A
licenseNot graded
qualityA
maintenancePersistent cognitive memory for AI agents. Sub-millisecond recall, fully offline, encrypted. 8 tools: recall, recall_structured, store, store_code, store_decision, search, insights, consolidate.
73
MIT
Universal AI Memory MCP Server
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Universal AI Memory MCP ServerRemember that my meeting with Alice is at 3pm."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Universal AI Memory starter
Python 3.12 local-first reference service with injected embedding, entity extraction, authorization, and vector persistence adapters. Private payload fields use AES-256-GCM; normalized entity labels are represented in the backend as HMAC-SHA-256 blind indexes. The included backend and deterministic embedder are development implementations.
Install and test
python3.12 -m venv .venv
. .venv/bin/activate
pip install -e '.[test]'
pytestTests are in-process and make no network requests. openapi.yaml is included in the wheel as universal_memory/openapi.yaml.
Related MCP server: Memory MCP
Run the HTTP API
Provide two distinct base64 keys and a non-empty bearer API key. Key-generation commands print secrets to the terminal; store real values in a secret manager, not source or logs.
export UNIVERSAL_MEMORY_ENCRYPTION_KEY="$(openssl rand -base64 32)"
export UNIVERSAL_MEMORY_INDEX_KEY="$(openssl rand -base64 32)"
export UNIVERSAL_MEMORY_API_KEY="$(openssl rand -hex 32)"
universal-memory-apiThe API binds to 127.0.0.1:8000. Every operation requires Authorization: Bearer $UNIVERSAL_MEMORY_API_KEY. Runnable mode grants that key read, write, and delete capabilities. Embedded applications must inject both a manager and an AuthorizationPolicy into create_app; omitting a policy denies all requests. A recognized credential without the operation's capability receives 403, while a missing or invalid credential receives 401.
curl -H "Authorization: Bearer $UNIVERSAL_MEMORY_API_KEY" \
-H 'Content-Type: application/json' \
-d '{"content":"Met Alice at launch","metadata":{"project":"demo"}}' \
http://127.0.0.1:8000/storeRun MCP
MCP tools are independently gated as read, write, and delete. No capability is granted by default. The local stdio launcher accepts an explicit comma-separated capability set:
export UNIVERSAL_MEMORY_MCP_CAPABILITIES=read,write,delete
universal-memory-mcpUse create_mcp_server(manager, capabilities={Capability.READ}) for a least-privilege embedded server. An MCP transport with per-client authentication should construct separately scoped sessions rather than sharing ambient capabilities.
Data and validation model
A store request may provide content, strict-JSON metadata, an encrypted source, a timezone-aware event_timestamp, and an optional ID. created_at is always service generated. Event chronology uses event_timestamp. Entity labels extracted during storage are encrypted in the payload and exposed only to authorized responses; filters use keyed blind indexes.
VectorStoreManager is the enforcement boundary even when HTTP/MCP schemas are bypassed. Default caps are: content 65,536 UTF-8 bytes, source 2,048 bytes, ID 256 bytes, canonical metadata 65,536 bytes and depth 12, 64 entities of 256 bytes each, 4,096 vector dimensions, and 10,000 records. Metadata must be acyclic strict JSON with string object keys and finite numbers. Validation and canonicalization occur before embedding. Limits can be reduced through MemoryLimits.
ID and entity selectors cannot be combined. Delete-by-entity authenticates complete records before trusting blind indexes or IDs. Malformed, unauthenticated, or corrupt records produce a sanitized domain error and are not used for sorting, scoring, or deletion.
Security boundaries
Content, metadata, source, event timestamp, and raw entity labels are encrypted in the payload.
Vectors are not encrypted and may leak semantic information. IDs, ingestion/event timestamps, nonce, ciphertext length, vectors, and HMAC entity indexes are visible to the backend.
Clear created/event timestamps plus digests of the vector and entity-index set are encoded canonically into AES-GCM associated data. This authenticates those fields; it does not make them private.
Blind indexes hide raw labels but permit equality correlation. Use an independent high-entropy index key.
The API uses bearer authentication, not transport encryption. Keep the default loopback binding or add trusted TLS before crossing a network boundary.
The in-memory backend loses records on restart and is not suitable for multi-process or production deployment. Production adapters also need durable atomic capacity enforcement, key rotation, auditing, and operational controls.
The service does not intentionally log plaintext or secrets. Decrypted API/MCP responses are returned only after capability checks.
