MCPVet
Low
npm · 3 files analyzed
@modelcontextprotocol/server-memory
Minor capabilities, nothing alarming.
View source ↗Environment variables (config / keys) 1
AI review
This is an official Anthropic MCP server for persistent memory using a local knowledge graph. It only reads the MEMORY_FILE_PATH environment variable to determine where to store data locally, and does not access, exfiltrate, or transmit any secrets or credentials. All tool descriptions match the stated purpose of managing a local knowledge graph.
- low Environment variable access is benign — The code reads process.env.MEMORY_FILE_PATH solely to configure local file storage path. No secrets, credentials, or sensitive data are read or transmitted.
Model: deepseek-chat
Static findings
Environment variables (config / keys) · Reads environment variables (config / API keys)
low
dist/index.js:12
if (process.env.MEMORY_FILE_PATH) {
Scanning every extension your team installs?
Pro & Team add monitoring, private scans, and a CI gate for unsafe extensions.
MCPVet is a heuristic aid, not a security guarantee. A clean grade does not prove an extension is safe; always review code and instructions you don't trust.