)
Last updated: November 5, 2026
What is an MCP memory server? An MCP memory server is a small program that gives an AI client such as Claude persistent memory through the Model Context Protocol. It stores facts in a local file, lets the model read and update them with tools, and keeps them after the chat ends. In Claude Code, one command connects it.
TL;DR: Key Takeaways
- The reference MCP memory server exposes 9 tools over a local knowledge graph and is published on npm as @modelcontextprotocol/server-memory (MCP servers repository, 2026).
- In Claude Code, one
claude mcp addcommand registers it, and the user scope makes it available across all your projects (Claude Code docs, 2026). - Node.js 24 or later is required. The default memory file sits next to the server code, where an update or a cleared npx cache can delete it, so set MEMORY_FILE_PATH to an absolute path you own (README, 2026).
- Local servers in claude_desktop_config.json are not available in Cowork or claude.ai. Remote custom connectors work on Free, Pro, Max, Ultra, Team and Enterprise plans (Claude Help Center, 2026).
- A September 2026 study reached an average 81.7% cross-session attack success rate on Claude Code by getting poisoned instructions written into persistent memory (Huang et al., 2026).
At a glance: three ways to give Claude memory
Quick Answer
How do I give Claude persistent memory with MCP?
Install the reference memory server as a local stdio server. In Claude Code, run one claude mcp add command. In Claude Desktop, add a JSON entry. For claude.ai or Cowork, you need a remote memory server added as a custom connector instead, because local servers do not reach those clients.
| Option | Works in | Where memory lives | Best for |
|---|---|---|---|
| Claude's built-in memory | Web, Desktop and mobile apps | Anthropic's account memory | Personal use in Claude only |
| Local MCP memory server | Claude Code, Claude Desktop | A JSONL file on your machine | Developers who want to own the file |
| Remote MCP memory server | claude.ai, Desktop, Cowork, mobile | Wherever the server is hosted | Teams and cross-client memory |
How we researched
On November 5, 2026 we read the reference server's README, the Claude Code MCP documentation, two Claude Help Center articles, the MCP tools specification (2026-07-28), the OWASP MCP Top 10 and a September 2026 arXiv paper. We ran the claude mcp add command in an isolated profile and it connected.
How an MCP memory server works
An MCP memory server exposes a small set of tools that read and write a knowledge graph. The model decides when to call them. According to the MCP servers repository (2026), the graph holds entities, relations between them and short observations, and each fact should be atomic.
| Tool group | Tools | What the model does |
|---|---|---|
| Write | create_entities, create_relations, add_observations | Saves people, projects and facts |
| Read | search_nodes, open_nodes, read_graph | Recalls what it saved earlier |
| Delete | delete_entities, delete_observations, delete_relations | Removes outdated or wrong facts |
The server also exposes the whole graph as an MCP resource. It serves clients on both protocol eras from one process, so it works with older and with 2026-07-28 clients. Memory only helps if the model calls it, so the next section includes a prompt.
)
Connect an MCP memory server to Claude in one line
You can connect an MCP memory server to Claude Code with one command. According to the Claude Code docs (2026), the double dash separates Claude's own options from the command that starts the server, and the local scope is the default.
Run claude mcp list to confirm it shows as connected, or type /mcp inside a session. Use --scope project to share the entry with your team through .mcp.json, or leave the scope out to keep it in the current project only.
Claude Desktop
Claude Desktop reads a JSON file. Add this block to claude_desktop_config.json, with the same optional MEMORY_FILE_PATH variable under env. On Windows, the README uses cmd with /c before npx.
Tell Claude when to remember
The README warns that the prompt decides how often and what Claude saves. Its example asks Claude to begin by saying "Remembering...", read the graph, then store new identity, preferences, goals and relationships as entities, relations and observations. Put your version in a Claude.ai Project's custom instructions, as the README suggests, or in your Claude Code project instructions.
Choose where the graph is stored
According to the README, the default memory.jsonl sits in the server's own directory. Under npx, that is inside node_modules, so an update or a cleared cache can delete your graph. Set MEMORY_FILE_PATH to an absolute path, and make sure its folder exists, because the server creates the file but not the folders above it.
What an MCP memory server cannot do
The reference server is, in its own words, a basic implementation. It is a good starting point for one person and a poor fit for a team that needs access control. Check each gap below before you rely on it for anything shared.
| Need | Reference server | What to do |
|---|---|---|
| Share memory across clients | Works only with a shared file path | Use one path, or a hosted server |
| Access control per user | None | Put a gateway or hosted service in front |
| Reach claude.ai or Cowork | Local servers cannot connect | Host a remote server as a custom connector |
| Audit who wrote what | Not provided | Log calls at a gateway |
When several clients share one file, each write takes a lock file, so writes take turns. A network filesystem that does not honour exclusive file creation cannot be shared this way. For options beyond the reference server, start with our guide to owning your AI memory.
MCP memory server security: poisoning and data ownership
An MCP memory server is a security boundary, because whatever lands in memory is read back as trusted context in later sessions. A poisoned write does not end with the chat. It persists and can steer the agent days later.
According to Huang, Zhang and Jia (2026), their attack hides malicious instructions in benign external content and induces the agent to save them. Across settings, injection succeeded 66.9% of the time on Claude Code and 73.7% on OpenClaw. The later cross-session success rates were 81.7% and 55.5%. A prompt-level defense reduced injection in many settings but gave limited protection once memory was poisoned.
