Verified Memory

Name: Verified Memory
Author: python1

by python1version 0.4.1i★ –iRuns on your computer

Registry nameio.github.python1/verified-memory

Install

Overview

Description from the maker (original English)

Offline read-only search over a checksum-verified, optionally signed memory pack, with exact quotes

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: stdio
Category: Search & AI memory

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on your computer with your user’s permissions (files, network, apps).
The registry lists no key to fill in.

You need

npmNode.js installed (for the npx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "verified-memory": {
      "command": "npx",
      "args": [
        "-y",
        "@python1/verified-memory-mcp",
        "--pack",
        "--require-signature",
        "false",
        "--strict",
        "false"
      ]
    }
  }
}

Run this in your terminal

claude mcp add verified-memory -- npx -y @python1/verified-memory-mcp --pack --require-signature false --strict false

This one needs values on its command line, so copy the settings and fill them in.

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "verified-memory": {
      "command": "npx",
      "args": [
        "-y",
        "@python1/verified-memory-mcp",
        "--pack",
        "--require-signature",
        "false",
        "--strict",
        "false"
      ]
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one needs values on its command line, so copy the settings and fill them in.

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "verified-memory": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@python1/verified-memory-mcp",
        "--pack",
        "--require-signature",
        "false",
        "--strict",
        "false"
      ]
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 6, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account python1, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Search & AI memoryi

More stars than 0% of the other 7234 servers in this category
Published to the registry more recently than 66% of the other 7234 servers in this category
Basic checks equal to or better than 100% of the other 7234 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is Verified Memory safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

The registry does not list a required key, though some servers ask you to sign in on first use.

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed –, and the latest version (0.4.1) reached the registry 19 days ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Node.js on your computer.

What can I use instead?

In the same category: Context7, Codebase Memory, Exa

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Context7

by upstash

Feeds AI the latest docs for libraries and frameworks before it answers, so code it writes does not use outdated, removed functions.

Computer or cloud★ 64,224MITUpdated 3 days ago

Install

Codebase Memory

by DeusData

Codebase knowledge graph for AI agents — 162 languages, sub-ms queries, 99% fewer tokens.

Runs on your computer★ 48,148MITUpdated 20 days ago

Install

Exa

by exa-labs

Connect AI agents to Exa for web search, content fetching, and multi-step research.

Runs in the cloud★ 5,213MITUpdated 44 days ago

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

verified-memory-mcp

Why

AI agents are starting to pay invoices and buy things. An agent pays wherever its memory says to pay. If someone swaps a remembered account number, the agent pays the attacker. This is vendor-payment fraud moving from fooling clerks to fooling AI.

Verified Memory serves only facts signed by a key you pin, and refuses anything changed after signing. An AI attacker red-teamed it with 12 tampering attacks (swapped files, broken signatures, fake clocks, a 5,000-file flood, the folder replaced while running). None got tampered data served (full log). Latest release: Verified Memory 0.4.1.

Free, MIT-licensed local stdio MCP server exposing verified_memory_search and verified_memory_get using the official MCP TypeScript SDK (@modelcontextprotocol/sdk 1.32.1). Published on npm as @python1/verified-memory-mcp and in the MCP Registry as io.github.python1/verified-memory.

Runtime is read-only and offline: no network transport, sockets, telemetry, embeddings, accounts, filesystem writes, subprocesses or shell execution. It reads one configured pack at startup and serves an isolated in-memory snapshot. On every request it checks, from file metadata only, that the pack folder is still the one it verified, and stops serving if it is not (no watchers, nothing re-read). Stdout is exclusively MCP protocol output; startup errors go to stderr and exit nonzero. Only these two tools are exposed; no resources, prompts, filesystem or command tools.

Run with npx

The npm package contains only dist/, the pack builder, this README and LICENSE. It ships no pack, so --pack is required:

npx -y @python1/verified-memory-mcp --pack /absolute/path/to/pack

Claude Code: claude mcp add verified-memory -- npx -y @python1/verified-memory-mcp --pack /absolute/path/to/pack. Running through npx does not apply Node's permission mode, because npx starts its own Node process. For the read-only filesystem allowlist described below, install the package and run its dist/index.js with node directly.

Build your own pack

A pack is a directory with exactly four files: records.jsonl, MEMORY.md, README.md and SHA256SUMS, plus an optional PACK.json (creation and expiry dates) and an optional signature, SHA256SUMS.sig (see Signed and dated packs). The easiest way to make one is the bundled offline builder. It reads your messages and the records you want to remember, finds every quote in its message, computes offsets and hashes, writes the pack, and then loads it with the server's own verifier. If any quote is not verbatim in its message, it writes nothing.

