memory-journal-mcp 3.1.4 → 4.0.0

package/.github/workflows/docker-publish.yml

@@ -154,7 +154,7 @@ jobs:
   security-scan:
     runs-on: ubuntu-latest
     needs: build-platform
-    if: github.event_name != 'pull_request'
+    if: always() && needs.build-platform.result == 'success' && github.event_name != 'pull_request'
     permissions:
       contents: read
       security-events: write
@@ -186,8 +186,8 @@ jobs:
         
         # Define CVEs to ignore (upstream issues with NO fix available)
         # CVE-2026-22184: Alpine zlib - no fix version released yet
-        # CVE-2019-10790: protobufjs taffydb - unmaintained/abandoned package
-        IGNORE_CVES="CVE-2026-22184|CVE-2019-10790"
+        # CVE-2025-60876: Alpine busybox wget - patch not in release yet
+        IGNORE_CVES="CVE-2026-22184|CVE-2025-60876"
         
         echo "⏱️ Running Docker Scout scan (max 8 minutes)..."
         if timeout 480 docker scout cves local-scan:latest > scout_output.txt 2>&1; then
@@ -221,7 +221,7 @@ jobs:
   merge-and-push:
     runs-on: ubuntu-latest
     needs: [build-platform, security-scan]
-    if: github.event_name != 'pull_request'
+    if: always() && needs.build-platform.result == 'success' && needs.security-scan.result == 'success' && github.event_name != 'pull_request'
     permissions:
       contents: read
       packages: write
@@ -274,11 +274,11 @@ jobs:
       with:
         images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
         flavor: |
-          latest=auto
+          latest=false
         tags: |
           type=semver,pattern=v{{version}}
-          type=raw,value=v${{ steps.version.outputs.version }},enable={{is_default_branch}}
-          type=raw,value=latest,enable={{is_default_branch}}
+          type=raw,value=v${{ steps.version.outputs.version }},enable=${{ github.ref == 'refs/heads/main' || github.event.workflow_run.head_branch == 'main' || startsWith(github.ref, 'refs/tags/v') }}
+          type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' || github.event.workflow_run.head_branch == 'main' || startsWith(github.ref, 'refs/tags/v') }}
           type=sha,prefix=sha-,format=short
 
     - name: Create and push manifest
@@ -302,7 +302,7 @@ jobs:
         password: ${{ secrets.DOCKER_PASSWORD }}
         repository: ${{ env.IMAGE_NAME }}
         readme-filepath: ./DOCKER_README.md
-        short-description: "MCP server for Git-aware project memory, capturing code context, GitHub issues, PRs, and Actions."
+        short-description: "Persistent AI Project Memory w/Triple Search, Knowledge Graphs, GitHub Integration & Tool Filtering."
 
     - name: Deployment Summary
       if: github.ref == 'refs/heads/main'

package/.github/workflows/security-update.yml

@@ -4,6 +4,19 @@ on:
   schedule:
     # Run weekly on Sundays at 2 AM UTC
     - cron: '0 2 * * 0'
+  push:
+    branches: [main]
+    paths:
+      - 'Dockerfile'
+      - 'package.json'
+      - 'package-lock.json'
+      - '.trivyignore'
+  pull_request:
+    branches: [main]
+    paths:
+      - 'Dockerfile'
+      - 'package.json'
+      - 'package-lock.json'
   workflow_dispatch:
 
 permissions:
@@ -35,7 +48,7 @@ jobs:
 
     # Run SARIF scan first (non-blocking) to always generate the file
     - name: Run Trivy scanner for SARIF output
-      uses: aquasecurity/trivy-action@master
+      uses: aquasecurity/trivy-action@0.29.1
       with:
         image-ref: security-test:latest
         format: 'sarif'
@@ -54,7 +67,7 @@ jobs:
 
     # Run table scan (blocking) after SARIF is uploaded
     - name: Run Trivy vulnerability scanner
-      uses: aquasecurity/trivy-action@master
+      uses: aquasecurity/trivy-action@0.29.1
       with:
         image-ref: security-test:latest
         format: 'table'

package/.scout-ignore

@@ -4,9 +4,9 @@
 # Only include CVEs with NO upstream fix available
 
 # Alpine zlib - Critical severity, but NO FIX VERSION RELEASED by Alpine yet
-# We run `apk upgrade --no-cache` but there's nothing to upgrade to
+# zlib 1.3.1.3 contains the fix but Alpine hasn't packaged it
 CVE-2026-22184
 
