Name: Monomem
Author: calasdan-sketch

Monomem MCP

Shared memory for AI coding agents that records who wrote each note and holds writes matching known attacks. One local SQLite file over MCP or REST; no cloud, no API keys.

Grade B Local · stdio No auth needed 35 tools v1.3.5 · 11 Nov 2026 MIT

No reviews yet by calasdan-sketchnpm 3,714 Runs on your machine, nothing hosted

84/100

trust score

136

downloads a day

local

runs on your machine

downloads in 30d

What it does

Tell one agent something and the rest already know it: Claude Code, Codex, Cursor, Copilot, Gemini CLI and Zed share one SQLite file on your own machine, over MCP or REST. No cloud, no API keys, no model calls when it saves.

Who wrote it, on every note. Notes keep their writer and their history, and can be undone or rolled back writer by writer.
Held writes. Writes that match known injection patterns wait for your OK; monomem approve-first --all on holds every agent write.
Private notes. Label notes public, internal or private, and give each app its own key with a limit.
Test it yourself. monomem drill replays 23 known poisoning attacks on a copy of your store; 2 still get through, and it says which.
Outside content labelled (new in 1.3.5). When a Claude Code session read the web or another MCP server's tool, its summary is stamped with the tool's name and kept out of the next session's start-up text. Agents cannot add or remove the label; an unlabelled note is not thereby safe.

Limits: pattern matching misses reworded attacks, and an agent with shell access can run the CLI itself. Free and MIT. Try npx monomem demo, then npx monomem setup.

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user monomem-mcp '--' npx -y monomem mcp

# 2 — ask your agent for something these tools do
#   state_write, state_read, state_search and 32 more

Monomem costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publisher

calasdan-sketch1 server

1 category

All 1 server

Installation

Where are you running it?

Every route below installs the same thing and ends at the same approval screen. This one runs on your machine: your client starts Monomem as a process under your own user, with your files and your network, so the tool surface below is what it can do to your computer rather than to a server somewhere else. Its scan result is on the Security tab — read the surface before you approve it.

Claude Codedeclared by this listing

This is a public server: you run it yourself and this marketplace is not in the path. You need Node.js — the current LTS (24) is the safe choice; npx comes with it. Claude Code registers it in one command; --scope user makes it available in every project. The '--' is in quotes so that PowerShell passes it on.

claude mcp add --scope user monomem-mcp '--' npx -y monomem mcp

Reconnect, or start a new session, and the tools appear in the model’s tool list.

Free on mcprush, and it runs from its publisher’s own package: this marketplace is not in the path, so there is no key of ours to hold and no card to add.

What it asks of you

Nothing is required, but it can take MONOMEM_CLIENT (App name stamped on this server's writes (written_by becomes stdio:<name>). 1-40 characters a-z 0-9 . _ -. Self-declared, not authenticated.), MONOMEM_HOME (Data directory (database, tokens). Default: ~/.monomem (Windows: the .monomem folder in your user profile); an existing ~/.onememory store is kept in place, as is a checkout's ./data/state.db.), MONOMEM_DB_PATH (SQLite file path, overriding the data directory for the database only. Default: <data dir>/state.db.) if you want to set them.

What it writes

One config entry your client uses to start the process locally. A local server runs with your file system and your network, which is why it is priced without metering.

What you approve

35 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

Read from its source code. A server that builds its tool list when it starts can list more tools than this.

Create a new note in the shared cross-surface state store, or update an existing one if id is given. Returns the resulting note without its body (state_read id=N has it).

Parameter	Type	Required	Notes
id	integer	no	Id of an existing note to update. Omit to create a new note.
title	string	no	Note title. Required when creating a new note.
body	string	no	Note body/content.
tags	array	no	Tags for the note.
facts	object	no	—
source	string	no	Provenance CLAIM: who/what you say wrote this note (an agent or user label). Advisory only -- anyone can claim anything here. The server separately stamps the authenticated writer as written_by (can
if_rev	integer	no	Compare-and-swap: only update if the note is still at this revision (from a prior read). Omit to force.
forget_after	number	no	Retention: days until this note is archived (soft-deleted, restorable). On update, resets the deadline; 0 clears it. Omit to keep the current deadline (none for new notes).
confidence	number	no	Optional CLAIM, 0 to 1, of how sure you are of this note (0 = a guess, 1 = certain). It is only your claim: the server stores it next to your name, shows it to readers as a claim, and never uses it to

Open one note from memory by its id. Pass neighbors: true to also get up to 10 similar notes. A body longer than max_chars (default …) comes in parts: body_truncated, body_chars and next_offset say where to continue (pass it as offset).

