Back to plugin

Security audit

Metacognitive Memory

Security checks for vulnerabilities and agentic risk

Overview

The plugin is a plausible local memory tool, but the shipped code logs conversations automatically despite opt-in claims and has real session-isolation gaps.

Only consider installing after the publisher ships a clean build where automatic capture is disabled unless allowConversationAccess is explicitly true, sensitive-data redaction is actually present in the executable code, source conflict markers are removed, and all mutating tools enforce session_id ownership. Do not use this release in sensitive workspaces.

Static analysis

No suspicious patterns detected.