zero events and zero skipFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Access to sensitive file pathssrc/memcp/init.py:104 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileslog.append("wrote .env from env.example" + (" (overwrote)" if existed else ""))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/memcp/init.py:14 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/memcp/config.py:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files./.env, $MEMCP_VAULT/.env. A `.env` in one of those spots may itself setFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_mcp_tools.py:170 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesresult = read_file("../.env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_mcp_tools.py:198 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesresult = read_file("../.env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/memcp/db/run_migrations.py:40 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Populate os.environ from .env files (compat shim over config.load_env)."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedsrc/memcp/code_index/scip_loader.py:392 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/memcp/tools/write_tools.py:151 · Python subprocess execution detectedproc = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout, env=_subprocess_env())Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Hex-encoded string detectedsrc/memcp/code_index/scip/scip_pb2.py:27 · Hex-encoded string detected — may contain obfuscated payloads…5\n\x11UnspecifiedSuffix\x10\x00\x12\r\n\tNamespace\x10\x01\x12\x0f\n\x07Package\x10\x01\x1a\x02\x08\x01\x12\x08\n\x04Type\x10\x02\x12\x08\n\x04Term\x10\x03\x12\n\n\x06Method\x10\x04\x12\x11\n…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Python subprocess execution detectedsrc/memcp/code_index/scip_loader.py:423 · Python subprocess execution detectedsubprocess.run([scip_ts, "index", "--output", str(outp)],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathssrc/memcp/init.py:97 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesdest = project_root / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/memcp/cli.py:342 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesinit = sub.add_parser("init", help="scaffold a vault, .env, and client config")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/memcp/search/reranker.py:36 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Load .env (HF_TOKEN for authenticated model downloads) before a modelFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/memcp/config.py:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesEnvironment (all optional; real process env always wins over .env file values):Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
HTML comment carrying imperative instructions to the agentsrc/memcp/templates/vault/advice.md:7 · HTML comment carrying imperative instructions to the agentThe example is indented so the vault parser (which only matches `##` / `###` sections at column 0) never reads it. ## example-thread ### 2026-01-15 | Short adviFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Process kill commandsrc/memcp/tools/memory_ops.py:49 · Process kill command — agent can terminate processes"""Parse all vault events. Import is lazy so a broken parser cannot kill import."""Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_mcp_tools.py:274 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filessrc/memcp/init.py:258 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction filelog.append(f"{action} CLAUDE.md managed block")Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Access to sensitive file pathstests/test_mcp_tools.py:291 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈428 tok
2 files · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

9 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim haitham72: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Hex-encoded string detected≈ +4 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
  5. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim haitham72Propose a patch to the maintainer