memory-journal-mcp 7.4.0 → 7.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -10,7 +10,7 @@
10
10
  [![MCP Registry](https://img.shields.io/badge/MCP_Registry-Published-green)](https://registry.modelcontextprotocol.io/v0/servers?search=io.github.neverinfamous/memory-journal-mcp)
11
11
  [![Security](https://img.shields.io/badge/Security-Enhanced-green.svg)](SECURITY.md)
12
12
  [![TypeScript](https://img.shields.io/badge/TypeScript-Strict-blue.svg)](https://github.com/neverinfamous/memory-journal-mcp)
13
- ![Coverage](https://img.shields.io/badge/Coverage-96.5%25-brightgreen.svg)
13
+ ![Coverage](https://img.shields.io/badge/Coverage-91.25%25-green.svg)
14
14
  ![Tests](https://img.shields.io/badge/Tests-1782_passed-brightgreen.svg)
15
15
  ![E2E Tests](https://img.shields.io/badge/E2E_Tests-391_passed-brightgreen.svg)
16
16
  [![CI](https://github.com/neverinfamous/memory-journal-mcp/actions/workflows/gatekeeper.yml/badge.svg)](https://github.com/neverinfamous/memory-journal-mcp/actions/workflows/gatekeeper.yml)
@@ -42,6 +42,7 @@ Memory Journal solves this by acting as your project's **long-term memory**, bri
42
42
  - _"Why did we choose SQLite over Postgres for this service last month?"_ (Semantic search)
43
43
  - _"Run the `/issue-triage` workflow on the top priority ticket in the Kanban board."_ (GitHub operations)
44
44
  - _"Who has been touching the auth module recently, and what's our team collaboration density?"_ (Team analytics)
45
+ - _"I'm stuck on this database error. Raise a 'blocker' flag for @sarah so her agent sees it next session."_ (Hush Protocol)
45
46
  - _"Close issue #42 and log an entry explaining our architectural fix for the parsing bug."_ (Context lifecycles)
46
47
  - _"Draw a visual graph showing how my last 10 architectural decisions relate to each other."_ (Knowledge graph)
47
48
 
@@ -51,7 +52,7 @@ Memory Journal solves this by acting as your project's **long-term memory**, bri
51
52
 
52
53
  ## 🎯 What Sets Us Apart
53
54
 
54
- **68 MCP Tools** · **17 Workflow Prompts** · **34 Resources** · **10 Tool Groups** · **Code Mode** · **GitHub Commander** (Issue Triage, PR Review, Milestone Sprints, Security/Quality/Perf Audits) · **GitHub Integration** (Issues, PRs, Actions, Kanban, Milestones, Insights) · **Team Collaboration** (Shared DB, Vector Search, Cross-Project Insights)
55
+ **70 MCP Tools** · **17 Workflow Prompts** · **36 Resources** · **10 Tool Groups** · **Code Mode** · **GitHub Commander** (Issue Triage, PR Review, Milestone Sprints, Security/Quality/Perf Audits) · **GitHub Integration** (Issues, PRs, Actions, Kanban, Milestones, Insights) · **Team Collaboration** (Shared DB, Vector Search, Cross-Project Insights, Hush Protocol Flags)
55
56
 
56
57
  | Feature | Description |
57
58
  | ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -60,10 +61,11 @@ Memory Journal solves this by acting as your project's **long-term memory**, bri
60
61
  | **Dynamic Project Routing** | Seamlessly switch contexts and access CI/Issue tracking across multiple repositories using a single server instance via `PROJECT_REGISTRY` |
61
62
  | **Knowledge Graphs** | 8 relationship types linking specs → implementations → tests → PRs with Mermaid visualization |
62
63
  | **Hybrid Search** | Reciprocal Rank Fusion combining FTS5 keywords, semantic vector similarity, auto-heuristics, and date-range filters |
63
- | **Code Mode** | Execute multi-step operations in a secure sandbox — up to 90% token savings via `mj.*` API |
64
- | **Configurable Briefing** | 14 env vars / CLI flags control `memory://briefing` content — entries, team, GitHub detail, skills awareness |
64
+ | **Code Mode** | Execute multi-step operations in a trusted-admin execution environment — up to 90% token savings via `mj.*` API |
65
+ | **Configurable Briefing** | 15 env vars / CLI flags control `memory://briefing` content — entries, team, GitHub detail, skills awareness, chronological grounding |
65
66
  | **Reports & Analytics** | Standups, retrospectives, PR summaries, digests, period analyses, and milestone tracking |
66
- | **Team Collaboration** | 23 tools with full parity CRUD, vector search, relationship graphs, cross-project insights, author attribution |
67
+ | **Hush Protocol (Flags)** | Replace Slack/Teams noise with structured, actionable, and searchable AI flags (blockers, reviews) that automatically surface in session briefings |
68
+ | **Team Collaboration** | 25 tools with full parity — CRUD, vector search, relationship graphs, cross-project insights, author attribution, Hush Protocol flags |
67
69
  | **Data Interoperability** | Bidirectional Markdown roundtripping, unified IO namespace, and schema-safe JSON exports with hard bounds-checked path traversal defenses |
68
70
  | **Backup & Restore** | One-command backup/restore with automated scheduling, retention policies, and safety-net auto-backups |
69
71
  | **Security & Transport** | OAuth 2.1 (RFC 9728/8414, JWT/JWKS, scopes), Streamable HTTP + SSE, rate limiting, CORS, SQL injection prevention, non-root Docker |
@@ -117,7 +119,7 @@ flowchart TB
117
119
  ---
118
120
 
