Octopoda-OS (RyjoxTechnologies/Octopoda-OS) is an MCP server listed on the M8ven Trust Index. It scores 22 out of 100, grade F. It declares 34 tools. No publisher has claimed this listing.

Warning

22/100

Octopoda-OS

Item: Octopoda-OS
Rating: 22
Author: M8ven

The open-source memory and observability layer for AI agents — persistent memory, loop detection, hash-chained audit trails, and a live dashboard, automatic on pip install.

→ RyjoxTechnologies/Octopoda-OS · listed on github_topic

Warning. Serious findings were identified. Review the full report before connecting. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

RyjoxTechnologies

Source: github_topic

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

GitHub

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

🚨

Secret credentials may flow to a network call

2 flows detected: STRIPE_SECRET_KEY. We can’t prove the destination matches the brand the credential belongs to.

🚨

Reads files from sensitive locations

Touches: /root/octopoda/.env, /root/octopoda/.env, /root/octopoda/.env

🚨

Code appears obfuscated

35 files are unreadable to a human reviewer. Cannot audit what they do.

🔐

You'll be asked for 14 credentials: OCTOPODA_API_KEY, RESEND_API_KEY, OCTOPODA_ENCRYPTION_KEY, STRIPE_SECRET_KEY, OPENAI_API_KEY, OCTOPODA_PLATFORM_OPENAI_KEY, OCTOPODA_OPENAI_API_KEY, OCTOPODA_ANTHROPIC_API_KEY, SYNRIX_HMAC_SECRET, OCTOPODA_LICENSE_KEY, SYNRIX_MAX_VERSIONS_PER_RUNTIME_KEY, SYNRIX_API_KEY, SYNRIX_LICENSE_KEY, STRIPE_WEBHOOK_SECRET

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes34 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

octopoda_remember

Store a persistent memory for an AI agent. Memory is stored in the cloud and persists across sessions.

octopoda_recall

Retrieve a stored memory by key.

octopoda_search

Search an agent's memories by key prefix.

octopoda_recall_similar

Search an agent's memories by meaning (semantic similarity). Finds memories related to the query even if the exact words don't match.

octopoda_recall_history

Get the full timeline of how a memory changed over time. Shows all versions with timestamps for when each was valid.

octopoda_related

Query the knowledge graph for an entity and its connections. Shows what other entities are related and how.

octopoda_snapshot

Take a snapshot (checkpoint) of all agent memory. Use before risky operations.

octopoda_restore

Restore agent memory from a snapshot. Reverts to the saved state.

octopoda_share

Write to shared memory that other agents can read.

octopoda_read_shared

Read from shared memory written by any agent.

octopoda_list_agents

List all registered agents in your Octopoda account.

octopoda_agent_stats

Get performance statistics and analytics for an agent.

octopoda_process_conversation

Process a conversation turn — automatically extracts and stores memories. Call this after your agent responds to learn from the conversation.

octopoda_get_context

Get relevant context from memory before generating a response. Returns memories related to the query, ready to inject into your prompt.

octopoda_log_decision

Log an agent decision with full audit trail.

octopoda_forget

Explicitly forget (delete) a specific memory. Use when a memory is no longer relevant or correct.

octopoda_forget_stale

Forget old memories to keep the agent's knowledge fresh. Critical memories are always preserved regardless of age.

octopoda_memory_health

Check the health of an agent's memory. Returns a score from 0-100 with actionable recommendations for improving retrieval quality.

octopoda_consolidate

Find and optionally merge duplicate memories. Duplicates degrade retrieval quality because similar but stale memories surface alongside current ones.

octopoda_loop_status

Get comprehensive loop detection status for an agent. Combines 5 signals: write similarity, key overwrites, velocity spikes, alert frequency, and goal drift. Returns severity (green/yellow/orange/red) with actionable recovery suggestions.

octopoda_loop_history

Get loop detection alert history for pattern analysis. Shows how loop behavior has evolved over time, broken down by hour and type. Automatically detects recurring patterns.

octopoda_send_message

Send a message from one agent to another. Creates an inbox/outbox system for asynchronous agent-to-agent communication.