OWASP's MCP Top 10, still in beta, covers the same ground. It describes secrets stored in model memory and protocol logs as MCP01 and context over-sharing across tasks, users or agents as MCP10. Our OWASP MCP Top 10 guide maps all ten, and the agentic applications guide covers memory and context poisoning as ASI06.
| Risk | Control |
|---|---|
| Poisoned writes from web pages or files | Keep a human able to deny tool calls, as the MCP specification says clients should |
| Facts that persist after the session | Review the graph often, using read_graph with observationLimit 0 for a cheap overview |
| Secrets saved as observations | Never store tokens or passwords in memory |
| Over-sharing between projects | Use a separate MEMORY_FILE_PATH per project or person |
| Package supply chain | Pin a reviewed version, for example @2.1.0, instead of the latest |
| Lost or locked-in data | Back up the JSONL file, which is plain text you own |
According to the MCP specification (2026), there SHOULD always be a human in the loop able to deny tool invocations. For teams, the Agent Gateway (TrustGate) sits between agents and MCP servers. NeuralTrust's MCP Gateway page says teams can decide which tools each agent can access, restrict read and write operations and track which LLM used which tool. That lets you give every agent search_nodes and one agent the write tools. For wider hardening, read the MCP security best practices checklist.
Which MCP memory server setup should you choose?
Pick the setup by where you work and who shares the memory. The reference server fits one developer in Claude Code. Anyone who works in claude.ai or in a team needs a remote server and some control over who can write to it.
| You are | Choose | Why |
|---|---|---|
| Solo developer in Claude Code | Reference server, user scope | One command, local file you own |
| Claude Desktop user | Reference server in the JSON config | Same server, no command line |
| Mostly on claude.ai | Built-in memory or a remote connector | Local servers cannot connect |
| Team or regulated company | Hosted server behind a gateway | Access control and audit trail |
If you are moving memory between assistants first, our guide to moving your AI memory between ChatGPT and Claude comes before any server setup.
Conclusion
An MCP memory server is the quickest way to give Claude Code memory you own: one command, a local JSONL file and a small set of tools. Set an absolute MEMORY_FILE_PATH, give Claude a clear prompt and review what it saves. Treat memory as an attack surface, because poisoned writes persist across sessions. For teams, add hosted storage with access control and an audit trail before sharing memory across agents.
Secure MCP Memory Servers in Production with NeuralTrust
Control which agents can read or write your MCP memory tools, and see which LLM called which tool, with the Agent Gateway (TrustGate).
Related Comparisons
- Own Your AI Memory
- MCP Security Best Practices
- What Is an Agent Harness?
- How to Build a Company Brain
FAQs about MCP Memory Server
1. What is an MCP memory server?
An MCP memory server is a program that gives an AI client persistent memory through the Model Context Protocol. The reference version stores a local knowledge graph of entities, relations and observations, and exposes tools to create, search and delete them. Claude can then recall facts across chats.
2. How do I add an MCP memory server to Claude Code?
Run claude mcp add memory --scope user -- npx -y @modelcontextprotocol/server-memory. The double dash separates Claude's options from the server command. Then run claude mcp list or type /mcp to confirm it is connected. Add --env MEMORY_FILE_PATH=~/memory.jsonl to choose where the graph is stored.
3. Does the MCP memory server work with Claude Desktop and claude.ai?
It works with Claude Desktop through claude_desktop_config.json. It does not work in claude.ai or Cowork, which use remote connectors that Claude reaches from Anthropic's cloud. For those clients, you need a remote memory server added as a custom connector.
4. Where does the MCP memory server store data?
It stores the graph in a JSONL file. By default that is memory.jsonl in the server's own directory, which under npx is inside node_modules and can be deleted on an update. Set MEMORY_FILE_PATH to an absolute path you own, and back that file up.
5. Is the MCP memory server safe?
It is safe to run locally, but memory itself is an attack surface. A 2026 study got poisoned instructions saved into persistent memory and reached an 81.7% cross-session success rate on Claude Code. Review what is saved, keep secrets out and require human approval for sensitive tool calls.
6. How is it different from Claude's built-in memory?
Claude's built-in memory is saved in your Anthropic account and works in Claude's own apps. An MCP memory server is a separate store you control, and any MCP client can use it. That makes it portable, but you must manage its storage, prompt and security yourself.
7. Can several clients share one memory file?
Yes, if they use the same MEMORY_FILE_PATH. Each client starts its own server process, and every write takes a lock file so writes happen one at a time. A write that cannot get the lock within 60 seconds fails with an error. Network filesystems that ignore exclusive creation are unsafe for this.
About the Author
Roger Howroyd is Head of Global SEO and AI at NeuralTrust, where he leads the company's search strategy across SEO, AEO, GEO, and LLM optimization. He specializes in AI-powered search, content strategy, and SEM. Connect on LinkedIn.
NeuralTrust is the leading platform for securing and scaling AI agents. Named a Pioneer in the Gartner Emerging Market Quadrant for AI Application Security 2026, recognized across four Gartner Hype Cycle reports in 2026, and featured in the Gartner Market Guide for Guardian Agents 2026, the Gartner Market Guide for AI Gateways 2025 and the KuppingerCole Leadership Compass for Generative AI Defense 2025. Headquartered in Barcelona with offices in London and New York. ISO 27001 certified.
Sources
Accessed on November 5, 2026.
- Model Context Protocol, "Knowledge Graph Memory Server" README, servers repository, 2026.
- Anthropic, "Connect Claude Code to tools via MCP", Claude Code Docs, 2026.
- Anthropic, "Get started with custom connectors using remote MCP", Claude Help Center, 2026.
- Anthropic, "Use Claude's chat search and memory to build on previous context", Claude Help Center, 2026.
- Model Context Protocol, "Tools" (spec version 2026-07-28), 2026.
- Huang, S., Zhang, J. and Jia, H., "When Malicious Instructions Persist: Persistent Memory Poisoning Attack on Harness-Based Agents", arXiv 2609.13889, September 12, 2026.
- OWASP, "OWASP MCP Top 10", beta.
)
)
)
)