Query Markup Documents - On-device hybrid search for markdown files with BM25, vector search, and LLM reranking
Nothing to run from here
HippoMCP is installed from its publisher's own source and answers where it runs, so this marketplace is not in the path of a single call. There is no address here to send one to, and a panel that pretended otherwise would be showing you an answer we made up. Install it and call it from your own client — the Installation tab has the entry for each one.
94/100
trust score
1
downloads a day
local
runs on your machine
119
downloads in 30d
What it does
MCP-native long-term memory for AI agents: local-first, pip-installable, native Chinese support
Quickstart
# 1 — add it to Claude Code
claude mcp add --scope user hippomcp '--' uvx hippocampus-mcp
# 2 — ask your agent for something these tools do
# store_memory, recall, get_memory and 45 more
HippoMCP costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.
Publishernot claimed
CSAll 1 server
cstksniper1 server
1 category
Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.
Installation
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. This one runs on your machine: your client starts HippoMCP as a process under your own user, with your files and your network, so the tool surface below is what it can do to your computer rather than to a server somewhere else. Its scan result is on the Security tab — read the surface before you approve it.
Claude Codedeclared by this listing
This is a public server: you run it yourself and this marketplace is not in the path. You need uv (docs.astral.sh/uv): uvx comes with it. Claude Code registers it in one command; --scope user makes it available in every project. The '--' is in quotes so that PowerShell passes it on.
claude mcp add --scope user hippomcp '--' uvx hippocampus-mcpReconnect, or start a new session, and the tools appear in the model’s tool list.
Free on mcprush, and it runs from its publisher’s own package: this marketplace is not in the path, so there is no key of ours to hold and no card to add.
What it writes
One config entry your client uses to start the process locally. A local server runs with your file system and your network, which is why it is priced without metering.
What you approve
48 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
Read from its source code. A server that builds its tool list when it starts can list more tools than this.
Bare single-fact write WITHOUT provenance; prefer ingest (L0 + entities + dedup). Args: content, importance 0-1, memory_type, idem_key.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| content | string | yes | — |
| importance | number | no | — |
| memory_type | string | no | — |
| library | string | no | — |
| idem_key | string | no | — |
Hybrid retrieval: vector + BM25 (RRF fusion) + MMR + entity bonus, hard relevance floor; shared scoring pipeline (R1). HIPPOCAMPUS_RECALL_FUSION=0 restores the legacy additive path.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| query | string | no | natural sentence (Chinese OK). top_k: max entries (default 5). |
| top_k | integer | no | — |
| use_lnn | boolean | no | — |
| sample | boolean | no | — |
| filter_tags | string | no | JSON object, narrows BEFORE retrieval, e.g. {"chapter": 43}. |
| library | string | no | — |
| scope | string | no | project (default) | user | all; libraries='a,b' fans out to <=4 named libraries (mutually exclusive with scope=user/all). |
| libraries | string | no | — |
| occurred_after | string | no | — |
| occurred_before | string | no | — |
Fetch one memory by exact ID.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| memory_id | string | yes | — |
| library | string | no | — |
| include_history | boolean | no | — |
Update only the provided fields of one memory (locate the id via recall). To retire an outdated fact: write the new version via ingest, then state='superseded' + superseded_by=<new id> (the result echoes this chain). clear_quarantine is a home-session-managed promotion.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| memory_id | string | yes | — |
| content | string | no | — |
| importance | number | no | — |
| memory_type | string | no | — |
| state | string | no | — |
| superseded_by | string | no | — |
| clear_quarantine | boolean | no | — |
| library | string | no | — |
Batch-update tags on existing memories.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| tags | string | no | JSON object of tag key/value updates. |
| clear_keys | string | no | JSON array of tag keys to remove. |
| source | string | no | — |
| source_contains | string | no | — |
| contains | string | no | — |
| state | string | no | — |
| untagged_only | boolean | no | Restrict the operation to records with no tags. |
| missing_keys | string | no | JSON array of keys that must be removed if present. |
| memory_ids | string | no | JSON array restricting the operation to specific memories. |
| mode | string | no | — |
| dry_run | boolean | no | Preview the plan without writing; default true. |
| limit | integer | no | — |
| confirm | boolean | no | Required confirmation when the operation exceeds the safety threshold. |
| undo | string | no | Undo a previous operation by ledger `op_id or "last"`. |
| library | string | no | — |
Delete one memory by id: cascade (entity index, L3 derivatives, tombstone). DESTRUCTIVE - confirm the id via recall first; prefer state='superseded' for corrections.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| memory_id | string | yes | — |
| reason | string | no | — |
| library | string | no | — |
Find and optionally delete memories matching a query.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| query | string | yes | Query text used to locate candidates. |
| top_k | integer | no | Maximum candidates to inspect; default 3. |
| dry_run | boolean | no | When true, return candidates only; default true. |
| min_similarity | number | no | — |
| allow_multiple | boolean | no | — |
| library | string | no | — |
List raw entries with metadata (source/state filters); audit path - recall is the search entry. Args: limit, source, state.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| limit | integer | no | — |
| source | string | no | — |
| state | string | no | — |
| library | string | no | — |
List known source labels and record counts.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| library | string | no | — |
Reset the LNN temporal context for the current library.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| library | string | no | — |
Return basic service/library statistics.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| library | string | no | — |
Persist the current library state.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| library | string | no | — |
Retry the most recent failed save.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| library | string | no | — |
Reload persisted state from disk.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| library | string | no | — |
RECOMMENDED write entry: raw text -> L0 archive + extracted L1 facts + entity links; dedup, supersede detection, idem_key retries. Use for "remember this".
