SkillTotal

Is Memory MCP server safe?

No malicious indicators - review capabilities before installing
Notable — review in context (capabilities are not malware):
  • Node.js filesystem read
  • Node.js filesystem write/delete
  • npm prepare hook

@modelcontextprotocol/server-memory is an AI npm_package analyzed by SkillTotal's deterministic static scanner. The scan found no malicious indicators, though 4 risky constructs are reported for review. It can: filesystem read, filesystem write, install time execution and mcp tools detected — capabilities are what the code can do, not a verdict on intent. Risk score 0/100 (low).

@modelcontextprotocol/server-memory 2026.8.31

npm_package · npm:@modelcontextprotocol/server-memory
LOW
0
/ 100 risk score
Snapshot · scanned Sep 24, 2026 · @modelcontextprotocol/server-memory@2026.8.31 · engine 0.53.0 / ruleset 60

Automated static-analysis result. It can contain false positives and false negatives, and is not a claim about the intent of Memory MCP server's authors. Report a false positive.

Capabilities — what this component can do (not a risk score):
filesystem readfilesystem writeinstall time executionmcp tools detected

Behavioral traits

How this component maps to the CSA agentic threat model. Descriptive — it never affects the risk score.

Tool surface
Tool Usage
Filesystem reach
Tool Execution Context
Supply-chain provenance risk
General Protections / Supply Chain

Findings (4)

MEDIUMNode.js filesystem readST-FS-NODE-READ

The component reads files from disk.

dist/index.js:54-54 
const data = await fs.readFile(this.memoryFilePath, "utf-8");

Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.

Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.

MEDIUMNode.js filesystem write/deleteST-FS-NODE-WRITE

The component writes or deletes files on disk.

dist/index.js:108-108 
await fs.writeFile(tempFilePath, lines.join("\n"));
dist/index.js:113-113 
await fs.unlink(tempFilePath).catch(() => { });

Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.

Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.

MEDIUMnpm prepare hookST-INSTALL-NPM-PREPARE

package.json has a 'prepare' script (runs on git/local installs and before publishing).

package.json:23-23 
"prepare": "npm run build",

Why it matters: Usually a build step, but confirm it doesn't fetch or run remote code.

Fix: Usually a legitimate build step; confirm it only builds and does not fetch or execute remote code.

LOWMCP tool surface detectedST-MCP-DETECTED

An MCP tool surface (manifest or tool definitions) was found.

dist/index.js:222-222 
const server = new McpServer({
dist/index.js:238-238 
server.registerTool("create_entities", {
dist/index.js:262-262 
server.registerTool("create_relations", {
dist/index.js:286-286 
server.registerTool("add_observations", {
dist/index.js:316-316 
server.registerTool("delete_entities", {
dist/index.js:341-341 
server.registerTool("delete_observations", {
dist/index.js:369-369 
server.registerTool("delete_relations", {
dist/index.js:394-394 
server.registerTool("read_graph", {
dist/index.js:416-416 
server.registerTool("search_nodes", {
dist/index.js:440-440 
server.registerTool("open_nodes", {

Why it matters: Just context — review which tools it offers and their permissions.

Fix: Review the declared MCP tools and their permissions.

Check your own component

Run the same evidence-backed scan on any MCP server, agent skill, or package.

Scan your own component

How we determine this: deterministic static analysis (regex + AST), evidence-anchored, no code execution. Methodology →