63
/ 100
1 month ago
glama

hmem

Enables persistent, portable memory for AI agents across sessions, devices, and providers with token-efficient 5-level lazy loading and automatic session capture.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Secret credentials may flow to a network call
1 flow detected: OPENAI_API_KEY. We can’t prove the destination matches the brand the credential belongs to.
⚠️
Known vulnerabilities in dependencies: 1 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
⚠️
Tests do not pass
Either the test suite is broken or the code regressed. Either way the published behaviour can’t be verified by the publisher’s own tests.
🔐
You'll be asked for 3 credentials: CODEX_API_KEY, DEEPSEEK_API_KEY, OPENAI_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies1 high3 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@earendil-works/pi-coding-agent@0.74.0GHSA-jfgx-wxx8-mp94

Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts

low@earendil-works/pi-coding-agent@0.74.0GHSA-7v5m-pr3q-6453

Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization bypass

low@earendil-works/pi-coding-agent@0.74.0GHSA-mqxh-6gq7-558m

Pi Agent: Pi loads project-local extensions without approval

low@earendil-works/pi-coding-agent@0.74.0GHSA-r95r-rj6r-c39x

Pi Agent: Race condition in Pi auth.json writes could expose stored credentials

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configCLAUDECODE
configCLAUDE_CODE_SESSION_ID
🔐 secretCODEX_API_KEY
configCODEX_SESSION_ID
🔐 secretDEEPSEEK_API_KEY"checkpointApiKeyEnv": ""
configHMEM_ACTIVE_PROJECT
configHMEM_DEPTH
configHMEM_HARNESS
configHMEM_NO_SESSIONE Error 158 spurious O-entries created when Haiku MCP lacked guard
configHMEM_PATH"": "C:/Users/YOUR_USERNAME/.hmem/Agents/DEVELOPER/DEVELOPER.hmem"
configHMEM_PROJECT_DIR"": "/home/yourname/.hmem",
configHMEM_SYNC_PASSPHRASEAdd to your MCP config for automatic sync on every read/write.
configLLM_MODEL
🔐 secretOPENAI_API_KEYcheckpointApiKeyEnv provider default Env var holding the API key. Defaults: ANTHROPIC_API_KEY or
configOPENAI_BASE_URL
configWSLENV
configWSL_DISTRO_NAME
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 10 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/bumblebiber-its-over-9k-z6mxgx)](https://m8ven.ai/mcp/bumblebiber-its-over-9k-z6mxgx)
commit: 0ccb04f033d55dae49d3c7ba395aff473cd1b593
code hash: 3ca7e613a8dec681140e8a156931d63553e6dd93cc83f22e089aec8fcb3b2650
verified: 6/22/2026, 12:46:57 PM
view raw JSON →