# com.runmemento/memento

> Local-first, LLM-agnostic memory layer for AI assistants.

- name: com.runmemento/memento
- version: 0.9.2
- connection class: L0 (run_local_package)
- trust: 84/100
- quality: –/100 (not scored)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/com.runmemento%2Fmemento
- tools: https://api.protogrid.dev/v1/servers/com.runmemento%2Fmemento/tools

**Runs on your machine: something must execute the package.** Only local packages are published (npm, PyPI, OCI, …). The registry never executes them, so tools are unknown until you run it.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "memento": {
      "command": "npx",
      "args": [
        "-y",
        "@psraghuveer/memento@0.9.2",
        "serve"
      ]
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: n/a
- freshness: 65
- provenance: 85
- drivers: +repository +dns-namespace +website ~liveness-unmeasured ~updated-156d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality –/100 (not scored)

Not scored: fewer than three checks apply, usually because no remote answered a credential-free probe or the server is a local package.

### protocol: n/a (weight 25)

- n/a `protocol.modern`, `protocol.stateless`, `protocol.transport`, `protocol.list_ttl`: no remote answered a protocol handshake (not probed yet, unreachable, or local-only)

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: n/a (weight 30)

- n/a `tools.descriptions`, `tools.description_length`, `tools.schemas`, `tools.annotations`, `tools.directory_hints`, `tools.token_cost`, `tools.api_dump`: tool list unknown (behind auth, not probed, or empty)

### stability: n/a (weight 15)

- n/a `stability.changes`, `stability.rug_pull`: tool list unknown

### dependencies: 33 (weight 15)

- fail `deps.known_vulns`: 10 advisories to act on (malicious, or rated high or critical with a fix available): GHSA-3vhc-576x-3qv4 in hono@4.6.14 (indirect, fixed in 4.11.4), GHSA-88fw-hqm2-52qc in hono@4.6.14 (indirect, fixed in 4.12.25), GHSA-f67f-6cw9-8mq4 in hono@4.6.14 (indirect, fixed in 4.11.4), ...; 41 more of lower severity or without a fix
- fail `deps.mcp_sdk_version`: @modelcontextprotocol/sdk 1.29.0 has 1 known advisory (GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.31.0 or later
- pass `deps.resolvable`: @psraghuveer/memento@0.9.2 resolved: 228 packages

- tools: unknown
- badge: [![protogrid quality](https://protogrid.dev/badge/com.runmemento/memento.svg)](https://protogrid.dev/servers/com.runmemento/memento)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Dependencies