119
121
  <details>
120
- <summary><strong>🤖 Click to view the recommended AI Agent Instructions/Rule</strong></summary>
122
+ <summary><strong>Recommended AI Agent Instructions/Rule</strong></summary>
121
123
 
122
124
  _Suggested Rule (Add to AGENTS.md, GEMINI.md, system prompts, etc.)_
123
125
 
@@ -128,14 +130,12 @@ Execute BEFORE fulfilling any user request in a new session:
128
130
  1. **TARGET**: Infer `repo_name` from the active workspace context or user prompt. If the task is not associated with a specific project, fallback to using the generic resource without a repo name (which defaults to the first registered workspace).
129
131
  2. **FETCH**: Use the MCP `read_resource` tool (Server: `memory-journal-mcp`) to read `memory://briefing/{repo_name}` (or `memory://briefing` if falling back).
130
132
  - **RESTRICTION**: Do NOT use `execute_code` for this step.
131
- 3. **RENDER TABLE**: Parse the briefing JSON and output a dense 2-column Markdown Table (Field, Value) capturing the core context.
132
- - **RESTRICTION**: NO bulleted lists. Do NOT truncate issues or summaries.
133
- - **FORMATTING**: Group related properties to save vertical space. Use `<br>` tags for inner-cell line breaks.
134
- - **REQUIRED GROUPS**:
135
- - **GitHub**: Combine Repo, Branch, CI, PRs, and Insights.
136
- - **GitHub Issues**: List every issue, one per line.
137
- - Also include Entry Counts (Journal/Team), Latest Entries/Summaries, Proactive Analytics/Team Density, Milestones, and Workspaces.
138
- 4. **STOP & WAIT**: After rendering the table, execute the user's prompt but do NOT autonomously resume past tasks or start work on new issues mentioned in the session summary. The briefing is strictly for context.
133
+ 3. **ACKNOWLEDGE FLAGS**: If the briefing JSON contains `activeFlags` (count > 0), you MUST print an alert ABOVE the table: `⚠️ **{count} active flag(s)** — review before proceeding.` followed by each flag (`🚩 {flag_type} → @{target_user}: {preview}`).
134
+ 4. **RENDER TABLE**: Parse the remaining JSON into a dense 2-column Markdown Table (Field, Value).
135
+ - **RESTRICTION**: NO bulleted lists inside the table. Do NOT truncate summaries or issues.
136
+ - **FORMATTING**: Group related properties (use `<br>` for line breaks).
137
+ - **REQUIRED GROUPS**: GitHub (Repo, Branch, CI, PRs, Insights), Issues, Entry Counts, Latest Entries/Summaries, Analytics, Milestones, Workspaces.
138
+ 5. **STOP & WAIT**: Do NOT autonomously resume past tasks or start work on new issues mentioned in the session summary. The briefing is strictly for context.
139
139
 
140
140
  </details>
141
141
 
@@ -150,12 +150,12 @@ Control which tools are exposed via `MEMORY_JOURNAL_MCP_TOOL_FILTER` (or CLI: `-
150
150
 
151
151
  | Filter | Tools | Use Case |
152
152
  | -------------------- | ----- | ------------------------ |
153
- | `full` | 68 | All tools (default) |
153
+ | `full` | 70 | All tools (default) |
154
154
  | `starter` | ~11 | Core + search + codemode |
155
155
  | `essential` | ~7 | Minimal footprint |
156
- | `readonly` | 18 | Disable all mutations |
157
- | `-github` | 50 | Exclude a group |
158
- | `-github,-analytics` | 48 | Exclude multiple groups |
156
+ | `readonly` | 17 | Disable all mutations |
157
+ | `-github` | 52 | Exclude a group |
158
+ | `-github,-analytics` | 50 | Exclude multiple groups |
159
159
 
160
160
  **Filter Syntax:** `shortcut` or `group` or `tool_name` (whitelist mode) · `-group` (disable group) · `-tool` (disable tool) · `+tool` (re-enable after group disable)
161
161
 
@@ -169,20 +169,20 @@ Control which tools are exposed via `MEMORY_JOURNAL_MCP_TOOL_FILTER` (or CLI: `-
169
169
 
