Name: Second Brain
Author: ara-5

Second Brain MCP

Shared Graph-RAG memory for AI agents: markdown vault, wikilink recall, tasks, messaging.

Grade A Local · stdio No auth needed 12 tools v1.7.1 MIT

No reviews yet by ara-5npm 1,121 Runs on your machine, nothing hosted

93/100

trust score

707

downloads a day

local

runs on your machine

downloads in 30d

What it does

Shared Graph-RAG memory for AI agents: markdown vault, wikilink recall, tasks, messaging.

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user ara-5-second-brain-mcp '--' npx -y mind-mri-second-brain

# 2 — ask your agent for something these tools do
#   brain_recall, brain_remember, brain_search and 9 more

Second Brain costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publishernot claimed

ara-51 server

1 category

All 1 server

Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.

Installation

Where are you running it?

Every route below installs the same thing and ends at the same approval screen. This one runs on your machine: your client starts Second Brain as a process under your own user, with your files and your network, so the tool surface below is what it can do to your computer rather than to a server somewhere else. Its scan result is on the Security tab — read the surface before you approve it.

Claude Codedeclared by this listing

This is a public server: you run it yourself and this marketplace is not in the path. You need Node.js — the current LTS (24) is the safe choice; npx comes with it. Claude Code registers it in one command; --scope user makes it available in every project. The '--' is in quotes so that PowerShell passes it on.

claude mcp add --scope user ara-5-second-brain-mcp '--' npx -y mind-mri-second-brain

Reconnect, or start a new session, and the tools appear in the model’s tool list.

Free on mcprush, and it runs from its publisher’s own package: this marketplace is not in the path, so there is no key of ours to hold and no card to add.

What it asks of you

Nothing is required, but it can take BRAIN_VAULT (Folder holding the markdown vault. Defaults to ~/.second-brain/vault when installed from npm.), BRAIN_PORT (Port of the local API server the MCP server starts and talks to (default 3747).), BRAIN_KEY (Optional API key; when set the local API requires it as a Bearer token.) if you want to set them.

What it writes

One config entry your client uses to start the process locally. A local server runs with your file system and your network, which is why it is priced without metering.

What you approve

12 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

Read from its source code. A server that builds its tool list when it starts can list more tools than this.

Recall relevant memory for a query from the shared Second Brain vault. It finds the best-matching notes (keyword and recency, plus semantic similarity when embeddings are configured), then follows their [[wikilinks]] outward for the requested number of hops, and packs the result into a token…

Parameter	Type	Required	Notes
query	string	yes	What you need to know, in plain words, e.g. "why did we choose SQLite for the cache". Specific queries recall better than broad ones.
hops	integer	no	How many [[wikilink]] steps to follow from the matching notes. 0 = matches only; 1 (default) adds directly linked notes; values above 3 are capped at 3.
maxTokens	integer	no	Token budget for the returned context. Notes that do not fit are left out. Values above 8000 are capped at 8000.

Write a new memory/research note into the shared Second Brain vault so future sessions, in this or any other project, can recall it later. Only for a genuine, reusable learning: a fact, pattern, constraint or decision that would change future behavior or save someone from re-deriving it. Not for…

Parameter	Type	Required	Notes
title	string	yes	Specific, searchable title that becomes the note's filename, e.g. "Decision - Use SQLite for the cache". Must not contain : / \ ? * " < > \| , start or end with a space, or end with a period; invalid t
content	string	yes	Markdown body. Link related notes with [[Note Title]] so recall can follow the graph. Never include secrets, credentials or personal data: notes are plain files and may be synced to git.
type	string	no	Kind of note: decision (a choice and its reason), insight (a non-obvious finding or fix), research (gathered findings), memory (general fact), note (anything else).
tags	array	no	Short lowercase labels, e.g. ["database", "cache"]. Used by search and filtering.
agent	string	no	Name of the calling project or agent; the note is stored under agents/<agent>/, which keeps each project's notes together. Same filename rules as title, so no slashes. If omitted, the note is stored a
importance	integer	no	How long the note stays prominent in recall, 1 to 10. Recency only re-ranks, so old notes are never hidden, but 8-10 fades over months, 5-7 (default) over weeks, and 1-4 within days.

Search the vault for notes matching a query: keyword search over titles, tags and content, combined with semantic similarity when embeddings are configured, then lightly re-ranked by recency. Use it to check whether a note already exists (before brain_remember) or to find a note id for…

Parameter	Type	Required	Notes
query	string	yes	Words to look for, e.g. "sqlite cache decision". Matches titles, tags and note text.
limit	integer	no	Maximum number of results to return (default 10).

Fetch one note by id (this also works for task and message notes, for example to read a single task in full): its full markdown content, metadata (type, tags, agent, importance, version, dates), the notes it links to (outLinks) and the notes that link to it (inLinks). Read-only. Use it to read a…

Parameter	Type	Required	Notes
id	string	yes	Note id exactly as returned by brain_search, brain_recall or brain_remember: the path inside the vault without ".md", e.g. "agents/atlas/Decision - Use SQLite for the cache".

Add a task to the shared, markdown-backed task queue so another agent (or a later session) can pick it up. A task with dependencies starts as "blocked" and moves to "pending" automatically when all of them complete; otherwise it starts as "pending". This only records the task: it is a coordination…

Parameter	Type	Required	Notes
prompt	string	yes	Complete, self-contained description of the work to be done.
title	string	no	Short title. If omitted, one is made from the first 60 characters of the prompt, prefixed "Task - ".
agents	array	no	Names of the agents this task is for, e.g. ["reviewer"]. Defaults to ["coordinator"].
priority	integer	no	Urgency, 1 (lowest) to 10 (highest).
dependencies	array	no	Node ids (nodeId values returned by earlier brain_tasks_submit calls) that must complete first.

