Security

#Treat recalled text as untrusted

Memories contain whatever was ingested, including text written by other people. A record could contain instructions. Clients should present recall results as data, and agents shouldn’t follow instructions found inside memories.

#Least privilege

• One token per client and person.
• Disable tools you don’t need.
• Use private default visibility.
• Set expiry dates.

#Tool approval

Keep the client’s approval prompts on for remember and forget, so a user sees what is stored or deleted.

#Tokens

Store tokens in the client’s secret input or your OS keychain, not in committed config files. See also Security.