{"repo":"NousResearch/hermes-agent","public_id":"45422","display_label":"Memory toolset gating and disabled_toolsets bypass fixes","summary":"These issues and PRs concern bugs where disabling the 'memory' toolset either incorrectly blocks third-party memory providers or fails to prevent their tools from being injected and called. The work focuses on correctly scoping toolset disable rules to built-in memory tools while enforcing restrictions against dynamic injection bypasses.","subsystem":"agent","counts":{"members":11,"open_issues":5,"open_issues_distinct":5,"open_prs":3,"closed_issues":0,"merged_prs":1,"attempt_prs":5},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":69221},"resolution":{"state":"unresolved","by":null},"freshness":{"state":"verified","last_verified_at":"2026-07-24T07:30:54+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_PARTIAL","link_density":0.17818181818181816},"fix_edges":[{"issue_number":49386,"pr_number":69221,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false}],"members":[{"kind":"issue","number":45422,"title":"[Bug]: `hermes tools disable memory` should disable the built-in memory, not the entire memory ecosystem","url":null,"state":"open"},{"kind":"issue","number":46108,"title":"`memory` toolset gating also blocks memory provider (e.g. Mnemosyne) tools","url":null,"state":"open"},{"kind":"issue","number":46171,"title":"[Security] Hermes Agent memory provider tools bypass `disabled_toolsets` and remain callable after final tool filtering","url":null,"state":"open"},{"kind":"issue","number":48181,"title":"[Security] Disabled `memory` toolsets can be bypassed by late memory-provider tool injection","url":null,"state":"open"},{"kind":"issue","number":49386,"title":"[Security] Hermes Agent mainline tool policy bypass exposes external memory-provider tools despite `disabled_toolsets=[\"memory\"]`","url":null,"state":"open"},{"kind":"pr","number":45548,"title":"fix: hermes tools disable memory should only disable built-in memory","url":null,"state":"open","close_reason":{"refs":[{"kind":"commit","value":"fbfa97991","number":0}],"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":46132,"title":"fix(agent): decouple memory provider tool injection from memory toolset gate","url":null,"state":"open","close_reason":{"refs":[{"kind":"commit","value":"4c61fb6cf63682e27e8561a591abc9fef9986ba2","number":0}],"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":46185,"title":"fix(agent): respect disabled_toolsets for memory provider tool injection (#46171)","url":null,"state":"open","close_reason":{"refs":[{"kind":"pr","value":"#30468","number":30468},{"kind":"pr","value":"#30468","number":30468},{"kind":"pr","value":"#46132","number":46132},{"kind":"pr","value":"#30468","number":30468}],"category":"duplicate_of","implication":"duplicate"},"merged":false},{"kind":"pr","number":46348,"title":"fix(agent): respect disabled_toolsets in memory provider tool injection (#46171)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#46185","number":46185},{"kind":"pr","value":"#46171","number":46171},{"kind":"pr","value":"#46185","number":46185}],"category":"duplicate_of","implication":"duplicate"},"merged":false},{"kind":"pr","number":69221,"title":"fix(openviking): harden tool gating, config auth, and runtime shutdown (salvage #51952)","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["agent/memory_manager.py","hermes_cli/memory_setup.py","plugins/memory/openviking/__init__.py","scripts/release.py","tests/agent/test_memory_provider.py","tests/hermes_cli/test_memory_setup.py","tests/openviking_plugin/test_openviking.py","tests/plugins/memory/test_openviking_provider.py","tests/plugins/memory/test_openviking_shutdown.py","tests/tools/test_refresh_agent_mcp_tools.py","tools/mcp_tool.py"]},{"kind":"pr","number":70016,"title":"fix(security): enforce disabled toolsets after dynamic injection (#49386)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#49386","number":49386},{"kind":"pr","value":"#69221","number":69221},{"kind":"pr","value":"#49386","number":49386}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false}],"trust":{"default_tier":"verified","includes_suggested":false}}