170
170
  ## 📋 Core Capabilities
171
171
 
172
- ### 🛠️ **68 MCP Tools** (10 Groups)
173
-
174
- | Group | Tools | Description |
175
- | --------------- | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
176
- | `codemode` | 1 | Code Mode (sandboxed code execution) 🌟 **Recommended** |
177
- | `core` | 6 | Entry CRUD, tags, test |
178
- | `search` | 4 | Text search, date range, semantic, vector stats |
179
- | `analytics` | 2 | Statistics, cross-project insights |
180
- | `relationships` | 2 | Link entries, visualize graphs |
181
- | `io` | 3 | JSON/Markdown export and File-level Markdown Data Integration Interoperability (Import/Export) |
182
- | `admin` | 5 | Update, delete, rebuild/add to vector index, merge tags |
183
- | `github` | 18 | Issues, PRs, context, Kanban, **Milestones**, **Insights**, **issue lifecycle**, **Copilot Reviews** |
184
- | `backup` | 4 | Backup, list, restore, cleanup |
185
- | `team` | 23 | CRUD, search, stats, relationships, IO (Markdown import/export), backup, vector search, cross-project insights, matrix (requires `TEAM_DB_PATH`) |
172
+ ### 🛠️ **70 MCP Tools** (10 Groups)
173
+
174
+ | Group | Tools | Description |
175
+ | --------------- | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
176
+ | `codemode` | 1 | Code Mode (sandboxed code execution) 🌟 **Recommended** |
177
+ | `core` | 6 | Entry CRUD, tags, test |
178
+ | `search` | 4 | Text search, date range, semantic, vector stats |
179
+ | `analytics` | 2 | Statistics, cross-project insights |
180
+ | `relationships` | 2 | Link entries, visualize graphs |
181
+ | `io` | 3 | JSON/Markdown export and File-level Markdown Data Integration Interoperability (Import/Export) |
182
+ | `admin` | 5 | Update, delete, rebuild/add to vector index, merge tags |
183
+ | `github` | 18 | Issues, PRs, context, Kanban, **Milestones**, **Insights**, **issue lifecycle**, **Copilot Reviews** |
184
+ | `backup` | 4 | Backup, list, restore, cleanup |
185
+ | `team` | 25 | CRUD, search, stats, relationships, IO (Markdown import/export), backup, vector search, cross-project insights, matrix, **Hush Protocol flags** (requires `TEAM_DB_PATH`) |
186
186
 
187
187
  **[Complete tools reference →](https://github.com/neverinfamous/memory-journal-mcp/wiki/Tools)**
188
188
 
@@ -205,15 +205,15 @@ Control which tools are exposed via `MEMORY_JOURNAL_MCP_TOOL_FILTER` (or CLI: `-
205
205
  - `confirm-briefing` - Acknowledge session context to user
206
206
  - `session-summary` - Create a session summary entry with accomplishments, pending items, and next-session context
207
207
  - `team-session-summary` - Create a retrospective team session summary entry securely isolated to the team database
208
- - `load-project-kanban` - Dynamic project board injection
208
+
209
209
 
210
210
  **[Complete prompts guide →](https://github.com/neverinfamous/memory-journal-mcp/wiki/Prompts)**
211
211
 
212
- ### 📡 **34 Resources** (25 Static + 9 Template)
212
+ ### 📡 **36 Resources** (27 Static + 9 Template)
213
213
 
214
214
  **Static Resources** (appear in resource lists):
215
215
 
216
- - `memory://briefing` - **Session initialization**: compact context for AI agents (~300 tokens)
216
+ - `memory://briefing` - **Session initialization**: compact context for AI agents (~300 tokens) — includes `localTime` and optional `activeFlags`
217
217
  - `memory://instructions` - **Behavioral guidance**: complete server instructions for AI agents
218
218
  - `memory://recent` - 10 most recent entries
219
219
  - `memory://significant` - Significant milestones and breakthroughs
@@ -237,7 +237,9 @@ Control which tools are exposed via `MEMORY_JOURNAL_MCP_TOOL_FILTER` (or CLI: `-
237
237
  - `memory://metrics/tokens` - Per-tool token usage breakdown sorted by output token cost — MEDIUM priority
238
238
  - `memory://metrics/system` - Process-level metrics: memory (MB), uptime (s), Node.js version, platform — MEDIUM priority
239
239
  - `memory://metrics/users` - Per-user call counts (populated when OAuth user identifiers are present) — LOW priority
240
- - `memory://audit` - Last 50 write/admin tool call entries from the JSONL audit log (requires `AUDIT_LOG_PATH`)
240
+ - `memory://audit` - Last 50 write/admin tool call entries from the JSONL operational telemetry log (requires `AUDIT_LOG_PATH`)
241
+ - `memory://flags` - Active (unresolved) team flags dashboard (requires `TEAM_DB_PATH`)
242
+ - `memory://flags/vocabulary` - Configured flag vocabulary terms
241
243
 
242
244
  **Template Resources** (require parameters, fetch directly by URI):
243
245
 
@@ -259,17 +261,17 @@ _Note: The `memory://github/status`, `memory://github/insights`, `memory://githu
259
261
 
