Memory MCP server. What it holds.
No credential, no file access, no outbound requests. The risk is in what the agent does with the output, not in the server. Published by MCP reference server.
The record
Taken from the official documentation linked at the bottom.
| Field | Value |
|---|---|
| Publisher | MCP reference server |
| Authentication | None. |
| What it holds | Nothing outside itself. It keeps a knowledge graph for persistent memory. |
| What that reaches | What was previously written into it. That is not access to another system, but it is a store that influences what the agent does next. |
| Risk class | Holds nothing No credential, no file access, no outbound requests. The risk is in what the agent does with the output, not in the server. |
Why it matters
Anything that can write into memory can change later behaviour. Treat it as an input to the agent rather than as a passive log.
Not whether the server is trustworthy. What it holds, and what that reaches.
What to check
Who or what can write into the store, and whether it persists across tasks that should not share context.
The same questions apply to any server in this database, which is why the MCP server security page is the general version of this page.
Holds nothing
Where this comes from.
Every field above is taken from the official documentation. Where it does not say, this page does not either.
Questions, answered.
The two questions this record answers.
What credential does the Memory MCP server hold?
Nothing outside itself. It keeps a knowledge graph for persistent memory.
What can it reach?
What was previously written into it. That is not access to another system, but it is a store that influences what the agent does next.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.