MCP, MCP server
io.github.chenxiaofie/memory-mcp
io.github.chenxiaofie/memory-mcp, an MCP server listed in the PlugVet directory.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
INSTALL_UNPINNED SECRETS_PATH_DOTENV PERMISSION_SHELL_DECLARED INSTALL_DOCUMENTED_INSTALLER
Why this grade
- INSTALL_UNPINNED Low
Dependencies use a range or git URL with no lockfile.
README.md, line 26
curl -LsSf https://astral.sh/uv/install.sh | sh - SECRETS_PATH_DOTENV Low
Mentions a .env file.
.gitignore, line 80
.env.local - PERMISSION_SHELL_DECLARED Note
Runs shell commands, and the manifest or description says so.
memory_mcp/hooks/session_monitor.py, line 52
result = subprocess.run( - INSTALL_DOCUMENTED_INSTALLER Note
Documentation shows an installer that pipes a download into a shell.
README.md, line 26
curl -LsSf https://astral.sh/uv/install.sh | sh
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Note
requests shell access. The manifest names this permission.
PERMISSION_SHELL_DECLARED
memory_mcp/hooks/session_monitor.py, line 52
result = subprocess.run(
memory_mcp/hooks/session_start.py, line 236
result = subprocess.run(
memory_mcp/hooks/session_start.py, line 314
proc = subprocess.Popen(
Show more
memory_mcp/hooks/session_start.py, line 330
proc = subprocess.Popen(
memory_mcp/vector/store.py, line 6
1. 使用 subprocess.Popen 启动独立编码器工作进程
memory_mcp/vector/store.py, line 34
_worker_proc: Optional[subprocess.Popen] = None
memory_mcp/vector/store.py, line 77
_worker_proc = subprocess.Popen(
DESIGN.md, line 15
| 003 | 1.2 | 陈佳俊 | 编码器改用 subprocess.Popen 独立工作进程方案 | 2026-02-08 |
Install and update
Concern
dependencies are not pinned. README documents an installer that pipes a download into a shell.
INSTALL_UNPINNED INSTALL_DOCUMENTED_INSTALLER
README.md, line 26
curl -LsSf https://astral.sh/uv/install.sh | sh
README_zh.md, line 26
curl -LsSf https://astral.sh/uv/install.sh | sh
requirements.txt, line 4
mcp>=1.0.0
Network
Pass
No network call found.
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
.gitignore, line 26
venv310/
.gitignore, line 79
*.p12
.gitignore, line 80
.env.local
Show more
.gitignore, line 81
.env.development
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 40e55250520f. requests shell access. The manifest names this permission. dependencies are not pinned. README documents an installer that pipes a download into a shell. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 40e55250520f6a5c7a3d2d98b40c5cba4b5858a1
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.