▸ Procurement-grade compliance · Public-facing

NSA CSI MCP Security Compliance

ai-memory v0.7.0 substrate-level coverage of the National Security Agency Cybersecurity Information document on Model Context Protocol security (U/OO/6030316-26, May 2026). Every concern, every recommendation, every real-world incident class — mapped to a codegraph-verified substrate primitive with file-anchored evidence.

10/10 concerns structurally addressed 7/7 recommendations implemented 27 substrate primitives catalogued 47 dedicated tests pinning the #1154 contract Schema v57 · 74 MCP tools · 89 HTTP routes
▸ Executive summary · 100% NSA CSI MCP coverage achieved

ai-memory v0.7.0 structurally addresses every NSA-enumerated MCP security concern at the substrate layer.

10 of 10
NSA CSI MCP security concerns structurally addressed at the substrate layer · 7 of 7 recommendations implemented

All 10 NSA-enumerated concerns structurally addressed at the substrate layer. All 7 NSA-issued recommendations implemented. Structural coverage of every real-world incident class the NSA document cites: tool parameter injection (NSA concern i, addressed by the RequestValidator DTO-bundled input-validation surface at src/validate.rs:1027); tool invocation path confusion (NSA concern j, closed by daemon-Ed25519-signed serverInfo at MCP initialize handshake per #1154); CVE-2025-49596 MCP-Inspector RCE (substrate ships its own verify-* CLI family); output poisoning for downstream automation (verbose-provenance recall decoration at src/mcp/tools/recall.rs:284 with MCP wire default verbose_provenance=true at v0.7.0). Every claim on this page traces to a capability_id in the codegraph-verified capability inventory.

10/10
NSA concerns structurally addressed
a-j all fully addressed (concern j closed via #1154 daemon serverInfo signing)
7/7
NSA recommendations implemented
a-g, plus the two meta-recommendations
27
Substrate primitives catalogued
Every primitive codegraph-verified at v0.7.0 HEAD
47
Net-new tests pinning #1154 contract
20 module + 27 integration; 0 regressions on existing MCP handshake tests
Notice of non-endorsement.

This mapping is one-directional: it describes ai-memory's substrate-level posture relative to NSA-issued guidance. The National Security Agency, the Department of Defense, and the United States Government do not endorse, certify, or recommend ai-memory, AgenticMem, AlphaOne LLC, or any commercial product. The NSA document is cited per its own bibliographic conventions.

▸ Navigation
▸ One-page reference

NSA CSI MCP Security Control → ai-memory Feature mapping.

Single-page procurement-grade table mapping every NSA CSI MCP control requirement to the ai-memory tool, primitive, or substrate feature that addresses it. Each row carries the capability identifier from the codegraph-verified inventory and the substrate file path operators or auditors can grep against to confirm the feature is wired and present.

Concerns (10/10 structurally addressed)

