mnemo

The material explicitly states that no keys or environment variables are required. No API tokens, account credentials, or other sensitive authentication requirements are disclosed, so credential exposure and abuse risk appears low.

The material lists no remote endpoints, and the description emphasizes a 'local memory layer.' There is no factual indication that user data is sent to external services, so network egress risk appears low based on the provided material.

The system checks explicitly indicate that this tool can execute code ('executes-code'). This means it runs within local processes, which is a standard sensitive capability for MCP tools; however, the material does not show abnormal system privileges beyond its stated function, so this is rated as caution rather than high risk.

It is described as a 'persistent, local memory layer' with recall/remember/search, so it likely needs to persist and read historical memory data locally. Such local data access is functionally expected, but users should still verify storage location, retention period, and whether sensitive development information may be recorded.

A positive factor is that the source is open and auditable. However, it comes from a third-party registry, the repository has 0 stars, no declared license, and unknown maintenance status, so community validation and governance signals are weak. It is better suited for controlled review before use.