FOR YOU AND YOUR AGENT
Review first.
Connect later.
Membrane is a prototype memory layer, not a new chat app. A local MCP adapter exists. A safe, self-service personal connection flow does not yet exist.
Do not send personal data yet. The current adapter authenticates with a shared operator secret. It is not a scoped, independently revocable agent credential. This website does not issue credentials or connect an agent.
What your agent can review now
- Compatibility. Can your harness run a Python 3 stdio MCP server? The adapter lives at
clients/mcp/swarm_mcp.pyin the project checkout. It importsclients/swarm_client.pyand readsclients/tools.json, so keep those files together. - Tools.
swarm_remembersaves a note. Omittingorgmakes it personal to the signed user.swarm_recallretrieves an answer from that user’s allowed context. It can also consult shared context permitted by the service’s access policies. - Disclosure. A note leaves the agent for the memory service. A recall answer returns to the agent and may enter its model context. Review both directions before enabling any tool.
- Permission. Choose exactly which notes may be sent. Do not auto-upload chat history. A human-approved scope, expiry and per-agent revoke are requirements for personal onboarding, not implemented controls in this page.
Operator-only test setup
Use an isolated deployment and made-up notes only. Obtain the actual service URL and the repository checkout from your operator. There is no public install package or memory API URL supplied here. The Pages website is not the API.
Show the current MCP configuration contract
Configure these environment variables in your local process manager or secret store, outside chat and the browser:
SWARM_URL Your operator-confirmed memory API base URL SWARM_USER Your synthetic test user ID SWARM_SECRET Shared operator secret (not a personal token) Command: python3 Arguments: /absolute/path/to/clients/mcp/swarm_mcp.py
The path is a template. Replace it with the actual checkout path. The adapter uses only Python’s standard library and speaks MCP over stdio. Never paste the shared secret into this page, a model prompt, or a command saved to shell history.
The current client signs X-Swarm-User and X-Swarm-Ts with HMAC-SHA256 in X-Swarm-Sig. Anyone holding the shared secret can sign another user identity. It is appropriate only for a trusted operator test, not distributed personal-agent access.
The bundled client uses ordinary HTTPS, not automatic enclave verification. An operator must configure and verify an attesting client or proxy before treating an enclave connection as verified. No attestation has been checked by this static page.
Try one synthetic memory
After your operator has configured an isolated test, explicitly approve each of these tool calls in your harness. These are examples, not executable buttons.
swarm_remember({"text": "My fictional test preference is Friday deep work."})
swarm_recall({"query": "What is my fictional test preference for Friday?"})The first call maps to POST /remember. The second maps to POST /recall. Check the real tool response; do not infer success from this example. Do not add an org unless you intend to share the note under that workspace’s policy.
Disconnect is not revoke
Disable or remove the MCP server in your harness to stop that client making new calls. This does not invalidate a copied secret or erase stored notes. There is no per-agent revocation endpoint in the inspected memory API. An operator can rotate the shared secret, which affects every client using it. There is no memory-deletion tool in this adapter.
Know the privacy boundary
- Private inference protects a route, not your past. It does not retract context already sent to a frontier model. A private memory service alone does not make the receiving agent’s model private.
- Personal-note rules assume an authentic user. Shared-secret authentication is not a strong per-person credential boundary.
- Attestation is component-specific. A verified memory deployment does not prove that a separate router, client or signer runs inside the enclave.
- The diagnostic router is separate. Its payment action is mock. Its API routes are not supplied by static Pages hosting. It is not the connection flow.
- No production guarantees. Data retention, deletion, per-agent consent and independently revocable access need to be established before personal use.