
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@mnemoverse/mcp-memory-server
Advanced tools
Hosted persistent memory for AI agents that learns which facts help — feedback re-ranks recall — one key across Claude Code, Cursor, VS Code & ChatGPT, no infra to run
@mnemoverse/mcp-memory-server — the MCP server for the Mnemoverse memory engine.
Mnemoverse is a hosted memory engine for AI agents, reached over the Model Context Protocol. Mnemoverse stores what your agents learn — decisions, preferences, lessons — and returns it in any connected tool, so one memory follows you across Claude Code, Cursor, VS Code and ChatGPT with a single API key. Mnemoverse re-ranks recall from outcomes: report that a recalled memory helped and a Rescorla-Wagner update on the prediction error raises it, report that it misled and it sinks — a different mechanism from similarity scoring, usable alongside it.
Most agent memory today lives in one of three places. Per-tool instruction files — CLAUDE.md, .cursorrules, AGENTS.md — are versioned and readable, but each copy belongs to one repo and one tool, and nothing follows you to the next window. A vector store behind RAG retrieves by similarity, and similarity never changes because advice helped or misled. Local-first memory servers win on privacy and latency, and ask you to run and update the infrastructure yourself. Mnemoverse is the managed, cross-tool option in that landscape: nothing to deploy, one key everywhere, and ranking that moves with reported outcomes. If you need memory inside your own perimeter, a local-first server is the better choice — this one is hosted by design.
The consolidation stage of the engine — HDBSCAN clustering with Von Restorff protection, so distinctive memories are not absorbed into the average — is designed in and currently switched off on the hosted service; our docs say so rather than hide it.
⭐ If Mnemoverse saves you from re-explaining context to your agents, star the repo. It helps other builders find it.
Sign up at console.mnemoverse.com — takes 30 seconds, no credit card.
The two canonical setups, Claude Code and Cursor. Each writes the key once, at user scope, covering every project. Avoid a per-project config file for this: it lives inside the repository and can be committed with it, and a key belongs outside:
Claude Code — add via CLI:
claude mcp add mnemoverse -s user \
-e MNEMOVERSE_API_KEY=mk_live_YOUR_KEY \
-e MNEMOVERSE_API_URL=https://core.mnemoverse.com/api/v1 \
-- npx -y @mnemoverse/mcp-memory-server@latest
On Windows (PowerShell), paste the same command as one line — PowerShell does not read the \ line continuations:
claude mcp add mnemoverse -s user -e MNEMOVERSE_API_KEY=mk_live_YOUR_KEY -e MNEMOVERSE_API_URL=https://core.mnemoverse.com/api/v1 -- npx -y @mnemoverse/mcp-memory-server@latest
Cursor — click to install, or add the JSON below to ~/.cursor/mcp.json, the global config that covers every project. Do not put it in a project-level .cursor/mcp.json: that file lives inside the repository and is committed with it unless you exclude it, and this config holds your key.
The install button carries the placeholder key mk_live_YOUR_KEY, not yours, so the shortest path is to skip the button: add the JSON below to ~/.cursor/mcp.json, merging it with any servers already there, and put your own key in place. Get one at console.mnemoverse.com. If you did click the button, edit the same key in the mcp.json it wrote; Cursor keeps MCP environment values in that file, not in a settings form. Until the key is real the server starts and lists its tools, but every tool call is refused.
