freshcrate
Skin:/
Home > MCP Servers > mcp-memory-service

mcp-memory-service

Open-source persistent memory for AI agent pipelines (LangGraph, CrewAI, AutoGen) and Claude. REST API + knowledge graph + autonomous consolidation.

Why this rank:Strong adoptionRecent releaseHealthy release cadence

Description

Open-source persistent memory for AI agent pipelines (LangGraph, CrewAI, AutoGen) and Claude. REST API + knowledge graph + autonomous consolidation.

README

mcp-memory-service

Persistent Shared Memory for AI Agent Pipelines

Open-source memory backend for multi-agent systems. Agents store decisions, share causal knowledge graphs, and retrieve context in 5ms โ€” without cloud lock-in or API costs.

Works with LangGraph ยท CrewAI ยท AutoGen ยท any HTTP client ยท Claude Desktop ยท OpenCode


License: Apache 2.0 PyPI version Python GitHub starsWorks with LangGraph Works with CrewAI Works with AutoGen Works with Claude Works with Cursor Remote MCP claude.ai Browser Compatible OAuth 2.0 Sponsor


๐ŸŽฌ See It in Action

Watch the Dashboard Walkthrough

Watch the Web Dashboard Walkthrough on YouTube โ€” Semantic search, tag browser, document ingestion, analytics, quality scoring, and API docs in under 2 minutes.


๐ŸŒ Works with claude.ai (Browser)

Unlike desktop-only MCP servers, mcp-memory-service supports Remote MCP for native claude.ai integration.

What this means:

  • โœ… Use persistent memory directly in your browser (no Claude Desktop required)
  • โœ… Works on any device (laptop, tablet, phone)
  • โœ… Enterprise-ready (OAuth 2.0 + HTTPS + CORS)
  • โœ… Self-hosted OR cloud-hosted (your choice)

5-Minute Setup:

# 1. Start server with Remote MCP enabled
MCP_STREAMABLE_HTTP_MODE=1 \
MCP_SSE_HOST=0.0.0.0 \
MCP_SSE_PORT=8765 \
MCP_OAUTH_ENABLED=true \
python -m mcp_memory_service.server

# 2. Expose via Cloudflare Tunnel (or your own HTTPS setup)
cloudflared tunnel --url http://localhost:8765
# โ†’ Outputs: https://random-name.trycloudflare.com

# 3. In claude.ai: Settings โ†’ Connectors โ†’ Add Connector
# Paste the URL: https://random-name.trycloudflare.com/mcp
# OAuth flow will handle authentication automatically

Production Setup: See Remote MCP Setup Guide for Let's Encrypt, nginx, and firewall configuration. Step-by-Step Tutorial: Blog: 5-Minute claude.ai Setup | Wiki Guide


Why Agents Need This

Without mcp-memory-service With mcp-memory-service
Each agent run starts from zero Agents retrieve prior decisions in 5ms
Memory is local to one graph/run Memory is shared across all agents and runs
You manage Redis + Pinecone + glue code One self-hosted service, zero cloud cost
No causal relationships between facts Knowledge graph with typed edges (causes, fixes, contradicts)
Context window limits create amnesia Autonomous consolidation compresses old memories

Key capabilities for agent pipelines:

  • Framework-agnostic REST API โ€” 15 endpoints, no MCP client library needed
  • Knowledge graph โ€” agents share causal chains, not just facts
  • X-Agent-ID header โ€” auto-tag memories by agent identity for scoped retrieval
  • conversation_id โ€” bypass deduplication for incremental conversation storage
  • SSE events โ€” real-time notifications when any agent stores or deletes a memory
  • Embeddings run locally via ONNX โ€” memory never leaves your infrastructure

Agent Quick Start

pip install mcp-memory-service
MCP_ALLOW_ANONYMOUS_ACCESS=true memory server --http
# REST API running at http://localhost:8000
import httpx

BASE_URL = "http://localhost:8000"

# Store โ€” auto-tag with X-Agent-ID header
async with httpx.AsyncClient() as client:
    await client.post(f"{BASE_URL}/api/memories", json={
        "content": "API rate limit is 100 req/min",
        "tags": ["api", "limits"],
    }, headers={"X-Agent-ID": "researcher"})
    # Stored with tags: ["api", "limits", "agent:researcher"]

# Search โ€” scope to a specific agent
    results = await client.post(f"{BASE_URL}/api/memories/search", json={
        "query": "API rate limits",
        "tags": ["agent:researcher"],
    })
    print(results.json()["memories"])

Framework-specific guides: docs/agents/

Real-World: Multi-Agent Cluster with Shared Memory

"After I work with one of the cluster agents on something I want my local agent to know about, the cluster agent adds a special tag to the memory entry that my local agent recognizes as a message from a cluster agent. So they end up using it as a comms bridge โ€” and it's pretty delightful." โ€” @jeremykoerber, issue #591

A 5-agent openclaw cluster uses mcp-memory-service as shared state and as an inter-agent messaging bus โ€” without any custom protocol. Cluster agents tag memories with a sentinel like msg:cluster, and the local agent filters on that tag to receive cross-cluster signals. The memory service becomes the coordination layer with zero additional infrastructure.

# Cluster agent stores a learning and flags it for the local agent
await client.post(f"{BASE_URL}/api/memories", json={
    "content": "Rate limit on provider X is 50 RPM โ€” switch to provider Y after 40",
    "tags": ["api", "limits", "msg:cluster"],       # sentinel tag
}, headers={"X-Agent-ID": "cluster-agent-3"})

# Local agent polls for cluster messages
results = await client.post(f"{BASE_URL}/api/memories/search", json={
    "query": "messages from cluster",
    "tags": ["msg:cluster"],
})

This pattern โ€” tags as inter-agent signals โ€” emerges naturally from the tagging system and requires no additional infrastructure.

Real-World: Self-Hosted Docker Stack with Cloudflare Tunnel

"The quality of life that session-independent memory adds to AI workflows is immense. File-based memory demands constant discipline. Semantic recall from a live database doesn't. Storing data on my own hardware while making it remotely accessible across platforms turned out to be a feature I didn't know I needed." โ€” @PL-Peter, discussion #602

A production-tested self-hosted deployment using Docker containers behind a Cloudflare tunnel, with AuthMCP Gateway handling authentication:

Layer Role
Cloudflare Tunnel Name-based routing, subnet-based access control, authentication before hitting self-hosted resources
AuthMCP Gateway Auth/aggregation with locally managed users, admin UI, per-user MCP server access control, bearer token auth
mcp-memory-service Two Docker containers sharing one SQLite backend โ€” one for MCP, one for the web UI (document ingestion)

Security best practices for this setup:

  • Use Cloudflare ZeroTrust with subnet-based access control (e.g., allow Anthropic subnets + your own IPs)
  • Add Client IP Address Filtering to all Cloudflare API tokens (Dashboard โ†’ My Profile โ†’ API Tokens โ†’ Edit โ†’ Client IP Address Filtering) to limit abuse if a token leaks
  • If using IPv6, include your IPv6 /64 network in the allowlist (Python prefers IPv6 by default)
  • Set MCP_OAUTH_ACCESS_TOKEN_EXPIRE_MINUTES=1440 to extend OAuth tokens to 24 hours (refresh tokens not yet supported)
  • Consider an auth proxy like AuthMCP or mcp-auth-proxy for robust session management