-# protobufjs bundled taffydb - 6+ year old unmaintained package
-# No fix version exists - package is abandoned
-CVE-2019-10790
+# Alpine busybox - wget CRLF injection (MEDIUM)
+# Patch submitted to busybox upstream but not in a release yet
+CVE-2025-60876

package/.trivyignore

@@ -6,14 +6,9 @@
 # ============================================================================
 
 # CVE-2026-22184: zlib vulnerability (CRITICAL)
-# No fix version released by Alpine yet - `apk upgrade` has nothing to update to
+# No fix version released by Alpine yet - zlib 1.3.1.3 not packaged
 CVE-2026-22184
 
-# ============================================================================
-# protobufjs Bundled CLI - in /app/node_modules/protobufjs/cli/node_modules/
-# taffydb is 6+ years unmaintained with no fix available
-# ============================================================================
-
-# CVE-2019-10790: taffydb prototype pollution (HIGH)
-# No fix version exists - package is abandoned
-CVE-2019-10790
+# CVE-2025-60876: busybox wget CRLF injection (MEDIUM)
+# Patch submitted to busybox upstream but not in a release yet
+CVE-2025-60876

package/DOCKER_README.md

@@ -1,81 +1,86 @@
 # Memory Journal MCP Server
 
-Last Updated January 11, 2026 - v3.1.4
+Last Updated January 16, 2026 - v4.0.0
 
 [![GitHub](https://img.shields.io/badge/GitHub-neverinfamous/memory--journal--mcp-blue?logo=github)](https://github.com/neverinfamous/memory-journal-mcp)
 [![Docker Pulls](https://img.shields.io/docker/pulls/writenotenow/memory-journal-mcp)](https://hub.docker.com/r/writenotenow/memory-journal-mcp)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
-![Version](https://img.shields.io/badge/version-v3.1.4-green)
+![Version](https://img.shields.io/badge/version-v4.0.0-green)
 ![Status](https://img.shields.io/badge/status-Production%2FStable-brightgreen)
 [![npm](https://img.shields.io/npm/v/memory-journal-mcp)](https://www.npmjs.com/package/memory-journal-mcp)
 [![Security](https://img.shields.io/badge/Security-Enhanced-green.svg)](https://github.com/neverinfamous/memory-journal-mcp/blob/main/SECURITY.md)
 [![GitHub Stars](https://img.shields.io/github/stars/neverinfamous/memory-journal-mcp?style=social)](https://github.com/neverinfamous/memory-journal-mcp)
 [![TypeScript](https://img.shields.io/badge/TypeScript-Strict-blue.svg)](https://github.com/neverinfamous/memory-journal-mcp)
 
-**Project context management for AI-assisted development - Maintain continuity across fragmented AI threads with persistent knowledge graphs and intelligent context recall**
-
-🎯 **Solve the AI Context Problem:** Bridge the gap between disconnected AI sessions. Memory Journal provides persistent project memory, enabling AI to access your complete development history, past decisions, and work patterns across any thread or timeframe.
+🎯 **AI Context + Project Intelligence:** Bridge disconnected AI sessions with persistent project memory, while integrating your complete GitHub workflow — Issues, PRs, Actions, Kanban boards, and knowledge graphs — into every conversation.
 
 **[GitHub](https://github.com/neverinfamous/memory-journal-mcp)** • **[Wiki](https://github.com/neverinfamous/memory-journal-mcp/wiki)** • **[Changelog](https://github.com/neverinfamous/memory-journal-mcp/wiki/CHANGELOG)** • **[Release Article](https://adamic.tech/articles/memory-journal-mcp-server)**
 
-**🚀 Multiple Deployment Options:**
-- **[Docker Hub](https://hub.docker.com/r/writenotenow/memory-journal-mcp)** - Node.js Alpine-based multi-platform support
-- **[npm Package](https://www.npmjs.com/package/memory-journal-mcp)** - Simple `npm install -g` for local deployment
-- **[MCP Registry](https://registry.modelcontextprotocol.io/v0/servers?search=io.github.neverinfamous/memory-journal-mcp)**
-
----
-
 ## 🎯 What This Does
 
