Privacy-first AI memory system with MCP server for managing user-authored memories, enabling AI agents to read/write memories with fine-grained vendor access control.
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
Fastify's connection header abuse enables stripping of proxy-added headers
Fastify's Content-Type header tab character allows body validation bypass
Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass
Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool
fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections
process.env. You'll be asked to provide them before it can run.ANTHROPIC_API_KEYCLERK_WEBHOOK_SECRETDATABASE_URLDB_PATHGOOGLE_AI_API_KEYHARNESS_DEV_DBHARNESS_DEV_HOSTHARNESS_JUDGE_MODELHARNESS_MCP_URLHARNESS_MODELREFLECT_MCP_URLREFLECT_MEMORY_API_KEYREFLECT_MEMORY_API_URLREFLECT_TEST_API_KEYREFLECT_TEST_BASE_URLREFLECT_TEST_WRITERM_AGENT_KEY_CURSOR— export ="your-cursor-key"RM_AGENT_KEY_GEMINIRM_API_KEY— export ="your-secret-api-key" # User key -- full access to all endpointsRM_BACKUP_S3_BUCKETRM_BACKUP_S3_ENDPOINTRM_BACKUP_S3_KEY_IDRM_BACKUP_S3_KEY_SECRETRM_BACKUP_S3_REGIONRM_CLUSTER_NAMING_MODELRM_COMPAT_API_KEYRM_COMPAT_BASE_URLRM_DASHBOARD_PUBLIC_URLRM_DASHBOARD_URLRM_DB_PATH— export ="/data/reflect-memory.db" # SQLite file path (default on Railway)RM_LLM_KEY_ENCRYPTION_KEYRM_LOG_SHARING_ENABLEDRM_MAX_SEATSRM_OWNER_EMAILRM_SANDBOX_MEMORY_CAPRM_SLACK_AGENT_MODELRM_SLACK_ENVRM_SMOKE_API_KEYRM_SMOKE_BASE_URLRM_TENANT_IDRM_TEST_MODESEED_TEAM_NAMESTRIPE_PRICE_BUILDERSTRIPE_PRICE_PROSTRIPE_PRICE_TEAMSTRIPE_SECRET_KEYSTRIPE_WEBHOOK_SECRET[](https://m8ven.ai/mcp/van-reflect-reflect-memory-1mdeix)