Parameter	Type	Required	Notes
id	integer	yes	Id of the note to read.
neighbors	boolean	no	Attach up to 10 similar-note neighbors (same namespace) with similarity scores. Default false.

Search notes in the shared state store by title/body/tags. Keyword (full-text) by default; set mode to 'semantic' or 'hybrid' for meaning-based search when embeddings are enabled (falls back to keyword otherwise). Set mode to 'relevant' and pass a natural conversational message as query to…

Parameter	Type	Required	Notes
query	string	yes	Search text.
namespace	string	no	—
limit	integer	no	Max results (default 20, max 200).
mode	string	no	keyword = full-text (default when embeddings off); semantic = meaning only; hybrid = fuse both. Falls back to keyword if embeddings are unavailable. relevant = treat query as a conversational messag
when	string	no	Natural-language time filter, e.g. 'yesterday evening'. Scopes results to that time range (interpreted in MONOMEM_TIMEZONE). Unrecognized values are ignored -- the query still runs unscoped.
explain	boolean	no	Attach a breakdown to each result: the base relevance, access boost and staleness factors that produced its rank. Default false.
as_of	string	no	Admin only. Read-only time travel: search memory as it stood at this time (ISO date/time or an age like 7d, 2h), rebuilt from note history. Keyword match on the old text only; notes whose old text is

Given a natural conversational message, extract keywords from it and return notes matching any of them. Permissive on purpose: a note qualifies on a single keyword hit (OR), unlike state_search's AND conjunction -- use this for vague messages where you don't know the exact wording. Returns the…

Parameter	Type	Required	Notes
message	string	yes	Natural conversational text to find relevant memories for.
limit	integer	no	Max results (default 5, max 200).
namespace	string	no	—

List the notes in memory, newest first. Optionally only one namespace (a named space).

Parameter	Type	Required	Notes
namespace	string	no	—
limit	integer	no	Max results (default 50, max 500).
offset	integer	no	Pagination offset.

Forget a note by id: it is archived, so it no longer appears in search, lists or recall.

Parameter	Type	Required	Notes
id	integer	yes	Id of the note to delete.

Read-only access-tracking stats for the shared state store: total notes, total reads, the most-read notes, how many notes were never read (dead-memory candidates for future cleanup), and how many notes are stale (older than the configured staleness thresholds). meter: what Monomem costs…

Parameter	Type	Required	Notes
namespace	string	no	—

Read-only: which memories a session start showed the agent and why (note id, rank, why-tag, approximate tokens). With session_id: that session, with note titles looked up now (a note deleted since is marked). Without: the most recent sessions. Receipts store ids and tags only, never note text.

Parameter	Type	Required	Notes
session_id	string	no	The session to show; omit to list recent sessions.
namespace	string	no	—

Read-only: the story of one note in time order: who wrote it (server-stamped or a config label), its versions, what replaced it or it replaced, held edits, pin, which session starts were shown it and why, and its status. Titles only, never note text. A note from a distrusted writer reads as…

Parameter	Type	Required	Notes
id	integer	yes	The note id.
namespace	string	no	—

Find near-duplicate notes (cosine similarity over title + body) that are candidates for consolidation. Same-namespace only; never suggests cross-namespace merges. Read-only, but requires the admin scope: the scan is O(n^2) CPU, so it runs one at a time under a time budget (narrow it with…

Parameter	Type	Required	Notes
namespace	string	no	Restrict the scan to this namespace.
threshold	number	no	Similarity threshold 0.5..1.0 (default 0.95). Out-of-range values are clamped, not rejected.
limit	integer	no	Max candidate pairs to return (default 50, max 200).

Merge 2+ duplicate notes into one: longest title wins (or merged_title), bodies are deduplicated and joined, tags are unioned. Deletes the source notes unless keep_sources is true, so this requires the admin scope (same policy as state_delete). Pass dry_run: true to preview the merge without…

Parameter	Type	Required	Notes
ids	array	yes	Ids of the notes to merge (2 or more, all in one namespace).
dry_run	boolean	no	Preview the merge without writing anything (default false).
merged_title	string	no	Title for the merged note. Defaults to the longest source title.
keep_sources	boolean	no	Keep the source notes after merging (default false: they are deleted).

