Name: Engram
Author: engram

Engram MCP

Memory for AI agent teams across tools, sessions, repositories, and teammates.

Grade B Remote or local · Streamable HTTP · stdio API key 20 tools v0.4.7 · 12 Oct 2026

No reviews yet by engramnpm 3,877 Runs on your machine or at its publisher’s address — not through us

88/100

trust score

157

downloads a day

local

or remote

726

downloads in 30d

What it does

Memory for AI agent teams across tools, sessions, repositories, and teammates.

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user --env 'ENGRAM_API_KEY=${ENGRAM_API_KEY}' --env 'ENGRAM_API_URL=${ENGRAM_API_URL}' --transport stdio engram-engram-mcp '--' npx -y engram-tools mcp

# 2 — ask your agent for something these tools do
#   engram_start, engram_rehydrate, engram_setup and 17 more

It needs ENGRAM_API_KEY, ENGRAM_API_URL: this reads them from your environment, so export them first.

Engram costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publisher

engram1 server

1 category

All 1 server

Installation

Where are you running it?

Every route below installs the same thing and ends at the same approval screen. This one can run either way — at an address its publisher runs, or as a process under your own user, with your files and your network — and this marketplace is in the path of neither.

Claude Codedeclared by this listing

This is a public server: you run it yourself and this marketplace is not in the path. You need Node.js — the current LTS (24) is the safe choice; npx comes with it. Claude Code registers it in one command; --scope user makes it available in every project. Claude Code reads ENGRAM_API_KEY (Workspace or restricted agent credential from Engram), ENGRAM_API_URL (Hosted Engram API endpoint) from your environment each time it starts the server, so the value stays out of its config: export them in your shell profile (macOS, Linux), or run setx ENGRAM_API_KEY …, setx ENGRAM_API_URL … and open a new terminal (Windows). The '--' is in quotes so that PowerShell passes it on.

claude mcp add --scope user --env 'ENGRAM_API_KEY=${ENGRAM_API_KEY}' --env 'ENGRAM_API_URL=${ENGRAM_API_URL}' --transport stdio engram-engram-mcp '--' npx -y engram-tools mcp

Reconnect, or start a new session, and the tools appear in the model’s tool list.

Or connect to its publisher’s address

Its publisher also runs it at https://api.engram.tools/mcp: nothing to start on your machine, and this marketplace is not in the path.

claude mcp add --scope user --transport http engram-engram-mcp https://api.engram.tools/mcp

Free on mcprush, and it runs from its publisher’s own package: this marketplace is not in the path, so there is no key of ours to hold and no card to add.

What it asks of you

It reaches a system of yours, so it needs your own credential rather than the publisher’s: ENGRAM_API_KEY — Workspace or restricted agent credential from Engram.; ENGRAM_API_URL — Hosted Engram API endpoint.. You set them in your own client’s config, on your machine — this marketplace never holds it.

What it writes

One config entry your client uses to start the process locally. A local server runs with your file system and your network, which is why it is priced without metering.

What you approve

20 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

One-call session starter. Call at the beginning of every meaningful session, when entering a repo, or when task context changes. It opens/updates the session journal and loads Engram operating guidance, private workspace memory, public knowledge, and matching skill guides. If prior context was…

Parameter	Type	Required	Notes
agent_tool	string	no	Which AI tool you are, e.g. "claude-code", "codex", "cursor", "gemini-cli"
project	string	no	Project or product name, e.g. "HouseCompass"
repo	string	no	Current repository name
role	string	no	The role you are playing for this task
market	string	no	Target market/domain, e.g. "UK property"
task	string	no	What you are about to do
stack	array	no	Detected stack, e.g. ["Next.js", "TypeScript"]
context	string	no	Optional full context summary. If omitted, Engram builds one from the other fields.
include_skills	boolean	no	Also fetch matching skill guides (default: true)
limit	number	no	Max memories to include
depth	string	no	Use focused by default. Use deep only when broader context is needed.

Restore the working session after context compaction, truncation, summary, resume, or agent confusion. Call this before continuing when the prior chat context was compacted or feels incomplete. It returns the session journal, previous checkpoint, decisions, gotchas, open loops, and lessons learned…

Parameter	Type	Required	Notes
session_id	string	no	Optional Engram session ID from a previous start/rehydrate response
agent_tool	string	no	Which AI tool you are, e.g. "claude-code", "codex", "cursor", "gemini"
project	string	no	Project or product name
repo	string	no	Current repository name
task	string	no	The task you are resuming
reason	string	no	Why recovery is needed, e.g. "context compacted", "session resumed", "summary lost details"
depth	string	no	How much session journal to return (default: standard)
since	string	no	Optional ISO timestamp to only include journal events since this time

Return workspace info, available tools, and usage guidance. Use as a refresher if you forgot how to use Engram. New sessions should call engram_start; post-compaction recoveries should call engram_rehydrate.

