Cairn

Memory toolset gating and disabled_toolsets bypass fixes

NousResearch/hermes-agent · cluster 45422 · agent

Data as of

8 open items. Fix merged in #69221. Check it covers your case.

The short answer

5open issues
3open PRs
11items grouped
Known?
Yes. 11 related items grouped here, 0 issues already closed.
Fix event
A fix was merged to main in PR #69221. Check it covers your case. No release data is tracked.
Tracker
The maintainers' tracker marks this unresolved. That is separate from the fix event.
Still open
5 issues and 3 PRs.

These issues and PRs concern bugs where disabling the 'memory' toolset either incorrectly blocks third-party memory providers or fails to prevent their tools from being injected and called. The work focuses on correctly scoping toolset disable rules to built-in memory tools while enforcing restrictions against dynamic injection bypasses.

Open issues5

  • Issue#45422[Bug]: `hermes tools disable memory` should disable the built-in memory, not the entire memory ecosystem
  • Issue#46108`memory` toolset gating also blocks memory provider (e.g. Mnemosyne) tools
  • Issue#46171[Security] Hermes Agent memory provider tools bypass `disabled_toolsets` and remain callable after final tool filtering
  • Issue#48181[Security] Disabled `memory` toolsets can be bypassed by late memory-provider tool injection
  • Issue#49386[Security] Hermes Agent mainline tool policy bypass exposes external memory-provider tools despite `disabled_toolsets=["memory"]`

Open PRs3

  • PR#45548fix: hermes tools disable memory should only disable built-in memory
  • PR#46132fix(agent): decouple memory provider tool injection from memory toolset gate
  • PR#46185fix(agent): respect disabled_toolsets for memory provider tool injection (#46171)

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

  • #69221 fix(openviking): harden tool gating, config auth, and runtime shutdown (salvage #51952)

    merged to main

    files: agent/memory_manager.py, hermes_cli/memory_setup.py, plugins/memory/openviking/__init__.py, scripts/release.py, tests/agent/test_memory_provider.py, tests/hermes_cli/test_memory_setup.py, tests/openviking_plugin/test_openviking.py, tests/plugins/memory/test_openviking_provider.py, tests/plugins/memory/test_openviking_shutdown.py, tests/tools/test_refresh_agent_mcp_tools.py, tools/mcp_tool.py

2 PRs closed without merging

From the close comments: done elsewhere 1 · duplicate 1

  • #46348 fix(agent): respect disabled_toolsets in memory provider tool injection (#46171) · duplicate → #46185, #46171
  • #70016 fix(security): enforce disabled toolsets after dynamic injection (#49386) · done elsewhere → #49386, #69221
How this cluster was grouped
  • Link evidence (partly structural links): some members are connected by structural evidence (shared changed files, or a closing/superseded reference); the rest are joined by an automated relevance judgement over their text.
  • Members outside that structural core may belong to a different underlying problem.
  • Pairwise link density 0.18: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
agent
Merged PRs
#69221
Closed issues
0
Attempts
2 PRs closed without merging
Fix link checked
24 Jul 2026

For your agent

The same facts, typed.

cluster/45422.json
cluster/45422.md