| .. | ||
| e2e | ||
| src | ||
| .dev.vars.example | ||
| .gitignore | ||
| package.json | ||
| pnpm-lock.yaml | ||
| README.md | ||
| tsconfig.json | ||
| tsconfig.widget.json | ||
| vite.config.dev.ts | ||
| vite.config.ts | ||
| vitest.config.ts | ||
| wrangler.jsonc | ||
Supermemory MCP Server
The Supermemory MCP server gives authenticated AI clients access to a user's memories, profile, workspaces, and interactive MCP Apps.
Runtime Model
- MCP SDK v2 with a fresh
McpServerfor every HTTP request - Modern MCP
2026-07-28plus stateless compatibility for 2025 clients - OAuth token validation on every request
- No MCP protocol session or protocol Durable Object
- Active workspace stored as application state in a dedicated Durable Object
- Workspace state keyed by authenticated
organizationId + userId
The workspace used by an operation resolves in this order:
- An explicit
containerTagtool or prompt argument - The account's durable active workspace
- The Supermemory client default,
sm_project_default
An explicit override applies only to that call. It does not mutate the active workspace.
Server URL
https://mcp.supermemory.ai/mcp
Example client configuration:
{
"mcpServers": {
"supermemory": {
"url": "https://mcp.supermemory.ai/mcp"
}
}
}
The client discovers the OAuth authorization server through
/.well-known/oauth-protected-resource/mcp.
Tools
Model-visible tools
| Tool | Purpose |
|---|---|
search_memory |
Search memories and optionally include profile context |
listDocuments |
List document metadata and summaries in a workspace |
getDocument |
Read one document's available content by ID |
listMemories |
List extracted memory entries and their source document IDs |
listSpaces |
List workspaces visible to the authenticated account |
whoAmI |
Return identity, access, and active-workspace context |
add_memory |
Save or forget a memory |
MCP App launchers
| Tool | Purpose |
|---|---|
select-workspace |
Open the interactive workspace picker |
memory-graph |
Open the interactive memory graph |
guided-save |
Open the guided memory form |
upload-file |
Open the file upload form |
App-only tools
These tools are available to the embedded MCP App and hidden from the model.
| Tool | Purpose |
|---|---|
set-active-tag |
Persist the selected active workspace |
save-memory |
Submit the guided save form |
upload-file-submit |
Submit an encoded file upload |
fetch-graph-data |
Fetch graph documents for the app |
Resources And Prompt
| Kind | Name or URI | Purpose |
|---|---|---|
| Resource | supermemory://profile |
Profile facts in the effective workspace |
| Resource | supermemory://container-tags |
Visible workspaces |
| Resource | ui://supermemory/app-v3.html |
Embedded MCP App bundle |
| Prompt | context |
Profile and recent context for an optional workspace |
The App resource and tool metadata include both current nested ui metadata and
the legacy flat resource URI key while MCP Apps completes its SDK v2 migration.
The Worker runtime does not import the SDK v1 Apps server helpers.
Development
Install from the repository root:
bun install
Run the local Worker:
cd apps/mcp
bun run dev
The portless URL is http://mcp.dev.supermemory.
Useful commands:
bun run build
bun run check-types
bun run test:unit
bun run test:e2e
Authenticated end-to-end tests use credentials captured by:
bun e2e/capture-oauth-token.ts
Without stored OAuth credentials, authenticated test groups skip. Public OAuth discovery and rejection tests still run.
Configuration
| Variable | Purpose | Default |
|---|---|---|
API_URL |
Supermemory API and OAuth issuer | https://api.supermemory.ai |
MCP_RESOURCE |
Expected OAuth audience | https://mcp.supermemory.ai/mcp |
ALLOWED_MCP_ORIGIN_HOSTNAMES |
Additional comma-separated browser origins | Built-in host allowlist |
Storage And Rollout
WorkspaceState stores only the active container tag. It never stores bearer
tokens, MCP client identity, or protocol messages.
The old SupermemoryMCP class and binding remain inert for one rollout. This
keeps the migration non-destructive and rollback-safe. A later deployment can
delete the old protocol class after production traffic and rollback windows
have been checked.