Skills/PyPI/memex-mcp

memex-mcp@1.0.3

CAUTION· not started

Publisher claims: "Open-source MCP server and hook service that keeps Claude Code and Codex engineering context current as the code changes." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher stifler7 · publishing for 186 daysInstalls 255Last detonated 3d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
GEMINI_API_KEYMEMEX_LLM_API_KEYNEO4J_PASSWORDNVIDIA_API_KEYNVIDIA_NIM_API_KEYConfiguration, not credentials: CODEX_HOME, DEBOUNCE_WINDOW, DECAY_HOUR, DECAY_HOURS_THRESHOLD, DECAY_MINUTE, EMBEDDING_MODEL, GEMINI_MODEL, GRAPHITI_LOG_LEVEL, MEMEX_EMBEDDING_DIM, MEMEX_EMBEDDING_MODEL, MEMEX_HOOK_CREATED, MEMEX_HOOKD, MEMEX_HOOKD_IDLE_SECONDS, MEMEX_IGNORED_PATTERNS, MEMEX_INTROSPECTION_ONLY, MEMEX_LIVE_CONTEXT, MEMEX_LIVE_NEO4J_URI, MEMEX_LLM_BASE_URL, MEMEX_LLM_MODEL, MEMEX_LLM_PROVIDER, MEMEX_MCP_TRANSPORT, MEMEX_NEO4J_CHECK_SECONDS, MEMEX_REGISTRY_PATH, NEO4J_DATABASE, NEO4J_URI, NEO4J_USER, NVIDIA_BASE_URL, NVIDIA_NIM_BASE_URL, POLL_INTERVAL, REPORT_DAY_OF_WEEK, REPORT_HOUR, REPORT_MINUTE, REPORT_PERIOD_DAYS, USERNAME
Where it talks to
no vendor host named in the codeAlso ai.studio, astral.sh, d3js.org, opentelemetry.io — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names ai.studio, astral.sh, d3js.org, opentelemetry.io as well as its own vendor. The guard injects GEMINI_API_KEY, MEMEX_LLM_API_KEY, NEO4J_PASSWORD, NVIDIA_API_KEY, NVIDIA_NIM_API_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx memex-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-11 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsmemex/cli.py:280 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesserve_parser.add_argument("--env-file", dest="env_file", help="Path to an .env file to load before startup (in addition to <repo>/.env)")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmemex/config.py:11 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Load .env file if it existsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmemex/cli.py:454 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesrepo_env = Path(path) / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Pipe-to-shell patternmemex/cli.py:149 · Pipe-to-shell pattern — downloads and immediately executes remote codeprint("[FAIL] uv not found. Install via 'curl -LsSf https://astral.sh/uv/install.sh | sh'")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Python subprocess execution detectedmemex/watcher/git_hook.py:118 · Python subprocess execution detecteddiff = subprocess.check_output(["git", "diff", "HEAD~1", "HEAD"], cwd=repo_root).decode().strip()Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedmemex/watcher/git_hook.py:114 · Python subprocess execution detectedmessage = subprocess.check_output(["git", "log", "-1", "--pretty=%B"], cwd=repo_root).decode().strip()Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedmemex/evaluation/fixtures.py:1455 · Python subprocess execution detecteddone = subprocess.run([sys.executable, "-I", "runner.py"], cwd=root, capture_output=True,Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Python subprocess execution detectedmemex/runtime/pilot.py:117 · Python subprocess execution detectedreturn int(subprocess.run(command, capture_output=True, text=True, check=True).stdout.strip())Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsmemex/config.py:354 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"`memex serve --env-file <path/to/.env>`."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)memex/memory_tool/http.py:8 · MCP server using network transport (SSE/HTTP) — data sent over networkBearer-auth pattern is inspired by ``memex/mcp_server/http.py`` butFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Python subprocess execution detectedmemex/evaluation/fixtures.py:1543 · Python subprocess execution detectedsubprocess.run(["git", "init", "-q", "-b", "main", str(repo)], check=True)Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Python subprocess execution detectedmemex/cli_review.py:154 · Python subprocess execution detectedsubprocess.run([editor, path], check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)memex/mcp_server/server.py:683 · MCP server using network transport (SSE/HTTP) — data sent over networkfrom memex.mcp_server.http import run_http_serverFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Python subprocess execution detectedmemex/watcher/git_hook.py:21 · Python subprocess execution detectedhooks_dir = Path(subprocess.check_output(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsmemex/runtime/views.py:161 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif relative.name.lower().startswith(".env") or "cred" in relative.name.lower():Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandmemex/cli_graph.py:106 · Process kill command — agent can terminate processesabsent) doesn't kill the whole export.