Parameter	Type	Required	Notes
agent_tool	string	no	Which AI tool you are
project	string	no	Project or product name
repo	string	no	Current repository name
role	string	no	The role you are playing for this task
market	string	no	Target market/domain
task	string	no	What you are about to do
stack	array	no	Detected stack

Load focused memory for a specific task. Use engram_start at session start, engram_rehydrate after compaction/resume, and this later when switching tasks or refocusing on a narrower decision. Skill guides are on-demand; request them only for checklist-heavy tasks.

Parameter	Type	Required	Notes
context	string	yes	Context summary: project name, tech stack, current task
repo	string	no	Current repository name
file	string	no	Current file path
include_skills	boolean	no	Also fetch matching skill guides. Default is heuristic/on-demand, not always on. Use true for reviews, security, migrations, deployment, testing, performance, accessibility, or localization checklists
limit	number	no	Max memories to include
depth	string	no	Use focused by default. Use deep only when the focused result is insufficient.

Find reusable lessons from other repositories in the same workspace. Use only when another repo is likely to contain a directly transferable pattern. Skip this for repo-specific work.

Parameter	Type	Required	Notes
target_repo	string	yes	Current repository that needs help
context	string	yes	Current task, stack, error, or decision to cross-pollinate
source_repos	array	no	Optional source repo names to search
include_public	boolean	no	Include public starter-pack memories (default: true)
limit	number	no	Max cross-project memories to return
depth	string	no	Use focused by default. Use deep only when the first transfer set is insufficient.

Store durable knowledge for the team. Use when you discover a convention, pattern, gotcha, solution, architecture decision, dependency quirk, or handoff fact that future agents should remember after compaction or a new session.

Parameter	Type	Required	Notes
type	string	yes	—
content	string	yes	The knowledge to store. Be specific and actionable.
repo	string	no	Repository name
tags	array	no	Tags for categorization
agent_tool	string	no	Which AI tool you are
context	object	no	Additional context
supersedes_memory_ids	array	no	Memory IDs this new knowledge explicitly replaces. Use only when the replacement is certain.
change_reason	string	no	Why the previous memory is no longer current

Search Engram memory before making decisions, debugging unfamiliar problems, or when context feels incomplete after compaction/resume. If starting a session, prefer engram_start first.

Parameter	Type	Required	Notes
query	string	yes	What you want to know
repo	string	no	Filter by repository
type	string	no	—
tags	array	no	—
limit	number	no	Max results
depth	string	no	Use focused by default. Use deep only when the focused result is insufficient.

Report whether a recalled memory helped. Always call after materially using a recalled memory so future compacted/new sessions rank the right memories higher.

Parameter	Type	Required	Notes
memory_id	string	yes	The memory ID from recall/start results
success	boolean	yes	true = helped, false = did not help or was wrong
detail	string	no	Explain the outcome
failure_reason	string	no	—
repo	string	no	Repo/project where the memory was used, for impact attribution
session_id	string	no	Session ID returned by engram_start or engram_rehydrate for exact attribution

Create a milestone checkpoint during substantial work. Report outcomes for used memories and store durable learnings after a meaningful phase, before switching tasks, after several used memories, or before final handoff. It is not a timer.

Parameter	Type	Required	Notes
repo	string	no	Current repository name
task	string	no	What you worked on
summary	string	no	Short summary of what changed or what was learned
agent_tool	string	no	Which AI tool you are
store	boolean	no	Set false to preview quality decisions without storing learnings
used_memories	array	no	Memories materially used this session and whether they helped
learnings	array	no	Durable project learnings to store for future agents
feedback	object	no	Submit product quality feedback or dismiss weekly pulse

Return product/admin proof and benchmark-ready workspace metrics: public/private memory bank size, outcome loop, usage, activation, and benchmark recipe. Not part of normal coding flow.

No parameter schema on file.

Load a focused repo memory dump for debugging, audits, or repo-specific inspection. Use engram_start for normal session startup and engram_smarter for normal task switches.

Parameter	Type	Required	Notes
repo	string	yes	Repository name
file	string	no	Current file path
task	string	no	What you are about to do

Load a complete skill guide by skill name. Advanced/on-demand tool: use when a complex task needs a repeatable checklist such as code review, security audit, migration, deployment, testing, performance, accessibility, or localization. Call with no skill to list available skills.

