36
/ 100
1 month ago
glama

reflect-memory

Privacy-first AI memory system with MCP server for managing user-authored memories, enabling AI agents to read/write memories with fine-grained vendor access control.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Secret credentials may flow to a network call
3 flows detected: RM_AGENT_KEY_GEMINI, RM_API_KEY, RM_SMOKE_API_KEY. We can’t prove the destination matches the brand the credential belongs to.
🚨
Known vulnerabilities in dependencies: 1 critical, 2 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
⚠️
Tests do not pass
Either the test suite is broken or the code regressed. Either way the published behaviour can’t be verified by the publisher’s own tests.
🔐
You'll be asked for 12 credentials: ANTHROPIC_API_KEY, CLERK_WEBHOOK_SECRET, GOOGLE_AI_API_KEY, REFLECT_MEMORY_API_KEY, REFLECT_TEST_API_KEY, RM_API_KEY, RM_BACKUP_S3_KEY_SECRET, RM_COMPAT_API_KEY, RM_LLM_KEY_ENCRYPTION_KEY, RM_SMOKE_API_KEY, STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies1 critical2 high1 medium2 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

critical@fastify/http-proxy@11.4.1GHSA-gwhp-pf74-vj37

Fastify's connection header abuse enables stripping of proxy-added headers

highfastify@5GHSA-jx2c-rxcm-jvmq

Fastify's Content-Type header tab character allows body validation bypass

highfastify@5GHSA-mg2h-6x62-wpwc

Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass

medium@anthropic-ai/sdk@0.90.0GHSA-p7fg-763f-g4gf

Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool

fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretANTHROPIC_API_KEY
🔐 secretCLERK_WEBHOOK_SECRET
configDATABASE_URL
configDB_PATH
🔐 secretGOOGLE_AI_API_KEY
configHARNESS_DEV_DB
configHARNESS_DEV_HOST
configHARNESS_JUDGE_MODEL
configHARNESS_MCP_URL
configHARNESS_MODEL
configREFLECT_MCP_URL
🔐 secretREFLECT_MEMORY_API_KEY
configREFLECT_MEMORY_API_URL
🔐 secretREFLECT_TEST_API_KEY
configREFLECT_TEST_BASE_URL
configREFLECT_TEST_WRITE
configRM_AGENT_KEY_CURSORexport ="your-cursor-key"
configRM_AGENT_KEY_GEMINI
🔐 secretRM_API_KEYexport ="your-secret-api-key" # User key -- full access to all endpoints
configRM_BACKUP_S3_BUCKET
configRM_BACKUP_S3_ENDPOINT
configRM_BACKUP_S3_KEY_ID
🔐 secretRM_BACKUP_S3_KEY_SECRET
configRM_BACKUP_S3_REGION
configRM_CLUSTER_NAMING_MODEL
🔐 secretRM_COMPAT_API_KEY
configRM_COMPAT_BASE_URL
configRM_DASHBOARD_PUBLIC_URL
configRM_DASHBOARD_URL
configRM_DB_PATHexport ="/data/reflect-memory.db" # SQLite file path (default on Railway)
🔐 secretRM_LLM_KEY_ENCRYPTION_KEY
configRM_LOG_SHARING_ENABLED
configRM_MAX_SEATS
configRM_OWNER_EMAIL
configRM_SANDBOX_MEMORY_CAP
configRM_SLACK_AGENT_MODEL
configRM_SLACK_ENV
🔐 secretRM_SMOKE_API_KEY
configRM_SMOKE_BASE_URL
configRM_TENANT_ID
configRM_TEST_MODE
configSEED_TEAM_NAME
configSTRIPE_PRICE_BUILDER
configSTRIPE_PRICE_PRO
configSTRIPE_PRICE_TEAM
🔐 secretSTRIPE_SECRET_KEY
🔐 secretSTRIPE_WEBHOOK_SECRET
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 9 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/van-reflect-reflect-memory-1mdeix)](https://m8ven.ai/mcp/van-reflect-reflect-memory-1mdeix)
commit: c0a2e90ec132fc0d01ec014703b5d0c8b895dc56
code hash: 5d21b0e8b1b54527af6c38a4c97b55082ef896e8c408d55edd465efa86c206ed
verified: 6/11/2026, 10:54:43 AM
view raw JSON →