260
262
  Code Mode (`mj_execute_code`) is a revolutionary approach that **dramatically reduces token usage by up to 90%** and is included by default in all presets. Instead of spending thousands of tokens on sequential tool calls, AI agents use a single sandboxed execution to reason faster.
261
263
 
262
- Code executes in a **sandboxed VM context** with multiple layers of security. All `mj.*` API calls execute against the journal within the sandbox, providing:
264
+ Code executes in a **worker_threads sandbox** designed as a secure multi-tenant process isolation environment. All `mj.*` API calls execute against the journal within the sandbox, providing:
263
265
 
264
266
  - **Static code validation** — blocked patterns include `require()`, `process`, `eval()`, and filesystem access
265
267
  - **Rate limiting** — 60 executions per minute per client
266
268
  - **Hard timeouts** — configurable execution limit (default 30s)
267
- - **Full API access** — all 10 tool groups are available via `mj.*` (e.g., `mj.core.createEntry()`, `mj.search.searchEntries()`, `mj.github.getGithubIssues()`, `mj.analytics.getStatistics()`)
269
+ - **Full API access** — all 10 tool groups are available via `mj.*` (e.g., `mj.core.createEntry()`, `mj.search.searchEntries()`, `mj.github.getGithubIssues()`, `mj.team.passTeamFlag()`)
268
270
  - **Strict Readonly Contract** — Calling any mutation method under `--tool-filter readonly` safely halts the sandbox to prevent execution, returning a structured `{ success: false, error: "..." }` response to the agent instead of a raw MCP protocol exception.
269
271
 
270
272
  ### ⚡ Code Mode Only (Maximum Token Savings)
271
273
 
272
- Run with **only Code Mode enabled** — a single tool that provides access to all 67 tools' worth of capability through the `mj.*` API:
274
+ Run with **only Code Mode enabled** — a single tool that provides access to all 69 tools' worth of capability through the `mj.*` API:
273
275
 