Comparison with Alternatives

vs. Commercial Memory APIs

Mem0 Zep DIY Redis+Pinecone mcp-memory-service
License Proprietary Enterprise โ€” Apache 2.0
Cost Per-call API Enterprise Infra costs $0
๐ŸŒ claude.ai Browser โŒ Desktop only โŒ Desktop only โŒ โœ… Remote MCP
OAuth 2.0 + DCR โ“ Unknown โ“ Unknown โŒ โœ… Enterprise-ready
Streamable HTTP โŒ โŒ โŒ โœ… (SSE deprecated)
Framework integration SDK SDK Manual REST API (any HTTP client)
Knowledge graph No Limited No Yes (typed edges)
Auto consolidation No No No Yes (decay + compression)
On-premise embeddings No No Manual Yes (ONNX, local)
Privacy Cloud Cloud Partial 100% local
Hybrid search No Yes Manual Yes (BM25 + vector)
MCP protocol No No No Yes
REST API Yes Yes Manual Yes (15 endpoints)

vs. MCP-Native Alternatives

MemPalace is an MCP-native alternative that went viral in April 2026 with strong LongMemEval claims. A community code review (Issue #27) subsequently showed that the headline numbers reflect the underlying vector store rather than the advertised Palace architecture, and the maintainers acknowledged most points. We keep the comparison here for transparency, but readers should interpret the scores with that context in mind.

MemPalace mcp-memory-service
LongMemEval R@5 (raw ChromaDB, zero LLM) 96.6%ยน 86.0% (session) / 80.4% (turn)
LongMemEval R@5 (with reranking) 100%ยฒ โ€”
Storage granularity Session-level Turn-level + session-level
Team / multi-device sync โŒ Local only โœ… Cloudflare sync
REST API / Web dashboard โŒ โœ…
OAuth 2.1 + multi-user โŒ โœ…
Knowledge graph โŒ โœ… (typed edges)
Auto consolidation โŒ โœ… (decay + compression)
Compatible AI tools Claude-focused 13+ tools
License MIT Apache 2.0

Why the benchmark gap? Two independent factors:

  1. Ingestion granularity. MemPalace stores each conversation as a single unit (session-level). LongMemEval asks "which session contains the answer?" โ€” a question that session-level storage answers structurally. mcp-memory-service defaults to turn-level storage (one entry per message), which enables fine-grained retrieval ("what exactly did the user say about X?") but spreads a session's signal across many entries. Using memory_store_session (added in v10.35.0) brings our score to 86.0% R@5.
  2. What the 96.6% actually measures. Per Issue #27, MemPalace's headline number is produced in "raw mode" โ€” plain text stored in ChromaDB with default embeddings. The Palace architecture (Wings, Rooms, Halls) is not active in that configuration; "Halls" exist only as metadata strings with no effect on ranking. The 96.6% is therefore a ChromaDB + default-embedding baseline, not a measurement of MemPalace's structural retrieval features. A direct "apples-to-apples" architectural comparison is not possible with the published numbers.

ยน Measured in MemPalace "raw mode" (plain text in ChromaDB with default embeddings). Per Issue #27, the Palace structural features are bypassed in this configuration.

ยฒ 100% result uses optional LLM reranking (~500 API calls) on a partially tuned test set. Clean held-out score (as reported by the maintainers): 98.4% R@5.


Stop Re-Explaining Your Project to AI Every Session

MCP Memory Service

Your AI assistant forgets everything when you start a new chat. After 50 tool uses, context explodes to 500k+ tokensโ€”Claude slows down, you restart, and now it remembers nothing. You spend 10 minutes re-explaining your architecture. Again.

MCP Memory Service solves this.

It automatically captures your project context, architecture decisions, and code patterns. When you start fresh sessions, your AI already knows everythingโ€”no re-explaining, no context loss, no wasted time.

๐ŸŽฅ 2-Minute Video Demo

MCP Memory Service Demo

Technical showcase: Performance, Architecture, AI/ML Intelligence & Developer Experience

โšก Works With Your Favorite AI Tools

๐Ÿค– Agent Frameworks (REST API)

LangGraph ยท CrewAI ยท AutoGen ยท Any HTTP Client ยท OpenClaw/Nanobot ยท Custom Pipelines

๐Ÿ–ฅ๏ธ CLI & Terminal AI (MCP)

Claude Code ยท Gemini CLI ยท Gemini Code Assist ยท OpenCode ยท Codex CLI ยท Goose ยท Aider ยท GitHub Copilot CLI ยท Amp ยท Continue ยท Zed ยท Cody

๐ŸŽจ Desktop & IDE (MCP)

Claude Desktop ยท VS Code ยท Cursor ยท Windsurf ยท Kilo Code ยท Raycast ยท JetBrains ยท Replit ยท Sourcegraph ยท Qodo

๐Ÿ’ฌ Chat Interfaces (MCP)

ChatGPT (Developer Mode) ยท claude.ai (Remote MCP via HTTPS)

Works seamlessly with any MCP-compatible client or HTTP client - whether you're building agent pipelines, coding in the terminal, IDE, or browser.

๐Ÿ’ก NEW: ChatGPT now supports MCP! Enable Developer Mode to connect your memory service directly. See setup guide โ†’


๐Ÿš€ Get Started in 60 Seconds

Not sure which setup fits your needs? See the Setup Guide โ€” a decision tree walks you to the right path in under a minute.

1. Install:

pip install mcp-memory-service

2. Configure your AI client:

Claude Desktop

Add to your config file:

  • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
  • Windows: %APPDATA%\Claude\claude_desktop_config.json
  • Linux: ~/.config/Claude/claude_desktop_config.json
{
  "mcpServers": {
    "memory": {
      "command": "memory",
      "args": ["server"]
    }
  }
}

Restart Claude Desktop. Your AI now remembers everything across sessions.

Claude Code
claude mcp add memory -- memory server

Restart Claude Code. Memory tools will appear automatically.

OpenCode

Start the HTTP API:

MCP_ALLOW_ANONYMOUS_ACCESS=true memory server --http

Install the local plugin:

git clone https://github.com/doobidoo/mcp-memory-service.git
cd mcp-memory-service
mkdir -p ~/.config/opencode/plugins
cp opencode/memory-plugin.js ~/.config/opencode/plugins/
cp opencode/memory-plugin.config.example.json ~/.config/opencode/memory-plugin.json

OpenCode automatically loads local plugins from ~/.config/opencode/plugins/ and .opencode/plugins/.

See OpenCode integration guide for configuration, project-local installs, and current limitations.

The current OpenCode integration ships as repository files for the local plugin directory. If you installed only the PyPI package, clone the repository once to copy the plugin files.

The plugin defaults to http://127.0.0.1:8000, but memoryService.endpoint and OPENCODE_MEMORY_ENDPOINT let you target any reachable HTTP deployment.

