Current baseline
v0.24.1 already implements a local stdio MCP client with eight tools. The earlier statement that no MCP implementation existed is historical. The independent protocol remains usable without this plugin, Python or SQLite.
This issue now asks for a narrow review/proposal for exposing only capabilities, status, recall, get and handoff to a host that wants a read-only client. A separately configurable read-only tool surface is not claimed implemented by the current full-client package.
Scope
Document a minimal opt-in configuration and the actual host access/connection boundary. Keep writes, trust enrollment, updates, sync administration, policy changes and execution APIs outside this read-only surface. Do not turn memory into an orchestrator or imply that a local stdio server is a secure public network service.
Required invariants
- One canonical record contract; no Task/Project/model/session ownership or parallel memory database.
- Current user intent and host policy outrank historical memory.
- Recalled text cannot register keys, change policy, run tools, start agents or allocate resources.
- Current key revocation must not be confused with historical admission; a hash does not authenticate an author.
- Use synthetic fixtures and content-free reports only. Include version, assumptions and unsupported cases; source review is not runtime validation.
A focused design comment, threat analysis or small independent implementation is useful. See AI_START_HERE.md and SECURITY.md.
Current baseline
v0.24.1 already implements a local stdio MCP client with eight tools. The earlier statement that no MCP implementation existed is historical. The independent protocol remains usable without this plugin, Python or SQLite.
This issue now asks for a narrow review/proposal for exposing only capabilities, status, recall, get and handoff to a host that wants a read-only client. A separately configurable read-only tool surface is not claimed implemented by the current full-client package.
Scope
Document a minimal opt-in configuration and the actual host access/connection boundary. Keep writes, trust enrollment, updates, sync administration, policy changes and execution APIs outside this read-only surface. Do not turn memory into an orchestrator or imply that a local stdio server is a secure public network service.
Required invariants
A focused design comment, threat analysis or small independent implementation is useful. See AI_START_HERE.md and SECURITY.md.