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)memex/config.py:153 · MCP server using network transport (SSE/HTTP) — data sent over networkmemex/mcp_server/http.py) has no config knob here; it isn't a choice."""Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Python subprocess execution detectedmemex/runtime/views.py:141 · Python subprocess execution detectedraw = subprocess.check_output([Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedmemex/runtime/views.py:31 · Python subprocess execution detectedreturn subprocess.check_output(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedmemex/cli.py:155 · Python subprocess execution detecteddocker_ver = subprocess.check_output([docker_cmd, "--version"]).decode().strip()Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandmemex/memory_tool/http.py:58 · File permission modification command — agent changes file ownership/permissionslogger.debug("could not chmod bearer key file (likely non-POSIX); continuing")Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedmemex/watcher/git_hook.py:113 · Python subprocess execution detectedsha = subprocess.check_output(["git", "rev-parse", "HEAD"], cwd=repo_root).decode().strip()Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Bidirectional text override characters detectedmemex/graph/schema.py:51 · Bidirectional text override characters detected — may hide content directionreturn str(v).replace('\x00', '').replace('‮', '')Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedmemex/cli.py:146 · Python subprocess execution detecteduv_ver = subprocess.check_output([uv_cmd, "--version"]).decode().strip()Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandmemex/graph/decay.py:97 · Process kill command — agent can terminate processeslogged but do not raise, so a transient Neo4j blip cannot kill theFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedmemex/hook_client.py:108 · Python subprocess execution detectedsubprocess.Popen([sys.executable, "-m", "memex.hookd", key, *argv], stdin=subprocess.DEVNULL,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsmemex/config.py:352 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"Set these as environment variables, or place them in a .env file at "Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)memex/auth/__init__.py:4 · MCP server using network transport (SSE/HTTP) — data sent over networkBearer-token auth (memex/mcp_server/http.py's Depends(require_principal),Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Python subprocess execution detectedmemex/runtime/guard.py:630 · Python subprocess execution detectedreturn subprocess.run(["git", "-C", str(self.root), *args], check=True, capture_output=True,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedmemex/hook_client.py:114 · Python subprocess execution detectedsubprocess.Popen([sys.executable, "-m", "memex.hookd", key, *argv], stdin=subprocess.DEVNULL,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedmemex/evaluation/fixtures.py:1517 · Python subprocess execution detectedreturn subprocess.run(["git", "-C", str(repo), "-c", "[email protected]", "-c", "user.name=p5",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Python subprocess execution detectedmemex/config.py:73 · Python subprocess execution detectedoutput = subprocess.check_output(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandmemex/watcher/health.py:3 · Process kill command — agent can terminate processesThe watcher daemon swallows per-event errors so one bad file can't kill theFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedmemex/hook_client.py:126 · Python subprocess execution detectedresult = subprocess.run([sys.executable, "-m", *argv], input=raw, stdout=subprocess.PIPE, env=env)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsmemex/config.py:353 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"<repo>/.env (auto-loaded by `memex serve --repo <path>`), or pass "Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Remote installer piped to shellmemex/cli.py:149 · Remote installer piped to shellprint("[FAIL] uv not found. Install via 'curl -LsSf https://astral.sh/uv/install.sh | sh'")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Python subprocess execution detectedmemex/watcher/git_hook.py:119 · Python subprocess execution detectedfiles_changed = subprocess.check_output(["git", "diff-tree", "--no-commit-id", "--name-only", "-r", "HEAD"], cwd=repo_root).decode().strip().split("\n")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈65 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for memex-mcp@1.0.3 as of 3d ago. This is the package itself, not its dependencies.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  2. Unclaimed publisher≈ +8 on the totalClaim stifler7: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Bidirectional text override characters detected≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  5. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  6. MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim stifler7Propose a patch to the maintainer