Parameter	Type	Required	Notes
skill	string	no	Skill name, e.g. "code-review"

Store a learned convention, pattern, gotcha, or solution so the whole team benefits. Use this when you: fix a hard-to-find bug, discover an undocumented convention, find a working solution to a recurring problem, or notice a version-specific library quirk. Do NOT store obvious facts or temporary…

Parameter	Type	Required	Notes
type	string	yes	Type of memory
content	string	yes	The knowledge to store. Be specific and actionable.
repo	string	no	Repository name
tags	array	no	Tags for categorization
agent_tool	string	no	Which AI tool you are
context	object	no	Additional context
supersedes_memory_ids	array	no	Memory IDs this new knowledge explicitly replaces
change_reason	string	no	Why the previous memory is no longer current

Search team memory for relevant conventions, patterns, gotchas, and solutions. Use this BEFORE making architectural decisions, when encountering unfamiliar errors, when context was compacted/resumed and feels incomplete, or when wondering "has someone solved this before?" Prefer engram_start at…

Parameter	Type	Required	Notes
query	string	yes	What you want to know
repo	string	no	Filter by repository
type	string	no	—
tags	array	no	—
limit	number	no	Max results (default: 5)
depth	string	no	Use focused by default. Use deep only when the focused result is insufficient.

Report whether a recalled memory was helpful or not. This is critical for learning. Always report after using a recalled memory. If it failed, explain WHY.

Parameter	Type	Required	Notes
memory_id	string	yes	The memory ID from engram_recall results
success	boolean	yes	true = helped, false = did not help or was wrong
detail	string	no	Explain the outcome. REQUIRED when success=false.
failure_reason	string	no	Why did it fail? Only when success=false.
repo	string	no	Repo/project where the memory was used, for impact attribution

Advanced/debug tool for loading a focused repository knowledge dump. Use engram_start for normal session startup and engram_smarter for task-focused refreshes.

Parameter	Type	Required	Notes
repo	string	yes	Repository name
file	string	no	Current file path
task	string	no	What you are about to do

Call when you first connect to Engram, or when you need a refresher on how to use the memory system. For normal session startup, use engram_start. For post-compaction recovery, use engram_rehydrate.

Parameter	Type	Required	Notes
agent_tool	string	no	Which AI tool you are (e.g. "claude-code", "cursor")
project	string	no	Project or product name, e.g. "HouseCompass"
repo	string	no	Current repository name
role	string	no	The role you are playing for this task
market	string	no	Target market/domain, e.g. "UK property"
task	string	no	What you are about to do
stack	array	no	Detected stack, e.g. ["Next.js", "TypeScript"]

Get a complete skill guide for a specific task. Returns all step-by-step memories for that skill as one organized bundle. Use this when you are about to perform a complex task like code review, database migration, security audit, deployment, etc. Call with no skill to list available skills.

Parameter	Type	Required	Notes
skill	string	no	Skill name (e.g. "code-review", "database-migration", "security-audit", "deployment"). Leave empty to list all available skills.

Fetch relevant knowledge for your current project and task. Send a context summary and get back relevant memories, patterns, gotchas, and skill guides. Use engram_start at the start of a session, engram_rehydrate after compaction/resume, and this alias when switching tasks or recovering focused…

Parameter	Type	Required	Notes
context	string	yes	Context summary: project name, tech stack, current task. Example: "evimibul - Next.js 16, Prisma 5, Neon - fixing search aggregator, adding location filters"
repo	string	no	Current repository name
file	string	no	Current file path
include_skills	boolean	no	Also fetch matching skill guides (default: true)
limit	number	no	Max memories to include
depth	string	no	Use focused by default. Use deep only when broader context is needed.

Find reusable lessons from other repositories in the workspace. Use after setup/start and before writing the implementation plan whenever the current task resembles something another project may have solved already: auth, billing, data models, migrations, deployment, monitoring, localization,…

Parameter	Type	Required	Notes
target_repo	string	yes	Current repository that needs help
context	string	yes	Current task, stack, error, or decision to cross-pollinate
source_repos	array	no	Optional source repo names to search
include_public	boolean	no	Include public starter-pack memories (default: true)
limit	number	no	Max cross-project memories to return
depth	string	no	Use focused by default. Use deep only when the first transfer set is insufficient.

Free

$0 forever

Every tool, no call limit
No card, and mcprush charges nothing for it
Source published under MIT
Runs on your machine — nothing of it reaches our gateway
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install Engram or to call it, at any volume.

