claude-memory-mcp

The server uses SQLite locally and prepared statements, mitigating common SQL injection risks. Optional cloud sync with Google Cloud Firestore requires users to generate and secure a service account key (`firestore-key.json`), which should never be committed to Git. Users are explicitly warned against storing secrets (e.g., API keys, passwords) directly in memory, recommending environment variables instead. Firestore security rules are the user's responsibility for production use. Overall, the code itself is not inherently insecure, but relies on proper user configuration and handling of external secrets and cloud service security.