Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

verygoodplugins/automem

https://github.com/verygoodplugins/automem · scanned 2026-06-16 00:48 UTC (2 months, 1 week ago)

151 raw signals (0 security + 151 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 1 week ago · v1 · 122 actionable findings from 1 signal source. 29 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
45.8
/100
Security checks
46
0 findings
System graph
46
100.0% cov · 122 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: severity: high × excluding tests × Reset all
Severity: Critical 0 High 23 Medium 9 Low 82 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 122 Crowd 0 Layer: Software 23 Frontend 3 Hardware 5 Security 18 Cicd 3 Quality 29 Api 41
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 45.8/100 with 100.0% coverage. It contains 2046 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 151 findings — concentrated in api (41), quality (38), software (23). Risk profile is high: 0 critical, 23 high, 20 medium. Recommended next step: open the api layer findings first — that's where the highest-impact wins live.

Showing 23 of 122 actionable findings. 151 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: CLAUDE.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
CLAUDE.md:149 SecretsClaude instruction
high System graph api Wiring conf 1.00 Dangling fetch: GET http://127.0.0.1:${port}/mcp/sse (mcp-sse-server/test/server.test.js:686)
`mcp-sse-server/test/server.test.js:686` calls `GET http://127.0.0.1:${port}/mcp/sse` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/mcp/sse` If this points at an external API, prefix it with `h…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST http://127.0.0.1:${port}/mcp (mcp-sse-server/test/server.test.js:325)
`mcp-sse-server/test/server.test.js:325` calls `POST http://127.0.0.1:${port}/mcp` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/mcp` If this points at an external API, prefix it with `https://…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST http://127.0.0.1:${port}/mcp (mcp-sse-server/test/server.test.js:360)
`mcp-sse-server/test/server.test.js:360` calls `POST http://127.0.0.1:${port}/mcp` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/mcp` If this points at an external API, prefix it with `https://…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST http://127.0.0.1:${port}/mcp (mcp-sse-server/test/server.test.js:491)
`mcp-sse-server/test/server.test.js:491` calls `POST http://127.0.0.1:${port}/mcp` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/mcp` If this points at an external API, prefix it with `https://…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST http://127.0.0.1:${port}/mcp/ (mcp-sse-server/test/server.test.js:406)
`mcp-sse-server/test/server.test.js:406` calls `POST http://127.0.0.1:${port}/mcp/` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/mcp` If this points at an external API, prefix it with `https:/…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST http://127.0.0.1:${port}/mcp/ (mcp-sse-server/test/server.test.js:447)
`mcp-sse-server/test/server.test.js:447` calls `POST http://127.0.0.1:${port}/mcp/` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/mcp` If this points at an external API, prefix it with `https:/…
Dangling fetchFetch
high System graph security auth conf 1.00 Flask mutation route `_associate` without `@login_required` — automem/api/memory.py:168
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
automem/api/memory.py:168 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `_by_tag` without `@login_required` — automem/api/memory.py:160
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
automem/api/memory.py:160 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `_delete` without `@login_required` — automem/api/memory.py:156
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
automem/api/memory.py:156 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `_store` without `@login_required` — automem/api/memory.py:148
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
automem/api/memory.py:148 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `_update` without `@login_required` — automem/api/memory.py:152
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
automem/api/memory.py:152 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `associate` without `@login_required` — automem/api/memory.py:765
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
automem/api/memory.py:765 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `by_tag` without `@login_required` — automem/api/memory.py:688
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
automem/api/memory.py:688 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `consolidate` without `@login_required` — automem/api/consolidation.py:22
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
automem/api/consolidation.py:22 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete` without `@login_required` — automem/api/memory.py:666
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
automem/api/memory.py:666 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `enrichment_reprocess` without `@login_required` — automem/api/enrichment.py:36
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
automem/api/enrichment.py:36 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `merge_entity` without `@login_required` — automem/api/entity.py:400
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
automem/api/entity.py:400 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `reembed` without `@login_required` — automem/api/admin.py:76
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
automem/api/admin.py:76 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `store_batch` without `@login_required` — automem/api/memory.py:833
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
automem/api/memory.py:833 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `store` without `@login_required` — automem/api/memory.py:203
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
automem/api/memory.py:203 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `sync_missing` without `@login_required` — automem/api/admin.py:233
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
automem/api/admin.py:233 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `update` without `@login_required` — automem/api/memory.py:513
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
automem/api/memory.py:513 securityAuth flask unauth route
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/7bef365c-23d4-4c18-99a3-08916b3ee539/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/7bef365c-23d4-4c18-99a3-08916b3ee539/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.