Memory MCP Server

The memory server gives an agent state that survives the end of a session, modelled as a knowledge graph of entities, relations and observations stored locally. It is the reference implementation of a pattern almost every serious agent deployment eventually wants: not having to re-explain the same context every morning.

It also introduces a risk class the other servers in this directory do not have, and it deserves more attention than it usually gets. Memory is *writable by the agent* and *read automatically in future sessions*, which means an injection landed once can be made to persist. An attacker who gets a single instruction written into memory has achieved something closer to persistence than to a transient compromise — the payload is re-read in later sessions, in a different context, long after whatever page or issue delivered it has been forgotten.

The second issue is accumulation without review. Memory grows quietly, is rarely audited, and becomes a store of accreted assertions — some accurate, some stale, some wrong. Because the agent treats it as established fact rather than as retrieved content, an error written once propagates into decisions indefinitely, and the provenance of any given claim is usually unrecoverable.

Both problems point the same direction: memory needs the treatment of a data store, not a cache. Somewhere to look at what is in it, a way to correct it, and an expectation that it will be reviewed rather than trusted by default.