List the tasks in the shared queue, optionally only those in one state. Use status "pending" to find work waiting for you, "blocked" to see what is waiting on dependencies. Read-only. Returns every matching task with no pagination and no guaranteed order: { count, tasks: [{ id, title, tags,…

Parameter	Type	Required	Notes
status	string	no	Only return tasks in this state. Omit to list all tasks.

Change the status of a task and, optionally, record its outcome. Use it to claim a task ("running"), finish it ("completed" or "failed") or withdraw it ("cancelled"). Completing a task releases the tasks that were blocked on it: once all the dependencies of a blocked task are completed it becomes…

Parameter	Type	Required	Notes
id	string	yes	Task note id: the id field from brain_tasks_list, or the nodeId returned by brain_tasks_submit, e.g. "tasks/Task - Review the migration".
status	string	yes	The new state. Use "running" when you start, "completed" or "failed" when you finish.
result	string	no	What was done or why it failed, in markdown. Stored in the Final Result section of the task. Omit to change only the status.

Send a message to another agent's inbox. The recipient reads it with brain_messages_get and clears it with brain_messages_mark_read. Use it for short hand-off context that does not belong in a task or a permanent note. Nothing is delivered in real time: the recipient has to check its inbox. Any…

Parameter	Type	Required	Notes
toAgent	string	yes	Recipient agent name, e.g. "reviewer". Inbox names are matched case-insensitively with spaces treated as hyphens. No slashes or other filename-invalid characters.
fromAgent	string	no	Sender name so the recipient knows who wrote. Recorded as "unknown" if omitted.
content	string	yes	The message body (markdown).
subject	string	no	Short subject line. Defaults to "Message from <fromAgent>".

Read the messages addressed to an agent: unread ones by default, or the full history with unread set to false. Read-only: it does not mark anything as read; call brain_messages_mark_read with each message id once handled. All matching messages are returned at once, with no pagination and no…

Parameter	Type	Required	Notes
agent	string	yes	Whose inbox to read, using the name senders used as toAgent (case-insensitive, spaces treated as hyphens).
unread	boolean	no	true (default) returns only unread messages; false returns every message including read ones.

Mark one message as read so it no longer appears in the default (unread) inbox from brain_messages_get. Call it after you have handled a message. Safe to repeat: marking an already-read message again changes nothing. The message stays in the vault and in the full history. Returns { success: true,…

Parameter	Type	Required	Notes
id	string	yes	Message note id exactly as returned in the id field by brain_messages_get, e.g. "messages/qa-agent/[MSG] Question".

Update an existing note in place instead of creating a near-duplicate. mode "append" (default) adds your text to the end and keeps everything already there; mode "replace" overwrites the whole body, so only use it when you have the full corrected text (read it with brain_node_get first). Tags and…

Parameter	Type	Required	Notes
id	string	yes	Note id exactly as returned by brain_search, brain_recall or brain_remember, e.g. "agents/my-project/Decision - Use SQLite".
content	string	no	In append mode, the text to add after the existing body. In replace mode, the complete new body (it overwrites everything, so include whatever you want to keep). Omit to change only tags or importance
mode	string	no	"append" (default) keeps the existing text and adds yours at the end. "replace" overwrites the whole body: read the note first with brain_node_get.
tags	array	no	The note's new complete tag list; it replaces the old tags rather than adding to them.
importance	integer	no	New importance, 1 to 10 (see brain_remember).

Check that the Second Brain server is running and get basic vault statistics: status, version, and how many notes (nodeCount) and links (edgeCount) the vault holds. Read-only and cheap. Call it first if another tool fails with a connection error, or to confirm the memory is connected. The server…

No parameter schema on file.

Free

$0 forever

Every tool, no call limit
No card, and mcprush charges nothing for it
Source published under MIT
Runs on your machine — nothing of it reaches our gateway
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install Second Brain or to call it, at any volume.

ATrust score 93 / 100

Release 1.7.1 · scanned 4 Nov 2026

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score94

Client score93

Findings8 threat · 0 capability

Capabilityminimal

Coveragesource

Verificationrepo

Surface digest178369829e49795347c9c332562c721a4353f14183e40565e7080b9a89da416e

Score vectorthreat 94 → client 93

Term	Level	What it prices	Points
capability-exposure	minimal	capability blast radius (minimal) — client exposure if the model is manipulated	−0
verification-discount	repo	publisher verification (public source) — no provenance, but the source is public and inspectable	−1
coverage-honesty	source	inspection depth (source) — how much of the target the scan could see	−0

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

Tool surfaceread

Implementation sourceread

Package metadataread

Live transportnot available

Tools were statically extracted from the published source (11 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. minimal is the level these add up to.

Tool	Capability tags	Why the tag was assigned
brain_recall	no tags
brain_search	no tags
brain_node_get	untrusted-input	untrusted-input: keyword "fetch"
brain_tasks_submit	no tags
brain_tasks_list	no tags
brain_tasks_update	no tags
brain_messages_send	no tags
brain_messages_get	no tags
brain_messages_mark_read	untrusted-input	untrusted-input: keyword "read_message"
brain_node_update	no tags
brain_health	no tags

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

The public result for this release does not print the flow graph, so there is nothing to show here. That is not the same as "no paths were found": what the scan did read is above, under coverage.

Supply chain and provenance

Integrityfirst-seen

Surface digest178369829e497953

Scanned2026-11-04

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.