NSA Concern ai-memory tool / feature Capability identifier Substrate anchor Status
a · Access control Namespace isolation + Form 7 agent-EXTERNAL governance + admin-role gate + per-tenant authorisation namespace_isolation, form_7_agent_external_governance src/governance/mod.rs::check_agent_action · src/handlers/admin_role.rs:97 addressed
b · Insecure context or data serialization Form 4 fact-provenance (citations, source_uri, source_span) + canonical-bytes Ed25519 signing + capabilities v3 envelope + RequestValidator form_4_fact_provenance, form_7_canonical_bytes_signing, capabilities_v3_envelope, request_validator_input_validation src/models/memory.rs:464 · src/governance/rules_store.rs:541 · src/validate.rs:1027 addressed
c · Poor approval workflows Track G 25-event hook pipeline (Allow/Modify/Deny/AskUser) + K10 pending-actions SSE stream + HMAC-mandatory webhook dispatch track_g_hook_pipeline src/hooks/events.rs:73 · src/subscriptions.rs:521-548 addressed
d · Token or session security mTLS A2A transport + per-agent Ed25519 attestation + federation nonce-replay defense + SQLCipher encryption-at-rest mtls_a2a_transport, ed25519_agent_attestation, encryption_at_rest_sqlcipher src/tls.rs:1175 · src/governance/audit.rs:558 · src/federation/signing.rs:42 addressed
e · Misconfigurations and poor implementation Capabilities v3 envelope + namespace isolation + 6 fail-CLOSED secure-default env vars (#1053/#1054/#1055/#791/#922/governance) capabilities_v3_envelope, namespace_isolation src/config.rs (env-var resolvers) · CLAUDE.md §Environment Variables addressed
f · Inconsistent behaviors Seven-Gap Gap 1 optimistic-concurrency versioned writes + capabilities v3 envelope + Form 6 MemoryKind discriminator seven_gap_versioned_writes, capabilities_v3_envelope, form_6_memory_kind src/models/memory.rs:521 · src/storage/mod.rs:1132/1185 · tests/http_if_match_concurrency.rs addressed
g · Poor or missing audit logs V-4 signed-events cross-row hash chain + substrate-native verify-* CLI family + Form 4 fact-provenance + Seven-Gap Gap 3 causal recall observations v4_signed_events_chain, substrate_native_verify_family, seven_gap_causal_recall src/signed_events.rs:100-119 · src/cli/verify_signed_events.rs · src/observations/mod.rs:65 addressed
h · Denial of service and fatigue-based techniques 7-layer DoS defense: K8 quota + cl100k token budget + HMAC fail-CLOSED webhook + SSRF guard + DLQ MAX_REPLAY_ATTEMPTS + 2 MB HTTP body cap + federation nonce-replay dos_multi_layer_defense, token_budget_guards, federation_push_dlq src/profile.rs:419 · src/subscriptions.rs:791-803 · src/federation/push_dlq.rs:195 · src/lib.rs:512 addressed
i · Tool parameter injection (real-world) RequestValidator DTO-bundled input-validation surface (89 HTTP routes + 74 MCP tools + 80 CLI subcommands) request_validator_input_validation, form_4_fact_provenance src/validate.rs:1027 (RequestValidator) · src/validate.rs:784/808/852 (free-fn primitives) addressed
j · Tool invocation path confusion (real-world) Composite defense: (1) clientInfo capture at MCP initialize + (2) daemon-Ed25519-signed serverInfo at MCP initialize (TOFU pin) mcp_client_attestation src/mcp/server_identity.rs · src/mcp/mod.rs:1607-1611 · tests/mcp_initialize_server_signing.rs addressed

Recommendations (7/7 implemented + 2 meta)

NSA Recommendation ai-memory tool / feature Capability identifier Substrate anchor Status
a · Choose supported MCP projects when possible MCP Registry submission + Apache 2.0 + AlphaOne LLC maintainer + public release cadence + LongMemEval benchmark + security advisory channel memory_portability_spec, longmemeval_benchmark SECURITY.md · docs/spec/v1.md · MCP Registry submission metadata at docs/compliance/_inventory/mcp-registry-submission.json implemented
b · Design for boundaries Namespace isolation + Form 7 governance + SAL trait boundary + federation peer allowlist + K9 permissions + capabilities v3 envelope namespace_isolation, form_7_agent_external_governance, capabilities_v3_envelope src/store/mod.rs · src/governance/mod.rs · src/handlers/admin_role.rs implemented
c · Validate parameters RequestValidator + per-field free functions (validate_id, validate_namespace, validate_agent_id, validate_source_uri, validate_citation, validate_source_span) + per-namespace K8 quota dimension (#1156, schema v50: agent_quotas PK (agent_id, namespace)) as defense-in-depth blast-radius control request_validator_input_validation, per_namespace_quota_dimension src/validate.rs:1027 · src/validate.rs:784/808/852 · migrations/sqlite/0042_v50_per_namespace_quota.sql · tests/per_namespace_quota.rs implemented
d · Constrain and sandbox tool execution Track G hook pipeline (Allow/Modify/Deny/AskUser) + per-namespace standard policy + K9 permissions engine + Form 7 governance track_g_hook_pipeline, namespace_isolation, form_7_agent_external_governance src/hooks/events.rs:73 · src/governance/agent_action.rs:99 implemented
e · Sign and verify MCP messages Per-agent Ed25519 attestation + canonical-bytes signing discipline + V-4 signed-events hash chain + federation nonce-replay + daemon serverInfo Ed25519 signing at MCP initialize ed25519_agent_attestation, form_7_canonical_bytes_signing, v4_signed_events_chain, mcp_client_attestation src/governance/rules_store.rs:541 · src/signed_events.rs:100-119 · src/mcp/server_identity.rs implemented
f · Filter and monitor output pipelines and chained execution Seven-Gap Gap 7 verbose-provenance recall decoration + Track G post_recall / post_search hooks + Accept-Provenance HTTP header (v0.7.x #1155) seven_gap_verbose_decoration, track_g_hook_pipeline src/mcp/tools/recall.rs:284 · src/handlers/accept_provenance.rs implemented
g · Instrument for logging and detection V-4 signed-events chain + Prometheus DLQ depth gauge + capabilities v3 envelope + Track G 25-event hook pipeline + bare /metrics surface v4_signed_events_chain, dos_multi_layer_defense, capabilities_v3_envelope, track_g_hook_pipeline src/signed_events.rs · src/federation/push_dlq.rs:334 · src/lib.rs implemented
meta · Track and patch MCP-related vulnerabilities Apache 2.0 release process + CHANGELOG per-release surface + GitHub Security Advisory channel + Cargo.lock dependency tracking + cargo-audit CI gate SECURITY.md · Cargo.lock · .github/workflows/ci.yml implemented
meta · Scan local network for open or vulnerable MCP servers Substrate-native verify-* CLI family (not vulnerable to CVE-2025-49596 MCP-Inspector); operator-side network scanning out of substrate scope substrate_native_verify_family src/cli/verify_signed_events.rs · src/forensic/bundle.rs operator-side

