MCP.Market

Cambium MCP server

by jarmstrong158·io.github.jarmstrong158/cambium·v0.2.0
No reviews yet

Knowledge-lifecycle MCP: turn agent work into memory, recall it across projects, promote to org.

A85/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A85/100

full report

Adoption
New

0 stars27 downloads/wk

Reviews

Write one

Nobody has reviewed Cambium yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Cambium tools (16)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • capture

    Save a knowledge item to your LOCAL scope: a fact, design note, gotcha, or troubleshooting step worth remembering. This is the manual capture path; distill() is the automatic one.

  • deprecate

    Retire a knowledge item so recall stops serving it — the counterpart to verify_entry (which re-affirms). This is the action stale_report points at: when an entry's premise has died ("we've left NetSuite"), deprecate it.

  • distill

    Automatically turn work that already happened into knowledge. Reads two substrates natively — no export step, no copy-paste:

  • endorse

    Vouch for an item — the strong trust signal, and a human judgement that nothing else in this server can substitute for.

  • export_markdown

    Render knowledge to a human-readable KNOWLEDGE.md — grouped by scope then project, each item showing summary, kind, provenance (dec-NNN / claim origin), recall count and promoted date. cp1252 mojibake (em dashes, curly quotes) is normalized so the text is clean.

  • generalize

    Restate an ALREADY-PROMOTED item's body as the cross-project rule, in place, keeping the concrete version as `example`. The remediation counterpart of the org generalization gate: items that reached org (or team) before the gate — or were forced past it — are listed by review_promotions() under `org_needs_generalization`; this rewrites one to its general form.

  • import_memory

    Ingest an external memory export into cambium as LOCAL-scope, provenance- tagged knowledge items — a source adapter alongside distill's substrate readers. Import/ingest only: it reads the source READ-ONLY and never writes back to it.

  • promote

    Graduate knowledge up a scope as it earns trust — the compound-growth step. With no arguments, scans your local items and promotes every one that qualifies to team. With an item_id, promotes that item one level (local->team, or team->org with to_scope="org").

  • recall

    Search knowledge across scopes and return the best matches. THE read endpoint for every agent type — a coding agent, a Slack KB bot, an SRE bot — they all ask here, so knowledge captured once serves them all.

  • record_need

    Record a NEED — something missing, wanted, or blocking. Needs are first-class alongside memories: "we need staging seeds", "docs for X are missing", "no way to replay a failed job".

  • review_promotions

    What's ready to move up? Lists local items eligible for team, team items eligible for org (endorsed), and org PRs already opened. The human-readable checkpoint before running promote().

  • session_primer

    A compact digest of what's ALREADY known for this project — built to be injected automatically at session start so recall is passive, not a step an agent has to remember. Returns the highest-value active knowledge (most- recalled, then most-recently-updated) across local+team+org, plus any promoted assumptions (valid_while premises) that look stale and worth re-checking.

  • setup

    Finish cambium's setup in one call — the tool status() and every unconfigured error point you to. Validates paths, scaffolds .cambium/ (and gitignores it), and writes a local fallback config the server reads when env vars are absent (env still wins when set, and it takes effect immediately — no restart).

  • stale_report

    Which promoted knowledge might be going stale? Lists team + org entries (the ones that cleared the trust gate) sorted OLDEST-VERIFIED-FIRST, with never-reverified entries flagged at the top and each entry's valid_while premise surfaced so a reader can spot dead assumptions ("while we're on NetSuite" long after the NetSuite migration).

  • status

    First thing to call — especially when cambium looks broken. Returns structured config state: what's set, what's missing, what each gap costs in plain terms, and the exact setup() call that fixes it. NEVER raises on missing config. When fully configured it also reports item counts per scope/type, distill watermarks, and which substrates are actually wired.

  • verify_entry

    Confirm a knowledge entry still holds — stamp its last_verified to now. This is the event that keeps promoted knowledge honest: promotion's trust gate defends what comes IN, verification keeps an entry from silently going stale after. An optional note records what was confirmed. Absent/old last_verified is a signal (see stale_report), never an automatic downgrade. Works on local and team entries;

Public scan report

scanner v0.1.9 · 2026-09-24 · same rubric, same numbers if you re-run it

no findings
  • Code scan2 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 33 days ago12/15
  • Maintainer identityregistry namespace matches repository owner6/10
Overall 85/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Cambium compares

Against every graded AI and agents MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
85/100
higher than 73% of 4,460 AI and agents servers
Tools
16
the typical AI and agents server has 6
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
27
more than 13% of 1,538 AI and agents servers with a package

What its tools let an agent do: 14 read · 1 create · 1 change

Install Cambium in Claude Code, Cursor or VS Code

claude mcp add cambium -- uvx cambium-mcp
Add to Cursor

What the publisher says

From the Cambium repository's README, as published. We do not edit it. Read it on GitHub

cambium

<!-- mcp-name: io.github.jarmstrong158/cambium -->

Part of the xylem stack.

