registry / @agentmemories/mcp / 0.1.7

@agentmemories/mcp@0.1.7

Universal AI-agent memory — MCP client for agent-memories server

AI Security Review

scanned 19h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. An explicit installer command copies this package's agent skill into detected third-party agent skill directories. At runtime, the MCP server forwards user/agent memory operations to its configured backend; no unconsented install-time execution is present.

Static reason

No blocking static signals were detected.

Trigger

User runs npx @agentmemories/mcp install, or configures and starts the MCP server.

Impact

Installed instructions can cause agents to proactively send task memory to the configured service.

Mechanism

Explicit AI-agent skill installation and authenticated MCP-to-HTTP memory proxying.

Rationale

No concrete malware behavior or unconsented lifecycle mutation was found. The explicit cross-agent skill installation and proactive remote memory capability meet the policy threshold for a warning.

Evidence

package.jsondist/cli.jsSKILL.mdreferences/~/.claude/skills/agent-memories/~/.cursor/skills/agent-memories/~/.omp/agent/skills/agent-memories/~/.agents/skills/agent-memories/

Network endpoints1

memories.agent-memories.com

@agentmemories/mcp@0.1.7

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code