Security, in plain terms. What runs where, what exists today, and what doesn't yet.
- Your machine
- Read-only MCP
- Recall
- Index
- Toolkit
- Knowledge folder
- Agent runtime
- Model provider
- Your git remote · opt-in
Where your data goes.
- Your knowledge base: plain Markdown and JSON in a folder you choose.
- Recall: runs locally over your files. No memfor account, no hosted service.
- Your agent: Claude Code or Codex sends prompts, including recalled snippets, to its model provider under that provider's terms.
- agentware: sends no telemetry. Features you turn on, like sync, use git to reach a remote you choose. We're auditing every network path and will publish the result here.
The memory path.
Available BM25 recall with a token budget
Writing and recalling memory is done by the toolkit, in Python's standard library by default. The toolkit never calls an LLM. Retrieval is BM25 over files in your folder.
Network access.
agentware sends no telemetry and has no account system. Some features you turn on use git to reach a remote you choose: knowledge-base sync, team mode and the package updater, which is off by default. Opt-in semantic mode downloads its model once. We're auditing every network path and will publish the results here.
What can write to memory.
Available Deterministic toolkit, sole index writer
Only the validating CLI writes the index, and learnings enter memory through it. The knowledge files themselves are plain files in your folder: your agent writes plans and worklogs there directly, and anything with access to the folder can edit them. git shows every change. Changes to agentware itself go through a plan, a self-extension warning, an adversarial review gate, a steering lint and release gates. The benchmark ledger is append-only.
Unattended mode.
The loop (./agentware.sh) and the optional PLAN_AW and WORK_AW shell aliases launch your agent with approvals bypassed: Claude Code with --dangerously-skip-permissions, Codex with --dangerously-bypass-approvals-and-sandbox. Your agent can then run commands without asking you. Run the loop in a container, a VM or a dedicated account, not on a machine holding credentials you care about. Onboarding asks before it adds the aliases to your shell rc file.
MCP server.
Available Read-only MCP server
Read-only. MCP clients can search your knowledge base; they can't change it.
Releases.
Next Signed release tags
There's no tagged release yet, so the install commands pin a commit. The release model is SSH-signed tags verified against a publisher key pinned outside the repository. The package updater only moves to signed tags, and it's off by default.
Memory poisoning.
Researchers have shown that malicious records can be injected into agent memory through queries alone (MINJA). That's one reason writes in agentware are explicit, validated and diffable. It doesn't make agentware immune, and we don't claim it does.
Team mode.
Experimental Team mode: shared KB over git
Experimental. The trust boundary for synced content (signed commits and a trusted-author allowlist) is still being hardened. Sync only with collaborators you trust.
This website.
| Header and value | What it does |
|---|---|
Content-Security-Policy in each page's <meta> default-src 'self'; script-src 'self' 'sha256-…'; style-src 'self' … | Scripts load only from this site and challenges.cloudflare.com; styles only from this site. The one inline script runs because its hash is listed: no unsafe-inline, no unsafe-eval. |
Strict-Transport-Security max-age=300; includeSubDomains | Browsers reach this site and its subdomains over HTTPS only, for as long as max-age says. |
X-Content-Type-Options nosniff | Browsers don't guess a file's type, so nothing runs as a script unless it's served as one. |
Referrer-Policy strict-origin-when-cross-origin | A site you follow a link to sees our domain, never the address of the page you came from. |
Permissions-Policy accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=() | Motion sensors, camera, location, microphone, payment and USB are off on every page. |
Cross-Origin-Opener-Policy same-origin | A page on another site that opens one of ours can't reach into its window. |
Cross-Origin-Resource-Policy same-site | Other websites can't load our pages, scripts or images into their own pages; only memfor.ai and its subdomains can. |
X-Frame-Options DENY | Browsers too old for frame-ancestors still refuse to show these pages in a frame. |
Content-Security-Policy frame-ancestors 'none'; object-src 'none'; base-uri 'self'; form-action 'self' | Nothing can show these pages in a frame (frame-ancestors 'none'). Plugins are off, and forms and base URLs stay on this site. |
Content-Security-Policy-Report-Only added to dist/_headers after the build <the page policy, minus upgrade-insecure-requests>; report-to csp | Reports anything the page policy would block, and never blocks anything itself. |
Reporting-Endpoints csp="https://memfor.ai/api/csp-report" | Where browsers send those reports. We keep only a count per rule. |
No cookies. No third-party scripts by default. Fonts are self-hosted.
The waitlist form loads Cloudflare Turnstile from challenges.cloudflare.com when you focus it.
What we don't have yet.
- No SOC 2.
- No ISO 27001.
- No HIPAA programme.
- No bug bounty.
- No external penetration test.
- No hosted service.
- No sandbox of our own around unattended mode: that isolation is yours to provide.
Report a vulnerability.
Please report privately: email security@memfor.ai.
We'll acknowledge your report within 3 business days. Please don't open a public issue for security problems.
We won't pursue action against good-faith research that follows this policy and avoids privacy violations and service disruption.