๐ŸŒ claude.ai (Browser โ€” Remote MCP)

No local installation required on the client โ€” works directly in your browser:

# 1. Start server with Remote MCP
MCP_STREAMABLE_HTTP_MODE=1 python -m mcp_memory_service.server

# 2. Expose publicly (Cloudflare Tunnel)
cloudflared tunnel --url http://localhost:8765

# 3. Add connector in claude.ai Settings โ†’ Connectors with the tunnel URL

See Remote MCP Setup Guide for production deployment with Let's Encrypt, nginx, and Docker.

๐Ÿ”ง Advanced: Custom Backends & Team Setup

For production deployments, team collaboration, or cloud sync:

git clone https://github.com/doobidoo/mcp-memory-service.git
cd mcp-memory-service
python scripts/installation/install.py

Choose from:

  • SQLite (local, fast, single-user)
  • Cloudflare (cloud, multi-device sync)
  • Hybrid (best of both: 5ms local + background cloud sync)

๐Ÿ’ก Why You Need This

The Problem

Session 1 Session 2 (Fresh Start)
You: "We're building a Next.js app with Prisma and tRPC" AI: "What's your tech stack?" โŒ
AI: "Got it, I see you're using App Router" You: Explains architecture again for 10 minutes ๐Ÿ˜ค
You: "Add authentication with NextAuth" AI: "Should I use Pages Router or App Router?" โŒ

The Solution

Session 1 Session 2 (Fresh Start)
You: "We're building a Next.js app with Prisma and tRPC" AI: "I rememberโ€”Next.js App Router with Prisma and tRPC. What should we build?" โœ…
AI: "Got it, I see you're using App Router" You: "Add OAuth login"
You: "Add authentication with NextAuth" AI: "I'll integrate NextAuth with your existing Prisma setup." โœ…

Result: Zero re-explaining. Zero context loss. Just continuous, intelligent collaboration.


๐ŸŒ SHODH Ecosystem Compatibility

MCP Memory Service is fully compatible with the SHODH Unified Memory API Specification v1.0.0, enabling seamless interoperability across the SHODH ecosystem.

Compatible Implementations

Implementation Backend Embeddings Use Case
shodh-memory RocksDB MiniLM-L6-v2 (ONNX) Reference implementation
shodh-cloudflare Cloudflare Workers + Vectorize Workers AI (bge-small) Edge deployment, multi-device sync
mcp-memory-service (this) SQLite-vec / Hybrid MiniLM-L6-v2 (ONNX) Desktop AI assistants (MCP)

Unified Schema Support

All SHODH implementations share the same memory schema:

  • โœ… Emotional Metadata: emotion, emotional_valence, emotional_arousal
  • โœ… Episodic Memory: episode_id, sequence_number, preceding_memory_id
  • โœ… Source Tracking: source_type, credibility
  • โœ… Quality Scoring: quality_score, access_count, last_accessed_at

Interoperability Example: Export memories from mcp-memory-service โ†’ Import to shodh-cloudflare โ†’ Sync across devices โ†’ Full fidelity preservation of emotional_valence, episode_id, and all spec fields.


โœจ Quick Start Features

๐Ÿง  Persistent Memory โ€“ Context survives across sessions with semantic search ๐Ÿ” Smart Retrieval โ€“ Finds relevant context automatically using AI embeddings โšก 5ms Speed โ€“ Instant context injection, no latency ๐Ÿ”„ Multi-Client โ€“ Works across 20+ AI applications โ˜๏ธ Cloud Sync โ€“ Optional Cloudflare backend for team collaboration ๐Ÿ”’ Privacy-First โ€“ Local-first, you control your data ๐Ÿ“Š Web Dashboard โ€“ Visualize and manage memories at http://localhost:8000 ๐Ÿงฌ Knowledge Graph โ€“ Interactive D3.js visualization of memory relationships ๐Ÿ†•

๐Ÿ–ฅ๏ธ Dashboard Preview (v9.3.0)

MCP Memory Dashboard Tour

8 Dashboard Tabs: Dashboard โ€ข Search โ€ข Browse โ€ข Documents โ€ข Manage โ€ข Analytics โ€ข Quality (NEW) โ€ข API Docs

๐Ÿ“– See Web Dashboard Guide for complete documentation.


Latest Release: v10.39.1 (April 19, 2026)

hotfix: plugin.json author field format โ€” unblocks /plugin install mcp-memory-service

What's New:

  • Hotfix for v10.39.0 plugin install: plugin.json author field now uses the required object format ({"name": "..."}) instead of a string. Users who hit Validation errors: author: Invalid input: expected object, received string on /plugin install mcp-memory-service should upgrade to v10.39.1. Thanks @yingzhi0808 for the report (#738) and fix (#739).
  • 1,547 Python tests passing.

Previous Releases:

  • v10.39.0 - feat: Claude Code plugin install (/plugin marketplace add doobidoo/mcp-memory-service) + MemoryClient.storeMemory() protocol-native writes (PRs #736, #735)
  • v10.38.4 - fix(mcp): return HTTP 202 for JSON-RPC notifications โ€” fixes Codex/strict-client handshake (PR #733)
  • v10.38.3 - fix: Server tab auto-check, list_memories total_pages, knowledge graph edge rendering (PRs #728, #731, #730)
  • v10.38.2 - fix(windows): PS 7+ cert bypass, per-call SkipCertificateCheck, chicken-egg lib sourcing (PR #723)
  • v10.38.1 - fix: OAuth loopback ports (RFC 8252), CLI ingestion NameError, SSE CLI flags, Docker CI bumps (PRs #697, #704, #705, #707-709)
  • v10.38.0 - feat: opt-in Claude Code SessionEnd auto-harvest hook โ€” safe-by-default, zero npm deps, 5s timeout, TLS opt-in (PR #711, 1,547 tests)
  • v10.37.0 - feat: POST /api/harvest HTTP endpoint for Session Harvest + CodeQL path-injection hardening (PR #710, 1,547 tests)
  • v10.36.8 - fix: event-loop blocking paths in SqliteVecMemoryStorage.initialize() โ€” pragma application and hash-embedding fallback now run in worker thread under _conn_lock (PR #700, 1,537 tests)
  • v10.36.7 - security: bump pygments to 2.20.0 (CVE-2026-4539/GHSA-5239-wwwm-4pmq) โ€” ReDoS fix via rich transitive dep (PR #698, 1,537 tests)
  • v10.36.6 - security: bump cryptography to 46.0.7 (CVE-2026-39892) โ€” buffer overflow fix in non-contiguous buffer handling (PR #690, 1,537 tests)
  • v10.36.5 - fix: Cloudflare Vectorize API v1 to v2 + test script fixes โ€” fixed error 1010 "incorrect_api_version", content_hash arg, sys.path correction (PR #689, @mychaelgo, 1,537 tests)
  • v10.36.4 - fix(windows): hotfix for Get-McpApiKey returning first char instead of full API key โ€” PowerShell array-enumeration trap fixed (PR #687, 1,537 tests)

Full version history: CHANGELOG.md | Older versions (v10.36.3 and earlier) | All Releases


Migration to v9.0.0

โšก TL;DR: No manual migration needed - upgrades happen automatically!

