io.github.n24q02m/mnemo-mcp

The materials indicate an API_KEYS environment variable is required, but do not specify the target service, scope, or least-privilege model. Such keys are sensitive credentials; if over-scoped or exposed, they could be abused for unauthorized memory sync or related API usage.

No remote host is listed in the registry metadata, but the description mentions 'cross-machine sync,' implying possible outbound data transfer to another device or service. The provided materials do not identify destinations, payloads, or transport protections, so source code or runtime configuration should be reviewed.

System checks indicate the tool executes code / starts local processes, which is a normal MCP capability. The available materials do not show requests for system privileges beyond what its stated 'persistent memory and search' function would typically require, so this is a caution rather than a high-risk issue.

The phrase 'Persistent AI memory with hybrid search' suggests the tool likely stores and retrieves user conversation or working memory, potentially via local databases or index files. The materials do not define data directories, retention, deletion behavior, or whether sensitive content may be synced, so the data boundary remains to be verified.

Positive factors include an official registry source, an auditable open-source repository, and updates within the past year; these materially reduce supply-chain risk. Points of caution are the missing README, undeclared license, and very low community adoption (0 stars), which limit confidence in maturity and review depth.