memora - Moses Yebei

The Problem

AI agents need persistent memory that survives across sessions, with semantic search, knowledge graph visualization, and cloud synchronization capabilities. The repository provides this as an MCP server, but the codebase shows significant structural debt that increases the risk and cost of modifications.

What This Does

Memora is a lightweight MCP server for semantic memory storage, knowledge graphs, and cross-session context. The Python core (memora/) handles storage backends, memory operations, and cloud sync via Cloudflare D1, S3, and R2. The TypeScript frontend (memora-graph/) provides a React-based visualization server with graph routes and Cloudflare Workers integration. The claude-plugin hooks (claude-plugin/) integrate memory operations into Claude Code workflows. Execution starts at memora/server.py:1704 (main), which routes through 134 functions; memora/graph/server.py:120 (api_graph) reaches 87 functions for graph data; and memora/graph/server.py:130 (api_memory) reaches 41 functions for memory operations. The import graph contains 2 modules in circular dependencies (memora/backends.py ↔ memora/storage.py), and memora/storage.py (87 functions) is the most connected data hub, called from 5 other files and performing database reads/writes, file operations, and model inference.

How It Is Wired

Control flows from entry points through the call graph. main in memora/server.py reaches compute_content_hash (crypto via hashlib.md5) and ultimately performs database writes via add_memory → conn.execute. api_graph routes to connect (sqlite3.connect) and get_graph_data. memory_create flows through _create_memory → add_memory. An outbound request in memora/graph/server.py has no timeout, so a slow peer can hold workers indefinitely. The circular import between memora/backends.py (62 functions, 9 classes) and memora/storage.py (87 functions) means either module cannot load without the other, increasing blast radius for changes. memora/graph/data.py and memora/graph/server.py both define _get_memora_version, indicating duplicated version-detection logic. Six functions make outbound network calls (R2, D1, CloudSQLiteBackend), and three call models for inference (embedding operations).

How To Use It

Setup:

pip install git+https://github.com/agentic-mcp-tools/memora.git
# Or for local embeddings:
pip install "memora[local]" @ git+https://github.com/agentic-mcp-tools/memora.git

Configuration: Required environment variables belong in .mcp.json project root:

MEMORA_DB_PATH for local SQLite
MEMORA_STORAGE_URI (d1://<account-id>/<database-id>) for Cloud Cloudflare D1
CLOUDFLARE_API_TOKEN for cloud auth
MEMORA_ALLOW_ANY_TAG to permit unrestricted tagging

Running it:

# Stdio mode (default MCP)
memora-server

# Graph visualization server
memora-server --graph-port 8765

# HTTP transport
memora-server --transport streamable-http --host 127.0.0.1 --port 8080

Real-World Use

In a multi-session Claude Code workflow, a user extracts research notes in one session and later resumes context in another. The server stores memories with vector embeddings (TF-IDF or OpenAI), auto-links cross-references based on similarity, and preserves tag hierarchies. When the graph visualization is enabled (--graph-port), an interactive Mermaid render appears at the configured port, showing clusters and edges. Cloud sync via D1 allows the same memories to be shared across deployed workers without manual DB migration.

Code Health & Issues

[HIGH] Commit a lockfile beside the manifest - pyproject.toml has no generated lockfile, so tested and shipped artifacts can differ.
[HIGH] Add a workflow that builds and tests this repository - 24 source files, no CI configuration; every merge runs untested.
[HIGH] Replace the wildcard CORS origin - memora-graph/worker/src/index.ts has Access-Control-Allow-Origin: "*; paired with credentials this allows any site to perform authenticated requests.
[MEDIUM] Enable Dependabot or Renovate - 2 manifest(s), no update bot configured; published advisories remain unpatched indefinitely.
[MEDIUM] Give the outbound request a timeout - memora/graph/server.py has 1 outbound call with no timeout; requests has no default, so a slow peer hangs workers.
[LOW] Add repository convention files - missing .editorconfig, .gitattributes, and formatter config.

The Bottom Line

The repository delivers a functional MCP server with semantic memory, graph visualization, and cloud sync out of the box, making it immediately useful for agents needing persistent cross-session context. However, the circular import between backends and storage, absent CI/CD, wildcard CORS, and missing lockfile represent real risks for production use and long-term maintenance. Teams that can tolerate the current code health gaps and add their own CI/tooling will find value quickly; others should budget refactoring time for the import cycle and cognitive-load hotspots before relying on this in critical paths.

