Name: Guardbee
Brand: Guardbee
Availability: InStock

MCP guide · Memory Poisoning Scanner

MCP Memory Poisoning Scanner: persistent agent memory risks — @guardbee/mcp-memory-poisoning-scanner

@guardbee/mcp-memory-poisoning-scanner targets a different surface than Prompt Injection Scanner: not one-shot content, but persistent / cross-session memory writes of untrusted input and readback into system/assistant roles.

What does it do?

Five memory-write and three memory-readback patterns. ConversationBuffer / chat history is deliberately out of scope — only archival/core memory and long-term knowledge-base style stores.

Who is it for?

Agent teams using MemGPT-style long-term memory
Products that treat a vector store as a durable knowledge base
DevSecOps scanning agent source in CI

What it is not

Chat history / ConversationBuffer (intentionally excluded)
One-shot document prompt injection (use Prompt Injection Scanner)
Open vector-store network probes (use Vector Store Scanner)

Features

Feature	Description
Memory-write	archival/core + vector add/upsert
Memory-readback	system/assistant / prompt template
False-positive guarded	chat-buffer negative tests
SARIF 2.1.0	CI
guardbee.yml	fail-on, exclude

MCP tools

Tool	Description
`scan_text`	Scan a snippet
`scan_file`	Scan a single file
`scan_directory`	Scan an agents source tree
`list_patterns`	List supported patterns

Install with npm

Global install (handy for Claude Desktop / Cursor):

bash

npm install -g @guardbee/mcp-memory-poisoning-scanner

or via npx (recommended with -y in config):

bash

npx -y @guardbee/mcp-memory-poisoning-scanner

npm: @guardbee/mcp-memory-poisoning-scanner

CLI

npx @guardbee/mcp-memory-poisoning-scanner scan ./agents --fail-on=high --format=sarif > results.sarif

Claude Desktop configuration

Config file paths:

macOS~/Library/Application Support/Claude/claude_desktop_config.json
Windows%APPDATA%\Claude\claude_desktop_config.json
Linux~/.config/Claude/claude_desktop_config.json

Merge this block, then restart Claude Desktop:

claude_desktop_config.json

{
  "mcpServers": {
    "guardbee-memory-poisoning-scanner": {
      "command": "npx",
      "args": [
        "-y",
        "@guardbee/mcp-memory-poisoning-scanner"
      ]
    }
  }
}

Cursor and other MCP clients

In Cursor, add the same command / args / env under Settings → MCP. stdio MCP servers use the same contract as Claude Desktop.

Example prompts in Claude

“Is there memory poisoning in this agents folder?”
“Does archival_memory_insert take raw user input?”
“Which memory-write patterns do you support?”

See surface risk with Guardbee

MCP servers speed up security work in chat. Start a 14-day free trial for brand scans and BeeAI.

Start free MCP servers

Frequently asked questions

Vs Prompt Injection Scanner?

That scans one-shot content; Memory Poisoning Scanner scans durable write + readback code patterns.

Will chat history flag?

No — deliberately out of scope.

API key?

No — local source scanning.

MCP Memory Poisoning Scanner: persistent agent memory risks