BTrust score 88 / 100

Release 0.4.7 · scanned 14 Oct 2026

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score100

Client score88

Findings2 threat · 5 capability

Capabilitycritical

Coveragesource

Verificationnone

Surface digesta0f749c554e010f14a30b5ab9d610cc815b5eef8aeca52489e30a24857413464

Score vectorthreat 100 → client 88

Term	Level	What it prices	Points
capability-exposure	critical	capability blast radius (critical) — client exposure if the model is manipulated	−10
verification-discount	none	publisher verification (unlinked) — no provenance/repo link, but the shipped source was fully read	−2
coverage-honesty	source	inspection depth (source) — how much of the target the scan could see	−0

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

Tool surfaceread

Implementation sourceread

Package metadataread

Live transportnot available

Tools were statically extracted from the published source (20 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".

20 of the 20 recovered tools are registered only when process.argv.slice(2).includes('mcp') is false (dist/index.js:1084) — typically when a key or option is configured. They are part of the server's surface and were analysed; a server started without that configuration exposes none of the recovered tools.

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. critical is the level these add up to.

No tool is registered unconditionally · 20 only when process.argv.slice(2).includes('mcp') is false (dist/index.js:1084) — typically when a key or option is configured. All 20 are in the table below and were analysed; the conditional ones are marked.

Tool	Capability tags	Why the tag was assigned
engram_start conditional	external-sink	external-sink: handler sends an HTTP POST (fetch(${API_BASE}${path}) at dist/index.js:1051
engram_rehydrate conditional	external-sink	external-sink: handler sends an HTTP POST (fetch(${API_BASE}${path}) at dist/index.js:1051
engram_setup conditional	external-sink	external-sink: handler sends an HTTP POST (fetch(${API_BASE}${path}) at dist/index.js:1051
engram_smarter conditional	external-sink	external-sink: handler sends an HTTP POST (fetch(${API_BASE}${path}) at dist/index.js:1051
engram_cross_pollinate conditional	external-sink	external-sink: handler sends an HTTP POST (fetch(${API_BASE}${path}) at dist/index.js:1051
engram_store conditional	external-sink	external-sink: handler sends an HTTP POST (fetch(${API_BASE}${path}) at dist/index.js:1051
engram_recall conditional	external-sink	external-sink: handler sends an HTTP POST (fetch(${API_BASE}${path}) at dist/index.js:1051
engram_report_outcome conditional	external-sink	external-sink: handler sends an HTTP POST (fetch(${API_BASE}${path}) at dist/index.js:1051
engram_reflect conditional	external-sink	external-sink: handler sends an HTTP POST (fetch(${API_BASE}${path}) at dist/index.js:1051
engram_proof conditional	no tags
engram_get_context conditional	sensitive-sourceexternal-sink	sensitive-source: keyword "dump"; external-sink: handler sends an HTTP POST (fetch(${API_BASE}${path}) at dist/index.js:1051
engram_skill conditional	external-sink	external-sink: handler sends an HTTP POST (fetch(${API_BASE}${path}) at dist/index.js:1051
atm_store conditional	external-sink	external-sink: handler sends an HTTP POST (fetch(${API_BASE}${path}) at dist/index.js:1051
atm_recall conditional	external-sink	external-sink: handler sends an HTTP POST (fetch(${API_BASE}${path}) at dist/index.js:1051
atm_report_outcome conditional	external-sink	external-sink: handler sends an HTTP POST (fetch(${API_BASE}${path}) at dist/index.js:1051
atm_get_context conditional	sensitive-sourceexternal-sink	sensitive-source: keyword "dump"; external-sink: handler sends an HTTP POST (fetch(${API_BASE}${path}) at dist/index.js:1051
atm_setup conditional	external-sink	external-sink: handler sends an HTTP POST (fetch(${API_BASE}${path}) at dist/index.js:1051
atm_skill conditional	external-sink	external-sink: handler sends an HTTP POST (fetch(${API_BASE}${path}) at dist/index.js:1051
atm_smarter conditional	untrusted-inputexternal-sink	untrusted-input: keyword "fetch"; external-sink: handler sends an HTTP POST (fetch(${API_BASE}${path}) at dist/index.js:1051
atm_cross_pollinate conditional	external-sink	external-sink: handler sends an HTTP POST (fetch(${API_BASE}${path}) at dist/index.js:1051

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

atm_smarter → atm_get_context → atm_cross_pollinate

A cross-tool exfiltration chain exists: atm_smarter → atm_get_context → atm_cross_pollinate.

flow-2

Tool "engram_get_context" both reads sensitive data and can send it externally.

flow-3

Tool "atm_get_context" both reads sensitive data and can send it externally.

Supply chain and provenance

Integrityfirst-seen

Surface digesta0f749c554e010f1

Scanned2026-10-14

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.