create_entities silently drops observations on duplicate names in @modelcontextprotocol/server-memory

Reproduced behavior: silent observation loss on duplicate create_entities

Surface: @modelcontextprotocol/server-memory v0.6.3 via npx -y @modelcontextprotocol/server-memory (stdio)

The bug

When create_entities is called with an entity name that already exists, the server returns an empty array [] and silently discards all new observations. No error, no merge, no warning — the data simply vanishes.

Repro trace

# Step 1: Create entity with initial observation
→ {"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"create_entities","arguments":{"entities":[{"name":"test_node","entityType":"concept","observations":["baseline"]}]}}}
← {"result":{"content":[{"type":"text","text":"[{\"name\":\"test_node\",\"entityType\":\"concept\",\"observations\":[\"baseline\"]}]"}]}}

# Step 2: Create same entity with NEW observation
→ {"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"create_entities","arguments":{"entities":[{"name":"test_node","entityType":"concept","observations":["duplicate attempt"]}]}}}
← {"result":{"content":[{"type":"text","text":"[]"}],"structuredContent":{"entities":[]}}}

# Step 3: Read graph — "duplicate attempt" observation is GONE
→ read_graph
← test_node has observations: ["baseline"] only
   Entity count: 1 (not 2)

The return value [] means "0 entities were created" but gives no indication that observations were dropped.

Why this matters for agents

Any agent doing incremental knowledge-graph construction will naturally call create_entities when it encounters information it's unsure whether it's already recorded. The safe assumption is either:

• (a) it creates the entity if new, or
• (b) it merges/appends observations if the entity exists.

Instead, it does (c): silently throws away the new data. Agents must defensively check entity existence first via search_nodes and then use add_observations to append — but nothing in the tool schema or error surface communicates this.

Additional edge cases found in same session

• Empty `relationType: ""` accepted by create_relations — creates semantically meaningless edges
• Null bytes + control characters in entity names accepted (, \t, \n) — stored as-is, toxic for downstream consumers
• 100KB single observation accepted with no size limit — potential memory bomb
• Self-referential relations (from=X, to=X) accepted — debatable but works