Back to MCP Trust Indexm8ven
72
/ 100
23 days ago
glama

memhippo

Provides persistent, shared memory for AI agents by capturing conversations verbatim, distilling facts and summaries, and enabling retrieval through search, timeline, details, and explicit remember tools.

→ memhippo/memhippo· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Known vulnerabilities in dependencies: 2 critical, 2 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
// known CVEs in dependencies2 critical2 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@3GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

criticalvitest@3GHSA-9crc-q9x8-hgqq

Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening

high@modelcontextprotocol/sdk@1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configMEMHIPPO_DEDUP_WINDOW_MS— 120000 Ingest content-hash dedup window
configMEMHIPPO_DISTILL_GRACE_MS— 3600000 backfill's liveness guard: how recent a transcript's last event can be before its synthetic session_end is deferred as still-live
configMEMHIPPO_DISTILL_MODEL— sonnet Model for session distillation
configMEMHIPPO_FACTS_PER_CHAPTER— 3 Max durable facts kept per distill call (spec §7; usually 0)
configMEMHIPPO_HOME— ~/.memhippo Data dir (raw tree, db, logs)
configMEMHIPPO_HOOK_DEBUG— unset Hooks flush buffered debug output to stderr
configMEMHIPPO_NO_PAGER— MEMHIPPO_PAGER / less -R / unset Pager for read/last
configMEMHIPPO_OPENCLAW_DIR— ~/.openclaw/agents OpenClaw session dir to watch
configMEMHIPPO_OPENCLAW_IDLE_MS— 1800000 Idle gap that closes an OpenClaw window
configMEMHIPPO_OPENCLAW_POLL_MS— 60000 OpenClaw poll interval
configMEMHIPPO_PAGER— / MEMHIPPO_NO_PAGER less -R / unset Pager for read/last
configMEMHIPPO_PORT— 7337 Daemon port (localhost only)
configMEMHIPPO_RECONCILE_MODEL— haiku Model for fact-reconcile verdicts
configMEMHIPPO_SWEEP_INTERVAL_MS— 600000 Chapter-close trigger sweep interval
configMEMHIPPO_TOPUP_THRESHOLD— 0.55 Min hybrid score for a mid-session top-up
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/memhippo-memhippo-83ml7a)](https://m8ven.ai/mcp/memhippo-memhippo-83ml7a)
commit: df7f2ef48694c5100356bbb239210ee54985e430
code hash: 3765e027012d9c3f1fcd5836843c48969635fc7a829e946ec9045335ad717228
verified: 7/8/2026, 8:45:50 AM
view raw JSON →