Breaking Changes:

  • Memory Type Ontology: Legacy types auto-migrate to new taxonomy (taskโ†’observation, noteโ†’observation)
  • Asymmetric Relationships: Directed edges only (no longer bidirectional)

Migration Process:

  1. Stop your MCP server
  2. Update to latest version (git pull or pip install --upgrade mcp-memory-service)
  3. Restart server - automatic migrations run on startup:
    • Database schema migrations (009, 010)
    • Memory type soft-validation (legacy types โ†’ observation)
    • No tag migration needed (backward compatible)

Safety: Migrations are idempotent and safe to re-run


Breaking Changes

1. Memory Type Ontology

What Changed:

  • Legacy memory types (task, note, standard) are deprecated
  • New formal taxonomy: 5 base types (observation, decision, learning, error, pattern) with 21 subtypes
  • Type validation now defaults to 'observation' for invalid types (soft validation)

Migration Process: โœ… Automatic - No manual action required!

When you restart the server with v9.0.0:

  • Invalid memory types are automatically soft-validated to 'observation'
  • Database schema updates run automatically
  • Existing memories continue to work without modification

New Memory Types:

  • observation: General observations, facts, and discoveries
  • decision: Decisions and planning
  • learning: Learnings and insights
  • error: Errors and failures
  • pattern: Patterns and trends

Backward Compatibility:

  • Existing memories will be auto-migrated (taskโ†’observation, noteโ†’observation, standardโ†’observation)
  • Invalid types default to 'observation' (no errors thrown)

2. Asymmetric Relationships

What Changed:

  • Asymmetric relationships (causes, fixes, supports, follows) now store only directed edges
  • Symmetric relationships (related, contradicts) continue storing bidirectional edges
  • Database migration (010) removes incorrect reverse edges

Migration Required: No action needed - database migration runs automatically on startup.

Code Changes Required: If your code expects bidirectional storage for asymmetric relationships:

# OLD (will no longer work):
# Asymmetric relationships were stored bidirectionally
result = storage.find_connected(memory_id, relationship_type="causes")

# NEW (correct approach):
# Use direction parameter for asymmetric relationships
result = storage.find_connected(
    memory_id,
    relationship_type="causes",
    direction="both"  # Explicit direction required for asymmetric types
)

Relationship Types:

  • Asymmetric: causes, fixes, supports, follows (Aโ†’B โ‰  Bโ†’A)
  • Symmetric: related, contradicts (Aโ†”B)

Retrieval Benchmarks

Three benchmarks measure retrieval quality (all-MiniLM-L6-v2, 384d embeddings, zero LLM API calls):

LongMemEval (500 questions, ~45โ€“62 distractor sessions per question):

Question Type R@5 R@10 NDCG@10 MRR
Overall 80.4% 90.4% 82.2% 89.1%
single-session-assistant 100.0% 100.0% 99.3% 99.1%
knowledge-update 84.6% 96.8% 86.2% 95.5%
single-session-user 91.4% 92.9% 86.0% 83.8%
temporal-reasoning 72.0% 84.1% 75.1% 85.7%
multi-session 70.7% 86.0% 77.6% 89.4%

DevBench (practical developer workflow queries):

Category Recall@5 MRR
Overall 91.1% 0.861
exact 100% 1.000
semantic 80.0% 0.700
cross-type 90.0% 0.867

LoCoMo (ACL 2024 long-term conversational memory):

Category Recall@5 MRR
Overall 49.7% 0.414
multi-hop 72.0% 0.600
temporal 33.5% 0.274

Run benchmarks: python scripts/benchmarks/benchmark_longmemeval.py, python scripts/benchmarks/benchmark_devbench.py, python scripts/benchmarks/benchmark_locomo.py

Performance Improvements

  • ontology validation: 97.5x faster (module-level caching)
  • Type lookups: 35.9x faster (cached reverse maps)
  • Tag validation: 47.3% faster (eliminated double parsing)

Testing

  • 829/914 tests passing (90.7%)
  • 80 new ontology tests with 100% backward compatibility
  • All API/HTTP integration tests passing

Support

If you encounter issues during migration:


๐Ÿ“š Documentation & Resources


๐Ÿค Contributing

We welcome contributions! See CONTRIBUTING.md for guidelines.

Quick Development Setup:

git clone https://github.com/doobidoo/mcp-memory-service.git
cd mcp-memory-service
pip install -e .  # Editable install
pytest tests/      # Run test suite