octopoda_read_messages

Read messages from an agent's inbox.

octopoda_broadcast

Broadcast a message to all agents. Any agent can read broadcasts.

octopoda_set_goal

Set a goal for an agent with optional milestones. Goals are tracked persistently and integrate with drift detection.

octopoda_get_goal

Get the current goal and progress for an agent.

octopoda_update_progress

Update progress on an agent's current goal.

octopoda_search_filtered

Search memories with combined filters. All filters are AND-combined.

octopoda_status

One-call diagnostic: is Octopoda actually working?

remember_memory

Store a memory that persists across conversations. Use this to save user preferences, facts, decisions, or any important information.

recall_memory

Retrieve a specific memory by its key. Use this when you need to look up a previously stored piece of information.

search_memories

Search all memories by meaning. Use this to find relevant information when you don't know the exact key. Returns the most semantically similar matches.

find_related

Find entities related to a given entity in the knowledge graph. Use this to discover connections between people, places, concepts, etc.

get_history

Get all historical versions of a memory. Use this to see how a piece of information has changed over time.

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

🔐 secretOCTOPODA_API_KEYAlready there

configOCTOPODA_LOCAL_MODESet to 1 to force local mode regardless of the API key

configOCTOPODA_DATA_DIR

configSYNRIX_DATA_DIRLocal data directory (SQLite + embeddings)

configOCTOPODA_TEST_PYTHON

configOCTOPODA_MCP_BIN

configSYNRIX_RATE_LIMIT_RPM

configSYNRIX_PER_AGENT_RPM

configOCTOPODA_VERSION

configSYNRIX_CORS_ORIGINS

configOCTOPODA_AUDIT_RETENTION_DAYS

configOCTOPODA_STALL_THRESHOLD_SEC

configOCTOPODA_STALL_CHECK_INTERVAL

configOCTOPODA_OWNER_TENANT_IDS

configSYNRIX_AUTH_DISABLED

configOCTOPODA_VERIFY_FILE

🔐 secretRESEND_API_KEY

configRESEND_FROM_EMAIL

configOCTOPODA_PLATFORM_FREE_LIMIT

🔐 secretOCTOPODA_ENCRYPTION_KEY

🔐 secretSTRIPE_SECRET_KEY

🔐 secretOPENAI_API_KEY

configOCTOPODA_AGENT_IDRunning multiple scripts that should share one brain? Set =my-agent so they write to the same memory. On slow networks, raise OCTOPODA_RECALL_TIMEOUT=5 (seconds).

configSYNRIX_SERVER_URL

configOCTOPODA_EMBEDDING_MODELLocal embedding model (~33 MB, CPU)

configSYNRIX_ENGINE_DOWNLOAD_BASE_URL

configOCTOPODA_LLM_PROVIDERopenai, anthropic, or ollama

configOCTOPODA_LLM_MAX_CONCURRENT

configOCTOPODA_LLM_TIMEOUT

🔐 secretOCTOPODA_PLATFORM_OPENAI_KEY

configOCTOPODA_OLLAMA_URL

configOCTOPODA_OLLAMA_MODEL

🔐 secretOCTOPODA_OPENAI_API_KEYYour OpenAI key for local fact extraction

configOCTOPODA_OPENAI_MODEL

configOCTOPODA_OPENAI_BASE_URL

🔐 secretOCTOPODA_ANTHROPIC_API_KEY

🔐 secretSYNRIX_HMAC_SECRET

🔐 secretOCTOPODA_LICENSE_KEYLicense key for higher tiers (optional)

configOCTOPODA_PG_POOL_MIN

configOCTOPODA_PG_POOL_MAX

🔐 secretSYNRIX_MAX_VERSIONS_PER_RUNTIME_KEYCap on runtime: / metrics: key versions

