io.github.Lyellr88/marm-mcp-server

Run a universal MCP server with AI memory and semantic search.

Source

Official Registry

Updated

2026-07-07

// securityCaution

Runs locally
Official / curated
Open source
Community-trusted

Summary

The available materials are sparse, but the tool declares no required secrets or remote endpoints and comes from an official registry with an open-source repository and recent maintenance. No clear high-risk red flags are evident, though its code-execution capability and the undisclosed scope of data used for 'memory/semantic search' warrant caution.

CredentialsLow risk

The materials explicitly state that no keys or environment variables are required; based on the available information, no API tokens, account secrets, or obvious credential-abuse surface are present.

Network egressLow risk

No remote host endpoints are declared, and the materials do not describe sending user data to external services; no explicit outbound data path is evident.

Code executionCaution

The system checks flag executes-code, indicating the tool has the standard MCP ability to execute code or spawn local processes. This is an inherent capability/risk surface for this tool class, but the materials do not show requests for system privileges beyond its stated function.

Data accessCaution

The description mentions 'advanced AI memory capabilities and semantic search,' which commonly implies reading, indexing, or persisting some data. However, the materials do not specify which files, directories, or data sources are accessed, so the data scope is insufficiently disclosed and should be verified before installation.

Supply chainCaution

Positive factors include the official registry source, an auditable open-source repository, and updates within the last year; these materially reduce risk. Points to watch are the missing README, undeclared license, and very low community adoption (0 stars), so supply-chain transparency is only moderate and the source/dependency list should be reviewed first.

Recommendations

Review the source code and dependency lockfiles before installation, focusing on undeclared network calls, telemetry, or dynamic downloads.
Run it with least privilege and restrict the working directories it can access, avoiding exposure of sensitive documents, SSH keys, or browser data.
Verify exactly what data the 'memory/semantic search' feature indexes or persists, and inspect where it is stored locally and how it can be cleared.
Prefer testing in an isolated environment first and monitor actual processes, file access, and network connections against the stated behavior.

Audited by: gpt-5.4 · 2026-06-17

// install

Copy the install command and let the AI configure it · recommended for beginners

Please install the "io.github.Lyellr88/marm-mcp-server" MCP server from askskill:
Run: claude mcp add 'io-github-lyellr88-marm-mcp-server' -- npx -y marm-mcp-server