Every Capability identifier in the tables above corresponds to a row in the codegraph-verified capability inventory JSON. Every Substrate anchor is a real file:line in the v0.7.x codebase. Procurement reviewers can run the verification commands in §For procurement reviewers to reproduce the mapping from a fresh checkout.

This table maps each control to the feature that addresses it. The companion Control → Test Matrix maps the same controls to the automated checks that exercise them — named tests (file::test_name), CI workflow jobs, and do-1461 live-fleet harness check ids — with evidence gaps stated honestly.

▸ NSA Concerns · 10 of 10 structurally addressed

NSA-enumerated security concerns → ai-memory substrate primitives.

Each concern below is mapped to the substrate primitive(s) that address it, with file-anchored verification references and a procurement-grade narrative. Status badges: addressed means structurally addressed at the substrate layer; partial means partial coverage with a documented v0.7.x landing; consumer means consumer-application responsibility with substrate-side exposure of provenance signals.

a · Access control

structurally addressed

What the NSA warns: MCP servers can expose tools that operate outside the user's intended access boundary; unauthorised callers may invoke privileged operations if the server lacks robust authentication and authorisation.

How ai-memory addresses it: Four-layer composite defense — per-namespace isolation (every memory carries a strictly-validated namespace foreign key enforced at the storage layer); Form 7 agent-EXTERNAL governance rules engine consulted on every write that proposes an external action; explicit admin-role gate honoured by AI_MEMORY_ADMIN_AGENT_IDS (post-#980 the * wildcard is rejected at startup); per-tenant authorisation gates on subscription enumeration and DLQ access (#870, #872 — both fixed in v0.7.0 cycle as security-high cross-tenant leaks).

Code anchors:
  • src/governance/mod.rs::check_agent_action
  • src/daemon_runtime.rs:1583+ (AI_MEMORY_ADMIN_AGENT_IDS resolver)
  • src/handlers/admin_role.rs:97 (admin gate)
  • src/subscriptions.rs:138-166 (cross-tenant authz, #870/#872)

b · Insecure context or data serialization

structurally addressed

What the NSA warns: Serialisation as a contamination vector — untyped fields, missing schema versioning, unbounded payloads create opportunities for malicious context to escape sanitisation.

How ai-memory addresses it: Form 4 fact-provenance (every memory carries typed Citation envelopes, a first-class source_uri field, a byte-range source_span); canonical-bytes Ed25519 signing of governance rules (explicitly excludes the signature itself and the attest_level field — preventing self-referential signature loops — and explicitly includes the enabled flag, preventing enable-after-sign tampering; both invariants pinned by regression tests); capabilities v3 envelope with explicit schema_version negotiation; RequestValidator DTO-bundled validation surface catching malformed serialised payloads at every wire boundary.

Code anchors:
  • src/models/memory.rs:464/473/482 (Memory.citations/source_uri/source_span)
  • src/governance/rules_store.rs:541 (canonical_bytes_for_signing)
  • src/governance/rules_store.rs:781/798 (canonical-bytes regression tests)
  • src/validate.rs:1027 (RequestValidator)
  • tests/capabilities_v3.rs:125 (capabilities v3 envelope test)

c · Poor approval workflows

structurally addressed

What the NSA warns: Automated tool execution without human-in-the-loop checkpoints can amplify damage from prompt injection or context contamination.

How ai-memory addresses it: Track G 25-event programmable hook pipeline (each hook returns Allow, Modify(delta), Deny{reason, code}, or AskUser{prompt, options, default}; chain ordering is priority-desc; first-Deny short-circuits); K10 pending-actions SSE stream at /api/v1/approvals/stream; pending_actions table with memory_pending_approve / memory_pending_reject MCP tools; HMAC-mandatory webhook dispatch under R3-S1.HMAC.

