C+

npm:@morous-dev/engram-cc

Item: npm:@morous-dev/engram-cc
Rating: 78
Author: wmcp.sh

https://www.npmjs.com/package/@morous-dev/engram-cc

78/100 · MCP Trust Grade · checked 2h ago · MCP 0.1.4

What it offers — 5 tools · Finance & Crypto

recall

Get full session context: last handoff, working memory, decisions, files modified. Call this at the start of every session.

search

Full-text search over session memory. Find past decisions, errors, file changes, and context by keyword.

recent

Get the most recent session events. Useful for understanding what happened in the last session.

semantic_search

Semantic similarity search over session memory. Finds related decisions, errors, and context by meaning, not just keywords. Use when keyword search fa

graph_query

Query the knowledge graph. Find files, concepts, and decisions related to a given topic or file path.

Spec / packaging20%100

✓ depends on an MCP SDK
✓ declares a bin entry (runnable server)
✓ 5 tool(s) detected in source

Security (OWASP MCP)30%55

install/postinstall script present (supply-chain surface)
uses eval/exec/child_process (review for unsanitized input)
scanned 6 source files

Maintenance / popularity20%100

published within 90 days
5 published versions

Tool hygiene15%55

no TypeScript types
4 runtime deps
install script reduces hygiene

Transparency / provenance15%90

✓ public repository linked
✓ AGPL-3.0-only license
28 weekly downloads

Findings

WARN Runs an install/postinstall script — supply-chain surface to review.

INFO Static analysis of npm package @morous-dev/engram-cc@0.1.4 (stdio server — no remote endpoint). Reliability/behavioral signals require running it; not measured.

Grade another server

We re-grade npm:@morous-dev/engram-cc on a schedule and alert your Slack/webhook the moment its tools change or its grade drops — rug-pull insurance for the connection.

Share this report card

A 1200×630 card with the grade + audit — drop it in a post, Slack, or your repo.

MCP Trust report card — npm:@morous-dev/engram-cc grade C+

Share on X Open card image

https://wmcp.sh/mcp/grade/npm%3A%40morous-dev%2Fengram-cc

Embed this grade

A live badge — it re-verifies itself and shows current stability. Static scorecards can't. Paste it in your README or site to show users you're independently audited.

Markdown (for your README)

[![MCP Trust Grade C+](https://wmcp.sh/mcp/grade/npm%3A%40morous-dev%2Fengram-cc/badge.svg)](https://wmcp.sh/mcp/grade/npm%3A%40morous-dev%2Fengram-cc)

HTML

<a href="https://wmcp.sh/mcp/grade/npm%3A%40morous-dev%2Fengram-cc"><img src="https://wmcp.sh/mcp/grade/npm%3A%40morous-dev%2Fengram-cc/badge.svg" alt="MCP Trust Grade C+ · wmcp.sh"></a>

Agents: check this before connecting

Add the wmcp.sh trust oracle as an MCP server and call grade_mcp_server / check_mcp_drift in your agent's pre-connection gate:

https://wmcp.sh/mcp/trust

How this grade is computed. An open, independent rubric — Spec conformance (20%), Security mapped to the OWASP MCP Top 10 (30%), Reliability (20%), Tool hygiene (15%), Transparency (15%) — run by connecting to the server and inspecting its real MCP surface. The grade is free and identical whether or not the operator pays. v1 uses static + spec signals from a single connection; continuous uptime, real latency, and annotation-truthing (declared readOnly vs observed behavior) layer on via the wmcp.sh proxy.