Recalculate the note similarity graph from scratch: every note is

Parameter	Type	Required	Notes
threshold	number	no	Similarity floor for an edge (default 0.25). Must be in (0, 1].
confirm	boolean	no	Required when the note count in scope exceeds …: re-call with confirm: true after telling the user how many pairs will be scored.

Change feed: notes created, updated, or deleted since a point in time, oldest first,

Parameter	Type	Required	Notes
since	string	no	ISO time, a duration like "24h"/"7d", or "last". Required unless cursor is given.
cursor	string	no	nextCursor from a previous page.
namespace	string	no	—
source	string	no	Only changes to notes with this provenance source (the writer's own CLAIM; see written_by).
limit	integer	no	Max entries per page (default 100, max …).
consumer	string	no	Label for the "last" marker, e.g. "phone" or "claude-code" (default "default").
wait_seconds	integer	no	Live wait: if nothing new yet, hold the call open up to this many seconds and return the moment something changes in your scope. Use …: proxies and tunnels often cut an idle response at 30s (hard cap
wait	integer	no	Alias of wait_seconds.
ack_mode	string	no	auto (default): the "last" marker advances when the final page is served. manual: it does NOT; the final page returns an ack_token and the marker moves only when you pass it back as ack_token (her
ack_token	string	no	Token from an earlier ack_mode:manual page: moves the marker before reading.
exclude_self	boolean	no	Hide changes WRITTEN BY the token/connection whose label equals your consumer label (the writer is recorded by the server; writes with no recorded writer fall back to the note's source). Only work

Shared task board across devices and models. Create a task (no id: title required) or update one

Parameter	Type	Required	Notes
id	integer	no	Task id to update. Omit to create.
title	string	no	Short single-line title (max …, no line breaks). Required when creating.
status	string	no	idea \| planned \| running \| blocked \| done \| queued \| failed (default idea).
next_step	string	no	The next concrete step, one line (max …). Empty string clears it.
owner	string	no	Which device, chat or model owns this now. Empty string clears it.
notes	string	no	Free-form details (max …).
if_rev	integer	no	Compare-and-swap: only update if the task is still at this rev.
client_key	string	no	Idempotency key for creating: same key + namespace returns the existing task (replayed:true).
priority	integer	no	0-…; null clears.
due	string	no	YYYY-MM-DD or an ISO time; empty/null clears.
parent_id	integer	no	Id of the parent task (same namespace); null clears.
blocked_by	array	no	Ids of tasks that must finish first; [] clears.
command	object	no	Command task: runner allowlist action + string params. null removes it. Needs target. Changing it voids any approval.
target	string	no	Runner name the command is for; must equal the runner's own id.
approve	boolean	no	ADMIN tokens only, when creating a command task: approve it in the same call.

One task in full: notes, command, approval state and result. task_list and catch_up return compact rows.

Parameter	Type	Required	Notes
id	integer	yes	Task id.

Take a task so no other session works it at the same time. Atomic compare-and-swap: if someone else holds

Parameter	Type	Required	Notes
id	integer	yes	Task id.
owner	string	yes	Who is claiming: device/chat/model label, e.g. "pc-claude-code".
ttl_seconds	integer	no	Lease length (…-…, default …).
release	boolean	no	Give the claim up (only the holder can).

ADMIN only. Approve the command currently stored on a queued task so the PC's runner may execute it

Parameter	Type	Required	Notes
id	integer	yes	Task id.
revoke	boolean	no	Withdraw the approval instead.
command_hash	string	no	The task's command_hash exactly as task_get showed it. Required to approve (or pass if_rev).
if_rev	integer	no	Alternatively the task's rev as task_get showed it.

List tasks on the shared board, most recently changed first. By default shows everything except

Parameter	Type	Required	Notes
status	string	no	One status, "open" (default: all but done) or "all".
owner	string	no	Only tasks owned by this device/chat/model.
parent_id	integer	no	Only subtasks of this task.
namespace	string	no	—
limit	integer	no	Max tasks (default 50, max …).