Release History

VersionChangesUrgencyDate
v10.65.0## What's New OpenCode plugin gains three slash commands, a working TUI sidebar widget, and a per-instance status bridge. ### Added - **`/memory` slash commands** โ€” three commands via `command.execute.before` hook: - `/memory` โ€” current session status (memories loaded, last capture, server health) - `/memory search <query>` โ€” top 5 semantic matches from the vector DB - `/memory health` โ€” backend type, status, total memory count (hits `/api/health/detailed`) - **TUI sidebar widget** (`opHigh5/24/2026
v10.59.2## What's Changed ### Bug Fixes **fix(oauth): use AnyUrl for redirect_uri in AuthorizationRequest and TokenRequest** (#942, reported by @tkislan) `HttpUrl` only accepts `http`/`https` schemes โ€” `cursor://`, `vscode://`, `vscode-insiders://` were silently rejected by Pydantic before reaching the `ALLOWED_SCHEMES` whitelist in `registration.py`. This meant the IDE scheme support added in v10.59.0 was a no-op in practice: Pydantic discarded the URI before the application code ever saw it. **FixHigh5/17/2026
v10.54.0## What's New ### feat(search): `tag_match` parameter for `memory_search` MCP tool Extends the AND/OR tag filtering already available in `memory_delete` to the `memory_search` MCP tool. **Usage:** - `tag_match: "any"` (default, OR) โ€” return memories matching at least one of the supplied tags. Preserves existing behavior, no breaking change. - `tag_match: "all"` (AND) โ€” return only memories that have every supplied tag. **Example:** ```json { "query": "python development", "tags": ["pythoHigh5/10/2026
v10.49.4## Summary Consolidation safety fix: high-value mistake notes no longer vanish during scheduled consolidation passes. ## What's Changed ### Fixed - **[#853] Mistake-notes survive consolidation**: `_is_protected_memory()` in `consolidation/base.py` now shields memories with `memory_type='mistake'` and `failure_count >= 3` from decay and forgetting passes. Error-replay records that have been marked as significant failures are never eligible for archival or removal by the consolidation scheduleHigh5/5/2026
v10.45.0## What's New ### feat(quality): OpenAI-compatible quality scoring provider (PR #790) Point quality scoring at any OpenAI `/v1/chat/completions`-compatible endpoint โ€” Ollama, LiteLLM, MLX-LM server, or vLLM โ€” without a cloud API key or the ONNX model. **Quick start:** ```bash MCP_QUALITY_AI_PROVIDER=openai-compatible MCP_QUALITY_AI_BASE_URL=http://localhost:11434/v1 # Ollama MCP_QUALITY_AI_MODEL=qwen2.5:7b-instruct # MCP_QUALITY_AI_API_KEY=ollama # optional ``` RecommenHigh4/30/2026
v10.40.3## What's Changed ### Fixed - **claude-hooks: socket hang-up on multi-phase retrieval eliminated** (`memory-client.js`): Node.js HTTPS agent defaults to `keepAlive: true`, which causes Uvicorn to close idle sockets after ~5 s. The hook is a one-shot CLI process โ€” keepAlive provides zero benefit and caused subsequent phase requests to reuse dead sockets, producing `ECONNRESET` ("socket hang up"). Added `agent: false` and `Connection: close` header to `_attemptHealthCheck`, `storeMemoryHTTP`, anHigh4/24/2026
v10.40.0## Special Thanks Huge thanks to @zc277584121 for contributing the Milvus storage backend โ€” the first major community-contributed storage backend in the project's history. This is ~1,750 lines of production-quality code with 39 tests, three deployment modes, and a 6-month maintenance SLA commitment. This is exactly the kind of deep, thoughtful contribution that expands the project's reach to new deployments. ## What's New ### Added - **[#721] Milvus storage backend (Lite / self-hosted / ZillHigh4/22/2026
v10.39.1## Hotfix for v10.39.0 plugin install **If you tried `/plugin install mcp-memory-service` on v10.39.0 and hit `Validation errors: author: Invalid input: expected object, received string`, this release fixes it.** The `plugin.json` manifest now uses the object form (`{"name": "..."}`) the Claude Code plugin validator requires. Thanks to @yingzhi0808 for the detailed bug report (#738) and the one-line fix (#739). ## What Changed ### Fixed - **plugin**: `plugin.json` `author` field now uses thHigh4/20/2026
v10.39.0## New: Install as a Claude Code Plugin Two commands replace the bash wrapper, API-key generation, and manual MCP-config-editing ceremony: \`\`\` /plugin marketplace add doobidoo/mcp-memory-service /plugin install mcp-memory-service \`\`\` v1.0.0 plugin is experimental. See [`claude-hooks/PLUGIN.md`](https://github.com/doobidoo/mcp-memory-service/blob/main/claude-hooks/PLUGIN.md) for install, config, and migration from the legacy `install_hooks.py` installer. Closes #530. ## What's Changed High4/19/2026
v10.38.4## fix(mcp): return HTTP 202 for JSON-RPC notifications โ€” strict-client compatibility ### Problem The `/mcp` Streamable HTTP endpoint was returning `-32601 Method not found` in response to JSON-RPC **notifications** (messages without an `id` field), specifically `notifications/initialized`. This violated two specs: - **JSON-RPC 2.0 ยง4.1**: servers MUST NOT reply to notifications - **MCP Streamable HTTP spec**: notifications must receive `HTTP 202 Accepted` with an empty body Claude Code and High4/19/2026
v10.38.3## What's Changed Three independent patch fixes bundled into this release. ### Fixed - **[#728] Dashboard: auto-check updates on Server tab open + accurate initial label** โ€” The Server tab now automatically triggers an update check when opened, and displays an accurate initial label before the first check completes, eliminating stale/misleading status on first render. (PR #728) - **[#731] API: add `total_pages` to `list_memories` return** โ€” The `list_memories` REST API response now includes High4/17/2026
v10.38.2## [10.38.2] - 2026-04-16 Windows scripts fix + docs cleanup + service portability. No Python code or API changes. ### Fixed - **[#723] Windows PS7+: replace removed `ICertificatePolicy` with `ServerCertificateValidationCallback`**: `lib/server-config.ps1` used `Add-Type` with the `ICertificatePolicy` interface (removed in .NET Core/5+). Replaced with `ServerCertificateValidationCallback`, scoped to PS 5.1 only to avoid global process-wide callback leak on PS 7+. (PR #723) - **[#723] Windows High4/16/2026
v10.38.1## What's Changed ### Fixed - **[#697] OAuth: accept native loopback redirect ports (RFC 8252)**: Native apps like OpenCode register a loopback redirect URI (e.g. `http://127.0.0.1`) without a port, then listen on an ephemeral port chosen at runtime. The authorization server now matches loopback URIs by scheme and host only, ignoring the port, per RFC 8252 ยง7.3. Previously the port mismatch caused authorization to fail for native app clients. (+109 test lines) - **[#704] CLI: import missing `gHigh4/15/2026
v10.38.0## feat: opt-in Claude Code SessionEnd auto-harvest hook (PR #711, issue #631) ### What's New **[#631] `claude-hooks/core/session-end-harvest.js`** โ€” A new opt-in hook that automatically calls `POST /api/harvest` at the end of every Claude Code session. Pure CommonJS, zero npm dependencies, installs as a direct `command:` entry in `.claude/settings.json`. **Safe-by-default design:** - `sessionHarvest.enabled: false` โ€” user must explicitly opt in - First run forces `dry_run: true` regardless oHigh4/15/2026
v10.37.0## What's New **`POST /api/harvest` โ€” Session Harvest over HTTP** (PR #710, closes #630) Until now, Session Harvest was only accessible via the `memory_harvest` MCP tool โ€” requiring an active MCP session. v10.37.0 adds a dedicated HTTP endpoint so scripts, cron jobs, CI pipelines, and the dashboard can trigger harvest without MCP. ### Added - **`POST /api/harvest`**: New REST endpoint in `src/mcp_memory_service/web/api/harvest.py`. Request fields mirror the MCP tool exactly: `sessions`, `sesHigh4/15/2026
v10.36.8## Fixed - **[#664] Event-loop blocking paths in `SqliteVecMemoryStorage.initialize()`**: Two synchronous operations in the async initialization path were blocking the event loop on startup: 1. Pragma application in `_connect_and_load_extension` now runs in a worker thread under `_conn_lock` via `_run_in_thread` instead of executing synchronously on the event loop. 2. `_initialize_hash_embedding_fallback` is now async and wraps `_get_existing_db_embedding_dimension` in `_run_in_thread`. High4/14/2026
v10.36.7## Security - **[#698] Bumped pygments to 2.20.0**: Resolves CVE-2026-4539 (GHSA-5239-wwwm-4pmq, ReDoS via inefficient regex for GUID matching). Transitive dependency via rich. (PR #698) ## Details **CVE-2026-4539 / GHSA-5239-wwwm-4pmq** - Severity: Medium - Vulnerability: ReDoS (Regular Expression Denial of Service) via inefficient regex in GUID matching - Dependency chain: pygments (transitive via rich) - Fix: Pinned pygments >= 2.20.0 ## What's Unchanged - 1,537 tests passing - No API orMedium4/14/2026
v10.36.6## Security - **[#690] Bumped cryptography to 46.0.7**: Resolves CVE-2026-39892 (buffer overflow in non-contiguous buffer handling). (PR #690) ## Details **CVE-2026-39892** โ€” Buffer overflow in non-contiguous buffer handling in the `cryptography` library. Bumped from the previous version to 46.0.7. **1,537 tests** passing. ## Upgrade ```bash pip install --upgrade mcp-memory-service ``` Or with uv: ```bash uv add mcp-memory-service==10.36.6 ``` See [CHANGELOG.md](https://github.com/doobiMedium4/14/2026
v10.36.5## Summary Fixes Cloudflare Vectorize API version mismatch that caused error 1010 during resource setup, plus two test script correctness fixes. ## What's Fixed - **Cloudflare Vectorize API v1โ†’v2** (`scripts/installation/setup_cloudflare_resources.py`): Updated API endpoint from v1 to v2, resolving error 1010 "incorrect_api_version" during `setup_cloudflare_resources.py` execution. Users setting up Cloudflare backends were blocked by this error. - **`test_cloudflare_backend.py` fixes**: AddedMedium4/14/2026