{
"mcpServers": {
"mnemoverse": {
"command": "npx",
"args": [
"-y",
"@mnemoverse/mcp-memory-server@latest"
],
"env": {
"MNEMOVERSE_API_KEY": "mk_live_YOUR_KEY",
"MNEMOVERSE_API_URL": "https://core.mnemoverse.com/api/v1"
}
}
}
}
VS Code — the VS Code extension signs in through the browser and needs no key; that's the default path. In VS Code's non-interactive Agent Host mode, servers that prompt for inputs like this one are not started; for unattended use there, put the key in the environment of the process that launches VS Code instead. To wire the MCP server directly instead, add this to .vscode/mcp.json (note: VS Code uses servers, not mcpServers). Never put a literal mk_live_ key in that file — it's committed with the repo. The inputs entry below prompts for the key instead: VS Code masks what you type and stores it in its own secret storage, not in the file:
{
"inputs": [
{
"type": "promptString",
"id": "mnemoverse-api-key",
"description": "Mnemoverse API key (starts with mk_live_). Optional to install and inspect — the server starts and lists its tools without a key; every actual tool call requires one. Get one free in ~30s at https://console.mnemoverse.com",
"password": true
}
],
"servers": {
"mnemoverse": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@mnemoverse/mcp-memory-server@latest"
],
"env": {
"MNEMOVERSE_API_KEY": "${input:mnemoverse-api-key}",
"MNEMOVERSE_API_URL": "https://core.mnemoverse.com/api/v1"
}
}
}
}
Windsurf — add to ~/.codeium/windsurf/mcp_config.json:
{
"mcpServers": {
"mnemoverse": {
"command": "npx",
"args": [
"-y",
"@mnemoverse/mcp-memory-server@latest"
],
"env": {
"MNEMOVERSE_API_KEY": "mk_live_YOUR_KEY",
"MNEMOVERSE_API_URL": "https://core.mnemoverse.com/api/v1"
}
}
}
}
More MCP clients — same server, different config file:
Zed — add to ~/.config/zed/settings.json (Zed uses context_servers, and "source": "custom" is required):
{
"context_servers": {
"mnemoverse": {
"source": "custom",
"command": "npx",
"args": [
"-y",
"@mnemoverse/mcp-memory-server@latest"
],
"env": {
"MNEMOVERSE_API_KEY": "mk_live_YOUR_KEY",
"MNEMOVERSE_API_URL": "https://core.mnemoverse.com/api/v1"
}
}
}
}
JetBrains (AI Assistant) — Settings → Tools → AI Assistant → Model Context Protocol (MCP), then paste:
{
"mcpServers": {
"mnemoverse": {
"command": "npx",
"args": [
"-y",
"@mnemoverse/mcp-memory-server@latest"
],
"env": {
"MNEMOVERSE_API_KEY": "mk_live_YOUR_KEY",
"MNEMOVERSE_API_URL": "https://core.mnemoverse.com/api/v1"
}
}
}
}
Cline — MCP Servers → Configure (or edit cline_mcp_settings.json). Cline reads env values literally, so paste your real key — not a ${VAR} reference:
{
"mcpServers": {
"mnemoverse": {
"command": "npx",
"args": [
"-y",
"@mnemoverse/mcp-memory-server@latest"
],
"env": {
"MNEMOVERSE_API_KEY": "mk_live_YOUR_KEY",
"MNEMOVERSE_API_URL": "https://core.mnemoverse.com/api/v1"
}
}
}
}
Continue — add ~/.continue/mcpServers/mnemoverse.yaml (Continue uses YAML):
mcpServers:
- name: mnemoverse
command: npx
args:
- "-y"
- "@mnemoverse/mcp-memory-server@latest"
env:
MNEMOVERSE_API_KEY: "mk_live_YOUR_KEY"
MNEMOVERSE_API_URL: "https://core.mnemoverse.com/api/v1"
Why
@latest? Barenpx @mnemoverse/mcp-memory-serveris cached indefinitely by npm and stops re-checking the registry. The@latestsuffix forces a metadata lookup on every Claude Code / Cursor / VS Code session start (~100-300ms), so you always pick up new releases.
⚠️ Restart your AI client after editing the config. MCP servers are only picked up on client startup.
Paste this in your AI chat:
"Remember that my favourite TypeScript framework is Hono, and please call
memory_writeto save it."
Your agent should call memory_write and confirm the memory was stored.
Then open a new chat / new session (this is the whole point — memory survives restarts), and ask:
"What's my favourite TypeScript framework?"
Your agent should call memory_read, find the entry, and answer "Hono". If it does — you're wired up. Write whatever you want next.
If it doesn't remember: check that the client was fully restarted and the config has your real mk_live_... key, not the placeholder.
| Tool | What it does |
|---|---|
memory_write | Store a memory — insight, preference, lesson learned |
memory_read | Search memories by natural language query (optional recency ordering, time bounds, author exclusion) |
memory_list_recent | List newest memories first — no query; since/until bounds (inclusive) + cursor paging |
memory_feedback | Rate memories as helpful or not (improves future recall) |
memory_stats | Check how many memories stored, which domains exist |
memory_create_room | Create a shared memory room; its address works as a domain on write/read |
memory_invite_to_room | Mint a one-time invite (code + link) for a room you own |
memory_join_room | Join a shared room with an invite code (mnvr_...) |
memory_list_rooms | List rooms you own or joined, with each room's address to use as domain |
vault_list | List Vault secrets by alias and purpose — the secret value is never returned |
tools/list is frozen per released version, so a client can save the list it
saw and diff it against what the server serves today, by version.
annotations
object of every tool (title, readOnlyHint, destructiveHint,
idempotentHint, openWorldHint) do not change. Only text may: descriptions
and what a tool returns, as the CHANGELOG rules state.deprecated since x.y, removed in x.z, and the change lands only in the
announced version, with its CHANGELOG line. A rename is announced by naming
both the old and the new name; the version pair alone does not say what a
client should look for. Because a MINOR may add a field but not remove one, a
renamed annotation field is declared under both names until the announced
version.tools/list outputs.The list above is the 0.10 surface: ten tools, each declaring all four hints.