-**Solve the AI Context Problem:** When working with AI across multiple threads, context is lost. Memory Journal provides persistent project memory - every AI conversation can access your complete development history, past decisions, and work patterns.
-
 ### Key Benefits
+- 🧠 **Dynamic Context Management** - AI agents automatically query your project history and create entries at the right moments
 - 📝 **Auto-capture Git/GitHub context** (commits, branches, issues, PRs, projects)
 - 🔗 **Build knowledge graphs** linking specs → implementations → tests → PRs  
 - 🔍 **Triple search** (full-text, semantic, date range)
 - 📊 **Generate reports** (standups, retrospectives, PR summaries, status)
 - 🗄️ **Backup & restore** your journal data with one command
 
-```mermaid
-flowchart LR
-    subgraph Problem["❌ Without Memory Journal"]
-        direction TB
-        A1["Session 1<br/>Context Lost"] --> A2["Session 2<br/>Start Over"]
-    end
-    
-    subgraph Solution["✅ With Memory Journal"]
-        direction TB
-        B1["Session 1"] --> MJ[("📚 Memory<br/>Journal")]
-        B2["Session 2"] --> MJ
-        MJ --> |"Recall"| B1
-        MJ --> |"Search"| B2
-    end
-    
-    Problem -.->|"Solve with"| Solution
-```
-
----
-
-## ✨ v3.0.0 Highlights (December 28, 2025)
-
-### **🚀 Complete TypeScript Rewrite**
-- **Pure JS Stack** - No native compilation required (`sql.js` + `vectra` + `@xenova/transformers`)
-- **Cross-Platform** - Works on AMD64 and ARM64 without architecture-specific builds
-- **Strict Type Safety** - 100% TypeScript strict mode compliance
-- **MCP 2025-11-25 Compliance** - Full spec with behavioral annotations
-
-### **🗄️ New: Backup & Restore Tools**
-- `backup_journal` - Create timestamped database backups
-- `list_backups` - List all available backup files
-- `restore_backup` - Restore from any backup (with auto-backup before restore)
-
-### **📊 New: Server Health Resource**
-- `memory://health` - Database stats, backup info, vector index status, tool filter config
+### Deployment Options
+- **[Docker Hub](https://hub.docker.com/r/writenotenow/memory-journal-mcp)** - Node.js Alpine-based multi-platform support
+- **[npm Package](https://www.npmjs.com/package/memory-journal-mcp)** - Simple `npm install -g` for local deployment
+- **[MCP Registry](https://registry.modelcontextprotocol.io/v0/servers?search=io.github.neverinfamous/memory-journal-mcp)**
 
-### **29 MCP Tools • 14 Workflow Prompts • 16 Resources**
++---------------------------+
+| 🤖 AI Session Start       |
+|---------------------------|
+|  📋 Read Briefing         |
+|  (memory://briefing)      |
++-------------+-------------+
+              |
+              v
++---------------------------+
+| 📝 Journal Operations     |
+|---------------------------|
+|  - Create Entry           |
+|  - Retrieve & Search      |
+|  - Link Entries           |
++------+------+------+------+
+       |      |      |
+       |      |      |
+       v      |      v
++--------------+   +---------------------------+
+| 🔍 Triple    |<->| 🐙 GitHub Integration    |
+|    Search    |   |---------------------------|
+|--------------|   |  - Issues & Milestones    |
+|  - Full-Text |   |  - Pull Requests          |
+|    (FTS5)    |   |  - GitHub Actions         |
+|  - Semantic  |   |  - Kanban Boards          |
+|    (Vector)  |   +-------------+-------------+
+|  - Date      |                 |
+|    Range     |                 |
++------+-------+                 |
+       |                         |
+       v                         v
+       +-----------+-------------+
+                   |
+                   v
+        +---------------------------+
+        | 📊 Outputs                |
+        |---------------------------|
+        |  - Standups & Retros      |
+        |  - Knowledge Graphs       |
+        |  - Project Timelines      |
+        +---------------------------+
+
+### 📈 **Current Capabilities**
+
+- **31 MCP tools** - Complete development workflow + backup/restore + Kanban + issue management
+- **15 workflow prompts** - Standups, retrospectives, PR workflows, CI/CD failure analysis, session acknowledgment
+- **18 MCP resources** - 12 static + 6 template (require parameters)
+- **GitHub Integration** - Projects, Issues, Pull Requests, Actions, **Kanban boards**
 - **8 tool groups** - `core`, `search`, `analytics`, `relationships`, `export`, `admin`, `github`, `backup`
-- **GitHub Kanban** - View and manage GitHub Project boards directly
-- **Knowledge graphs** - 5 relationship types, Mermaid diagram visualization
+- **Knowledge graphs** - 5 relationship types, Mermaid visualization
 - **Semantic search** - AI-powered conceptual search via `@xenova/transformers`
 
