MCP Memory Service v12.6.0

Every memory is a node, every relationship an edge. Recall works by meaning, not keywords.

See it in 50 seconds: store, retrieve, link and consolidate. Narrated with a local text-to-speech model.

What's new in v12.6

A security fix for unauthenticated local HTTP transports, entity graph rebuilds, OAuth client management, and a dashboard that follows your system theme.

Security

Local HTTP transports refuse cross-origin requests

An unauthenticated loopback --streamable-http or --sse server now accepts only loopback Host values and loopback origins plus MCP_CORS_ORIGINS, closing a cross-origin and DNS-rebinding hole (GHSA-8p26-g7wp-65jw). Servers with an API key or OAuth are unchanged.
Entities

Rebuild existing entity graphs

memory_quality(action="rebuild_entities") previews by default and applies the current extraction settings to all live memories on SQLite, Hybrid and Milvus.
OAuth

List and delete registered clients

memory oauth list-clients and memory oauth delete-client replace editing oauth.db by hand. The SQLite store now enforces its foreign keys, so deleting a client removes its codes and tokens.
Dashboard

System theme and Russian

The dashboard follows prefers-color-scheme by default, and gains a Russian translation. Several tabs and dialogs that stayed in English now read from the catalogs.
Harvest

Older statements no longer replace newer memories

Harvest processes sessions oldest first and records when each statement was made, so evolution stores an older candidate separately instead of superseding a newer memory.
Fixes

Restart under uvicorn, and a read-only flag that was wrong

Dashboard restart no longer crashes servers started with python -m uvicorn, and memory_graph is no longer advertised as read-only although extract_entities writes.

Full release notes for v12.6.0

One service, three ways in

Agents on your machine talk to it over stdio, frameworks over REST, and browser chat apps over Remote MCP with OAuth 2.1.

Terminal and IDE agentsClaude Code, Codex CLI, Cursor, OpenCode

Local MCPstdio, on your machine

Agent frameworksLangGraph, CrewAI, AutoGen, any HTTP client

REST APIHTTP with API key or OAuth

Browser chatclaude.ai, ChatGPT (Developer Mode)

Remote MCPStreamable HTTP, OAuth 2.1 + PKCE

Memory service Search by meaning, knowledge graph, consolidation SQLite-vec, Cloudflare or Hybrid storage

The underlined lane is the one that crosses the network with OAuth. Local MCP is a process on your machine, with no network hop.

The architecture diagram: stdio, REST and Streamable HTTP entries leading to MemoryServer and the storage backends

Architecture diagramThe three ways in, with the source lines behind every box.

The deployment diagram: GitHub, its Actions runner, PyPI, Docker Hub, Cloudflare Pages and the GitLab mirror

Deployment landscapeWhere releases and the site are built, published and mirrored.

In the wild

Three deployments people built and run themselves.

"After I work with one of the cluster agents on something I want my local agent to know about, the cluster agent adds a special tag to the memory entry that my local agent recognizes as a message from a cluster agent. So they end up using it as a comms bridge, and it's pretty delightful."

@jeremykoerber

A five-agent cluster uses one memory service as shared state and as an inter-agent channel, with no custom protocol: cluster agents write a sentinel tag, the local agent filters on it. The pattern

"File-based memory demands constant discipline. Semantic recall from a live database doesn't. Storing data on my own hardware while making it remotely accessible across platforms turned out to be a feature I didn't know I needed."

@PL-Peter

Two Docker containers on one SQLite backend, a Cloudflare tunnel for name-based routing, and an auth gateway in front. The checklist

"Claude Code, Claude Desktop, Codex CLI and OpenCode all talk to the same sqlite-vec DB over stdio on my Mac. ~5,900 memories and counting. It's the closest thing to persistent identity my agents have."

Mingjian Shao, AI PM and consultant, September 2026

One local sqlite-vec database shared by four agents: no server, no cloud, offline embeddings, daily backups and scheduled consolidation.

How it compares

Against the commercial memory APIs and the MCP-native alternatives.

Commercial memory APIs

	mcp-memory-service	Mem0	Zep	DIY Redis+Pinecone
License	Apache 2.0	Proprietary	Enterprise	—
Cost	$0	Per-call API	Enterprise	Infra costs
claude.ai browser	Remote MCP	Desktop only	Desktop only	No
OAuth 2.0 + DCR	Yes	Unknown	Unknown	No
Streamable HTTP	Yes (SSE too)	No	No	No
Framework integration	REST, any HTTP client	SDK	SDK	Manual
Knowledge graph	Yes, typed edges	No	Limited	No
Auto consolidation	Yes, decay + compression	No	No	No
On-premise embeddings	Yes, ONNX local	No	No	Manual
Privacy	100% local	Cloud	Cloud	Partial
Hybrid search	Yes, BM25 + vector	No	Yes	Manual
MCP protocol	Yes	No	No	No

MCP-native: MemPalace

	mcp-memory-service	MemPalace
LongMemEval R@5 (raw ChromaDB, zero LLM)	86.0% session / 80.4% turn	96.6%¹
LongMemEval R@5 (with reranking)	—	100%²
Storage granularity	Turn-level and session-level	Session-level
Team / multi-device sync	Cloudflare sync	Local only
REST API / web dashboard	Yes	No
OAuth 2.1 + multi-user	Yes	No
Knowledge graph	Yes, typed edges	No
Auto consolidation	Yes, decay + compression	No
License	Apache 2.0	MIT

Why the benchmark gap? MemPalace stores whole sessions as single units, and LongMemEval asks which session contains the answer, so that granularity answers the question structurally. This service defaults to turn-level storage for finer retrieval; session-mode ingestion brings it to 86.0% R@5.
¹ Measured in MemPalace "raw mode": plain text in ChromaDB with default embeddings. Per Issue #27, the Palace structural features are bypassed in that configuration, and the maintainers acknowledged most of the review's points.
² Uses optional LLM reranking (~500 API calls) on a partially tuned test set. Clean held-out score as reported by the maintainers: 98.4% R@5.
Full numbers and the run commands: docs/BENCHMARKS.md

SHODH ecosystem

Fully compatible with the SHODH Unified Memory API Specification: every SHODH implementation shares the same memory schema (emotional metadata, episodic memory, source tracking, quality scoring), so memories export and import across implementations with full fidelity. The reference implementation is shodh-memory (RocksDB); shodh-cloudflare runs on Workers + Vectorize; this service runs SQLite-vec or Hybrid.

In the media

Talks and coverage from the community.

Heavybit, Humans in the Loop
Agents Overdrawn at the Memory Bank
A deep dive with maintainer Heinrich Krupp on agent amnesia and why persistent memory is the missing infrastructure layer for agentic systems.
AI Tinkerers Zürich
Talk by Heinrich Krupp · full video
Persistent memory architecture, semantic search, and multi-agent memory sharing.
LinkedIn, Dr. Álvaro Cintas
Solving session amnesia
How mcp-memory-service gives Claude Code, Cursor and OpenCode a shared memory over MCP, with on-device ONNX embeddings and no external API calls.