configOCTOPODA_API_URL

configOCTOPODA_QUIET

configSYNRIX_BACKEND

configSYNRIX_SQLITE_DB

configSYNRIX_LATTICE_FILE

configSYNRIX_MAX_NODES

configSYNRIX_API_HOST

configSYNRIX_API_PORT

configSYNRIX_API_ENABLED

configSYNRIX_DASHBOARD_PORT

configSYNRIX_DASHBOARD

🔐 secretSYNRIX_API_KEY

🔐 secretSYNRIX_LICENSE_KEY

configSYNRIX_GC_ENABLED

configSYNRIX_GC_INTERVAL_HOURS

configSYNRIX_GC_METRICS_DAYS

configSYNRIX_GC_EVENTS_DAYS

configSYNRIX_GC_ALERTS_DAYS

configSYNRIX_GC_AUDIT_DAYS

configSYNRIX_GC_MAX_SNAPSHOTS

configSYNRIX_LOG_LEVEL

configOCTOPODA_RECALL_TIMEOUTRunning multiple scripts that should share one brain? Set OCTOPODA_AGENT_ID=my-agent so they write to the same memory. On slow networks, raise =5 (seconds).

configOCTOPODA_WRITE_TIMEOUT

configOCTOPODA_WRITE_RETRIES

configOCTOPODA_WRITE_RETRY_BACKOFF

configOCTOPODA_WRITE_RETRY_CAP

🔐 secretSTRIPE_WEBHOOK_SECRET

configOWNER_NOTIFICATION_EMAIL

configSTRIPE_PRICE_PRO_MONTHLY

configSTRIPE_PRICE_PRO_ANNUAL

configSTRIPE_PRICE_BUSINESS_MONTHLY

configSTRIPE_PRICE_BUSINESS_ANNUAL

configSTRIPE_PRICE_SCALE_MONTHLY

configSTRIPE_PRICE_SCALE_ANNUAL

configOCTOPODA_TENANT_POOL_MAX

configAUDIT_V2_ASYNC

configAUDIT_V2_QUEUE_MAX

configAUDIT_V2_BATCH_MAX

configAUDIT_V2_FLUSH_MS

configOCTOPODA_TENANT_ID

configAUDIT_V2_POOL_MAX

configSYNRIX_HEARTBEAT_INTERVAL_SECDaemon heartbeat interval (raise for low-resource boxes)

configSYNRIX_ANOMALY_INTERVAL_SEC

configSYNRIX_METRICS_INTERVAL_SEC

configSYNRIX_RECOVERY_INTERVAL_SEC

configSYNRIX_GC_RUNTIME_AGENTS_DAYS

configOCTOPODA_LOOP_INTEL_V2_TENANTS

configOCTOPODA_CIRCUIT_BREAKER_INTERVAL

configOCTOPODA_CIRCUIT_BREAKER_WINDOW

configOCTOPODA_CIRCUIT_BREAKER_DEFAULT_USD_PER_MIN

configOCTOPODA_CIRCUIT_BREAKER_DISABLED

Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.

deployDATABASE_URL

deploySENTRY_DSN

deploySENTRY_TRACES_SAMPLE_RATE

deploySENTRY_ENVIRONMENT

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

34/34 tools missing one or more hints — octopoda_remember (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); octopoda_recall (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); octopoda_search (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +31 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

15/34 tools referenced in tests (44%)

Write tests that reference each tool by name so every tool has at least one test.

No access to sensitive paths

Reads sensitive paths: /root/octopoda/.env, /root/octopoda/.env, /root/octopoda/.env

Remove reads of sensitive system paths. If you genuinely need them, document why in the README.

No eval / new Function

6 eval() or new Function() calls — dynamic code execution

Replace eval / Function with explicit parsing or safer alternatives.

Readable source code

35 files are minified or bundled, which is usually build output rather than concealment

Ship unminified, readable source.

Secrets not logged

8 secret values sent to logger.error/print/logger.warning/logger.info

Redact or omit secret values from log output.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/ryjoxtechnologies/octopoda-os?variant=verified)](https://m8ven.ai/mcp/ryjoxtechnologies/octopoda-os)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: 583ddf190df809d7380afd6d07ee4095086773c2

code hash: 5d3e93a293e667bc714ad3eda5e65d97edd696e9188b45118bdd423966ae916e

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client