274
276
  ```json
275
277
  {
@@ -296,6 +298,22 @@ If you prefer individual tool calls, exclude codemode:
296
298
 
297
299
  ---
298
300
 
301
+ ## 🤫 Hush Protocol: Asynchronous Team Collaboration
302
+
303
+ The **Hush Protocol** reimagines team collaboration for AI-augmented workflows by replacing noisy Slack/Teams messages with structured, machine-actionable flags.
304
+
305
+ When you encounter a blocker, need a review, or want to broadcast a milestone, your AI agent can raise a flag in the shared Team Database:
306
+
307
+ - **Actionable Visibility**: Active flags automatically surface at the very top of the `memory://briefing` payload for all team members. When another developer's agent starts a session, it immediately sees your blockers and can help resolve them autonomously.
308
+ - **Structured Types**: Raise specific flag types (`blocker`, `needs_review`, `help_requested`, `fyi`). You can customize your team's vocabulary via the `--flag-vocabulary` configuration.
309
+ - **Searchable History**: Unlike chat messages that disappear into the void, Hush flags are permanent, query-able AI journal entries. Your agents can search past `needs_review` flags to understand how architectural blockers were conquered.
310
+
311
+ **Dashboard & Operations**: Read `memory://flags` to see an active dashboard overview and use `mj.team.passTeamFlag()` / `mj.team.resolveTeamFlag()` to manage them programmatically in Code Mode.
312
+
313
+ **[Complete Hush Protocol guide and Mermaid sequence diagrams →](https://github.com/neverinfamous/memory-journal-mcp/wiki/Hush-Protocol)**
314
+
315
+ ---
316
+
299
317
  ## 🚀 Quick Start
300
318
 
301
319
  ### Option 1: npm (Recommended)
@@ -326,7 +344,8 @@ Add this to your `~/.cursor/mcp.json`, Claude Desktop config, or equivalent:
326
344
  "command": "memory-journal-mcp",
327
345
  "env": {
328
346
  "GITHUB_TOKEN": "ghp_your_token_here",
329
- "PROJECT_REGISTRY": "{\"my-repo\":{\"path\":\"/path/to/your/git/repo\",\"project_number\":1}}"
347
+ "PROJECT_REGISTRY": "{\"my-repo\":{\"path\":\"/path/to/your/git/repo\",\"project_number\":1}}",
348
+ "ALLOWED_IO_ROOTS": "/path/to/your/git/repo"
330
349
  }
331
350
  }
332
351
  }
@@ -347,8 +366,10 @@ Showcasing the full power of the server, including Multi-Project Routing, Team C
347
366
  "TEAM_DB_PATH": "/path/to/shared/team.db",
348
367
  "GITHUB_TOKEN": "ghp_your_token_here",
349
368
  "PROJECT_REGISTRY": "{\"my-repo\":{\"path\":\"/path/to/repo\",\"project_number\":1},\"other-repo\":{\"path\":\"/path/to/other\",\"project_number\":5}}",
369
+ "ALLOWED_IO_ROOTS": "/path/to/repo,/path/to/other,/path/to/your/skills",
350
370
  "AUTO_REBUILD_INDEX": "true",
351
371
  "MEMORY_JOURNAL_MCP_TOOL_FILTER": "codemode",
372
+ "CODEMODE_INTERNAL_FULL_ACCESS": "true",
352
373
  "BRIEFING_ENTRY_COUNT": "3",
353
374
  "BRIEFING_SUMMARY_COUNT": "1",
354
375
  "BRIEFING_INCLUDE_TEAM": "true",
@@ -360,7 +381,9 @@ Showcasing the full power of the server, including Multi-Project Routing, Team C
360
381
  "BRIEFING_COPILOT_REVIEWS": "true",
361
382
  "RULES_FILE_PATH": "/path/to/your/RULES.md",
362
383
  "SKILLS_DIR_PATH": "/path/to/your/skills",
363
- "MEMORY_JOURNAL_WORKFLOW_SUMMARY": "/deploy: prod deployment | /audit: security scan"
384
+ "MEMORY_JOURNAL_WORKFLOW_SUMMARY": "/deploy: prod deployment | /audit: security scan",
385
+ "AUDIT_LOG_PATH": "/path/to/your/mcp-audit.jsonl",
386
+ "TEAM_AUTHOR": "your_username"
364
387
  }
365
388
  }
366
389
  }
@@ -384,15 +407,21 @@ Restart your MCP client and start journaling!
384
407
 
385
408
  ### Option 3: HTTP/SSE Transport (Remote Access)
386
409
 
410
+ > 🔒 **Security Posture: Stdio vs HTTP**
411
+ >
412
+ > - **Stdio (Default):** Runs implicitly within the secure boundaries of your local IDE or command-line environment. No explicit authentication is required because the execution context is already trusted.
413
+ > - **HTTP/SSE:** Exposes the server over a network socket. By default, HTTP binds ONLY to `localhost` and blocks wildcard CORS to prevent unauthorized access and CSRF attacks. **Public network binding (`--server-host 0.0.0.0`) requires explicit authentication** (`--auth-token` or `--oauth-enabled`). The server will throw a fatal error if you attempt to expose it publicly without securing it.
414
+
387
415
  For remote access or web-based clients, run the server in HTTP mode:
388
416
 
389
417
  ```bash
390
418
  memory-journal-mcp --transport http --port 3000
391
419
  ```
392
420
 
393
- To bind to all interfaces (required for containers) and enable the automated proactive analytics scheduler (e.g. daily digest):
421
+ To bind to all interfaces (required for containers) and enable the automated proactive analytics scheduler (e.g. daily digest), you MUST provide an authentication token:
394
422
 
395
423