What the analyser found

Deployment readiness

5/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

50 files

Python19
JSON5
TypeScript5
Markdown4
TOML3
Shell2

React

Architecture

Top-level areas of the codebase, sized by module count. Arrows show how many imports cross from one area into another.

graph TD g0["memora<br/>13 modules"] g1["memora-graph<br/>7 modules"] g2["claude-plugin<br/>2 modules"] g3["tests<br/>2 modules"] g2 -->|2| g0 g1 -->|1| g0 g3 -->|1| g0

Module dependencies

The 10 most depended-upon modules of 24, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_memora_storage["storage"] n1_memora_backends["backends"] n2_memora___init__["__init__"] n3_memora_image_storage["image_storage"] n4_memora_graph_issues["issues"] n5_memora_graph_todos["todos"] n6_memora_graph_data["data"] n7_memora_graph_templates["templates"] n8_memora_server["server"] n9_memora_graph___init__["__init__"] n1_memora_backends --> n0_memora_storage n9_memora_graph___init__ --> n6_memora_graph_data n9_memora_graph___init__ --> n4_memora_graph_issues n9_memora_graph___init__ --> n5_memora_graph_todos n6_memora_graph_data --> n0_memora_storage n6_memora_graph_data --> n4_memora_graph_issues n6_memora_graph_data --> n5_memora_graph_todos n6_memora_graph_data --> n7_memora_graph_templates n6_memora_graph_data --> n3_memora_image_storage n7_memora_graph_templates --> n4_memora_graph_issues n7_memora_graph_templates --> n5_memora_graph_todos n8_memora_server --> n0_memora_storage n8_memora_server --> n9_memora_graph___init__ n8_memora_server --> n2_memora___init__ n8_memora_server --> n3_memora_image_storage n8_memora_server --> n1_memora_backends n0_memora_storage --> n1_memora_backends n0_memora_storage --> n3_memora_image_storage classDef cyc stroke:#ef4444,stroke-width:2px; class n0_memora_storage,n1_memora_backends cyc;

Dependencies

6 of 8 declared dependencies are a major version behind. Resolved 8 of 8 against the registry.

Package	Declared	Latest	Behind
`typescript`	^5.4.5	7.0.2	2 major
`pillow`	>=10.0.0	12.3.0	2 major
`openai`	>=1.0.0	3.1.0	2 major
`@cloudflare/workers-types`	^4.20240620.0	5.20260816.1	1 major
`wrangler`	^3.60.0	4.123.0	1 major
`mcp`	>=1.0.0	2.0.0	1 major

Findings

MediumNo CI/CD pipeline detected - no automated build/test gate .github/ or CI config

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high3

medium2

low1

Commit a lockfile beside the manifesthigh

pyproject.toml

manifest with no lockfile in scope

An unlocked range means the artifact you tested and the artifact you ship can contain different transitive code, so a malicious patch release reaches production with no diff.

Fix: Run the package manager once and commit the generated lockfile.

Add a workflow that builds and tests this repositoryhigh

24 source files, no CI configuration

Every change merges with nobody having run the build once, which across this estate is 499 repositories.

Fix: Add a workflow running the project build and test command on push and pull_request.

Replace the wildcard CORS origin with an explicit allow listhigh

memora-graph/worker/src/index.ts

Access-Control-Allow-Origin": "*"

Any page on the internet can call the API with the browser's cookies attached, so a logged-in visitor to an unrelated site performs authenticated requests without knowing, and the wildcard combined with credentials is the exact configuration browsers refuse for that reason.

Fix: List the origins the API actually serves, and never pair a wildcard with credentials.

Enable Dependabot or Renovatemedium

2 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Give the outbound request a timeoutmedium

memora/graph/server.py

1 outbound call(s) with no timeout

requests has no default timeout, so a peer that accepts the connection and then says nothing holds the worker forever, and with a small worker pool a single slow dependency takes the whole service down without anything appearing to fail.

Fix: Pass timeout= on every call, or use a session with one configured.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.