 ---
@@ -146,12 +151,23 @@ To enable GitHub tools (`get_github_issues`, `get_github_prs`, etc.), add enviro
 |---------------------|-------------|
 | `GITHUB_TOKEN` | GitHub personal access token for API access |
 | `GITHUB_REPO_PATH` | Path to git repo inside container (mount your repo) |
+| `DEFAULT_PROJECT_NUMBER` | Default GitHub Project number for auto-assignment when creating issues |
 
 **Without `GITHUB_REPO_PATH`**: Explicitly provide `owner` and `repo` when calling GitHub tools.
 
-### Cursor Known Issues
+### Client-Specific Notes
+
+**Cursor IDE:**
+
+- **Listing MCP Resources**: If the agent has trouble listing resources, instruct it to call `ListMcpResources()` without specifying a server parameter, or with `server: "user-memory-journal-mcp"` (Cursor prefixes server names with `user-`).
+
+**Google AntiGravity IDE:**
 
-**Listing MCP Resources**: If the agent has trouble listing resources, instruct it to call `list_mcp_resources()` without specifying a server parameter. Using `server="memory-journal-mcp"` may return nothing (Cursor bug).
+- **Session start**: Add to your user rules: "At session start, read `memory://briefing` from memory-journal-mcp."
+
+- **Full guidance**: If behaviors missing, read `memory://instructions` for complete Dynamic Context Management patterns.
+
+- **Prompts not available**: AntiGravity does not currently support MCP prompts. The 15 workflow prompts are not accessible.
 
 ---
 
@@ -203,7 +219,7 @@ docker pull writenotenow/memory-journal-mcp@sha256:<manifest-digest>
 
 ## ⚡ Core Features
 
-### 🛠️ 29 MCP Tools (8 Groups)
+### 🛠️ 31 MCP Tools (8 Groups)
 | Group | Tools | Description |
 |-------|-------|-------------|
 | `core` | 6 | Entry CRUD, tags, test |
@@ -212,52 +228,21 @@ docker pull writenotenow/memory-journal-mcp@sha256:<manifest-digest>
 | `relationships` | 2 | Link entries, visualize graphs |
 | `export` | 1 | JSON/Markdown export |
 | `admin` | 4 | Update, delete, vector index management |
-| `github` | 7 | Issues, PRs, context, **Kanban board** |
+| `github` | 9 | Issues, PRs, context, Kanban, **issue lifecycle** |
 | `backup` | 3 | Backup, list, restore |
 
 **[Complete tools documentation →](https://github.com/neverinfamous/memory-journal-mcp/wiki/Tools)**
 
-### 🎯 14 Workflow Prompts
+### 🎯 15 Workflow Prompts
 Standups • Retrospectives • Weekly digests • PR summaries • Code review prep • Goal tracking  
 **[Complete prompts guide →](https://github.com/neverinfamous/memory-journal-mcp/wiki/Prompts)**
 
-### 📡 16 Resources
-Including `memory://health` for diagnostics and `memory://kanban/{n}` for Kanban boards  
+### 📡 18 Resources (12 Static + 6 Template)
+Including `memory://briefing` for session initialization, `memory://instructions` for behavioral guidance, `memory://health` for diagnostics, and `memory://kanban/{n}` for Kanban boards. Template resources require parameters and are accessed directly by URI.  
 **[Resources documentation →](https://github.com/neverinfamous/memory-journal-mcp/wiki/Resources)**
 
 ---
 
-## 📖 Quick Examples
-
-```javascript
-// Create entry with auto-context
-create_entry({
-  content: "Implemented lazy ML loading",
-  tags: ["performance"]
-})
-
-// Create a backup before major changes
-backup_journal({ name: "pre_refactor" })
-
-// Check server health
-// Fetch memory://health resource
-
-// Search entries
-search_entries({ query: "performance" })
-
-// View Kanban board
-get_kanban_board({ project_number: 5 })
-
-// Move item on Kanban
-move_kanban_item({ project_number: 5, item_id: "PVTI_...", target_status: "Done" })
-
-// Access MCP resources
-memory://recent                  // Recent entries
-memory://health                  // Server diagnostics
-memory://kanban/5                // Kanban board view
-memory://projects/1/timeline     // Project timeline
-```
-
 **Ask Cursor AI naturally:**
 - "Show me my recent journal entries"
 - "Create a backup of my journal"
@@ -288,6 +273,37 @@ memory://projects/1/timeline     // Project timeline
 **Token Scopes:** `repo`, `project`, `read:org` (org projects only)  
 **[Full configuration guide →](https://github.com/neverinfamous/memory-journal-mcp/wiki/Installation#configuration)**
 