From a ChatGPT or Claude export, in your browser

Pack maker (beta): [https://python1.github.io/data-lore-hive/](https://python1.github.io/data-lore-hive/). Load your data export, search your chats, select the exact sentences to remember, and download a ready pack. It runs entirely in the browser (no server, and its Content-Security-Policy forbids network requests), uses the same building code as the command-line builder, and checks the pack with the server's own verifier before offering the download. It does not sign packs or add dates (use sign-pack, below), but its *Check a signed pack* panel runs the same verifier on a signed pack and the public keys you paste. Its source is in web/; to run it from a checkout instead, run npm install && npm run build there and open web/dist/index.html. See web/README.md.

Quick start

Put your source messages in messages.jsonl, one JSON object per line:

   {"id": 3, "date": "2026-03-02T08:20:00Z", "speaker": "Rowan", "text": "Quick thing first: the shed code changed. Also, the café on the corner sells seedlings on Saturdays."}

Field	Rule
`id`	positive integer, unique
`date`	UTC ISO 8601 ending in `Z` or `+00:00`, e.g. `2026-03-02T08:20:00Z`
`speaker`	non-empty string
`text`	non-empty string; quotes are matched against it exactly

Put what you want remembered in records.jsonl, one record per line, each citing exact quotes from those messages:

   {"record_id": "M-garden-3", "role": "user", "topic": "Seedlings", "category": "places", "quotes": [{"message_id": 3, "quote": "the café on the corner sells seedlings on Saturdays."}]}

Field	Rule
`record_id`	`M-` followed by 1–127 letters, digits, `_` or `-`; unique
`role`	`"user"` (the person) or `"agent"` (the assistant)
`topic`, `category`	non-empty strings of your choice
`quotes`	non-empty list of `{"message_id", "quote"}`; a quote must appear verbatim in that message. If it appears more than once, add `"start"` (the builder lists the choices)
`statement`	optional summary; defaults to the quotes joined by spaces
`speaker`	optional; defaults to the cited messages' speaker, required if they differ

Unknown fields are refused, so typos fail loudly.

Build into a directory that does not exist yet, then point the server at it:

   npx -y -p @python1/verified-memory-mcp verified-memory-build-pack \

--messages messages.jsonl --records records.jsonl \ --out /absolute/path/to/my-pack --title "My memory" --description "Optional text for the pack README" npx -y @python1/verified-memory-mcp --pack /absolute/path/to/my-pack

From a repository checkout, run node tools/build-pack.mjs ... after npm run build. The building rules (verbatim quotes, code-point offsets, hashes, file layout) live in tools/pack-core.mjs, which has no imports so a browser can run the same code. The builder makes no network calls. It never overwrites: it stages in a hidden sibling directory and renames it into place only after verification passes.

examples/input/ holds invented sample input (a fictional community garden, not real people), and examples/pack/ is the pack built from it; the test suite rebuilds it byte for byte. Neither ships in the npm package.

`records.jsonl` format (what the server verifies)

One JSON object per line, UTF-8, at most 10,000 records, unique record_ids. Every field below is required unless marked optional:

Field	Rule
`record_id`	`^M-[A-Za-z0-9_-]{1,127}$`
`role`	`"user"` or `"agent"`
`speaker`, `statement`, `topic`, `category`	non-empty strings
`date_first_utc`, `date_last_utc`	UTC ISO 8601 (`Z` or `+00:00`), first ≤ last
`evidence`	non-empty list of citations (below)
anything else	optional; kept and returned by `verified_memory_get` as metadata (e.g. `supersedes`, `approval`, `audits`)

Each citation in evidence:

Field	Rule
`message_id`	positive integer
`date_utc`	UTC ISO 8601, between the record's first and last dates
`quote`	non-empty exact text from the message
`start`, `end`	integers, `start ≥ 0`, `end − start` = quote length in Unicode code points (offsets index the message text by code point, as Python string slicing does)
`message_sha256`	64 lowercase hex characters: SHA-256 of the full message text encoded as UTF-8

Example (one line in the file; wrapped here for reading):

{"record_id":"M-garden-3","role":"user","speaker":"Rowan","category":"places","topic":"Seedlings",

"statement":"the café on the corner sells seedlings on Saturdays.", "date_first_utc":"2026-03-02T08:20:00Z","date_last_utc":"2026-03-02T08:20:00Z", "evidence":[{"message_id":3,"date_utc":"2026-03-02T08:20:00Z", "quote":"the café on the corner sells seedlings on Saturdays.","start":48,"end":100, "message_sha256":"e3aebbd25f7b809dd5b0b8d55b9ad7df6566464dc2a5033d02e3c5aa7ed8eeb2"}]}