  ```bash
424
+ export MCP_AUTH_TOKEN="your_secure_random_token"
396
425
  memory-journal-mcp --transport http --port 3000 --server-host 0.0.0.0 --digest-interval 1440
397
426
  ```
398
427
 
@@ -477,56 +506,59 @@ Each job is error-isolated — a failure in one job won't affect the others. Sch
477
506
 
478
507
  The GitHub tools (`get_github_issues`, `get_github_prs`, etc.) auto-detect the repository from your git context when `PROJECT_REGISTRY` is configured or the MCP server is run inside a git repository.
479
508
 
480
- | Environment Variable | Description |
481
- | --------------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
482
- | `DB_PATH` | Database file location (CLI: `--db`; default: `./memory_journal.db`) |
483
- | `TEAM_DB_PATH` | Team database file location (CLI: `--team-db`) |
484
- | `TEAM_AUTHOR` | Override author name for team entries (default: `git config user.name`) |
485
- | `GITHUB_TOKEN` | GitHub personal access token for API access |
486
- | `DEFAULT_PROJECT_NUMBER` | Default GitHub Project number for auto-assignment when creating issues |
487
- | `PROJECT_REGISTRY` | JSON map of repos to `{ path, project_number }` for multi-project auto-detection and routing |
488
- | `AUTO_REBUILD_INDEX` | Set to `true` to rebuild vector index on server startup |
489
- | `MCP_HOST` | Server bind host (`0.0.0.0` for containers, default: `localhost`) |
490
- | `MCP_AUTH_TOKEN` | Bearer token for HTTP transport authentication (CLI: `--auth-token`) |
491
- | `MCP_CORS_ORIGIN` | Allowed CORS origins for HTTP transport, comma-separated (default: `*`) |
492
- | `MCP_RATE_LIMIT_MAX` | Max requests per minute per client IP, HTTP only (default: `100`) |
493
- | `LOG_LEVEL` | Log verbosity: `error`, `warn`, `info`, `debug` (default: `info`; CLI: `--log-level`) |
494
- | `MCP_ENABLE_HSTS` | Enable HSTS security header on HTTP responses (CLI: `--enable-hsts`; default: `false`) |
495
- | `OAUTH_ENABLED` | Set to `true` to enable OAuth 2.1 authentication (HTTP only) |
496
- | `OAUTH_ISSUER` | OAuth issuer URL (e.g., `https://auth.example.com/realms/mcp`) |
497
- | `OAUTH_AUDIENCE` | Expected JWT audience claim |
498
- | `OAUTH_JWKS_URI` | JWKS endpoint for token signature verification |
499
- | `OAUTH_CLOCK_TOLERANCE` | Allowed clock skew tolerance in seconds for JWT verification (default: `5`) |
500
- | `CODE_MODE_MAX_RESULT_SIZE` | Maximum size in bytes for mj_execute_code result payload (CLI: `--codemode-max-result-size`; default: `102400`) |
501
- | `BRIEFING_ENTRY_COUNT` | Journal entries in briefing (CLI: `--briefing-entries`; default: `3`) |
502
- | `BRIEFING_SUMMARY_COUNT` | Session summaries to list in briefing (CLI: `--briefing-summaries`; default: `1`) |
503
- | `BRIEFING_INCLUDE_TEAM` | Include team DB entries in briefing (`true`/`false`; default: `false`) |
504
- | `BRIEFING_ISSUE_COUNT` | Issues to list in briefing; `0` = count only (default: `0`) |
505
- | `BRIEFING_PR_COUNT` | PRs to list in briefing; `0` = count only (default: `0`) |
506
- | `BRIEFING_PR_STATUS` | Show PR status breakdown (open/merged/closed; default: `false`) |
507
- | `BRIEFING_MILESTONE_COUNT` | Milestones to list in briefing; `0` = hide entirely (CLI: `--briefing-milestones`; default: `3`) |
508
- | `BRIEFING_WORKFLOW_COUNT` | Workflow runs to list in briefing; `0` = status only (default: `0`) |
509
- | `BRIEFING_WORKFLOW_STATUS` | Show workflow status breakdown in briefing (default: `false`) |
510
- | `BRIEFING_COPILOT_REVIEWS` | Aggregate Copilot review state in briefing (default: `false`) |
511
- | `RULES_FILE_PATH` | Path to user rules file for agent awareness (CLI: `--rules-file`) |
512
- | `SKILLS_DIR_PATH` | Path to skills directory for agent awareness (CLI: `--skills-dir`) |
513
- | `MEMORY_JOURNAL_WORKFLOW_SUMMARY` | Free-text workflow summary for `memory://workflows` (CLI: `--workflow-summary`) |
514
- | `INSTRUCTION_LEVEL` | Briefing depth: `essential`, `standard`, `full` (CLI: `--instruction-level`; default: `standard`) |
515
- | `PROJECT_LINT_CMD` | Project lint command for GitHub Commander validation gates (default: `npm run lint`) |
516
- | `PROJECT_TYPECHECK_CMD` | Project typecheck command (default: `npm run typecheck`; empty = skip) |
517
- | `PROJECT_BUILD_CMD` | Project build command (default: `npm run build`; empty = skip) |
518
- | `PROJECT_TEST_CMD` | Project test command (default: `npm run test`) |
519
- | `PROJECT_E2E_CMD` | Project E2E test command (default: empty = skip) |
520
- | `PROJECT_PACKAGE_MANAGER` | Package manager override: `npm`, `yarn`, `pnpm`, `bun` (default: auto-detect from lockfile) |
521
- | `PROJECT_HAS_DOCKERFILE` | Enable Docker audit steps (default: auto-detect) |
522
- | `COMMANDER_HITL_FILE_THRESHOLD` | Human-in-the-loop checkpoint if changes touch > N files (default: `10`) |
523