| Parameter | Type | Required | Notes |
|---|---|---|---|
| text | string | yes | verbatim. speaker: user|assistant|role. importance: -1 = auto. |
| speaker | string | no | — |
| importance | number | no | — |
| cognitive_type | string | no | experience|world|opinion (blank = auto). entities: comma list. |
| entities | string | no | — |
| source | string | no | origin label. tags: JSON object. idem_key: same key on retry = no duplicate. |
| tags | string | no | — |
| auto_tags | boolean | no | — |
| library | string | no | — |
| idem_key | string | no | — |
Ingest multiple texts in one call.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| items | string | yes | — |
| source | string | no | — |
| tags | string | no | — |
| granularity | string | no | — |
| detect_supersede | boolean | no | — |
| save | boolean | no | — |
| auto_tags | boolean | no | — |
| library | string | no | — |
Five-slot assembled context (hits / open todos / timeline / entity state / unfinished topics) under a char budget. For "what should I know right now"; point lookups use recall.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| query | string | no | empty = pinned brief. top_k: hit count. token_budget: whole-block chars (coarse). item_max_chars: per-line clip, 0 = off (numeric tails survive). |
| top_k | integer | no | — |
| token_budget | integer | no | — |
| item_max_chars | integer | no | — |
| filter_tags | string | no | JSON object. scope: project | user only (no all). |
| library | string | no | — |
| scope | string | no | — |
Open a session; return the pre-activation package (pins, profile, open topics, intents, task recall, receipt). Call at session start or after compaction - on compaction keep ONLY the receipt identity and call again. Check active_sessions before editing files.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| task | string | no | drives pre-recall and write attribution. working_on: module/file. |
| recent_limit | integer | no | — |
| working_on | string | no | — |
| task_top_k | integer | no | — |
| pin_limit | integer | no | — |
| filter_tags | string | no | — |
| client | string | no | — |
| library | string | no | — |
| user_scope | integer | no | — |
| task_directory | integer | no | — |
Export memories without vectors for backup or migration.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| since_ts | number | no | Only records with timestamp >= this Unix time; 0 means all. |
| source | string | no | Exact source filter. |
| state | string | no | `active, superseded, archived`, or empty for all. |
| limit | integer | no | Maximum records; 0 means unlimited. |
| library | string | no | Optional library override. |
Close THIS session: L2 summary, profile update, consolidate trigger, forced save.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| summary | string | no | one line. open_topics: unfinished topics (array or comma string). |
| open_topics | string/array | no | — |
| close_topics | string/array | no | topics to close (exact text). client: caller id. |
| session_id | string | no | — |
| client | string | no | — |
| library | string | no | — |
Register a todo/intent for future sessions.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| text | string | yes | What should be done. |
| due | string | no | Optional due date/deadline. |
| library | string | no | — |
Mark a todo/intent complete by keyword.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| keyword | string | yes | — |
| library | string | no | — |
Report whether a recalled memory was useful.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| memory_id | string | yes | — |
| useful | boolean | no | — |
| library | string | no | — |
Run maintenance/consolidation over the library.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| filter_tags | string | no | JSON object string narrowing the consolidation scope. |
| max_items | integer | no | Maximum items to process; 0 uses the configured limit. |
| dry_run | boolean | no | Report the plan without writing; default false. |
| library | string | no | — |
List candidate pairs where one fact may have two versions.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| limit | integer | no | Maximum candidate pairs; default 10. |
| source | string | no | Optional source filter. |
| filter_tags | string | no | JSON object string narrowing the candidate pool. |
| library | string | no | — |
| plan | boolean | no | Also return a reviewable supersede_plan and a need_human bucket. |
| confirm | string | no | Host-approved plan array (JSON string) to execute in one call. The service never adjudicates; it writes only what was sent. |
Audit memories whose source files may have drifted.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| source | string | no | Specific source to audit; empty audits known sources. |
| limit | integer | no | Maximum detailed rows; default 50. |
| include_ok | boolean | no | — |
| library | string | no | — |