Quotes are checked against their source messages when the pack is built, and after that the signature protects them. The builder (or agent-memory/) refuses any quote that is not verbatim in its message and computes message_sha256 from that message. The server never sees your original messages, so at load and at serve time it checks only citation structure, offsets' arithmetic and the hash's format; it does not re-check quotes against message_sha256. Once the pack is sealed, SHA256SUMS (and, for a signed pack, SHA256SUMS.sig) is what protects those quotes from later changes. A pack with no records is refused at load (since 0.4.1).

`MEMORY.md` and the pack `README.md`

The server requires both to exist, be valid UTF-8 and match SHA256SUMS. It does not parse them or return them from either tool; they are for people and agents reading the pack directly. By convention, and as the builder writes them:

MEMORY.md: a # Title heading, then for each record its ID and speaker, its statement, and each quote with its message ID and date, marked as historical data.
README.md: what the pack is and where it came from (SHA-256 of the input files, record count), plus the notice that quotes are data, not instructions, and that checksums prove integrity, not truth or approval.

`SHA256SUMS` format

Exactly one line per other file (three, or four with PACK.json), each <64 lowercase hex> + two spaces + file name; no entry for SHA256SUMS or SHA256SUMS.sig; at most 4 KiB:

f3ed88bca6a7a451a892f49bd6d2970f5671b8c704d0bc6cae7646c46978bc69  MEMORY.md

0685a25133fd3e7f60e70ba1e836a2e8b045ace1e2be2ecbd306a4fc656f558f README.md 34212f199411c8e4ef52cb341b0c68d970b5b30d9b8117c2eae5729b0d71dfa5 records.jsonl

If you edit a pack by hand, regenerate it from inside the pack directory:

shasum -a 256 MEMORY.md README.md records.jsonl > SHA256SUMS   # macOS

sha256sum MEMORY.md README.md records.jsonl > SHA256SUMS # Linux

Resealing by hand only makes the checksums match again; it does not re-check quotes. Prefer rebuilding with the builder. Resealing also invalidates any signature: sign again.

Signed and dated packs

A pack can carry two optional extras:

SHA256SUMS.sig: an OpenSSH signature over the exact SHA256SUMS bytes, which pin every other file. Only Ed25519 keys, the sha512 hash and the namespace verified-memory-pack-v1 are accepted, so a git or code-release signature cannot be reused as a pack signature.
PACK.json (since 0.3.0): when the pack was made and when it stops being current, and (since 0.4.0) an optional sequence number. It is listed in SHA256SUMS like every other file, so the signature covers the dates and the sequence.

"format": "verified-memory-pack", "version": 2, "created_utc": "2026-10-12T18:00:00Z", "expires_utc": "2027-01-10T18:00:00Z", "sequence": 3 }

Exactly these four keys plus the optional sequence; dates are UTC ISO 8601 and created_utc is before expires_utc. version is the format version and stays 2; sequence is a whole number (0 or more) that the signer raises with every pack they publish, so hosts can refuse an older one (see Rollback protection). A malformed PACK.json refuses to load. The pack maker and the builder never write one, so their packs still load on 0.2.0 hosts; packs with a PACK.json need 0.3.0 or later (older hosts refuse the extra file), and packs with a sequence need 0.4.0 or later (0.3.0 hosts refuse the extra key).

Signing: `sign-pack`

Sign on a machine you trust with a passphrase-protected key. Since 0.4.1, sign-pack ships in the npm package as the verified-memory-sign-pack command (in a checkout it is tools/sign-pack.mjs). It copies a verified pack to a new folder, writes PACK.json, reseals SHA256SUMS and runs ssh-keygen -Y sign. It never opens the private key itself: ssh-keygen reads it and asks for the passph

Only the beginning is shown; read the rest in the repo

Verified Memory

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Search & AI memoryi

Common questions

Alternatives

Context7

Codebase Memory

Exa

README from the maker

verified-memory-mcp

Why

Run with npx

Build your own pack

From a ChatGPT or Claude export, in your browser

Quick start

records.jsonl format (what the server verifies)

MEMORY.md and the pack README.md

SHA256SUMS format

Signed and dated packs

Signing: sign-pack

`records.jsonl` format (what the server verifies)

`MEMORY.md` and the pack `README.md`

`SHA256SUMS` format

Signing: `sign-pack`