# NousResearch/hermes-agent · Memory toolset gating and disabled_toolsets bypass fixes

## Open now

- 5 issues, 3 PRs open on GitHub.
- #45422: \[Bug\]: \`hermes tools disable memory\` should disable the built-in memory, not the entire memory ecosystem
- #46108: \`memory\` toolset gating also blocks memory provider (e.g. Mnemosyne) tools
- #46171: \[Security\] Hermes Agent memory provider tools bypass \`disabled_toolsets\` and remain callable after final tool filtering
- #48181: \[Security\] Disabled \`memory\` toolsets can be bypassed by late memory-provider tool injection
- #49386: \[Security\] Hermes Agent mainline tool policy bypass exposes external memory-provider tools despite \`disabled_toolsets=\["memory"\]\`
- PR #45548: fix: hermes tools disable memory should only disable built-in memory
- PR #46132: fix(agent): decouple memory provider tool injection from memory toolset gate
- PR #46185: fix(agent): respect disabled_toolsets for memory provider tool injection (#46171)

These issues and PRs concern bugs where disabling the 'memory' toolset either incorrectly blocks third-party memory providers or fails to prevent their tools from being injected and called. The work focuses on correctly scoping toolset disable rules to built-in memory tools while enforcing restrictions against dynamic injection bypasses.

## TL;DR

- 11 member(s): 5 open issue(s), 0 closed issue(s), 3 open PR(s), 1 merged PR(s), 2 PR(s) closed without merging.
- A fix was merged to main in PR #69221. Verify it addresses your case.
- **Recommended:** read PR #69221 (and any competing PRs below) before filing. Confirm the merged change covers your symptom.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `unresolved`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_PARTIAL`): some members are connected by structural evidence (shared changed files, or a closing/superseded reference); the rest are joined by an automated relevance judgement over their text.
- Members outside that structural core may belong to a different underlying problem.
- Pairwise link density `0.18`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Open related issues

- #45422: \[Bug\]: \`hermes tools disable memory\` should disable the built-in memory, not the entire memory ecosystem
- #46108: \`memory\` toolset gating also blocks memory provider (e.g. Mnemosyne) tools
- #46171: \[Security\] Hermes Agent memory provider tools bypass \`disabled_toolsets\` and remain callable after final tool filtering
- #48181: \[Security\] Disabled \`memory\` toolsets can be bypassed by late memory-provider tool injection
- #49386: \[Security\] Hermes Agent mainline tool policy bypass exposes external memory-provider tools despite \`disabled_toolsets=\["memory"\]\`

## Prior & competing PRs

- **#69221: fix(openviking): harden tool gating, config auth, and runtime shutdown (salvage #51952)**. merged to main · fix tier `verified`
  - maintainer direction: category `merged`; implication `superseded`
  - files: `agent/memory_manager.py`, `hermes_cli/memory_setup.py`, `plugins/memory/openviking/__init__.py`, `scripts/release.py`, `tests/agent/test_memory_provider.py`, `tests/hermes_cli/test_memory_setup.py`, `tests/openviking_plugin/test_openviking.py`, `tests/plugins/memory/test_openviking_provider.py`, `tests/plugins/memory/test_openviking_shutdown.py`, `tests/tools/test_refresh_agent_mcp_tools.py`, `tools/mcp_tool.py`
- **#45548: fix: hermes tools disable memory should only disable built-in memory**. open
  - maintainer direction: category `superseded_by_pr`; implication `superseded`; refs `fbfa97991`
  - files: `acp_adapter/server.py`, `agent/memory_manager.py`, `agent/system_prompt.py`, `tests/agent/test_memory_provider.py`, `tests/run_agent/test_run_agent.py`
- **#46132: fix(agent): decouple memory provider tool injection from memory toolset gate**. open
  - maintainer direction: category `uncategorized`; implication `needs_llm`; refs `4c61fb6cf63682e27e8561a591abc9fef9986ba2`
  - files: `agent/agent_init.py`, `agent/memory_manager.py`, `tests/agent/test_memory_provider.py`
- **#46185: fix(agent): respect disabled_toolsets for memory provider tool injection (#46171)**. open
  - maintainer direction: category `duplicate_of`; implication `duplicate`; refs `#30468`, `#30468`, `#46132`, `#30468`
  - files: `AGENTS.md`, `agent/agent_init.py`
- **#46348: fix(agent): respect disabled_toolsets in memory provider tool injection (#46171)**. closed without merge
  - maintainer direction: category `duplicate_of`; implication `duplicate`; refs `#46185`, `#46171`, `#46185`
- **#70016: fix(security): enforce disabled toolsets after dynamic injection (#49386)**. closed without merge
  - maintainer direction: category `implemented_elsewhere`; implication `superseded`; refs `#49386`, `#69221`, `#49386`

## Fix status

- Merged to main in PR #69221 (cited above). No release data is tracked. Verify downstream.
- Fix last verified (merged) `2026-07-24`.
- Subsystem: `agent`