MCP, MCP server
SuperMemory
SuperMemory, an MCP server listed in the PlugVet directory.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 9849ccb97ca0, unchanged since the check below.
PERMISSION_DELETE_FILES SECRETS_PATH_UNCONFIRMED NETWORK_LOCALHOST SECRETS_ENV_READ
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
examples/multi_agent_orchestrator/demo.py, line 93
shutil.rmtree(tmp, ignore_errors=True) - SECRETS_PATH_UNCONFIRMED Low
The Secrets check reports a credential or environment file, but no quoted line shows a recognisable path.
packages/uall_python/client.py, line 100
self.api_key = api_key or os.environ.get("UALL_API_KEY", "dev-key-change-me") - NETWORK_LOCALHOST Note
Calls localhost only.
.cursor/skills/supermemory-agent-learning/examples.md, line 68
r = httpx.post("http://localhost:8000/memory/search", headers=headers, json={ - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
packages/uall_python/client.py, line 100
self.api_key = api_key or os.environ.get("UALL_API_KEY", "dev-key-change-me")
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
examples/multi_agent_orchestrator/demo.py, line 93
shutil.rmtree(tmp, ignore_errors=True)
scripts/release.py, line 27
return subprocess.run(cmd, cwd=ROOT, check=check, text=True)
scripts/sync_skills.py, line 30
shutil.rmtree(dest)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Note
can reach localhost.
NETWORK_LOCALHOST
.cursor/skills/supermemory-agent-learning/examples.md, line 68
r = httpx.post("http://localhost:8000/memory/search", headers=headers, json={
skills/supermemory-agent-learning/examples.md, line 68
r = httpx.post("http://localhost:8000/memory/search", headers=headers, json={
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_UNCONFIRMED
packages/uall_python/client.py, line 100
self.api_key = api_key or os.environ.get("UALL_API_KEY", "dev-key-change-me")
packages/uall_server/main.py, line 20
API_KEY = os.environ.get("UALL_API_KEY", "dev-key-change-me")
.gitignore, line 8
.supermemory/
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 9849ccb97ca0. can delete files. can reach localhost. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 9849ccb97ca00360c225bf9cddb0d81e8f47ef17
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.