Available Tools
4 toolsforgetC
Delete selected memories; requires the delete capability.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| entities | No | ||
| memory_id | No |
Output Schema
ParametersJSON Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
C2.6/5.0
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must convey behavioral traits. It discloses the need for the delete capability, but it fails to warn that deletion is irreversible or explain what happens to associated memories. The selection semantics (entities vs. memory_id) are also absent, leaving the agent unaware of potential side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, tight sentence with no wasted words, efficiently stating the core purpose. It is front-loaded with the action, though it omits necessary details that would make it complete. The brevity is appropriate, but the lack of parameter context keeps it from being a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This destructive tool has two optional parameters and no required fields, meaning it could delete a broad or narrow set of memories depending on input. The description should explain how entities and memory_id interact, but it doesn't. The presence of an output schema covers return values, but the selection semantics and irreversibility are gaps that make the description incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters1/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description is the only source of parameter meaning. It merely says "selected memories" without explaining that the entities array or memory_id parameter determines what gets deleted. This leaves both parameters completely ambiguous, and the description does not compensate for the lack of schema documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (delete) and the resource (selected memories), which distinguishes it from siblings like store, retrieve, and search. However, "selected" is vague and doesn't specify how selection occurs, leaving some ambiguity about the tool's exact scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like retrieve or search. It only notes a permission requirement (the delete capability), which is operational rather than usage context, so the agent gets no hints about appropriate scenarios or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
retrieveB
Retrieve memories; requires read and rejects ambiguous selectors.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| entities | No | ||
| memory_id | No | ||
| newest_first | No |
Output Schema
ParametersJSON Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
B3.2/5.0
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description discloses useful behavioral traits: it requires read permission and rejects ambiguous selectors. However, it doesn't state whether it is read-only, how it handles missing memories, or anything about pagination or return format beyond the ambiguous mention of selectors.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is exceptionally concise at just 9 words, front-loaded with the core action, and every word adds value. It conveys purpose, a key requirement, and a behavioral constraint without waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 4-parameter tool with no annotations, this description is too sparse. It omits usage guidance, parameter semantics, and behavioral details like non-mutating status or error handling. The existence of an output schema helps with return values, but there are significant gaps in context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters2/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description adds almost no parameter-specific meaning. It vaguely refers to 'selectors' but doesn't clarify that memory_id and entities are the selectors, and it says nothing about limit or newest_first. The description fails to compensate for the lack of schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb+resource ('Retrieve memories') and hints at a distinct behavior ('rejects ambiguous selectors'). However, it doesn't explicitly differentiate from the sibling 'search' tool, which also retrieves memories, so sibling differentiation is weak.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines3/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'rejects ambiguous selectors' implies this tool is for direct, unambiguous retrieval when you have exact memory IDs or entities, but it doesn't explicitly state when to use it over 'search' or provide alternatives. Usage context is implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
searchC
Search memories; requires the read capability.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| query | Yes | ||
| entities | No |
Output Schema
ParametersJSON Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
C2.7/5.0
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses a key behavioral trait by requiring the read capability, implying a read-only operation. However, it does not elaborate on search semantics (e.g., fuzzy vs. exact) or potential side effects, leaving gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that front-loads the core action and includes a useful prerequisite. It wastes no words, though its briefness borders on under-specification.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is incomplete for the tool's complexity. It doesn't explain when to use search vs. retrieve, how the query/limit/entities parameters affect results, or any behavioral nuances. The presence of an output schema mitigates the need for return-value explanation, but other context is lacking.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters1/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description makes no mention of the parameters (query, limit, entities). It provides zero added meaning beyond the schema's structural definitions, failing to compensate for the lack of parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the tool's action ('Search') and resource ('memories'), making its purpose clear. It does not explicitly differentiate from the sibling tool 'retrieve', but the verb 'search' implies query-based lookup, which subtly distinguishes it.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus the sibling tools (store, retrieve, forget). It only mentions a prerequisite ('requires the read capability'), which is not usage direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
storeB
Encrypt and store a memory; requires the write capability.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| source | No | ||
| content | Yes | ||
| metadata | No | ||
| memory_id | No | ||
| event_timestamp | No |
Output Schema
ParametersJSON Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
B3.1/5.0
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry behavioral transparency. It does disclose two behaviors: encryption and the need for write capability. However, it omits other crucial behaviors such as whether storing overwrites existing memories, how memory_id is used, or return value expectations, leaving notable gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence, front-loaded with the action and resource. It contains no filler or redundant information, making it appropriately sized for a tool with a clear primary purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with five parameters and an output schema, the description is under-specified. It fails to mention behavior on existing memory_id, the meaning of metadata or event_timestamp, or any return value details. The lack of annotations further reduces context, leaving the description incomplete for an agent to use correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters1/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, meaning the description does not explain any of the five parameters. While parameter names (e.g., content, metadata) are somewhat self-explanatory, the description fails to clarify semantics like the role of memory_id, event_timestamp, or source. It does not compensate for the low coverage at all.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: encrypting and storing a memory. The verb 'store' is specific, and 'memory' identifies the resource. It implicitly distinguishes itself from sibling tools (retrieve, search, forget) which handle reading and deletion.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. The only extra note, 'requires the write capability,' is a permission prerequisite, not usage context. There are no explicit statements about when to choose this over retrieve, search, or forget.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
B3.3/5.0
Disambiguation4/5
Store and forget are clearly distinct, while retrieve and search both involve reading but serve different purposes: retrieve fetches by specific selector, search handles broader queries. The descriptions help distinguish them, though the names alone could be slightly ambiguous.
Naming Consistency5/5
All four tools use a single lowercase verb (store, retrieve, search, forget), following a consistent imperative style. There are no prefixes, suffixes, or mixed conventions.
Tool Count5/5
Four tools is a compact and appropriate scope for a memory server, covering the essential operations without bloat. Each tool has a clear role.
Completeness4/5
The core memory lifecycle is covered: create (store), read (retrieve and search), and delete (forget). Missing is an update operation, but that may be acceptable for immutable memory entries; otherwise the set is complete.
Maintenance
ActivitySlowing
ResponsivenessNo issues
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Private-by-default, local-first memory/context/task orchestrator for MCP apps and agents.
Shared, governed long-term memory for AI agents across tools and sessions via MCP and REST.
Persistent memory for AI agents. Semantic search, memory graph, W3C DID identity.
Governed personal world model and memory for your AI agent. Pair once, connect over MCP.
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceProvides persistent AI agent memory using a local vector database for long-term semantic storage and short-term session scratchpads. It enables low-latency memory operations including search, storage, and bulk management without external cloud dependencies.
- AlicenseNot gradedqualityCmaintenanceProvides persistent, local-first AI memory across sessions via MCP tools for storing, searching, and retrieving context from past interactions.1MIT
- AlicenseNot gradedqualityAmaintenanceLocal-first, encrypted memory for AI agents, with cryptographic forgetting.3Apache 2.0
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/vigneshsai890/universal-ai-memory'
If you have feedback or need assistance with the MCP directory API, please join our Discord server