Return the memory profile for one entity.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| entity | string | yes | Entity name or alias. |
| limit | integer | no | Maximum linked memories; default 20. |
| order | string | no | `asc or desc` chronological order. |
| include_superseded | boolean | no | — |
| library | string | no | Optional library override. |
List known entities with optional prefix/count filters.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| prefix | string | no | Optional case-insensitive prefix. |
| limit | integer | no | Maximum entities; default 50. |
| min_mentions | integer | no | Minimum linked-memory count; default 1. |
| trusted_only | boolean | no | — |
| library | string | no | Optional library override. |
Create/update one key in a named information map.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | yes | Map name. |
| key | string | yes | Entry key. |
| status | string | no | Current status/value. |
| fields | string | no | JSON object of additional structured fields. |
| desc | string | no | Human-readable description; used for relevance matching. |
| truth_source | string | no | File/path/system that is authoritative for this entry. |
| note | string | no | Optional note. |
| updated_by | string | no | Who/what made this update. |
| library | string | no | Optional library override. |
Fetch one information-map entry by exact map/key.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | yes | — |
| key | string | yes | — |
| library | string | no | — |
List information maps or all entries in one map.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | no | — |
| library | string | no | — |
Verify information-map entries against their truth sources.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | no | — |
| library | string | no | — |
List derived knowledge topics in the library.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| limit | integer | no | Maximum topics; default 20. |
| include_archived | boolean | no | Include archived topics; default false. |
| library | string | no | Optional library override. |
Read material for, or write/undo, one knowledge topic.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| topic_id | string | no | Topic ID from `knowledge_map`. |
| action | string | no | `brief / summarize / revert`. |
| summary | string | no | Host-written summary for `summarize`. |
| evidence | string | no | JSON array of member memory IDs supporting the summary. |
| limit | integer | no | — |
| topics | string | no | — |
| items | string | no | — |
| batch | integer | no | — |
| per_topic | integer | no | — |
| fras | string | no | Optional four-field structured summary as a JSON object. |
| library | string | no | Optional library override. |
Add trusted entity names/aliases to the library lexicon.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| terms | string | yes | JSON array or comma-separated list. Use `alias => canonical` for aliases. |
| relink | boolean | no | Re-run entity linking after adding terms; default true. |
| library | string | no | Optional library override. |
Suggest high-frequency unregistered names for the lexicon.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| top_n | integer | no | — |
| min_docs | integer | no | — |
| min_files | integer | no | — |
| min_len | integer | no | — |
| max_len | integer | no | — |
| exclude | string | no | — |
| library | string | no | — |
Suggest possible aliases for the same entity.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| top_n | integer | no | — |
| min_confidence | number | no | — |
| min_support | integer | no | — |
| min_lift | number | no | — |
| min_containment | number | no | — |
| allow_stat_only | boolean | no | — |
| exclude | string | no | — |
| cue_words | string | no | — |
| with_paren | boolean | no | — |
| library | string | no | — |
Re-run entity extraction/linking across the library.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| library | string | no | — |
Inspect recent retrieval misses.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| limit | integer | no | Maximum recent misses; default 20. |
| clear | boolean | no | Clear the miss log after reporting; default false. |
| library | string | no | Optional library override. |
Return detailed library/runtime self-report.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| daily_days | integer | no | — |
| library | string | no | — |
Force a save of the current brain/library.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| library | string | no | — |
List discoverable memory libraries.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| include_backups | boolean | no | Include backup/snapshot directories; default false. |
Describe one memory library.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| library | string | no | — |
Which library this session reads/writes (binding self-report). Call when the target library is uncertain; near-zero cost.
Takes no parameters.