- | `COMMANDER_SECURITY_TOOLS` | Override security tool auto-detection (comma-separated; default: auto-detect) |
524
- | `COMMANDER_BRANCH_PREFIX` | Branch naming prefix for PRs (default: `fix`) |
525
- | `AUDIT_LOG_PATH` | Path for the JSONL audit log of write/admin tool calls. Rotates at 10 MB (keeps 5 archives). Omit to disable audit logging. |
526
- | `AUDIT_REDACT` | Set to `true` to omit tool arguments from audit log entries for privacy (default: `false`) |
527
- | `AUDIT_READS` | Log read-scoped tool calls in addition to write/admin (CLI: `--audit-reads`; default: `false`) |
528
- | `AUDIT_LOG_MAX_SIZE` | Maximum audit log file size in bytes before rotation (CLI: `--audit-log-max-size`; default: `10485760`) |
529
- | `MCP_METRICS_ENABLED` | Set to `false` to disable in-memory tool call metrics accumulation (default: `true`) |
509
+ | Environment Variable | Description |
510
+ | --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
511
+ | `DB_PATH` | Database file location (CLI: `--db`; default: `./memory_journal.db`) |
512
+ | `TEAM_DB_PATH` | Team database file location (CLI: `--team-db`) |
513
+ | `TEAM_AUTHOR` | Override author name for team entries (default: `git config user.name`) |
514
+ | `GITHUB_TOKEN` | GitHub personal access token for API access |
515
+ | `DEFAULT_PROJECT_NUMBER` | Default GitHub Project number for auto-assignment when creating issues |
516
+ | `PROJECT_REGISTRY` | JSON map of repos to `{ path, project_number }` for multi-project auto-detection and routing |
517
+ | `AUTO_REBUILD_INDEX` | Set to `true` to rebuild vector index on server startup |
518
+ | `MCP_HOST` | Server bind host (`0.0.0.0` for containers, default: `localhost`) |
519
+ | `MCP_AUTH_TOKEN` | Bearer token for HTTP transport authentication (CLI: `--auth-token`). Must NOT be the default placeholder token. |
520
+ | `ALLOWED_IO_ROOTS` | **Critical Security Boundary**: Comma-separated absolute paths granting filesystem access to Code Mode and export tools (default: none / fail-closed) |
521
+ | `MCP_CORS_ORIGIN` | Allowed CORS origins for HTTP transport, comma-separated (default: blank, strict opt-in) |
522
+ | `MCP_RATE_LIMIT_MAX` | Max requests per minute per client IP, HTTP only (default: `100`) |
523
+ | `LOG_LEVEL` | Log verbosity: `error`, `warn`, `info`, `debug` (default: `info`; CLI: `--log-level`) |
524
+ | `MCP_ENABLE_HSTS` | Enable HSTS security header on HTTP responses (CLI: `--enable-hsts`; default: `false`) |
525
+ | `OAUTH_ENABLED` | Set to `true` to enable OAuth 2.1 authentication (HTTP only) |
526
+ | `OAUTH_ISSUER` | OAuth issuer URL (e.g., `https://auth.example.com/realms/mcp`) |
527
+ | `OAUTH_AUDIENCE` | Expected JWT audience claim |
528
+ | `OAUTH_JWKS_URI` | JWKS endpoint for token signature verification |
529
+ | `OAUTH_CLOCK_TOLERANCE` | Allowed clock skew tolerance in seconds for JWT verification (default: `5`) |
530
+ | `CODE_MODE_MAX_RESULT_SIZE` | Maximum size in bytes for mj_execute_code result payload (CLI: `--codemode-max-result-size`; default: `102400`) |
531
+ | `CODEMODE_INTERNAL_FULL_ACCESS` | Bypass tool filter constraints within the Code Mode sandbox (CLI: `--codemode-internal-full-access`; default: `false`) |
532
+ | `BRIEFING_ENTRY_COUNT` | Journal entries in briefing (CLI: `--briefing-entries`; default: `3`) |
533
+ | `BRIEFING_SUMMARY_COUNT` | Session summaries to list in briefing (CLI: `--briefing-summaries`; default: `1`) |
534
+ | `BRIEFING_INCLUDE_TEAM` | Include team DB entries in briefing (`true`/`false`; default: `false`) |
535
+ | `BRIEFING_ISSUE_COUNT` | Issues to list in briefing; `0` = count only (default: `0`) |
536
+ | `BRIEFING_PR_COUNT` | PRs to list in briefing; `0` = count only (default: `0`) |
537
+ | `BRIEFING_PR_STATUS` | Show PR status breakdown (open/merged/closed; default: `false`) |
538
+ | `BRIEFING_MILESTONE_COUNT` | Milestones to list in briefing; `0` = hide entirely (CLI: `--briefing-milestones`; default: `3`) |
539
+ | `BRIEFING_WORKFLOW_COUNT` | Workflow runs to list in briefing; `0` = status only (default: `0`) |
540
+ | `BRIEFING_WORKFLOW_STATUS` | Show workflow status breakdown in briefing (default: `false`) |
541
+ | `BRIEFING_COPILOT_REVIEWS` | Aggregate Copilot review state in briefing (default: `false`) |
542
+ | `RULES_FILE_PATH` | Path to user rules file for agent awareness (CLI: `--rules-file`) |
543
+ | `SKILLS_DIR_PATH` | Path to skills directory for agent awareness (CLI: `--skills-dir`) |
544
+ | `MEMORY_JOURNAL_WORKFLOW_SUMMARY` | Free-text workflow summary for `memory://workflows` (CLI: `--workflow-summary`) |
545
+ | `INSTRUCTION_LEVEL` | Briefing depth: `essential`, `standard`, `full` (CLI: `--instruction-level`; default: `standard`) |
546
+ | `PROJECT_LINT_CMD` | Project lint command for GitHub Commander validation gates (default: `npm run lint`) |
547