v10.36.4## What's Fixed **Critical regression from v10.36.3**: `Get-McpApiKey` in `scripts/service/windows/lib/server-config.ps1` returned the first character of the API key (`'b'`) instead of the full key (`bxvWZwrI...`), breaking `manage_service.ps1 status` Version and Backend display for all Windows users. ### Root Cause The v10.36.3 refactor (Gemini review suggestion, PR #685) replaced a working implementation with: ```powershell $apiKey = ($matches[1], $matches[2], $matches[3] | Where-Object { High4/10/2026
v10.36.3## What Changed PATCH release restoring user-visible functionality broken since v10.21.0 (GHSA-73hc-m4hx-79pj). That security fix correctly removed `version`, `timestamp`, and `uptime_seconds` from the public `/api/health` response โ€” but two callers of the old contract were not updated at the time. ### Fixed **Dashboard Settings modal version row (N/A for ~4 months)** `SYSTEM_INFO_CONFIG.settingsVersion` in `app.js` still pointed at `api: 'health'` after the security hardening. The Version rMedium4/10/2026
v10.36.2## What's Fixed ### Hardcoded server URLs in Windows management scripts All 5 Windows PowerShell management scripts (`manage_service.ps1`, `run_http_server_background.ps1`, `install_scheduled_task.ps1`, `uninstall_scheduled_task.ps1`, `update_and_restart.ps1`) previously used a hardcoded `http://127.0.0.1:8000` regardless of `.env` configuration. Health checks failed silently as soon as a user enabled HTTPS or changed the port. **Fix**: Introduced `scripts/service/windows/lib/server-config.psMedium4/10/2026
v10.36.0## What's New ### Added - **OpenCode memory awareness integration** (`opencode/memory-plugin.js`): Read-only plugin that injects relevant memories into OpenCode sessions via the HTTP API. Includes configurable endpoints, parallel search, session deduplication, and timeout handling. Setup guide and example config included. Thanks to @irizzant! (PR #673, closes #671) ### Fixed - **Lite package version sync** (#672): `mcp-memory-service-lite` was stuck at 8.76.0 on PyPI because `pyproject-lite.toMedium4/9/2026
v10.35.0## feat: session-level memory ingestion New `memory_store_session` MCP tool and `POST /api/sessions` HTTP endpoint store a full conversation as a single memory unit โ€” all turns concatenated as `[role] content` lines, stored with `memory_type=session` and auto-tagged `session:<id>`. ### Why two ingestion strategies? Turn-level storage (default) is best for precise fact retrieval. Session-level storage improves session-recall benchmarks. | Strategy | LongMemEval R@5 | Delta | |----------|-----High4/8/2026
v10.34.0## LongMemEval Benchmark: R@5 80.4%, R@10 90.4%, NDCG@10 82.2%, MRR 89.1% (zero LLM) This release adds a complete LongMemEval benchmark implementation, providing verified retrieval quality metrics against a real-world 500-question conversational memory dataset โ€” with zero LLM API calls required. ### What is LongMemEval? [LongMemEval](https://huggingface.co/datasets/xiaowu0162/longmemeval) is a benchmark dataset of 500 single-session questions designed to evaluate memory retrieval systems on rMedium4/8/2026
v10.33.0## What Changed This release resolves two production-quality issues in `SqliteVecMemoryStorage` that were exposed under concurrent async load. ### Changed - **Wrap all remaining direct SQLite calls in `_execute_with_retry`** ([#663](https://github.com/doobidoo/mcp-memory-service/pull/663), fixes [#637](https://github.com/doobidoo/mcp-memory-service/issues/637)): Eliminated ~119 direct `self.conn.execute()` / `executemany()` / `commit()` calls in async methods. All DB operations now run via `aMedium4/6/2026
v10.32.0## Special Thanks This release is entirely the work of community contributors: **[@Lobster-Armlock](https://github.com/Lobster-Armlock)** โ€” Transport `/health` endpoint and configurable uvicorn timeouts (PR #656). Brings first-class production observability to SSE and Streamable HTTP transports. **[@irizzant](https://github.com/irizzant)** โ€” Optional DCR registration key protection (PR #657). Adds security hardening to the OAuth Dynamic Client Registration endpoint while maintaining full backMedium4/6/2026
v10.31.2## Bug Fixes Three community-contributed fixes from @lawrence3699: - **Consistent metadata parsing in SQLite-Vec** (#648): Replaced remaining bare `json.loads` calls in `get_largest_memories()` and `get_graph_visualization_data()` with `_safe_json_loads` helper, ensuring consistent error handling for malformed metadata across all storage methods. - **Handle non-JSON error responses in HTTP client and embedding API** (#649): Wrapped `response.json()` calls on error paths in `http_client.py` anMedium4/3/2026
v10.31.1## Bug Fix: store() after delete() of same content This patch release fixes a regression where soft-deleted memories left a tombstone row that prevented the same content from being re-stored. ### Fixed - **[#644] `store()` fails with UNIQUE constraint after `delete()` of same content**: Soft-deleted memories leave a tombstone row (`deleted_at` set) that caused `INSERT OR IGNORE` to silently drop re-insertions and `INSERT` to raise `UNIQUE constraint failed`. Fixed by adding `_purge_tombstone(Medium3/31/2026
v10.31.0## What's New ### P4 Harvest Evolution (#641) - **Evolve instead of duplicate:** Before storing a harvested memory, checks semantic similarity against existing active memories. If match > 0.85, evolves via `update_memory_versioned()` instead of creating a new duplicate. - New config: `MCP_HARVEST_SIMILARITY_THRESHOLD` (default 0.85), `MCP_HARVEST_MIN_CONFIDENCE_TO_EVOLVE` (default 0.3) - `harvest_config_from_env()` factory function for environment variable overrides - 9 new tests ### Sync-in-AMedium3/31/2026
v10.30.0## Memory Evolution โ€” P1 + P2 + P3 This release introduces a complete Memory Evolution system: memories can now be updated without destroying history, grow stale over time with configurable decay, and automatically detect contradictions with each other. --- ### Added **P1: Non-destructive Versioned Updates** - `update_memory_versioned()` creates a child node from an existing memory via SAVEPOINT-atomic operation, marking the parent as `superseded_by` the new version - Schema migration `011_mMedium3/30/2026
v10.29.1## Fixed - **[#632] Clean up orphaned graph edges on memory deletion**: Graph edges are now removed when memories are deleted via `delete()`, `delete_by_tag()`, and `delete_by_tags()`. The consolidation forgetting phase also performs periodic orphan pruning. ## Documentation - Troubleshooting additions: pre-commit hook PATH, editable install switching, Cloudflare 401 memory-first diagnosis - Bootstrap `instincts/learned.instincts.yaml` with 4 session-derived instincts ## Tests - +5 regressiMedium3/29/2026
v10.29.0## What's New in v10.29.0 This is a MINOR release adding an optional LLM-based classification layer to the session harvest tool. ### Added **[#628] LLM-based classification layer for `memory_harvest` (Phase 2)** The `memory_harvest` MCP tool now accepts an optional `use_llm` boolean parameter. When enabled, extracted memories are routed through a new `_GroqClassifierBridge` that calls the Groq API for higher-precision category labels โ€” especially valuable for nuanced or multi-topic memories Medium3/29/2026
v10.28.5## Bug Fix: MCP_ALLOW_ANONYMOUS_ACCESS=true ignored in dashboard Fixes #621 โ€” when `MCP_ALLOW_ANONYMOUS_ACCESS=true` was set, the dashboard still showed a login prompt instead of granting access. This was a regression introduced during the OAuth middleware refactor where the anonymous path granted only `read` scope, which was insufficient for the dashboard's write-level auth check. ### What Changed - **OAuth middleware**: Anonymous users now receive `read write` scope when `MCP_ALLOW_ANONYMOUMedium3/29/2026
v10.28.4## Security Fixes This patch release addresses two CVEs via dependency upgrades and one CodeQL finding via import cleanup. ### Dependabot Alerts Closed - **CVE-2026-34073** โ€” `cryptography` bumped from 46.0.5 to **46.0.6**: Fixes incomplete DNS name constraint enforcement for wildcard DNS SANs. Credit to Oleh Konko (1seal) for the report. Dependabot alert #68 (low severity). ([#622](https://github.com/doobidoo/mcp-memory-service/pull/622)) - **CVE-2026-34043** โ€” `serialize-javascript` bumped Medium3/29/2026
v10.28.3## What's Changed ### Fixed - **[#619] Accept 'content' as alias for 'query' in HTTP MCP endpoint** โ€” Claude Code sends `{content: "search terms"}` via HTTP transport but the handler only read `arguments.get("query")`, causing `retrieve_memory` and `recall_memory` to always return empty results via HTTP. Now accepts both parameter names. (reported by @pablo-garcia-asesorti) **Full Changelog**: https://github.com/doobidoo/mcp-memory-service/compare/v10.28.2...v10.28.3Medium3/26/2026
v10.28.2## What's Changed ### Fixed - **Tune relationship inference for real-world memory distribution** โ€” Knowledge graph relationships went from 99.5% "related" to 93.5% typed labels (follows, supports, contradicts) - Lowered thresholds: min_typed_confidence 0.75โ†’0.50, min_typed_similarity 0.65โ†’0.45 - Expanded type patterns to cover `note`, `reference`, `document`, `configuration` (previously missed 85%+ of memories) - Accept shared tags as domain overlap signal (not just keyword overlap) - AMedium3/26/2026
v10.28.1## What's Changed ### Fixed - **fix(harvest): filter system prompts, skill outputs, and long injected content** โ€” Reduces false positives in session harvest by skipping `<system-reminder>`, `<command-name>`, `<ide_opened_file>` tags and text blocks >2000 chars. 3 new tests. **Full Changelog**: https://github.com/doobidoo/mcp-memory-service/compare/v10.28.0...v10.28.1Medium3/26/2026
