From 2e5c81c0ee27cbac1a1bfb08c62caaf9e615f9ba Mon Sep 17 00:00:00 2001 From: jknapp Date: Fri, 15 May 2026 11:29:58 -0700 Subject: [PATCH] docs(mcp): clarify that sensitive info IS appropriate for shared-memory Per-user OIDC-gated storage is strictly safer than writing API keys / credentials to local container files, so the tool description should not discourage that use case. Adds an explicit allowlist for sensitive data the user actively shares (vs. asking for them). Co-Authored-By: Claude Opus 4.7 (1M context) --- apps/web/lib/mcp/tools.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/web/lib/mcp/tools.ts b/apps/web/lib/mcp/tools.ts index 02c106e..2cc63b7 100644 --- a/apps/web/lib/mcp/tools.ts +++ b/apps/web/lib/mcp/tools.ts @@ -117,7 +117,7 @@ const projectIdentify: ToolDef = { const memoryWrite: ToolDef = { name: "memory.write", description: - "Save a durable fact, preference, or decision that ANY future Claude Code session on ANY of this user's machines should know. Call this when the user shares something that meets ALL of: (1) likely to matter beyond this conversation, (2) not derivable from reading current code/git, (3) would surprise a future you if forgotten. Examples: 'I use HAProxy at home' (user-scope), 'we chose Drizzle over Prisma because of bundle size' (project-scope), 'our prod DB is at db.example.com' (user-scope reference). Use scope='user' for facts about the human or their infra; scope='project' for facts tied to a specific codebase (always preceded by project.identify). DO NOT use for: transient task state, this-session-only scratch notes, or container-specific facts (those belong in the built-in file-based memory at ~/.claude/.../memory/). Tags help retrieval.", + "Save a durable fact, preference, or decision that ANY future Claude Code session on ANY of this user's machines should know. Call this when the user shares something that meets ALL of: (1) likely to matter beyond this conversation, (2) not derivable from reading current code/git, (3) would surprise a future you if forgotten. Examples: 'I use HAProxy at home' (user-scope), 'we chose Drizzle over Prisma because of bundle size' (project-scope), 'our prod DB is at db.example.com' (user-scope reference). Use scope='user' for facts about the human or their infra; scope='project' for facts tied to a specific codebase (always preceded by project.identify). Sensitive info (API keys, credentials, connection strings the user actively shares with you) IS appropriate to save here — this server is OIDC-gated and per-user; safer than writing to local container files. DO NOT use for: transient task state, this-session-only scratch notes, or container-specific facts (those belong in the built-in file-based memory at ~/.claude/.../memory/). Tags help retrieval.", inputSchema: { type: "object", properties: {