+ | `PROJECT_TYPECHECK_CMD` | Project typecheck command (default: `npm run typecheck`; empty = skip) |
548
+ | `PROJECT_BUILD_CMD` | Project build command (default: `npm run build`; empty = skip) |
549
+ | `PROJECT_TEST_CMD` | Project test command (default: `npm run test`) |
550
+ | `PROJECT_E2E_CMD` | Project E2E test command (default: empty = skip) |
551
+ | `PROJECT_PACKAGE_MANAGER` | Package manager override: `npm`, `yarn`, `pnpm`, `bun` (default: auto-detect from lockfile) |
552
+ | `PROJECT_HAS_DOCKERFILE` | Enable Docker audit steps (default: auto-detect) |
553
+ | `COMMANDER_HITL_FILE_THRESHOLD` | Human-in-the-loop checkpoint if changes touch > N files (default: `10`) |
554
+ | `COMMANDER_SECURITY_TOOLS` | Override security tool auto-detection (comma-separated; default: auto-detect) |
555
+ | `COMMANDER_BRANCH_PREFIX` | Branch naming prefix for PRs (default: `fix`) |
556
+ | `AUDIT_LOG_PATH` | Path for the JSONL operational telemetry log of write/admin tool calls. Rotates at 10 MB (keeps 5 archives). Omit to disable telemetry logging. |
557
+ | `AUDIT_REDACT` | Set to `false` to include tool arguments in telemetry log entries (default: `true`) |
558
+ | `AUDIT_READS` | Log read-scoped tool calls in addition to write/admin (CLI: `--audit-reads`; default: `false`) |
559
+ | `AUDIT_LOG_MAX_SIZE` | Maximum operational telemetry file size in bytes before rotation (CLI: `--audit-log-max-size`; default: `10485760`) |
560
+ | `MCP_METRICS_ENABLED` | Set to `false` to disable in-memory tool call metrics accumulation (default: `true`) |
561
+ | `FLAG_VOCABULARY` | Comma-separated flag types for Hush Protocol (CLI: `--flag-vocabulary`; default: `blocker,needs_review,help_requested,fyi`) |
530
562
 
531
563
  **Multi-Project Workflows**: For agents to seamlessly support multiple projects, provide **`PROJECT_REGISTRY`**.
532
564
 
@@ -630,7 +662,7 @@ Memory Journal provides a **hybrid approach** to GitHub management:
630
662
 
631
663
  ### GitHub Commander Workflows
632
664
 
633
- The server natively bundles the `github-commander` agent skill (accessible via `memory://skills/github-commander`). This extends your AI assistant with 8 autonomous DevOps workflows for repository stewardship: **Issue Triage**, **Milestone Sprints**, **PR Reviews**, **Security Audits**, **Code Quality Audits**, **Performance Audits**, **Roadmap Kickoffs**, and **Dependency Updates**. Configure validation layers using the `PROJECT_*` environment overrides to enforce CI-matching execution locally during agent tasks!
665
+ The server natively bundles the `github-commander` agent skill (accessible via `memory://skills/github-commander`). This extends your AI assistant with 9 autonomous DevOps workflows for repository stewardship: **Issue Triage**, **Milestone Sprints**, **PR Reviews**, **Copilot Audits**, **Security Audits**, **Code Quality Audits**, **Performance Audits**, **Roadmap Kickoffs**, and **Dependency Updates**. Configure validation layers using the `PROJECT_*` environment overrides to enforce CI-matching execution locally during agent tasks!
634
666
 
635
667
  ## 🏗️ Architecture
636
668
 
@@ -641,8 +673,8 @@ flowchart TB
641
673
  AI["🤖 AI Agent<br/>(Cursor, Windsurf, Claude)"]
642
674
 
643
675
  subgraph MCP["Memory Journal MCP Server"]
644
- Tools["🛠️ 67 Tools"]
645
- Resources["📡 34 Resources"]
676
+ Tools["🛠️ 70 Tools"]
677
+ Resources["📡 36 Resources"]
646
678
  Prompts["💬 17 Prompts"]
647
679
  end
648
680
 
@@ -670,7 +702,7 @@ flowchart TB
670
702
  ┌─────────────────────────────────────────────────────────────┐
671
703
  │ MCP Server Layer (TypeScript) │
672
704
  │ ┌─────────────────┐ ┌─────────────────┐ ┌─────────────┐ │
673
- │ │ Tools (67) │ │ Resources (34) │ │ Prompts (17)│ │
705
+ │ │ Tools (70) │ │ Resources (36) │ │ Prompts (17)│ │
674
706
  │ │ with Annotations│ │ with Annotations│ │ │ │
675
707
  │ └─────────────────┘ └─────────────────┘ └─────────────┘ │
676
708
  ├─────────────────────────────────────────────────────────────┤
@@ -695,8 +727,8 @@ flowchart TB
695
727
 
696
728
  - **TypeScript + Native SQLite** - High-performance `better-sqlite3` with synchronous I/O
697
729
  - **sqlite-vec** - Vector similarity search via SQLite extension
698
- - **@huggingface/transformers** - ML embeddings in JavaScript
699
- - **Lazy loading** - ML models load on first use, not startup
730
+ - **@huggingface/transformers** - Local ML embedding models in JavaScript
731
+ - **Background Warmup** - Model weights (~23MB) are loaded into memory asynchronously on server startup to avoid first-request latency. If the server is invoked before warmup completes, the first semantic search or vector insertion will incur a network-bound cold start (~1.5s - 3s) while the weights are cached locally.
700
732
 
701
733
  ### Performance Benchmarks
702
734