v10.28.0## What's Changed ### Added - **[#615] Session Harvest โ€” extract learnings from Claude Code transcripts** (closes #596) New `memory_harvest` MCP tool that parses Claude Code JSONL session transcripts and auto-extracts decisions, bugs, conventions, and learnings using pattern-based extraction with confidence scoring. Dry-run mode enabled by default. 27 new tests. ### Dependencies - **[#614] bump requests 2.32.5 โ†’ 2.33.0** โ€” security fix for CVE-2026-25645 - **[#616] bump pypdf 6.9.1 โ†’ 6.9.2**Medium3/26/2026
v10.27.0## What's Changed ### Fixed - **[#612] Tolerate missing index in external embedding responses** โ€” Community contribution by @qq540491950. The external embedding client now falls back to positional ordering when providers omit the `index` field, improving compatibility with self-hosted embedding APIs (Ollama, vLLM, etc.). ### Documentation - **Add real-world self-hosted Docker + Cloudflare deployment example** โ€” Complete end-to-end deployment walkthrough covering Docker Compose, Cloudflare D1 +Medium3/25/2026
v10.26.9## Changes ### Refactored - **Fix N+1 query in update_memories_batch** โ€” The batch update method issued a separate SELECT per memory to fetch \`updated_at\`; it now includes \`updated_at\` in the initial bulk SELECT, eliminating the N+1 query pattern and reducing database round-trips proportionally to batch size. - **Simplify _get_memory_age_days** โ€” Replaced explicit conditional logic with a concise \`max(filter(None, ...))\` expression, improving readability while preserving correct behaviouMedium3/24/2026
v10.26.8## What's Changed Six targeted bug fixes across consolidation, embedding cache, and memory type handling. ### Fixed - **[#603] Fix invalid memory_type "learning_note" in learning_session prompt**: The `create_learning_session` prompt handler was emitting `memory_type: "learning_note"`, which is not a valid type in the memory schema. Changed to `"learning"` so sessions are correctly classified and retrievable by type filter. - **[#604] Remove memory.touch() call from update_memory_relevance_meMedium3/24/2026
v10.26.7## ๐Ÿ™ Special Thanks **[@Lyt060814](https://github.com/Lyt060814) (Yitong Li)** โ€” This release is entirely the work of Yitong, who identified and fixed a subtle Cloudflare D1 behavior that broke schema initialization on brand-new databases. Thank you for the careful diagnosis, clean fix, and regression test! ## Changes ### Fixed - **[#601] Cloudflare D1 schema initialization fails on fresh database (issue #600)**: On a brand-new Cloudflare D1 database, `PRAGMA table_list` returns a success rMedium3/23/2026
v10.26.5Security patch: bump `black` dev dependency to >=26.3.1 (GHSA-3936-cmfr-pm3m, CVE-2026-32274, High) ## Security Fix **black path traversal via --python-cell-magics (GHSA-3936-cmfr-pm3m, CVE-2026-32274, High)** The `black` code formatter contained a path traversal vulnerability via the `--python-cell-magics` option that could allow an attacker to write files outside the intended directory when `black` was invoked on maliciously crafted input. **Impact:** Development and CI environments only. Low3/13/2026
v10.26.4## Special Thanks **[@xXGeminiXx](https://github.com/xXGeminiXx)** โ€” Fixed a long-standing silent regression where the FTS5 virtual table was not created when upgrading pre-v10.8.0 databases, causing BM25+vector hybrid search to silently fall back to vector-only. **[@jeremykoerber](https://github.com/jeremykoerber)** โ€” Tracked down and fixed 9 bugs in the dashboard auth lifecycle, resolving persistent API key loss, 401 spam, SSE leaks, and more. --- ## [10.26.4] - 2026-03-12 ### Fixed - **Low3/12/2026
v10.26.3## Special Thanks **[@lukyrys](https://github.com/lukyrys)** โ€” This release consists entirely of fixes contributed by @lukyrys: dashboard metadata rendering, modal UX improvements, and quality scorer resilience. Excellent work identifying and resolving these user-facing issues! --- ## What's Changed ### Fixed - **Dashboard: metadata object values now rendered as JSON** (#582): Metadata values that are objects (or arrays of objects) were previously displayed as `[object Object]`. They are noLow3/10/2026
v10.26.2## What's Changed ### Fixed - **[#576] OAuth token exchange fails with 500 for public PKCE clients** (`authorization.py`): claude.ai and other MCP clients that use OAuth 2.1 public-client PKCE flow (no `client_secret`) received a `500 Internal Server Error` during token exchange. The endpoint now detects public clients โ€” requests supplying a `code_verifier` but no `client_secret` โ€” and skips secret authentication, using the PKCE verifier as identity proof per OAuth 2.1 ยง2.1. Confidential clienLow3/8/2026
v10.26.1## What's Changed ### Fixed - **[#570] Hybrid backend misidentified as sqlite-vec in `memory_health`**: `HealthCheckFactory` relied solely on the storage object's class name to select the health-check strategy. When the hybrid backend's storage is accessed through a delegation or wrapper layer the class name is not `HybridMemoryStorage`, so the factory fell back to the sqlite-vec strategy and reported `"sqlite-vec"` instead of `"hybrid"`, hiding Cloudflare sync status from users. The factory nLow3/8/2026
v10.26.0## Summary This release brings a major dashboard upgrade: a new Credentials tab lets you manage Cloudflare credentials directly from the Settings modal without editing config files. A new Sync Owner setting (`MCP_HYBRID_SYNC_OWNER`) lets HTTP server own all Cloudflare sync, removing the need for a Cloudflare token in the MCP server config. ## Added - **Credentials tab in Settings modal** (`GET /api/config/credentials`, `POST /api/config/credentials/test`, `POST /api/config/credentials`): ManaLow3/7/2026
v10.25.3## [10.25.3] - 2026-03-07 ### Fixed - **Strict stdio eager-init timeout cap** โ€” Caps eager storage initialization to 5.0s for non-LM-Studio stdio clients (Claude Desktop, Codex CLI), preventing MCP handshake timeouts (#569, fixes #561) - **Syntax errors in timeout cap** โ€” Fixed duplicate `detect_mcp_client_simple()` call, orphaned closing paren, duplicate return statement from PR #569; extracted named constants, fixed dead-code guard, clarified warning messages ### Changed - **gitignore TLS ceLow3/7/2026
v10.25.2## Fixed - **Health check in `update_and_restart.sh` always reported "unknown" version**: The `/api/health` endpoint was stripped of its `version` field in v10.21.0 (security hardening GHSA-73hc-m4hx-79pj). The update script still tried to read `data.get('version')`, causing it to always fall back to "unknown" and wait the full 15-second timeout before giving up. The check now reads the `status` field (`"healthy"`) to confirm the server is up, and reports the already-known pip-installed versionLow3/7/2026
v10.25.1## Security Fixes ### GHSA-g9rg-8vq5-mpwm โ€” Wildcard CORS Default (HIGH) **Impact:** When HTTP server is enabled with anonymous access, the default wildcard CORS configuration (`*`) allowed any website to silently read, modify, and delete all stored memories via cross-origin JavaScript requests. **Fix:** - `MCP_CORS_ORIGINS` now defaults to `http://localhost:8000,http://127.0.0.1:8000` instead of `*` - `allow_credentials` is automatically set to `False` when wildcard origins are configured - Low3/6/2026
v10.25.0## ๐Ÿ™ Special Thanks This release is entirely the work of **[@chriscoey](https://github.com/chriscoey)**, who contributed 5 meticulously researched and well-tested PRs in a single day. Each one identified real bugs through careful code reading โ€” not just surface-level fixes but root-cause analysis with regression tests proving the fix. Outstanding community contribution. --- ## What's Changed This release consolidates 5 high-quality PRs from [@chriscoey](https://github.com/chriscoey) that fiLow3/6/2026
v10.24.0## What's Changed ### Bug Fixes - **[#551] Fix external embedding API silent fallback** (PR #554): When an external embedding provider (vLLM, Ollama, TEI, OpenAI-compatible) returned an error during startup or embedding generation, `sqlite_vec.py` silently fell back to the local ONNX model. This mixed two incompatible vector spaces in the same database, causing all subsequent semantic searches to return incorrect or irrelevant results โ€” with no warning to the user that anything was wrong. *Low3/5/2026
v10.23.0## What's Changed ### Fixed - **[#544] Missing `import asyncio` in `ai_evaluator.py`**: `NameError` crashed batch quality scoring for all users without ONNX Runtime installed, leaving 41%+ of memories unscored. - **[#545] Consolidator used invalid `memory_type="association"`** (not in ontology) and omitted `skip_semantic_dedup=True`, causing templated association content to be rejected as duplicates; store() failure reason now captured and logged instead of discarded. ### Added - **[#546] `MLow3/5/2026
v10.22.0## Summary Three targeted fixes to the consolidation engine that resolve crashes, data corruption, and accuracy issues encountered during repeated consolidation cycles. ## Fixed ### memory_consolidate status KeyError on empty statistics dict (closes #542) The `memory_consolidate` MCP tool's `status` action raised `KeyError` when the consolidation engine returned an empty or partial `statistics` dict โ€” a common state during the first run or immediately after a reset. All dict lookups in the sLow3/5/2026
v10.21.1## Security This patch release resolves 5 CodeQL code scanning alerts that were introduced in recent development work. ### CodeQL Alerts Resolved **`py/unused-import` โ€” alerts #359, #360, #361** - Removed unused `os` import from `src/mcp_memory_service/mcp_server.py` - Removed unused `platform` import from `src/mcp_memory_service/web/api/health.py` - Removed unused `Path` import from `src/mcp_memory_service/utils/http_server_manager.py` **`py/empty-except` โ€” alert #358** - Fixed bare `pass` Low3/5/2026

