Mnemoverse Memory

It requires MNEMOVERSE_API_KEY, which is a sensitive credential. The materials do not describe token scope, storage, or least-privilege controls, so normal misuse risk exists if leaked, but requiring a key alone does not justify a high-risk rating.

The objective metadata lists remote endpoint host as 'none', but the tool requires an API key; combined with its 'long-term memory/semantic recall' description, it is reasonable to infer some communication with a backing service may occur. The materials do not disclose actual domains, payloads, or whether user memory data is sent out, so network egress transparency is limited and merits caution.

System checks indicate this MCP tool executes code or runs a local process, which is a normal MCP server capability. The provided materials show no request for elevated system privileges, shell injection patterns, or execution scope clearly disproportionate to its stated function, so this is caution rather than risk.

Its stated purpose—'Persistent long-term memory for AI agents'—implies storing and retrieving memory data over time, potentially including user-provided content. However, the materials do not specify storage location, retention policy, encryption, or access boundaries, so the data-handling scope is not sufficiently transparent.

The source is an official registry entry and an open-source repository is provided, with updates within the last year. These are positive signals that improve auditability. Although the license is not stated and community stars are low, those factors alone are not high-risk red flags, so overall supply-chain risk is relatively low.