Self-audit of a memory MCP server found models could read other users' memories
Technical_Bench_188 · reddit · 2026-08-27
While auditing his own memory MCP server, the developer found that although agent identity was pinned via an env var, the recall tool's schema still exposed a user parameter — passing {"user": "alice"} would return alice's private memories.
The fix: both user and agent identity are now injected via environment variables, with no identity parameter in any tool schema; leaving OMEMUSER unset makes user-scoped memory completely invisible, as a safe default.
Other design points:
- Only three tools: recall, observe, and why (why returns provenance for a single memory — most useful for debugging odd agent behavior)
- Memory is belief-tracked rather than overwritten: contradictory facts are kept together with history instead of silently replaced
- Runs locally, standard library only, pip install omem-infrastructure, MIT licensed
More from coding & agent
- Managing reminders with RemCTL and Codex — rudrank · 2026-08-27
- Max Useful TPS for Agentic Coding: Is 50-60 tps Enough? — AppealSame4367 · 2026-08-27
- Weir: Deterministic Unit Testing for AI Agents via OpenTelemetry — Hopeful-Safe8184 · 2026-08-27
- Automating Slack Scheduling with AsideAI Browser Agent — brandon_galang · 2026-08-27
- Study finds Agent skill injection may lower Pass@2 rates — rohanpaul_ai · 2026-08-27
- Agentic Atlas: An MCP Server for Structured Agent Design Reasoning — emobeach · 2026-08-27