+### GitHub Management Capabilities
+
+Memory Journal provides a **hybrid approach** to GitHub management:
+
+| Capability Source | Purpose |
+|-------------------|---------|
+| **MCP Server** | Specialized features: Kanban visualization, journal linking, project timelines |
+| **Agent (gh CLI)** | Full GitHub mutations: create/close issues, create/merge PRs, manage releases |
+
+**MCP Server Tools (Read + Kanban + Issue Lifecycle):**
+- `get_github_issues` / `get_github_issue` - Query issues
+- `get_github_prs` / `get_github_pr` - Query pull requests
+- `get_github_context` - Full repository context
+- `get_kanban_board` / `move_kanban_item` - **Kanban management**
+- `create_github_issue_with_entry` / `close_github_issue_with_entry` - **Issue lifecycle with journal linking**
+
+**Agent Operations (via gh CLI):**
+```bash
+# Issues
+gh issue create --title "Bug fix" --body "Description"
+gh issue close 42
+
+# Pull Requests
+gh pr create --fill
+gh pr merge 123
+```
+
+> **Why this design?** The MCP server focuses on value-added features that integrate journal entries with GitHub (Kanban views, timeline resources, context linking). Standard GitHub mutations are handled by `gh` CLI, which agents can invoke directly.
+
+**[Complete GitHub integration guide →](https://github.com/neverinfamous/memory-journal-mcp/wiki/Git-Integration)**
+
 ### Tool Filtering
 
 Control which tools are exposed using `MEMORY_JOURNAL_MCP_TOOL_FILTER`:
@@ -325,7 +341,7 @@ docker run -i --rm \
 | **AMD64** (x86_64) | Complete: all tools, semantic search, Git context |
 | **ARM64** (Apple Silicon) | Complete: all tools, semantic search, Git context |
 
-**TypeScript v3.0 Image Benefits:**
+**TypeScript Image Benefits:**
 - **Node.js 24 on Alpine Linux** - Minimal footprint (~150MB compressed)
 - **Pure JS Stack** - No native compilation, identical features on all platforms
 - **sql.js** - SQLite in pure JavaScript
@@ -342,7 +358,7 @@ docker run -i --rm \
 - 📋 **SBOM Available** - Complete software bill of materials
 
 **Available Tags:**
-- `3.1.4` - Specific version (recommended for production)
+- `4.0.0` - Specific version (recommended for production)
 - `3.0` - Latest patch in 3.0.x series
 - `3` - Latest minor in 3.x series
 - `latest` - Always the newest version

package/Dockerfile

@@ -21,11 +21,9 @@ COPY package*.json .npmrc ./
 # The .npmrc has legacy-peer-deps=true to handle zod peer conflicts
 RUN npm ci
 
-# Clean protobufjs bundled cli dependencies and apply overrides
-# This ensures our brace-expansion and tmp overrides take effect
-RUN rm -rf node_modules/protobufjs/cli/node_modules/brace-expansion \
-           node_modules/protobufjs/cli/node_modules/tmp && \
-    npm dedupe
+# Remove protobufjs CLI entirely - not needed at runtime
+# Eliminates CVE-2019-10790 (taffydb), CVE-2025-54798 (tmp), CVE-2025-5889 (brace-expansion)
+RUN rm -rf node_modules/protobufjs/cli
 
 # Copy source code
 COPY tsconfig.json ./
@@ -78,6 +76,6 @@ CMD ["node", "dist/cli.js"]
 # Labels for Docker Hub
 LABEL maintainer="Adamic.tech"
 LABEL description="Memory Journal MCP Server - Project context management for AI-assisted development"
-LABEL version="3.1.4"
+LABEL version="4.0.0"
 LABEL org.opencontainers.image.source="https://github.com/neverinfamous/memory-journal-mcp"
 LABEL io.modelcontextprotocol.server.name="io.github.neverinfamous/memory-journal-mcp"