supermemory - Moses Yebei

The Problem

Developers building AI assistants face a hard constraint: models have no persistent memory. Every conversation starts from zero, and context windows cap what a model can recall. Supermemory solves this by ingesting content — URLs, PDFs, notes, tweets, chat transcripts — into a searchable memory store, then exposing that store to AI tools via chat, an MCP server, and SDKs. The result is a "second brain" that any model can query.

What This Does

This is a monorepo with two top-level projects: apps/ (476 files) and packages/ (243 files). The apps/ directory contains the web app (apps/web/), a browser extension (apps/browser-extension/) with content scripts for ChatGPT, Claude, Twitter/X, and T3, an MCP server (apps/mcp/), a Raycast extension, and a memory-graph playground. The packages/ directory holds shared libraries: packages/lib/ (utility functions, auth context, queries), packages/tools/ (Claude memory tooling), packages/ui/ (memory-graph React components), and packages/validation/ (schemas).

The browser extension is the most active surface. Content scripts inject save buttons and capture prompts from ChatGPT, Claude, and Twitter. The MCP server (apps/mcp/src/index.ts) lets Claude, Cursor, and other MCP-compatible tools read and write memories. The web app provides chat over stored memories, onboarding, and connection management for Notion, Google Drive, OneDrive, GitHub, and S3.

How It Is Wired

Execution starts at three entry points. main in apps/browser-extension/entrypoints/content/index.ts reaches 33 functions and is the deepest path: main -> chatWithMemoryTool, which calls anthropic.beta.messages.create — a model inference call leaving the process. The popup entry (apps/browser-extension/entrypoints/popup/App.tsx) and the MCP server (init in apps/mcp/src/server.ts) are smaller, reaching 4 and 1 functions respectively.

The dependency hub is cn in packages/lib/utils.ts, called from 238 places — changing its signature breaks a third of the codebase. dmSansClassName in apps/web/utils/fonts.ts (36 callers) and safeCapture (21 callers) carry similar blast radius. The module graph shows two circular dependencies, which raises the cost of refactoring those files. The MCP server's handleCommand in packages/tools/src/claude-memory.ts is the command router for AI-tool integrations, called from 9 places.

Effects are concentrated: 10 functions read/write files, 1 makes an outbound network call, 5 call a model for inference. apps/browser-extension/utils/storage.ts owns persistence for the extension.

How To Use It

git clone https://github.com/moses-y/supermemory
cd supermemory
npm install
npm run dev

The browser extension requires configuration via apps/browser-extension/.env.example — copy it to .env and set your API keys. The MCP server runs from apps/mcp/; its package.json defines the start command. The memory-graph playground uses Next.js (apps/memory-graph-playground/next.config.ts). The docs site is under apps/docs/. Note: the repo has no Dockerfile, so containerized deployment is not documented here.

Real-World Use

A developer wants Claude to remember what a user said last week. They run the MCP server, connect it to Claude via the MCP integration, and Claude calls handleCommand with a search query. The command routes to the memory store, retrieves relevant memories, and returns them as context. The browser extension captures the same user's tweets and ChatGPT conversations into the store automatically, so the memory grows without manual input.

Code Health & Issues

Static analysis found 207 findings: 111 high, 96 medium, 0 low. Two kinds:

High — deep nesting (x58) — control flow hard to follow at max indentation depth 8; worst in apps/browser-extension/utils/ui-components.ts, apps/web/app/onboarding/nav-menu.tsx, packages/tools/src/vercel/index.ts. Fix with early returns and guard clauses.
High — oversized files (x2) — apps/browser-extension/utils/ui-components.ts (627 lines) and packages/validation/api.ts; changes ripple widely. Split by responsibility.

SDLC observations:

Critical — ANTHROPIC_API_KEY is committed in .github/workflows/claude.yml; a fork-triggered PR could exfiltrate credentials. Move secret-using steps to a workflow_run job.
High — third-party actions pinned to tags (anthropics/claude-code-action@v1, oven-sh/setup-bun@v2, pnpm/action-setup@v4); pin to commit SHAs.
High — wildcard CORS origin (origin: "*") in apps/mcp/src/index.ts; any page can call the API with the browser's cookies.
High — CI has no test command despite 37 test files; the green check asserts nothing.
Medium — no Dependabot/Renovate config, no dependency vulnerability scan in CI, persist-credentials not disabled on checkout, 6 blobs over 5MB in apps/docs/images/ (up to 6.3MB).
Low — no job timeouts, missing .editorconfig, .gitattributes, and formatter config.

The Bottom Line

This is a well-structured memory engine with real product surface area — extension, MCP, web, docs — and a healthy test suite. The main risks are operational: a committed API key in CI, unpinned actions, and a wildcard CORS origin. The deep nesting and oversized files are maintainability concerns for anyone modifying the extension's UI utilities or validation layer. Teams building AI assistants with persistent memory should evaluate this seriously; the security findings need fixing before production use.

What the analyser found

Deployment readiness

6/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

731 files

TSX245
TypeScript136
JSON36
Markdown18
Python16
CSS7

ReactNext.js

Module dependencies

The 10 most depended-upon modules of 401, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_y_graph_src_styles_theme_css["theme.css"] n1_er_extension_utils_constants["constants"] n2_ckages_ui_memory_graph_types["types"] n3_nboarding_onboarding_context["onboarding-context"] n4_wser_extension_utils_storage["storage"] n5_rowser_extension_utils_types["types"] n6_es_ui_memory_graph_constants["constants"] n7_xtension_utils_ui_components["ui-components"] n8_ponents_memories_utils_index["index"] n9_kages_tools_src_openai_index["index"] n4_wser_extension_utils_storage --> n5_rowser_extension_utils_types n7_xtension_utils_ui_components --> n1_er_extension_utils_constants n7_xtension_utils_ui_components --> n5_rowser_extension_utils_types

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

critical1

high3

medium4

low2

Keep secrets out of workflows a fork can triggercritical

.github/workflows/claude.yml

ANTHROPIC_API_KEY

Contributor-controlled input reaches a job holding a publish token or cloud credential, so a pull request becomes credential exfiltration.

Fix: Move secret-using steps into a workflow_run job that never checks out pull request code, or gate on an environment with required reviewers.

Pin third-party GitHub Actions to a commit SHAhigh3 occurrences

.github/workflows

anthropics/claude-code-action@v1, oven-sh/setup-bun@v2, pnpm/action-setup@v4

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Replace the wildcard CORS origin with an explicit allow listhigh

apps/mcp/src/index.ts

origin: "*"

Any page on the internet can call the API with the browser's cookies attached, so a logged-in visitor to an unrelated site performs authenticated requests without knowing, and the wildcard combined with credentials is the exact configuration browsers refuse for that reason.

Fix: List the origins the API actually serves, and never pair a wildcard with credentials.

Make CI invoke the test suite it hashigh37 occurrences

.github/workflows

37 test files, no test command in any workflow

A green check that never executed an assertion is worse than no check, because reviewers trust it.

Fix: Add a test step to the existing workflow rather than a new workflow.

Enable Dependabot or Renovatemedium

16 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Move large binaries to Git LFS or out of the repositorymedium6 occurrences

apps/docs/images/pipeline.png

6 blobs over 5MB: pipeline.png 6.3MB, process.png 6.2MB, bg-rectangle.png 5.7MB

One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.

Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.

Set persist-credentials: false on checkoutmedium

.github/workflows/publish-ai-sdk.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Set timeout-minutes on the workflow jobslow3 occurrences

.github/workflows/claude-code-review.yml

3 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.