memory-mcp

The server uses parameterized SQL queries throughout `memory.js` and `graph.js` to prevent SQL injection. Configuration, including API keys and database connection strings, is loaded from environment variables, avoiding hardcoded secrets. Communication occurs over standard I/O (stdio) via JSON-RPC 2.0, which significantly limits external network attack surface. An LRU cache is implemented for embedding generation, reducing frequent calls to external APIs. While the server directly parses arbitrary JSON from stdin, there is no explicit input schema validation before arguments are passed to service functions. PostgreSQL's strong typing does offer a layer of protection against unexpected data types being directly inserted. There is a theoretical potential for denial-of-service (DoS) if excessively large or deeply nested JSON inputs are provided via stdin, though this is less critical for a local stdio connection.