
Product
Microsoft Teams Notifications Are Now Available in Socket
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.
memory-vault
Advanced tools
Claude-style memory over a local folder, served via MCP — per-project spaces plus a shared org layer. Harness-neutral, customer-owned.
An organizational memory layer that works with any harness, any model. Customer-owned, permission-first, harness-neutral.
Thesis: the harness is temporary, the model is temporary, the memory is the org. The vault holds the one asset that survives every model swap and every vendor switch.
Local-only, zero dependencies, one file (server.mjs). The store is a plain directory (memory/) of markdown files with MEMORY.md indexes — the same shape Claude Code keeps its own memory in. The server exposes exactly Claude's core memory commands over MCP — view, create, str_replace, insert, delete, rename — sandboxed to the requesting project's slice of that folder. No search engine, no database, no auth: the model maintains the index, checks for duplicates, and decides what to keep, guided by the server's instructions. Files are the source of truth — edit them by hand, grep them, sync the folder with git.
memory/
MEMORY.md # vault index: one line per space
shared/ # org-wide memory, read-write from every project scope
MEMORY.md
<project>/ # one space per project, isolated from the others
MEMORY.md
*.md
skills/<name>/ # whole skill folders scraped into the vault
The scope is carried in the URL: POST /mcp/<project> sandboxes a session to memory/<project>/ plus shared/; bare POST /mcp is the unscoped whole-vault view — the org "gardener" scope for pruning across projects and promoting facts into shared/.
The package is on npm — no clone, no dependencies (Node ≥18):
MEMORY_DIR=~/memory-vault npx memory-vault # serves the folder at http://localhost:8787 (127.0.0.1 only)
Set MEMORY_DIR to where you want the vault to live — the default is ./memory relative to wherever you ran the command. VAULT_PORT overrides the port. From a clone, npm start does the same thing.
npx memory-vault connectOne command from the repo root wires it up for every harness it finds:
npx -y memory-vault connect # add --dry-run to preview, --project <name> to override the space name
It starts the server if it's down (store: $MEMORY_DIR, default ~/.memory-vault), then writes both layers each detected harness needs — the MCP registration in its own config format, and the memory ritual in a rules file it actually loads:
| Harness | MCP registration | Ritual |
|---|---|---|
| Claude Code | .mcp.json (always written — the repo-level MCP convention) | CLAUDE.md (imports @AGENTS.md) |
| Cursor | .cursor/mcp.json | AGENTS.md |
| Codex | .codex/config.toml (trusted projects) | AGENTS.md |
| DSH | printed pointer to dsh-cordis.patch.yml (profile patch stays manual) | — |
Re-running is idempotent — existing entries are left alone, missing ones added. Then restart the session and approve the vault MCP server when prompted; the memory tools appear from the next session on. If the repo already has harness memory to import, see the scraper below.
Or don't do it yourself:
Ask your agent: "Set up memory-vault for this repo — run
npx -y memory-vault connectfrom the repo root and relay its output."
Per repo (recorded in the repo's .mcp.json):
claude mcp add --transport http --scope project vault http://localhost:8787/mcp/<project>
Optionally also at user scope for the whole-vault gardener view — the project-scope entry of the same name wins inside a repo:
claude mcp add --transport http --scope user vault http://localhost:8787/mcp
New sessions get the memory tools; the server must be running.
DSH loads MCP servers as Cordis plugin instances via @deepseek-ai/dsh-mcp-client. A ready-to-use patch is in dsh-cordis.patch.yml:
# Per-session (workspace-local)
dsh --profile headless --patch ./dsh-cordis.patch.yml "your task"
# Or make it permanent by copying the entry into:
# ~/.dsh/profiles/headless/cordis.patch.yml
# ~/.dsh/profiles/web/cordis.patch.yml
The patch connects to the local vault at http://localhost:8787/mcp/memory-vault; tools appear as mcp__vault__view, mcp__vault__create, etc. The server must be running.
Copy markdown files into memory/<project>/ (or memory/shared/) — the store is the folder. Give each name: and description: frontmatter and an index line in that space's MEMORY.md (or let the model tidy that up next session).
First time connecting the vault on a repo that already has harness memory? Scrape it in:
node scripts/scrape.mjs <repo-path> [--dry-run] # writes into memory/<project>/
Per-harness adapters, each stamping its own source (scrape:<adapter>) and origin path:
| Adapter | Scrapes |
|---|---|
claude-memory | ~/.claude/projects/<repo-slug>/memory/*.md (Claude Code auto-memory) |
claude-instructions | CLAUDE.md, CLAUDE.local.md, .claude/CLAUDE.md |
claude-skills | .claude/skills/* (whole folders, into skills/<name>/; add --include-user-skills for ~/.claude/skills/*), .claude/commands/*.md, .claude/agents/*.md |
codex | AGENTS.md |
cursor | .cursorrules, .cursor/rules/* |
Everything lands in memory/<project>/ (project = repo dir name, override with --project) and only that project's MEMORY.md is rebuilt. Names are stable, so re-running is an idempotent refresh. --only <a,b> runs a subset of adapters (skills = claude-skills). User-level files (~/.claude/CLAUDE.md, ~/.claude/skills/) are personal, not org memory — opt in with --include-user / --include-user-skills. --dry-run previews without storing; --claude-home overrides ~/.claude (mainly for tests). Adding a harness = adding one adapter block in scripts/scrape.mjs.
MVP above is the read/write pipe. Write governance (extraction, dedup, contradiction handling, review) comes next. See docs/roadmap.md for the path from local MVP to org deployment, and docs/architecture.md for the architecture sketch.
FAQs
Portable AI memory over a local folder or hosted vault, served via MCP — one memory shared across models and harnesses (Claude, ChatGPT, Codex, Cursor). Per-project spaces plus a shared org layer, stored as plain markdown you own.
The npm package memory-vault receives a total of 121 weekly downloads. As such, memory-vault popularity was classified as not popular.
We found that memory-vault demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.

Security News
Socket CTO Ahmad Nassri joins AppSec leaders at Black Hat to discuss active malware, package manager risks, and software supply chain defense.