- npm @psraghuveer/memento@0.9.2: resolved, 227 dependencies, MCP SDK @modelcontextprotocol/sdk 1.29.0
  - GHSA-wc8c-qw6v-h7f6 (high) in `` @hono/node-server@1.13.7 ``, direct, fixed in `` 1.19.10 ``, advisory summary: "@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware" https://osv.dev/vulnerability/GHSA-wc8c-qw6v-h7f6
  - GHSA-6qxp-vccf-f47h (high) in `` @modelcontextprotocol/sdk@1.29.0 ``, indirect, fixed in `` 1.31.0 ``, advisory summary: "MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server" https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h
  - GHSA-3vhc-576x-3qv4 (high) in `` hono@4.6.14 ``, indirect, fixed in `` 4.11.4 ``, advisory summary: "Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback)" https://osv.dev/vulnerability/GHSA-3vhc-576x-3qv4
  - GHSA-88fw-hqm2-52qc (high) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.25 ``, advisory summary: "hono: CORS Middleware reflects any Origin with credentials when \`origin\` defaults to the wildcard" https://osv.dev/vulnerability/GHSA-88fw-hqm2-52qc
  - GHSA-f67f-6cw9-8mq4 (high) in `` hono@4.6.14 ``, indirect, fixed in `` 4.11.4 ``, advisory summary: "Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth Bypass" https://osv.dev/vulnerability/GHSA-f67f-6cw9-8mq4
  - GHSA-m732-5p4w-x69g (high) in `` hono@4.6.14 ``, indirect, fixed in `` 4.10.2 ``, advisory summary: "Hono Improper Authorization vulnerability" https://osv.dev/vulnerability/GHSA-m732-5p4w-x69g
  - GHSA-q5qw-h33p-qvwr (high) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.4 ``, advisory summary: "Hono vulnerable to arbitrary file access via serveStatic vulnerability" https://osv.dev/vulnerability/GHSA-q5qw-h33p-qvwr
  - GHSA-pv5w-4p9q-p3v2 (high) in `` kysely@0.28.16 ``, indirect, fixed in `` 0.28.17 ``, advisory summary: "Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in \`JSONPathBuilder.key()\` / \`.at()\`" https://osv.dev/vulnerability/GHSA-pv5w-4p9q-p3v2
  - GHSA-f88m-g3jw-g9cj (high) in `` sharp@0.34.5 ``, indirect, fixed in `` 0.35.0 ``, advisory summary: "sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591" https://osv.dev/vulnerability/GHSA-f88m-g3jw-g9cj
  - GHSA-rgj7-g3m4-5g8c (high) in `` sharp@0.34.5 ``, indirect, fixed in `` 0.35.4 ``, advisory summary: "sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545" https://osv.dev/vulnerability/GHSA-rgj7-g3m4-5g8c
  - GHSA-wq5f-xc86-pv6w (high) in `` sharp@0.34.5 ``, indirect, fixed in `` 0.35.5 ``, advisory summary: "sharp : Vulnerability in librsvg dependency CVE-2026-96889" https://osv.dev/vulnerability/GHSA-wq5f-xc86-pv6w
  - GHSA-92pp-h63x-v22m (moderate) in `` @hono/node-server@1.13.7 ``, direct, fixed in `` 1.19.13 ``, advisory summary: "@hono/node-server: Middleware bypass via repeated slashes in serveStatic" https://osv.dev/vulnerability/GHSA-92pp-h63x-v22m
  - GHSA-frvp-7c67-39w9 (moderate) in `` @hono/node-server@1.13.7 ``, direct, fixed in `` 1.19.15 ``, advisory summary: "Node.js Adapter for Hono: Path traversal in \`serve-static\` on Windows via encoded backslash (\`%5C\`)" https://osv.dev/vulnerability/GHSA-frvp-7c67-39w9
  - GHSA-26pp-8wgv-hjvm (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.12 ``, advisory summary: "Hono missing validation of cookie name on write path in setCookie()" https://osv.dev/vulnerability/GHSA-26pp-8wgv-hjvm
  - GHSA-2gcr-mfcq-wcc3 (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.21 ``, advisory summary: "Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths" https://osv.dev/vulnerability/GHSA-2gcr-mfcq-wcc3
  - GHSA-3hrh-pfw6-9m5x (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.21 ``, advisory summary: "Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection" https://osv.dev/vulnerability/GHSA-3hrh-pfw6-9m5x
  - GHSA-458j-xx4x-4375 (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.14 ``, advisory summary: "hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR" https://osv.dev/vulnerability/GHSA-458j-xx4x-4375
  - GHSA-5pq2-9x2x-5p6w (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.4 ``, advisory summary: "Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()" https://osv.dev/vulnerability/GHSA-5pq2-9x2x-5p6w
  - GHSA-69xw-7hcm-h432 (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.16 ``, advisory summary: "hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection" https://osv.dev/vulnerability/GHSA-69xw-7hcm-h432
  - GHSA-6wqw-2p9w-4vw4 (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.11.7 ``, advisory summary: "Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception" https://osv.dev/vulnerability/GHSA-6wqw-2p9w-4vw4
  - GHSA-8j4g-w8fx-2239 (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.34 ``, advisory summary: "Hono: ReDoS in CORS middleware via Access-Control-Request-Headers" https://osv.dev/vulnerability/GHSA-8j4g-w8fx-2239
  - GHSA-92vj-g62v-jqhh (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.9.7 ``, advisory summary: "Hono has Body Limit Middleware Bypass" https://osv.dev/vulnerability/GHSA-92vj-g62v-jqhh
  - GHSA-9r54-q6cx-xmh5 (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.11.7 ``, advisory summary: "Hono vulnerable to XSS through ErrorBoundary component" https://osv.dev/vulnerability/GHSA-9r54-q6cx-xmh5
  - GHSA-9vqf-7f2p-gf9v (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.16 ``, advisory summary: "Hono: bodyLimit() can be bypassed for chunked / unknown-length requests" https://osv.dev/vulnerability/GHSA-9vqf-7f2p-gf9v
  - GHSA-crvj-82cr-hjcx (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.13.5 ``, advisory summary: "Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials" https://osv.dev/vulnerability/GHSA-crvj-82cr-hjcx
  - GHSA-f23p-vx2j-j53r (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.34 ``, advisory summary: "Hono: \`memo()\` retains SSR output across requests, leading to cross-user data disclosure" https://osv.dev/vulnerability/GHSA-f23p-vx2j-j53r
