# ZettelForge [Health: Active]

**Category:** 🧠 Knowledge & Memory  
**Repository:** https://github.com/rolandpg/zettelforge  
**GitHub Stars:** 66  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/zettelforge

## Description
Agentic memory for cyber threat intelligence. STIX graphs, actor aliasing, offline RAG, Sigma/YARA.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `uvx` (confidence: high):

```json
"mcpServers": {
  "zettelforge": {
    "command": "uvx",
    "args": ["zettelforge"]
  }
}
```

## Documentation

## What ZettelForge MCP server does

The ZettelForge MCP server connects an AI coding or analysis agent to a local memory system designed for cyber threat intelligence. It accepts analyst notes and threat reports, extracts security entities, and stores them as structured memories. Supported entity types include CVEs, threat actors, IP addresses, domains, hashes, URLs, email addresses, MITRE ATT&CK techniques, campaigns, intrusion sets, tools, people, locations, and organizations.

The system represents extracted information with STIX 2.1 types and builds a knowledge graph from entity relationships. It can recognize that names such as APT28, Fancy Bear, Sofacy, and STRONTIUM refer to the same actor. It also records temporal relationships and supersession so newer intelligence can replace or qualify older information.

## How it works

Memory ingestion begins with regex-based extraction and can be enriched with local LLM-based named-entity recognition. Recall combines 768-dimensional fastembed vector search with breadth-first traversal of graph edges. An intent classifier weights those retrieval paths for factual, temporal, relational, exploratory, or causal questions.

When memory evolution is enabled, new intelligence is compared with existing records. An LLM can classify the change as ADD, UPDATE, DELETE, or NOOP, allowing duplicates, stale information, and contradictions to be handled as new material arrives. Synthesis can then produce an answer across stored memories using the `direct_answer` format.

## Setup and configuration

Install the Python package with:

```bash
pip install zettelforge
```

A basic `MemoryManager()` uses a local data directory at `~/.amem/`. Set `ZETTELFORGE_DATA_DIR` or use configuration to change that location. The initial embedding model download may require network access; once models are available locally, the system can operate offline, including on air-gapped hosts.

No external API key is required. Embeddings use fastembed and ONNX by default. For synthesis and richer extraction, run Ollama locally and preload a model, or configure another supported provider such as local llama-cpp, litellm, or mock for tests.

## Tools and capabilities

ZettelForge MCP server exposes the memory workflow to Claude Code through MCP. Its documented memory operations include:

- Remembering CTI notes and extracting security entities.
- Recalling relevant memories through blended vector and graph search.
- Synthesizing answers across stored investigations.
- Resolving threat-actor aliases during storage and retrieval.
- Evolving stored knowledge as new intelligence arrives.
- Emitting audit events in the Open Cybersecurity Schema Framework format.

The audit stream can be sent to a SIEM, written to a WORM store, or left unused according to the surrounding deployment.

## Limitations and notes

Without an LLM, `remember` and `recall` remain useful in the pip-only setup, but synthesis returns a structured response with a fallback placeholder rather than a generated answer. Local LLM inference and richer extraction therefore require an available provider. The first use may download an approximately 80 MB embedding model, so a fully offline deployment needs its models preloaded.

_Full upstream README: https://allmcps.com/mcp/zettelforge/readme_