doobidoo/mcp-memory-service v11.15.0

on GitHub

Security

mcp-memory-server refuses to bind to a non-loopback address (GHSA-26rx-6fvr-qjqg, #1443). The MCP-only entry point served the full MCP tool surface with no authentication on whatever address MCP_HTTP_HOST named. It now refuses to start on a non-loopback bind. Thanks to @NotAFlightRisk for the report.

Upgrading is recommended for anyone running mcp-memory-server with a non-loopback MCP_HTTP_HOST. Network clients should use memory server --streamable-http with MCP_SSE_HOST plus MCP_API_KEY or OAuth instead.

Special Thanks

This release carries work from @filhocf, @massimiliano1991, @MrHard (mrhard9090), @timkjr, @breken-ai, @ghulands and others, including the continuing log-injection sweep (#1146) and several retention and consolidation fixes.

Highlights

• The HTTP API can scope memory, search, CRUD and analytics by store (#1106). POST /api/search/by-tag accepts limit. MCP_CONSOLIDATION_AUTO_SUPERSEDE keeps contradicts edges without hiding memories.
• Milvus implements the full storage and graph contract (#1201). Cloudflare recall ceiling raised from 50 to 100 neighbours (#1300).
• Retention and decay: a human rating no longer overwrites the machine quality score (#1312), MCP_DECAY_ENABLED=false takes effect (#1354), type-based retention matches the real ontology (#1355), decay no longer uses host-local time as its default reference (#1302).
• Search: hybrid BM25 now matches keywords (#1327), exact-mode search no longer treats % and _ as wildcards (#1316), tags with spaces match exactly on sqlite-vec (#1331), versioned updates keep custom metadata and write superseded_by to the real column (#1318, #1408).
• Harvest: Kiro CLI v3 sessions parsed from SQLite, workspace-layout discovery, and a coverage report in results and logs (#1346, #1423).
• The Claude Code plugin manifest moves to 1.0.6.

This is a MINOR: 94 commits since v11.14.0, including the feature work above. Numbers below #341 in older entries are Codeberg numbers.

Full changelog

See CHANGELOG.md.

PyPI: mcp-memory-service==11.15.0 and mcp-memory-service-lite==11.15.0. Docker Hub: 11.15.0, 11.15.0-slim, 11.15, 11.15-slim, latest.