The knowledge-lifecycle MCP that turns work your agents already did into compound, org-wide knowledge. cambium bridges two substrates that already exist — agentsync (what happened: claims, finishes, notes, changed files) and context-keeper (why: decisions, constraints) — and adds the three things neither has:

(coding agent, Slack KB bot, SRE bot — same store, same call)

  1. distill() — turn events into memory automatically (passive capture)
  2. recall() — one federated read endpoint for every agent type
  1. promote() — graduate knowledge local → team → org as it earns trust

Named for the cambium layer of a tree: the thin living tissue where all growth happens.

Why a third MCP (and not a database)

Knowledge layers fail because they're a side system nobody calls. cambium's bet: capture and recall must be native tools in the agent's loop, and state must live in the substrate the work already lives in — git — not a separate service. Storage is an implementation detail behind recall():

Team writes use the agentsync pattern: a private worktree under .git/ and git push as compare-and-swap, so concurrent agents never clobber each other.

Install

pip install -r requirements.txt      # just `mcp`

gh (GitHub CLI) is only needed for pull-request-mode org promotion.

Configure

Point an MCP client at the server — no env required to start:

{
  "mcpServers": {
    "cambium": {
      "command": "python3",
      "args": ["/abs/path/to/cambium_server.py"]
    }
  }
}

First contact is helpful, not cold. MCP servers can't start a conversation, so cambium teaches you through its own responses. Call status() (or any tool) before it's configured and instead of a bare env error you get structured guidance — what's set, what's missing, what each gap costs in plain terms, and the exact setup() call that fixes it:

{
  "configured": false,
  "gaps": [
    {"setting": "CAMBIUM_REPO",
     "cost": "no project repo → cambium has no substrate; every tool is unavailable",
     "fix": "setup(project_repo=\"/abs/path/to/your/clone\", agent_id=\"your-id\")"},
    {"setting": "CAMBIUM_ORG_REPO",
     "cost": "org scope off → promotions stop at team; org-wide recall unavailable",
     "fix": "setup(project_repo=…, agent_id=…, org_repo=\"owner/knowledge or /abs/path/to/clone\")"}
  ],
  "next_step": "setup(project_repo=\"/abs/path/to/your/clone\", agent_id=\"your-id\")"
}

setup(projectrepo, agentid, orgrepo?, orgpr?, teambranch?) finishes the job: it validates the paths, scaffolds .cambium/ (and adds it to the repo's .gitignore), and writes a fallback config at ~/.cambium/config.json that the server reads when env vars are absent. It takes effect immediately — no restart. No secrets are written: the file holds only paths, ids, and flags, and lives outside any repo. If orgrepo is a GitHub owner/name you haven't cloned locally, setup offers the exact gh/git commands to stand it up and leaves org scope off — it never creates or pushes a repo for you.

Env still wins. Any of the variables below, set in the MCP client config, overrides the config file per-key — the table is the full reference layer:

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Cambium: common questions

Is Cambium MCP server safe?
Yes, by our scan: it is graded A (85/100). Read the Cambium safety report
How do I install Cambium?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Cambium need an API key?
No secret keys are declared. It reads 3 settings from the environment.
Is Cambium maintained?
The last commit was 74 days ago (2026-08-22). The latest release is v0.2.0.
What can I use instead of Cambium?
Servers from other publishers that do the same job: Total Agent Memory MCP server, Basic Memory MCP server and IWE (iwe.md) MCP server.
How does Cambium compare with other AI and agents MCP servers?
safety score 85/100 (higher than 73% of 4,460 AI and agents servers); tools 16 (the typical AI and agents server has 6); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Cambium

Same job from other publishers: the closest match first, then the best rated.

  • Total Agent Memory
    Persistent local memory for coding agents: temporal knowledge graph, procedural and episodic recall
    A
  • Basic Memory
    Local-first knowledge management with bi-directional LLM sync via Markdown files.
    B
  • IWE (iwe.md)
    Markdown knowledge base as agent memory. Runs against the notes directory it is started in.
    A
  • Agent Recall
    Correction-first agent memory. Precision KPI tracks if agents heed warnings. 5 layers, local-only.
    A
  • LLM Sandbox
    Securely run LLM-generated code in isolated containers across 7 languages and 3 container backends.
    A

More from jarmstrong158 →