Read-only. Whether the PC's command runner looks online or stale (age of its last heartbeat), and, per readable

Parameter	Type	Required	Notes
namespace	string	no	—

Leave a structured handoff for the next session (any device or model) before you stop: what you did,

Parameter	Type	Required	Notes
surface	string	yes	Who is handing off: device/chat/model, e.g. "phone" or "claude-code on pc".
summary	string	no	One or two sentences (max …).
done	array	no	What got done (short items).
pending	array	no	What is still open.
decisions	array	no	Decisions made that the next session must respect.
next_step	string	no	The single next thing to do.
client_key	string	no	Idempotency key: same key + namespace returns the existing handoff (replayed:true).

One call to learn where things stand: what changed since THIS consumer last called (titles only; the

Parameter	Type	Required	Notes
consumer	string	no	Label for the "last" marker (default "default").
namespace	string	no	—
include_changes	boolean	no	false = skip the changes part (and leave the marker alone). Default true.
tasks	integer	no	Max open tasks (default 20).
handoffs	integer	no	Max handoffs (default 3).
ack_mode	string	no	auto (default): marker advances now. manual: it advances when you return ack_token.
ack_token	string	no	Token from an earlier ack_mode:manual call: moves the marker before reading.
exclude_self	boolean	no	Hide changes written by the token whose label equals your consumer label (see memory_since).

Confirm you handled the changes from a memory_since / catch_up call made with ack_mode:"manual": pass its

Parameter	Type	Required	Notes
ack_token	string	yes	The ack_token from the final page of an ack_mode:manual read.
consumer	string	no	Same consumer label you read with (default "default").
namespace	string	no	—
source	string	no	Same source filter you read with.

Admin review queue for writes the memory linter held (prompt-injection-like text, or secrets

Parameter	Type	Required	Notes
action	string	yes	list, approve, or reject.
id	integer	no	Quarantine id (required for approve/reject).
limit	integer	no	Max entries for list (default 50, max 500).

Admin-only. Manage who this store does NOT trust. distrust puts a writer (a token label such as "phone", or a stable

Parameter	Type	Required	Notes
action	string	yes	What to do.
writer	string	no	Token label or writer_id to distrust / undistrust.
public_key	string	no	add_attester: the other server's 43-character base64url public key (from monomem trust identity).
server_id	string	no	add_attester: the server id this key signs for. Required unless any_server is true: a key is trusted for ONE server.
any_server	boolean	no	add_attester: EXPERIMENTAL escape hatch. Trust the key for ANY server id (discouraged: the key holder can then claim to be any peer).
not_after	string	no	add_attester: ISO time at which trust in this key ENDS (judged when an import is verified). An expiry, not a revocation: use revoke_attester for a leaked key.
label	string	no	add_attester: a note to yourself about whose key this is.
key_id	string	no	remove_attester / revoke_attester / unrevoke_attester: the 16-hex-digit key id.
reason	string	no	revoke_attester: why (kept in the trust log).

STEP 1 of replacing one or more notes with a newer one. This changes NOTHING. It returns JSON whose warning field is a plain-language warning

Parameter	Type	Required	Notes
old_ids	array	yes	The id(s) of the note(s) to be replaced.
new_id	integer	no	The id of an existing live note that takes the old note's place (instead of new_title/new_body).

STEP 2. Replaces the note(s) previewed with memory_supersede_preview, but ONLY with that preview's one-time token and ONLY after the

Parameter	Type	Required	Notes
token	string	yes	The confirmation code from memory_supersede_preview.
acknowledge_risk	boolean	no	Only for a warning that had a RED FLAG: say you accept it (admin connections only).

Brings a replaced (superseded) note back exactly as it was: it shows up in search again. The note that replaced it is not touched.

Parameter	Type	Required	Notes
id	integer	yes	The id of the replaced note to bring back.

Admin only. Lists the earlier versions (text, writer, when it stopped being current) Monomem kept for a note, newest first, so a bad

Parameter	Type	Required	Notes
id	integer	yes	The note id.

Admin only. Makes an earlier version of a note's title and body the current text again, as a NEW version. Nothing is overwritten: the text it

Parameter	Type	Required	Notes
id	integer	yes	The note id.
version	integer	yes	The version number from memory_history.
if_rev	integer	no	Only restore if the note is still at this revision.

Admin only. Permanently forgets the earlier versions kept for a note (for example after a secret was removed from it). The note itself is not changed.

Parameter	Type	Required	Notes
id	integer	yes	The note id.