The hosted connector at mcp.mnemoverse.com/mcp serves the same ten.
The pattern that pays off first is cross-tool continuity: a decision made while pairing in Claude Code is there when you open Cursor an hour later, and the preference you stated in VS Code holds in a ChatGPT session that evening. Teams use shared rooms the same way — one place where an agent's lessons about a codebase accumulate instead of being re-taught per seat. And because recall re-ranks from feedback, the memories that keep proving useful surface first, which matters once a store grows past what anyone curates by hand.
Concrete things worth writing:
The same API key works across all tools. Write a memory in Claude Code — read it in Cursor. Learn something in VS Code — your GPT Custom Action knows it too.
┌── Claude Code (this MCP server)
├── Cursor (this MCP server)
Mnemoverse API ──├── VS Code (this MCP server)
(one memory) ├── GPT (Custom Actions)
├── Python SDK (pip install mnemoverse)
└── REST API (curl)
| Env Variable | Required | Default |
|---|---|---|
MNEMOVERSE_API_KEY | For every tool call — the server starts and lists its tools without one | — |
MNEMOVERSE_API_URL | No | https://core.mnemoverse.com/api/v1 |
The retrieval model is published: arXiv:2603.08965, accepted at the GRAAI workshop at IEEE WCCI 2026 — it establishes the abstraction-discovery method the memory model builds on. No benchmark figures appear in this README, ours or anyone's: numbers will come with a reproducible run to stand behind, not before.
Setup and reference
Background reading
Other ways to install it
The same memory, packaged for hosts that prefer a plugin or an extension over an MCP config block. How each one connects and authenticates differs, so the line below says which is which rather than claiming one flow for all of them.
agent-memory-discipline skill
claude plugin marketplace add mnemoverse/claude-plugin
claude plugin install mnemoverse@mnemoverse
gemini extensions install https://github.com/mnemoverse/gemini-extensionmanifest.json in this repository is an MCPB manifest. This one is different from the four above: it runs the server as a local node process and reads MNEMOVERSE_API_KEY from the extension settings rather than calling the hosted endpoint. The packaged .mcpb ships with each releaseStanding rules, separate from this server
.claude-plugin/.Project
This server sends to the Mnemoverse API (core.mnemoverse.com), authenticated with your API key, what a tool call carries — and nothing else it can see. It does not read your AI client's conversation history, your local files, or anything you don't pass to a memory_* / vault_* tool. Stored memories live under your account; Mnemoverse never sells them and never shares them on its own. The one sharing path is the one you create yourself: inviting someone to a shared room grants their assistant access to that room's memories, bounded by the invite's scope.
What each tool sends:
| Tool | Data sent |
|---|---|
memory_write | the content, concepts, and domain you pass |
memory_read | the query, plus any filters: domain, since/until, exclude_author, top_k, order_by |
memory_list_recent | the feed filters: domain, since/until, exclude_author, limit, cursor |
memory_feedback | the atom_ids being rated and the outcome score |
memory_create_room | the room name and description |
memory_invite_to_room | the room_id, invite scope, and expiry |
memory_join_room | the invite code |
memory_stats / memory_list_rooms / vault_list | no request body — authenticated GETs |
One thing goes out that you did not explicitly request: since 0.8.1, when a search or feed comes back empty, the server sends one or two authenticated read-only GET probes (/memory/rooms and/or /memory/stats) so the empty answer can say what it did not cover. The probes carry your API key and nothing else, change no stored state, and are disclosed in the CHANGELOG.
| Privacy Policy | https://mnemoverse.com/privacy |
| Retention & deletion | correct a wrong or stale memory by writing a fresh one; deletion is an administrative operation on the REST API, not exposed through this MCP server |
| Contact | hello@mnemoverse.com |
MIT © Mnemoverse
FAQs
Hosted persistent memory for AI agents that learns which facts help — feedback re-ranks recall — one key across Claude Code, Cursor, VS Code & ChatGPT, no infra to run
The npm package @mnemoverse/mcp-memory-server receives a total of 340 weekly downloads. As such, @mnemoverse/mcp-memory-server popularity was classified as not popular.
We found that @mnemoverse/mcp-memory-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.