  - GHSA-f577-qrjj-4474 (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.21 ``, advisory summary: "Hono: JWT middleware accepts any Authorization scheme, not only Bearer" https://osv.dev/vulnerability/GHSA-f577-qrjj-4474
  - GHSA-g6gw-c38x-mqfc (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.13.5 ``, advisory summary: "Hono: Unbounded dot-notation nesting in \`parseBody()\` can cause memory exhaustion" https://osv.dev/vulnerability/GHSA-g6gw-c38x-mqfc
  - GHSA-gqvv-2mrq-wpjv (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.13.5 ``, advisory summary: "Hono: Incomplete fix for CVE-2026-39408: \`toSSG()\` still writes files outside the output directory" https://osv.dev/vulnerability/GHSA-gqvv-2mrq-wpjv
  - GHSA-hxh3-vqpv-xpqv (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.13.7 ``, advisory summary: "hono/jsx renders plain strings unescaped in boundary components, leading to XSS" https://osv.dev/vulnerability/GHSA-hxh3-vqpv-xpqv
  - GHSA-j6c9-x7qj-28xf (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.25 ``, advisory summary: "hono: AWS Lambda adapter merges multiple \`Set-Cookie\` headers into one value, dropping cookies on ALB single-header and Lattice" https://osv.dev/vulnerability/GHSA-j6c9-x7qj-28xf
  - GHSA-p6xx-57qc-3wxr (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.4 ``, advisory summary: "Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE()" https://osv.dev/vulnerability/GHSA-p6xx-57qc-3wxr
  - GHSA-p77w-8qqv-26rm (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.18 ``, advisory summary: "Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage" https://osv.dev/vulnerability/GHSA-p77w-8qqv-26rm
  - GHSA-q7jf-gf43-6x6p (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.10.3 ``, advisory summary: "Hono vulnerable to Vary Header Injection leading to potential CORS Bypass" https://osv.dev/vulnerability/GHSA-q7jf-gf43-6x6p
  - GHSA-qp7p-654g-cw7p (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.18 ``, advisory summary: "Hono has CSS Declaration Injection via Style Object Values in JSX SSR" https://osv.dev/vulnerability/GHSA-qp7p-654g-cw7p
  - GHSA-r354-f388-2fhh (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.11.7 ``, advisory summary: "Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing" https://osv.dev/vulnerability/GHSA-r354-f388-2fhh
  - GHSA-r5rp-j6wh-rvv4 (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.12 ``, advisory summary: "Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()" https://osv.dev/vulnerability/GHSA-r5rp-j6wh-rvv4
  - GHSA-rv63-4mwf-qqc2 (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.25 ``, advisory summary: "hono: Body Limit Middleware can be bypassed on AWS Lambda by understating \`Content-Length\`" https://osv.dev/vulnerability/GHSA-rv63-4mwf-qqc2
  - GHSA-v8w9-8mx6-g223 (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.7 ``, advisory summary: "Hono vulnerable to Prototype Pollution possible through \_\_proto\_\_ key allowed in parseBody({ dot: true })" https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223
  - GHSA-w332-q679-j88p (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.11.7 ``, advisory summary: "Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)" https://osv.dev/vulnerability/GHSA-w332-q679-j88p
  - GHSA-w62v-xxxg-mg59 (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.27 ``, advisory summary: "Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility" https://osv.dev/vulnerability/GHSA-w62v-xxxg-mg59
  - GHSA-wgpf-jwqj-8h8p (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.25 ``, advisory summary: "hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest" https://osv.dev/vulnerability/GHSA-wgpf-jwqj-8h8p
  - GHSA-wmmm-f939-6g9c (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.12 ``, advisory summary: "Hono: Middleware bypass via repeated slashes in serveStatic" https://osv.dev/vulnerability/GHSA-wmmm-f939-6g9c
  - GHSA-wwfh-h76j-fc44 (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.25 ``, advisory summary: "hono: Path traversal in \`serve-static\` on Windows via encoded backslash (\`%5C\`)" https://osv.dev/vulnerability/GHSA-wwfh-h76j-fc44
  - GHSA-xf4j-xp2r-rqqx (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.12 ``, advisory summary: "Hono: Path traversal in toSSG() allows writing files outside the output directory" https://osv.dev/vulnerability/GHSA-xf4j-xp2r-rqqx
  - GHSA-xgm2-5f3f-mvvc (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.27 ``, advisory summary: "Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication" https://osv.dev/vulnerability/GHSA-xgm2-5f3f-mvvc
  - GHSA-xpcf-pg52-r92g (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.12 ``, advisory summary: "Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses" https://osv.dev/vulnerability/GHSA-xpcf-pg52-r92g
  - GHSA-xrhx-7g5j-rcj5 (moderate) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.21 ``, advisory summary: "Hono: IP Restriction bypasses static deny rules for non-canonical IPv6" https://osv.dev/vulnerability/GHSA-xrhx-7g5j-rcj5
  - GHSA-48c2-rrv3-qjmp (moderate) in `` yaml@2.6.1 ``, indirect, fixed in `` 2.8.3 ``, advisory summary: "yaml is vulnerable to Stack Overflow via deeply nested YAML collections" https://osv.dev/vulnerability/GHSA-48c2-rrv3-qjmp
  - GHSA-hp3w-g68c-fv3c (moderate) in `` sprintf-js@1.1.3 ``, indirect, no fix yet, advisory summary: "sprintf-js vulnerable to denial of service through unbounded precision specifiers" https://osv.dev/vulnerability/GHSA-hp3w-g68c-fv3c
  - GHSA-gq3j-xvxp-8hrf (low) in `` hono@4.6.14 ``, indirect, fixed in `` 4.11.10 ``, advisory summary: "Hono added timing comparison hardening in basicAuth and bearerAuth" https://osv.dev/vulnerability/GHSA-gq3j-xvxp-8hrf
  - GHSA-hm8q-7f3q-5f36 (low) in `` hono@4.6.14 ``, indirect, fixed in `` 4.12.18 ``, advisory summary: "Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()" https://osv.dev/vulnerability/GHSA-hm8q-7f3q-5f36

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

_none_

## Packages

- npm @psraghuveer/memento@0.9.2

## Tools (0)

_none observed_