Git-native project memory for AI coding agents: Markdown source of truth, reviewable, secret-safe.
Risky behavior the analysis could not rule out.
. Suspicious.claude/skills/agent-memory No issues foundinternal/adapters/claude InconclusiveThe bundled Cursor rule description instructs the agent to call memory.fetch_context at the start of every coding task and to prefer it over reading raw source files, steering agent behavior per-task, though this matches the adapter's declared purpose.
At the start of every coding task call memory.fetch_context to load current state, conventions, and prior decisions.
Candidates the review stage examined and rejected, kept for transparency.
The Cursor adapter's user-invoked `agent-memory install cursor` writes an agent-instruction rule file into .cursor/rules (project or user-global), an agent control-plane location; this is the adapter's declared purpose and does not write to the .agent-memory store, so the DET contradiction with the memory-store claims is spurious.
const rulesDirRel = ".cursor/rules"
The .cursor/rules write happens only through the explicit Cursor adapter install, which the package documents as its purpose. It is not a memory-store write, so the detector contradiction is spurious.
The Gemini adapter's explicit install command writes a GEMINI.md agent-context file at the project root (not overwritten unless Force); this is the adapter's declared function, not a contradiction of the memory-store write claims.
const geminiFile = "GEMINI.md"
GEMINI.md is written only by the explicit Gemini adapter install, which the package documents as its purpose. It skips existing files unless Force is set and does not write to the memory store.
The npm launcher downloads a prebuilt binary and its checksums file from the same GitHub release URL, so the integrity check has no independent trust anchor; it caches the binary with mode 0755 and executes it with spawnSync, giving a download-write-execute chain on first run.
fs.writeFileSync(tmp, bin, { mode: 0o755 });Fetching and running a prebuilt binary is the launcher's declared core capability. The download is version-pinned to the project's own release and SHA-256 verified before it is cached and executed.
The npm launcher downloads a prebuilt binary at first run from GitHub releases, checks it only against a checksum file from the same release origin, caches it under ~/.cache and then executes it with all arguments; the behaviour is documented in the header comments but means the code that runs is not in the npm package.
const bin = await fetch(`${base}/${asset.name}`);The first-run download from the project's own GitHub release is the declared function of this launcher. It is version-pinned and checksum-verified, and the package description states that the binary is not shipped in the package.
The install adapter writes or merges the repo's .mcp.json (agent MCP control-plane config) to register the agent-memory stdio server; this is the artifact's own server, documented in code comments, non-destructive, and run only via an explicit install command, so it is plausibly necessary but still a control-plane write.
const mcpConfigFile = ".mcp.json"
The .mcp.json write only registers the project's own stdio server, during an explicit install. The merge is non-destructive and documented in code comments, so the contradiction with the SKILL.md claim is spurious.
The undeclared eval harness passes the user-supplied $AGENT_CMD environment string plus a task through shell eval; this is dynamic execution, but it is the script's stated purpose and the command comes from the operator.
eval "$AGENT_CMD \"\$TASK\""
The eval in the dev-only benchmark harness runs an operator-supplied $AGENT_CMD, which the script header documents as its purpose. The task text is passed as an escaped variable, and no untrusted source reaches the sink.
The `agents` adapter's install command writes an embedded AGENTS.md rules file into the project root (an agent control-plane file). This is a user-invoked, declared install feature, and it does not actually contradict the listed claims about agent writes under .agent-memory/. It is flagged only as a persistent agent-instruction write.
const agentsFile = "AGENTS.md"
AGENTS.md is written only by the explicit `install agents` adapter, and the package documents this as its purpose. It does not touch .agent-memory, so the detector's contradiction with the store-write claims is spurious.
The explicit `merge-driver --install` command registers a git merge driver in the repo's git config and writes .gitattributes, a host-config write; it is user-invoked and documented in the command help.
if err := agentgit.InstallMergeDriver(root); err != nil {The git config and .gitattributes writes happen only under the explicit `merge-driver --install` flag. The command help documents both, so this is declared, user-invoked setup.
The explicit `merge-driver --install` command writes a .gitattributes entry and registers a merge driver in the repo's git config, so git will later run the agent-memory binary on merges; this is a documented, user-invoked setup feature.
registers "merge.agent-memory.driver" in the repo's git config
The driver registration is user-invoked via `--install`, and the command's own help documents the .gitattributes and git config writes. Nothing is concealed.
The memory server ships code that writes a custom merge driver (invoking the `agent-memory` binary from PATH) into the repository's local .git/config. This is a host-config write beyond the declared memory tools (propose_update/status/fetch_context/ping), but it is openly documented and plausibly part of the memory-merge feature.
InstallMergeDriver registers the section-aware merge driver in the repo's
InstallMergeDriver is the documented, user-invoked implementation of the merge-driver install. Its comments state that it writes local git config and is run once per clone, so it is declared rather than concealed.
The npm launcher is declared to fetch a prebuilt binary from a remote source at runtime and run it, so the code that actually executes is not shipped in the package and its source and integrity cannot be verified here.
Thin launcher that fetches the prebuilt agent-memory binary.
The package description openly declares the launcher's fetch-the-binary behavior. That is the declared core capability, not a concealed one, and the download is version-pinned and checksum-verified in the launcher code.
The eval benchmark script documents running the agent with --dangerously-skip-permissions, an undeclared permission-bypass suggestion; it appears only in a comment as an example for a dev-only evaluation harness.
claude -p --dangerously-skip-permissions $AM_MCP --model sonnet
The flag appears only inside a header comment as an example of how an operator might set AGENT_CMD for headless Claude in a dev eval harness. The script never applies it itself and nothing instructs an agent to use it.
The server contains a git clone helper that can fetch from a remote URL into external 'landscape' stores whose content is later blended into agent context; this is mutable remote content that the declared tool set does not mention. The comments indicate pinning and lockfile controls, and sandboxed copying (symlinks rejected).
source may be a remote URL or a
This is a plain git clone helper for the documented landscape-store and sync feature. It pins revisions and does not auto-ingest remote content as instructions. The multi-store capability is documented in the code comments.
Parts of the artifact the static analysis could not fully examine.
no_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_go go file: string-literal extraction onlyno_dataflow_for_dynamic_code line 102: invoked code is not structurally extractedno_dataflow_for_go go file: string-literal extraction only