
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
memory-mcp-lite
Advanced tools
A local-first, token-efficient MCP memory server for AI coding clients (Windsurf, Cursor, Claude Desktop, and any MCP-compatible client).
A lightweight, structured memory layer that persists across AI coding sessions. It complements your AI client's built-in context by storing durable, structured knowledge.
What it stores:
What it does NOT do:
Retrieval policy (summary-first)
│
▼
Stage 1: global / project / task summaries // compact, always cheap
│
▼ (only if summaries insufficient)
Stage 2: FTS5 light search → compact candidates
│
▼ (only for top 1-3 results)
Stage 3: full memory detail
Memory is organized in a tree:
global
└── project
├── [project_summary]
└── task
├── [task_summary]
└── atomic // decision | fact | gotcha | command | link | convention
Optional graph-lite edges connect nodes across the tree: related_to, depends_on, affects, caused_by, supersedes, references.
Stack:
better-sqlite3 adapter)@modelcontextprotocol/sdk)Add to your MCP client config and the package will be fetched automatically via npx.
Windsurf (~/.codeium/windsurf/mcp_config.json):
{
"mcpServers": {
"memory-mcp-lite": {
"command": "npx",
"args": ["memory-mcp-lite"]
}
}
}
Claude Desktop (~/Library/Application Support/Claude/claude_desktop_config.json):
{
"mcpServers": {
"memory-mcp-lite": {
"command": "npx",
"args": ["memory-mcp-lite"]
}
}
}
npm install
npm run db:push # creates ~/.memory-mcp/memory.db
npm run build # outputs to dist/index.js
Custom DB path - set DATABASE_URL environment variable:
DATABASE_URL="file:/path/to/custom.db" npm run dev
After building, point your MCP client at the compiled output:
Windsurf (~/.codeium/windsurf/mcp_config.json):
{
"mcpServers": {
"memory-mcp-lite": {
"command": "node",
"args": ["/absolute/path/to/memory-mcp/dist/index.js"]
}
}
}
Claude Desktop (~/Library/Application Support/Claude/claude_desktop_config.json):
{
"mcpServers": {
"memory-mcp-lite": {
"command": "node",
"args": ["/absolute/path/to/memory-mcp/dist/index.js"]
}
}
}
For development without a build step, use tsx:
{
"mcpServers": {
"memory-mcp-lite": {
"command": "npx",
"args": ["tsx", "/absolute/path/to/memory-mcp/apps/server/src/index.ts"]
}
}
}
| Tool | When to use |
|---|---|
get_global_summary | Recurring preferences, coding style, cross-project conventions |
get_project_summary | Project architecture, key decisions, long-term context |
get_task_summary | Resume previous work, recall progress or next steps |
search_memory_light | When summaries aren't enough - returns compact candidates only |
get_memory_detail | Load full detail for a specific memory (follow-up to search) |
remember_decision | Store architecture choices, trade-offs, rejected alternatives |
remember_fact | Store commands, env facts, gotchas, links, conventions |
upsert_project_summary | Update after major architectural changes or new conventions |
upsert_task_summary | Update after progress, blockers, or plan changes |
Retrieval discipline enforced by server instructions:
Projects are identified by (in priority order):
This makes memory portable even when clients provide inconsistent paths.
npm run typecheck # TypeScript check
npm run db:push # sync schema to DB (no migration history)
npm run db:migrate # create migration files (for production)
npm run db:studio # open Prisma Studio to browse data
npm run dev # start dev server with tsx watch
DB location: ~/.memory-mcp/memory.db (default)
Schema: prisma/schema.prisma - edit here, then run npm run db:push
FTS5 index: created at server startup by initDb() in db/client.ts (Prisma does not manage virtual tables)
apps/server/src/
index.ts # entry point
server.ts # MCP server wiring
config/
env.ts # DB path, server name/version
constants.ts # numeric defaults
core/
project-resolver.ts # robust project identity resolution
retrieval-gate.ts # gating policy (skip / summaries / search / detail)
summary-policy.ts # summary freshness and update advice
progressive-loader.ts # 3-stage staged retrieval coordinator
memory-policy.ts # importance defaults and retention config
db/
client.ts # PrismaClient singleton + FTS5 init
schema.ts # FTS5 SQL + edge relation type definitions
repositories/ # typed async data access functions
services/
summary-service.ts # global / project / task summary CRUD
search-service.ts # FTS5 light search + detail loader
memory-service.ts # atomic memory write path
graph-lite-service.ts # edge CRUD and related node queries
mcp/
instructions.ts # server-level retrieval instructions
tool-descriptions.ts # strong tool descriptions
tools/ # 9 tool handlers with Zod validation
types/
memory.ts # MemoryNode, MemoryLevel, AtomicMemoryType
project.ts # Project, resolution types
tool.ts # SummaryOutput, LightSearchResult, DetailOutput
utils/
time.ts ids.ts hash.ts git.ts
prisma/
schema.prisma # Prisma 7 schema (projects, nodes, closure, edges)
prisma.config.ts # datasource URL for migrate/push
FAQs
A lightweight, structured, token-efficient local-first MCP memory server (Drizzle + libSQL)
The npm package memory-mcp-lite receives a total of 29 weekly downloads. As such, memory-mcp-lite popularity was classified as not popular.
We found that memory-mcp-lite demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.