Raven Memory

What to consider before installing: - Trust & provenance: the registry metadata lacked a homepage/source; pyproject points to a GitHub repo. Verify the package source (PyPI vs repository) and review the repo/maintainer before pip installing. - Prompt modification risk: the skill asks you to change your agent's system prompt so it always calls the memory tool at session start. That is required for persistent memory but also broadens the skill's influence. Only add these instructions if you trust the code. - Data & privacy: Raven stores all recorded events in a local SQLite file (~/.raven/raven.db) which can contain sensitive user messages and tool outputs. If you have secrets or private data, restrict file permissions, consider disk encryption/SQLCipher, or avoid enabling semantic embeddings which may cache richer content. - Network/native components: semantic search uses sentence-transformers and sqlite-vec. SentenceTransformer will likely download model weights (network) and torch is a heavy native dependency. Be prepared for large downloads and native binaries; if you want to avoid network/model downloads, skip the 'vec' feature. - Dependency mismatch: requirements.txt lists many heavy/unreferenced packages. Prefer installing from a verified source and review the package's pyproject/requirements to avoid unexpected installs. - Testing: run the MCP server in an isolated environment first, and inspect the created DB contents. Review code (mcp_server, store, dag) yourself — no obvious exfil endpoints appear in the provided files, but embeddings/model downloads and loading a SQLite extension are actions with extra risk. - If unsure: install and test in a disposable VM/container, or request the upstream repository URL and a maintainer identity before enabling in production.