PlugWiki
Knowledge Graph Memory (shaneholloman) logo

Knowledge Graph Memory MCP by Shane Holloman: Setup for Claude and Other Apps

CommunityLocal
Getnpmmcp-knowledge-graphshaneholloman/mcp-knowledge-graph

Gives Claude, Cursor and other AI apps a memory that lasts between chats, kept as a knowledge graph in files on your computer.

This community server by Shane Holloman stores what your assistant should remember as people, projects and concepts with notes and links. It saves them in JSONL files in a folder you choose, and no account is needed.

You can keep a master memory plus named ones such as work or personal. A folder named .aim inside a project makes that project use its own memory.

Good for

  • People who want their assistant to remember people, projects and preferences
  • Developers who want per-project memory kept in a .aim folder
  • Users who want memory in plain files they can sync or back up

Works in

12 should work

Tap an app to see how to set it up and any known problems.

Install Knowledge Graph Memory (shaneholloman) MCP

Claude Code

  1. 1

    Copy this prompt.

    Add the Knowledge Graph Memory (shaneholloman) MCP server to Claude Code. Open .mcp.json (create it if it does not exist) and merge in this entry, keeping any servers already there:
    
    {
      "mcpServers": {
        "knowledge-graph": {
          "command": "npx",
          "args": [
            "-y",
            "mcp-knowledge-graph",
            "--memory-path",
            "/absolute/path/to/.aim"
          ]
        }
      }
    }
    
    Then tell me how to load it and whether I need to sign in.
  2. 2

    Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js.

The project says to always set --memory-path to the folder where your memory files should live. If a project has a .aim folder, memories go there instead. The command form adapts the project's config.

From the project README. Source.

Tools

  • Saves new memories

    Stores new people, projects or concepts as named memories with notes (observations) attached. You can choose a named database such as work, and project or global storage.

    Try: “Remember that Dana is our new designer and prefers email.”

    Write · aim_memory_store

  • Adds notes to an existing memory

    Appends new facts to a memory that already exists, without recreating it.

    Try: “Add that Dana joined in March to her memory.”

    Write · aim_memory_add_facts

  • Connects two memories

    Creates a named relationship between two memories, such as "Dana works on Project X".

    Try: “Link Dana to Project Atlas as "leads".”

    Write · aim_memory_link

  • Finds memories by keyword

    Searches memory names, types and notes for text, ignoring case.

    Try: “What do I remember about the Atlas project?”

    Files · aim_memory_search

  • Gets memories by exact name

    Returns the memories with the exact names you give, with their notes and links.

    Try: “Show everything stored about Dana.”

    Files · aim_memory_get

  • Reads all memories in a database

    Returns every memory and link in one database, as JSON or readable text.

    Try: “Show me everything in my work memory.”

    Files · aim_memory_read_all

  • Lists your memory databases

    Shows the available databases and whether the assistant is using project or global storage.

    Try: “Which memory databases do I have?”

    Files · aim_memory_list_stores

  • Deletes memories

    Removes memories by name, together with the links attached to them.

    Try: “Forget everything about the cancelled Orion project.”

    Delete · aim_memory_forget

  • Deletes notes from a memory

    Keeps the memory but removes the notes you name from it.

    Try: “Remove the outdated address note from Dana's memory.”

    Delete · aim_memory_remove_facts

  • Deletes links between memories

    Keeps both memories but removes the relationship between them.

    Try: “Unlink Dana from the cancelled Orion project.”

    Delete · aim_memory_unlink

Read from the source code

Permissions

high risk · 3 things to watch · 1 advisory

High risk

The assistant can read, change and delete everything in your memory files. Back up the memory folder and never run version 1.2.1 of the npm package, which was flagged as malware.

What it can do

  • Read your data
  • Create and change things
  • Delete things
  • Read-only mode

Watch out for

  • It can delete memories, notes and links

    aim_memory_forget, aim_memory_remove_facts and aim_memory_unlink delete stored data, and the project documents no read-only switch. Back up the memory folder, or sync it so you can recover. github.com

  • Version 1.2.1 on npm was compromised

    Version 1.2.1 of mcp-knowledge-graph (published 14 September 2025) was compromised by the Shai-Hulud npm worm, which steals tokens and credentials (MAL-2025-47327, GHSA-qq74-6323-3h57). Only 1.2.1 is listed as affected. npm no longer lists that version, and 1.3.2, the current release, is not listed. If you ever ran 1.2.1, the advisory says to treat the machine as compromised and rotate its secrets. osv.dev

  • The memory path controls where files are written

    Memories are written in the folder you pass as --memory-path, or in a .aim folder it finds in the current project. Pick a folder you control. github.com

Security advisories

Technical details
Sign-in and keysNo credentials are needed.
Scopes
  • Memory files in the folder you set with --memory-path, or a .aim folder in the current project

Questions

Is this the official MCP memory server?

No. It is a community server by Shane Holloman. The README describes it as persistent memory through a local knowledge graph, with tools prefixed aim_memory_.

Where are my memories stored?

In JSONL files on your computer. The files go in the folder you pass as --memory-path, or in a .aim folder inside your project if there is one. The server reads and writes only those files.

Do I need an API key?

No. The server needs no account, key or sign-in.

Can it delete my memories?

Yes. It can forget memories, remove notes from a memory and remove links. Keep a backup of the memory folder.

Can I keep separate memories for work and personal?

Yes. Tools accept a context name such as work, which creates a separate memory file next to the master one. A .aim folder in a project gives that project its own memory.

Was this package ever compromised?

Yes. Version 1.2.1 of the npm package was compromised by the Shai-Hulud worm in September 2025 (MAL-2025-47327). Only 1.2.1 is listed as affected, npm no longer lists it, and the current release, 1.3.2, is not listed.

Information

updated Nov 2, 2026

Publisher
Community
Package
mcp-knowledge-graph
Registry
npm
Transport
stdio
Auth
None
License
MIT
Last commit
May 29, 2026
Open issues
3

GitHubChangelogIssues

Sources

Docs, issue trackers and discussions this page is built from. Issues, quotes and findings above link to their own source.

Show all 3
  1. github.com · github.com
  2. github.com · github.com
  3. osv.dev · osv.dev

Facts from the official MCP registry, GitHub, npm, PyPI and the Docker catalog. Updated Nov 2, 2026.