Admin only, operator tool. Without code: a preview of undoing everything one writer did since a time (notes it created are archived,

Parameter	Type	Required	Notes
writer	string	no	The exact writer name (written_by), e.g. "token:ci" or "stdio:cursor"; "stdio" means every local app.
since	string	no	An ISO time, or a duration back from now: 30m, 2h, 7d.
include_conflicts	boolean	no	Also roll back notes another writer changed afterwards (their text stays in the history).
code	string	no	The one-time code from the preview, to apply it.

START HERE to look something up in memory. Returns COMPACT rows (id, kind, type, title, date, files, ~tokens) for notes,

Parameter	Type	Required	Notes
query	string	no	Full-text search words (any order).
kind	string	no	Row kind (default all).
obs_type	string	no	Observation type: bugfix, feature, refactor, change, discovery, decision, security_alert, security_note.
file	string	no	Only rows linked to this file path (as shown in files).
session	string	no	Only rows from this session id.
since	string	no	Only rows created at/after this ISO-8601 date or time.
limit	integer	no	Max rows (default 30, max 200).

Compact rows before and after an anchor, oldest first: the anchor is a note id, or the best match for query / file / session.

Parameter	Type	Required	Notes
anchor	integer	no	Note id to centre on.
query	string	no	Or: centre on the best match for these words.
file	string	no	Or: centre on the newest row linked to this file.
session	string	no	Or: centre on this session (and stay inside it).
before	integer	no	Rows before the anchor (default 5, max 50).
after	integer	no	Rows after the anchor (default 5, max 50).

The full notes for up to … ids (from memory_index / memory_timeline), with their files, their session and a citation (om:#<id>).

Parameter	Type	Required	Notes
ids	array	yes	Note ids (max …).

Agent sessions Monomem recorded (newest first): folder, start/end, prompt and event counts, and the title of the session summary.

Parameter	Type	Required	Notes
session	string	no	One session id: its summary and observations.
limit	integer	no	Max sessions (default 20, max 200).

Free

$0 forever

Every tool, no call limit
No card, and mcprush charges nothing for it
Source published under MIT
Runs on your machine — nothing of it reaches our gateway
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install Monomem or to call it, at any volume.

BTrust score 84 / 100

Release 1.3.5 · scanned 11 Nov 2026

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score94

Client score84

Findings8 threat · 3 capability

Capabilitycritical

Coveragesource

Verificationsource

Surface digest66917413a1ffe3ba7233b6fef448562c85cda9f99cb6ac8f04599f3a19e7c655

Score vectorthreat 94 → client 84

Term	Level	What it prices	Points
capability-exposure	critical	capability blast radius (critical) — client exposure if the model is manipulated	−10
verification-discount	source	publisher verification (provenance) — cryptographic build provenance ties the artifact to its source	−0
coverage-honesty	source	inspection depth (source) — how much of the target the scan could see	−0

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

Tool surfaceread

Implementation sourceread

Package metadataread

Live transportnot available

Tools were statically extracted from the published source (35 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. critical is the level these add up to.

Tool	Capability tags	Why the tag was assigned
state_write	no tags
state_read	no tags
state_search	no tags
state_relevant	no tags
state_list	no tags
state_delete	state-write	state-write: declares destructiveHint: true
memory_stats	no tags
memory_receipt	no tags
memory_why	no tags
memory_consolidation_candidates	no tags
memory_consolidate	state-write	state-write: declares destructiveHint: true
memory_rebuild_edges	state-write	state-write: declares destructiveHint: true
memory_since	no tags
task_put	code-exec	code-exec: parameter "command"
task_get	no tags
task_claim	no tags
task_approve	no tags
task_list	no tags
runner_status	no tags
session_handoff	no tags
catch_up	no tags
memory_ack	no tags
memory_quarantine	state-write	state-write: declares destructiveHint: true
trust_policy	state-write	state-write: declares destructiveHint: true
memory_supersede_preview	no tags
memory_supersede_confirm	state-write	state-write: declares destructiveHint: true
memory_supersede_undo	no tags
memory_history	no tags
memory_restore_version	no tags
memory_history_purge	state-write	state-write: declares destructiveHint: true
memory_rollback	state-write	state-write: declares destructiveHint: true
memory_index	no tags
memory_timeline	no tags
memory_get	untrusted-input	untrusted-input: keyword "fetch"
session_list	no tags

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

flow-1

Untrusted input can drive an external action even though no sensitive source is exposed.

Supply chain and provenance

Integrityfirst-seen

Surface digest66917413a1ffe3ba

Scanned2026-11-11

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.