Switch this session's sticky library.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| library | string | yes | Library name, alias, `lib_*` ID, or path. |
| client | string | no | Caller identity; required on shared connections. |
Create a new memory library and optionally switch to it.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | yes | Library name. |
| path | string | no | Optional explicit path; omitted uses the configured library root. |
| aliases | string | no | Optional comma-separated aliases. |
| use | boolean | no | Switch the current session to the new library after creation; default true. |
| client | string | no | — |
| workspace_root | string | no | — |
No parameter schema on file.
No parameter schema on file.
Free
$0 forever
- Every tool, no call limit
- No card, and mcprush charges nothing for it
- Source published under MIT
- Runs on your machine — nothing of it reaches our gateway
- Nothing to cap, because mcprush bills nothing
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable: mcprush charges nothing to install HippoMCP or to call it, at any volume.
Call allowance · this installenforced at the gateway
Monthly allowance, in calls
—
—
Alert at 80% · then the tool returns a normal MCP error
Used this month: —
ATrust score 94 / 100
Release 0.2.2 · scanned 9 Nov 2026
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
Threat score100
Client score94
Findings3 threat · 0 capability
Capabilityhigh
Coveragesource
Verificationsource
Surface digest955b8f5b684fa4143f0e4728f8ffd00b8824c5a693642e4298df7148687f1cd9
Score vectorthreat 100 → client 94
| Term | Level | What it prices | Points |
|---|---|---|---|
| capability-exposure | high | capability blast radius (high) — client exposure if the model is manipulated | −6 |
| verification-discount | source | publisher verification (provenance) — cryptographic build provenance ties the artifact to its source | −0 |
| coverage-honesty | source | inspection depth (source) — how much of the target the scan could see | −0 |
score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.
What the scan could actually read
A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.
Tool surfaceread
Implementation sourceread
Package metadataread
Live transportnot available
Tools were statically extracted from the published source (48 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Capability — what it could do if the model were manipulated
Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. high is the level these add up to.
| Tool | Capability tags | Why the tag was assigned |
|---|---|---|
| store_memory | no tags | |
| recall | no tags | |
| get_memory | untrusted-input | untrusted-input: keyword "fetch" |
| update_memory | no tags | |
| update_tags | no tags | |
| forget_memory | no tags | |
| forget_by_query | no tags | |
| list_memories | no tags | |
| list_sources | no tags | |
| reset_context | no tags | |
| get_stats | no tags | |
| save_state | no tags | |
| retry_save | no tags | |
| load_state | no tags | |
| ingest | no tags | |
| ingest_batch | no tags | |
| get_memory_context | no tags | |
| session_start | no tags | |
| export_memories | no tags | |
| session_end | no tags | |
| remember_intent | no tags | |
| complete_intent | no tags | |
| report_feedback | no tags | |
| consolidate | no tags | |
| contradictions | no tags | |
| drift_audit | no tags | |
| entity_profile | no tags | |
| entity_list | no tags | |
| map_set | no tags | |
| map_get | untrusted-input | untrusted-input: keyword "fetch" |
| map_list | no tags | |
| map_verify | no tags | |
| knowledge_map | no tags | |
| knowledge_topic | no tags | |
| lexicon_add | no tags | |
| lexicon_suggest | no tags | |
| lexicon_alias_suggest | no tags | |
| relink_entities | no tags | |
| miss_log | no tags | |
| brain_stats | no tags | |
| save_brain | no tags | |
| library_list | no tags | |
| library_info | no tags | |
| library_whoami | no tags | |
| library_use | no tags | |
| library_create | no tags | |
| hippo_help | no tags | |
| hippo_extra | no tags |
Toxic-flow graph
The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.
The public result for this release does not print the flow graph, so there is nothing to show here. That is not the same as "no paths were found": what the scan did read is above, under coverage.
Supply chain and provenance
Integrityfirst-seen
Surface digest955b8f5b684fa414
Scanned2026-11-09
This is the first scan of this surface here, so there is nothing yet to compare it against.
Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.
Release history
Always latest — the install command names no version, so it installs the newest release when it runs; the current release on file is 0.2.2. Pin a release below and the command asks for exactly that one.
0.2.2
undated
latestNo release note was published with this version.
—
no reviews yet
Who can review
One review per account, from a signed-in account that does not publish this listing. Nothing else is asked — you can say what you think before you install it. Publishers can reply once per review, and a review can be edited or deleted by whoever wrote it.
Sign in to write one
Any signed-in account that does not publish HippoMCP can review it, once — before installing it or after. A review from an account that has installed it is marked as one.
No reviews yet
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes a signed-in account that does not publish it, and nothing else.