MCP server

LinkLore

mcp:linklore/linklore-mcp

AI-native structured memory for agents (MCP). Built for agents, not humans.

awesome-mcp-servers Glama MCP Registry

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 26, 2026, 12:38 UTC at 10d304a

findings

high

highest severity

threat classes

155

files scanned

45/45

checks satisfied

package advisories

Why this verdict

plugin plugin Suspicious

suspicious: unverified finding plugin:plugin:plugin/.mcp.json:4:SUPPLY

skill plugin/skills/getting-started No issues found

benign: 13 checks satisfied, no findings for skill:plugin/skills/getting-started

Security findings 1

Supply chain

highUnverifiedmedium confidence

The plugin's MCP config launches the unpinned PyPI package 'llre' via uvx, so whatever version is current at runtime is fetched and executed; the package name also differs from the plugin name 'linklore'.

plugin/.mcp.json:4-5

"command": "uvx"

conceal:remotevector:metadata

Open questions 1

What the analysis could not settle from the code alone.

The manifest names the repository linklore-mcp and the homepage linklore.io, but the launched package is `llre`. Does the PyPI package `llre` actually belong to LinkLore?

Supply chain