npm · server-memory2026.1.26

Evidence

],

  "scripts": {

    "build": "tsc && shx chmod +x dist/*.js",

    "prepare": "npm run build",

    "watch": "tsc --watch",

    "test": "vitest run --coverage"

  },

RemediationAI

The `prepare` script in `package.json` runs automatically during `npm install`, executing `npm run build` which compiles TypeScript and modifies file permissions. This is unnecessary for a pure library package and introduces supply-chain risk. Remove the `prepare` key entirely from the `scripts` object in `package.json`—consumers can run `build` manually if needed. This eliminates unintended code execution during installation. Verify by running `npm install` in a clean directory and confirming no build steps execute automatically.

Evidence

# Knowledge Graph Memory Server

A basic implementation of persistent memory using a local knowledge graph. This lets Claude remember information about the user across chats.

## Core Concepts

### Entities

Entities are the primary nodes in the knowledge graph. Each entity has:

- A unique name (identifier)

- An entity type (e.g., "person", "organization", "event")

- A list of observations

Example:

```json

{

  "name": "John_Smith",

  "entityType": "person",

  "observations": ["Speaks fluent Span

RemediationAI

The MCP manifest lacks an explicit authentication declaration, making it unclear whether the server relies on implicit network-level protections (e.g., localhost binding) or requires authentication. Add an `auth` field to the MCP manifest (e.g., `"auth": "none"` or `"auth": {"type": "bearer", "token": "env:API_KEY"}`) to document the mechanism. This ensures reviewers can audit the security model. Verify by checking the manifest file for the new `auth` field and confirming it matches the server's actual authentication logic (e.g., no auth, API key, or OAuth).