MCP server

Repo Memory

mcp:yubinkim444/repo-memory

Shared, git-tracked working memory for AI agents on the same codebase.

awesome-mcp-servers Glama MCP Registry

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 26, 2026, 13:18 UTC at 167f6bd

findings

high

highest severity

threat classes

files scanned

184/184

checks satisfied

package advisories

Why this verdict

suspicious: finding mcp-server:.:src/repo_memory/store.py:174:PERSIST

Security findings 1

Persistence

highContextual riskmedium confidence

The MCP write tools (add_fact, add_decision, add_gotcha) call store.init with its default update_claude_md=True, so an agent calling a 'record a fact' tool silently creates or modifies the repo's CLAUDE.md/AGENTS.md agent instruction file, which the tool descriptions do not declare; the CLI documents this behavior and offers an opt-out, but the MCP path has none.

src/repo_memory/store.py:174

target.write_text(prefix + CLAUDE_MD_SECTION, encoding="utf-8")

vector:code

Counter-argument considered

The MCP write tools call init(root) with the default update_claude_md=True. That silently writes to the agent instruction file, and the tool docstrings do not mention it. The README documents this only for the CLI init command, so the MCP path is undeclared. The block content is benign and static, so severity is low, but the chain is concrete.

Refuted findings 2

Candidates the review stage examined and rejected, kept for transparency.

Persistence

criticalRefutedmedium confidence

The `repo-memory init` command writes a block into the repo's agent rules file (CLAUDE.md or AGENTS.md), creating it if missing, which instructs every agent entering the repo to consult and write to .ai-memory/; this is a documented, opt-out, idempotent control-plane write.

README.md:189

also appends a short discoverability section to your

Why it was refuted

The CLAUDE.md/AGENTS.md write is openly documented in the README and CLI table. It is idempotent, delimited, has an explicit opt-out, and is the tool's core discoverability feature. It is therefore not undeclared and not concealed.

Agent hijacking

mediumRefutedlow confidence

get_repo_memory renders the git-tracked decision files verbatim into LLM context, and the tool description tells agents to call it first and the README calls the memory 'ground truth', so a contributor could plant instructions that the agent will read (memory poisoning). No such payload is present here.

src/repo_memory/store.py:286

parts.append(p.read_text(encoding="utf-8").strip() + "\n")

Why it was refuted

Rendering the stored memory into LLM context is the declared core function of get_repo_memory. The finding itself concedes that no malicious payload exists. It is speculative and has no concrete source-to-sink instruction beyond the declared capability.