roampal-core (roampal-ai/roampal-core) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 12 tools. No publisher has claimed this listing.

C
Emerging
74/100

roampal-core

Outcome-based persistent memory MCP server for Claude Code and OpenCode. Good advice promoted, bad advice demoted. pip install roampal.

Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

roampal-ai

Source: Glama · also listed on github_topic, github_code

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Secret credentials may flow to a network call
2 flows detected: ANTHROPIC_API_KEY. We can’t prove the destination matches the brand the credential belongs to.
🔐
You'll be asked for 2 credentials: ROAMPAL_SIDECAR_KEY, ANTHROPIC_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes6 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

search_memory

Search persistent memory (current profile) across collections. Returns ranked results with metadata. WHEN TO USE • User references past conversations ("remember", "I told you", "we discussed") → query=<their words>. • Need detail beyond auto-injected context → query=<topic>. • Verify or fetch a spe

add_to_memory_bank

Permanent fact for cross-session memory: identity, preferences, goals, project context. WHEN TO USE • Identity (name, role) → tags=["identity"] • Standing preference/rule → tags=["preference"] • Persistent project fact → tags=["project"] • Effectiveness tip for this user → tags=["system_mastery"]

update_memory

Replace an existing memory_bank fact with updated content. Requires the exact doc_id from a prior search_memory result. WHEN TO USE • A stored fact is outdated (e.g., version number changed, project status updated) → update_memory • A fact needs correction or more detail → search_memory first, then

delete_memory

Remove a memory_bank entry. Stops appearing in search and dedup. No undo via MCP — call only when you're sure. WHEN TO USE • Fact wrong, stale, or causing bad responses → delete_memory. • Redundant entry superseded by a newer fact → delete_memory. WHEN NOT TO USE • Topic still relevant, only detai

score_memories

Record outcomes after a turn boundary: scores the memories that were injected, plus stores the turn's takeaway summary and any atomic facts. Fires in response to a scoring hook — a system-reminder that lists doc_ids to score and asks for an exchange_summary + exchange_outcome. Don't call without th

record_response

Store a key takeaway when the transcript alone won't capture important learning. WHEN TO USE (optional — most exchanges don't need this) • Major decisions made • Complex solutions that worked • User corrections (what you got wrong and why) • Important context that would be lost WHEN NOT TO USE • R

// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configROAMPAL_ALLOW_SUBAGENTS
configROAMPAL_DEV
configROAMPAL_PROFILE
configROAMPAL_SIDECAR_DISABLED
🔐 secretROAMPAL_SIDECAR_KEY
configROAMPAL_SIDECAR_MODEL
configROAMPAL_SIDECAR_URL
configXDG_CONFIG_HOME
configPYTHONUNBUFFERED
configROAMPAL_PLATFORM
configROAMPAL_PORT
configROAMPAL_INSPECT_ONLY
configROAMPAL_DATA_PATH
configNO_COLOR
configTERM
configOLLAMA_HOST
configROAMPAL_REEMBED_DISABLE
configROAMPAL_SUMMARIZE_MODEL
configROAMPAL_OLLAMA_URL
🔐 secretANTHROPIC_API_KEY
configROAMPAL_LMSTUDIO_URL
configROAMPAL_SIDECAR_PRIORITY
configROAMPAL_CONVERSATION_ID
configROAMPAL_SERVER_URL
configROAMPAL_TEST_DISABLE_WAL
configROAMPAL_USE_SERVER
configROAMPAL_REEMBED_BATCH_SLEEP
configROAMPAL_EMBED_MODEL
configROAMPAL_EMBED_ONNX_FILE
configROAMPAL_ORT_THREADS
configROAMPAL_BENCHMARK_MODE
configROAMPAL_CE_ONNX_FILE
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

12/12 tools missing one or more hints — search_memory (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); add_to_memory_bank (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); update_memory (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +9 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

6/12 tools referenced in tests (50%)

Write tests that reference each tool by name so every tool has at least one test.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/roampal-ai/roampal-core)](https://m8ven.ai/mcp/roampal-ai/roampal-core)
Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.
commit: e2525490bc4cdaa8651cefbf36088ca65dcf1d2c
code hash: c9fadd6180369414c41a42454eff3b467c7fd800c4b86fedb645aebed246dcad
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client