mcp-server-memory
Provides persistent knowledge graph storage for entities and relationships, enabling AI assistants to remember information about users across conversation sessions.
89
/ 100 · Grade B
B = 80–89
“I need to maintain persistent memory of entities, relationships, and observations across multiple conversation sessions so my AI assistant can remember important context about me and my interactions.”
mcp-server-memory earned Certified status with a trust score of 89/100 (Grade B). No adversarial findings — all attack patterns were handled gracefully. Supply chain contains 266 components with 17 known vulnerabilities. Security scan: clean.
Trust Score Breakdown
Eight weighted signals composing the aggregate trust score
Scheme v2.0 · Weights provisional · Consumer confirmations and uptime use pipeline-derived baselines.
Findings
Security scan results, adversarial testing, and pipeline review
Security Scan — Cisco MCP Scanner
Adversarial Testing — 4 categories, 0 findings
No adversarial findings — all attack patterns handled gracefully.
Methodology v1.0 · 4 categories · ~55 attack patterns
OWASP MCP Top 10 Coverage
Evaluation activity mapped to the OWASP MCP Top 10 risk framework
Excessive Agency & Permissions
Cisco scanner behavioral analysis of permission scope
Unauthorized Data Access
Category 3 (data exfiltration) attack patterns
Tool Poisoning
Category 1 (prompt injection) and Category 5 (context poisoning) attack patterns
Supply Chain Vulnerabilities
SBOM generation (syft/cdxgen) and vulnerability scanning (grype/osv-scanner/npm audit)
Command Injection
Category 2 (privilege escalation) and Category 6 (repo config injection) attack patterns
Intent Subversion
Category 1 (prompt injection) and Category 4 (capability squatting) attack patterns
Insecure Data Handling
Cisco scanner data flow and sensitive data handling analysis
Insufficient Logging
Not directly tested — logging adequacy requires runtime observation beyond current pipeline scope
Resource Exhaustion
Resource profiling (CPU, memory) during functional and adversarial testing
Context Injection
Category 5 (context poisoning) attack patterns
OWASP MCP Top 10 (Beta) — owasp.org/www-project-mcp-top-10
Supply Chain
SBOM analysis and vulnerability assessment
Components
266
Direct deps
1
Transitive deps
265
Total vulns
17
Vulnerability breakdown
Format: CycloneDX 1.5 · Generated: Mar 29, 2026
Behavioral Fingerprint
Runtime performance baseline for drift detection
Samples
136
Error rate
0.0%
Peak memory
70.4 MB
Avg CPU
0.08%
Response time distribution
Output size distribution
Per-tool performance
| Tool | p50 | p95 | Error rate | Samples |
|---|---|---|---|---|
| open_nodes | 2ms | 4ms | 0.0% | 12 |
| read_graph | 2ms | 3ms | 0.0% | 6 |
| search_nodes | 1ms | 3ms | 0.0% | 42 |
| create_entities | 2ms | 8ms | 0.0% | 14 |
| delete_entities | 2ms | 3ms | 0.0% | 13 |
| add_observations | 1ms | 3ms | 0.0% | 12 |
| create_relations | 2ms | 10ms | 0.0% | 13 |
| delete_relations | 2ms | 3ms | 0.0% | 12 |
| delete_observations | 2ms | 3ms | 0.0% | 12 |
Fingerprint v1.0 · Baseline: Mar 29, 2026 · Status: baseline
Interface
Enumerated tools, resources, and prompts
Tools (9)
create_entities
Create multiple new entities in the knowledge graph
create_relations
Create multiple new relations between entities in the knowledge graph. Relations should be in active voice
add_observations
Add new observations to existing entities in the knowledge graph
delete_entities
Delete multiple entities and their associated relations from the knowledge graph
delete_observations
Delete specific observations from entities in the knowledge graph
delete_relations
Delete multiple relations from the knowledge graph
read_graph
Read the entire knowledge graph
search_nodes
Search for nodes in the knowledge graph based on a query
open_nodes
Open specific nodes in the knowledge graph by their names
Transport: stdio
Scope & Permissions
What this capability can and cannot access — derived from pipeline analysis
yes
yes
yes
yes
no
no
Side effects
May modify files on disk
May create new files or directories
May delete files or directories
Accesses environment variables
Behavioral Guarantees
Claims extracted from publisher documentation — each tagged with provenance
Implements persistent memory using a local knowledge graph
authorLets Claude remember information about the user across chats
authorCreates entities with unique names, entity types, and observations
authorCreates directed relations between entities stored in active voice
authorStores observations as strings attached to specific entities
authorIgnores entities with existing names when creating new entities
authorSkips duplicate relations when creating new relations
authorReturns added observations per entity when adding observations
authorPerforms cascading deletion of associated relations when deleting entities
authorOperates silently if entity doesn't exist when deleting entities
authorOperates silently if observation doesn't exist when deleting observations
authorOperates silently if relation doesn't exist when deleting relations
authorReturns complete graph structure with all entities and relations when reading graph
authorSearches across entity names, entity types, and observation content
authorReturns matching entities and their relations when searching nodes
authorReturns requested entities and relations between requested entities when opening nodes
authorSilently skips non-existent nodes when opening nodes
authorStores data in JSONL file format
authorKnown failure modes
Fails if entity doesn't exist when adding observations
Prior mcp/memory volume contains an index.js file that could be overwritten by the new container
Old docker volume's index.js file should be deleted before starting the new container
Sources: author, protocol
Badge & Integration
Embed certification status in your README, docs, or CI pipeline
Certification Notes
Provenance observations from the pipeline
Publisher "Model Context Protocol a Series of LF Projects, LLC." is not verified — first certification from this publisher
Single contributor — no peer review evidence in commit history
Repository is 11 days old — recently created
Signed Artifact
Certification provenance and verification metadata
Pipeline Artifacts
Raw data files from this certification run — downloadable for independent verification
contract.json
Full unsigned contract
stage1-ingest.json
Ingest stage output
stage2a-sbom.json
SBOM generation results
stage2a-vulns.json
Vulnerability scan results
stage2b-security.json
Security scan results
stage3a-functional.json
Functional test results
stage3b-adversarial.json
Adversarial test results
stage3c-fingerprint.json
Behavioral fingerprint
stage4-certify.json
Certification decision + trust score
stage3a-measurements.json
Raw functional test measurements
stage3b-measurements.json
Raw adversarial test measurements
run-log.json
Pipeline execution log
Not all files may be present for every certification.