Dependencies & License Audit

Loading dependencies...

Similar Packages

mcp-rag-agent๐Ÿ” Build a production-ready RAG system that combines LangGraph and MCP integration for precise, context-aware AI-driven question answering.main@2026-06-06
agentic-ai๐Ÿค– Explore AI agent architectures with agentic-ai, featuring ReAct agents, reflection-based designs, and modular LLM integrations using LangChain and LangGraph.main@2026-06-05
consolidation-memoryStore, consolidate, and recall coding agent memories with provenance tracking using SQLite and FAISS for fast, structured knowledge access.main@2026-06-03
Awareness-SDKLocal-first AI agent memory โ€” one command, 13+ IDEs, works offline. Persistent memory for Claude Code, Cursor, Windsurf, OpenClaw. Zero-code interceptors for OpenAI/Anthropic. Python & TypeScript SDKsmain@2026-05-04
AI-Agents-Orchestrator๐Ÿชˆ Intelligent orchestration system that coordinates multiple AI coding assistants (Claude, Codex, Gemini CLI, Copilot CLI) to collaborate on complex software development tasks via REPL or a Vue/Nuxt v1.0.0

More from doobidoo

MCP-Context-ProviderA static MCP server that provides AI models with persistent tool context, preventing context loss between chats.

More in MCP Servers

node9-proxyThe Execution Security Layer for the Agentic Era. Providing deterministic "Sudo" governance and audit logs for autonomous AI agents.
claude-plugins-officialOfficial, Anthropic-managed directory of high quality Claude Code Plugins.
langchain4jLangChain4j is an open-source Java library that simplifies the integration of LLMs into Java applications through a unified API, providing access to popular LLMs and vector databases. It makes impleme
hyperframesWrite HTML. Render video. Built for agents.