Back to Browse

Willder Core MCP Server

Developer ToolsUse Caution3.5MCP RegistryLocalRemote
Free

Server data from the Official MCP Registry

One memory for your AI agents: scoped, expiring, revocable per-agent tokens and an audit log.

About

One memory for your AI agents: scoped, expiring, revocable per-agent tokens and an audit log.

Remote endpoints: streamable-http: https://willder.ai/api/mcp

Security Report

3.5
Use Caution3.5High Risk

The visible code and README describe a self-hosted memory server with per-agent scoped tokens, an access check in the application, and an audit trail, and the CLI never writes tokens to disk, which is a good sign. The main concerns are that the authorizer runs in application code rather than the database (no row-level security), credentials such as DATABASE_URL and Neo4j passwords bypass the check entirely, and the server exposes several data-bearing tools and an optional outbound model endpoint that should be reviewed. The code shown is truncated, so the full MCP tool implementations and dependency details could not be fully verified. Supply chain analysis found 10 known vulnerabilities in dependencies (0 critical, 3 high severity).

7 files analyzed · 15 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

database

Check that this permission is expected for this type of plugin.

env_vars

Check that this permission is expected for this type of plugin.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

File System Write

Writes or modifies files on your machine. Check that this is expected for the tool.

process_spawn

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

The memory service's HTTP API. It trusts whatever group_id the caller sends, so the key can read or write any org's graph partition.Optional

Environment variable: GRAPHITI_SERVICE_API_KEY

Uploaded source files, stored privately under memory/<orgId>/, before extraction.Optional

Environment variable: BLOB_READ_WRITE_TOKEN

With database access, the sealed connector and mailbox credentials (Source.encryptedTokens, Integration.encryptedTokens, mailbox OAuth tokens), and through them the connected sources that memory is buOptional

Environment variable: APP_ENCRYPTION_KEY

Agent traces. These record the full prompt, including memory an agent was allowed to read.Optional

Environment variable: LANGFUSE_SECRET_KEY

How to Install & Connect

Available as Local & Remote

This plugin can run on your machine or connect to a hosted endpoint. during install.

Reviews

No reviews yet

Be the first to review this server!