Code anchors:
  • src/hooks/events.rs:73 (HookEvent enum, 25 variants)
  • src/subscriptions.rs:521-548 (pending_actions surface)
  • src/subscriptions.rs:791-803 (HMAC fail-CLOSED)
  • Command::Pending in src/daemon_runtime.rs

d · Token or session security

structurally addressed

What the NSA warns: MCP servers handling tokens (API keys, signed bearer tokens, mTLS client certs) must protect them from theft and replay.

How ai-memory addresses it: mTLS transport on the federation surface (sync daemon refuses to start without mTLS unless explicit insecure flag is set; an empty peer allowlist refuses every peer); per-agent Ed25519 keypairs for substrate-level attestation; federation nonce-replay defense (#922 — AI_MEMORY_FED_REQUIRE_NONCE defaults to 1; signature bound to nonce as body || 0x00 || nonce so captured (body, sig) pairs cannot be replayed under a fresh nonce); optional SQLCipher encryption at rest with mode-0400 strict-permission enforcement (#1055).

Code anchors:
  • src/tls.rs:1175 (mTLS happy-path test)
  • src/tls.rs:1197 (empty-allowlist refusal test)
  • src/cli/sync.rs:654 (sync_daemon insecure-without-mtls refusal)
  • src/federation/signing.rs:42 (REQUIRE_NONCE_ENV)
  • src/governance/audit.rs:558 (load_daemon_signing_key)

e · Misconfigurations and poor implementation

structurally addressed

What the NSA warns: Permissive defaults compound across deployments; secure posture must be the default, not an opt-in.

How ai-memory addresses it: v0.7.0 ships secure defaults across the board: permissions.mode = "enforce" (was "advisory" in v0.6.4); governance fail-CLOSED on rule-consultation errors (AI_MEMORY_GOVERNANCE_FAIL_OPEN_ON_ERROR=false, #1054); SSRF DNS-failure fail-CLOSED (AI_MEMORY_SSRF_GUARD_ALLOW_DNS_FAIL=false, #1053); passphrase-file mode-0400 strict-permission enforcement (AI_MEMORY_PASSPHRASE_FILE_ALLOW_LAX_PERMS=false, #1055); federation signature enforcement (AI_MEMORY_FED_REQUIRE_SIG=1, #791); federation nonce defense (AI_MEMORY_FED_REQUIRE_NONCE=1, #922).

Code anchors:
  • src/config.rs::PermissionsMode (default Enforce)
  • Six fail-CLOSED env-var resolvers documented in CLAUDE.md §Environment Variables

f · Inconsistent behaviors

structurally addressed

What the NSA warns: Race conditions and undefined-behavior corner cases in MCP implementations produce non-deterministic outcomes that defy auditing.

How ai-memory addresses it: Seven-Gap Gap 1 optimistic-concurrency versioned writes (Memory.version: i64 at schema v45; concurrent updates passing expected_version race exactly one winner; the loser receives a typed 409 CONFLICT envelope; HTTP If-Match parity pinned by 5 regression tests); capabilities v3 envelope publishing runtime configuration to callers; Form 6 MemoryKind discriminator disambiguating Claim from Observation from Reflection for epistemic-weight differentiation.

Code anchors:
  • src/models/memory.rs:521 (Memory.version: i64)
  • src/storage/mod.rs:1185 (update_with_expected_version)
  • src/store/postgres.rs:1987 (postgres adapter)
  • tests/http_if_match_concurrency.rs (5 parity tests)
  • src/models/memory.rs:38 (MemoryKind 10 variants)

g · Poor or missing audit logs

structurally addressed

What the NSA warns: An MCP implementation without tamper-evident audit logs cannot support forensic reconstruction after a security incident.

How ai-memory addresses it: V-4 signed-events cross-row hash chain (every append to signed_events carries a SHA-256 prev_hash over the prior row's canonical bytes plus a monotonic sequence counter; tampering with row N's content breaks row N+1's prev_hash verification; tampering with sequence breaks the contiguity check; chain is tamper-evident even when individual signatures are valid); substrate-native ai-memory verify-signed-events-chain CLI verifier; Form 4 fact-provenance giving every memory row a typed Citation envelope, source_uri, and source_span; Seven-Gap Gap 3 causal recall observation tracking (every recall writes a recall_observations row keyed by UUIDv4 recall_id).

Code anchors:
  • src/signed_events.rs:100-119 (prev_hash + sequence columns at schema v34)
  • src/cli/verify_signed_events.rs (chain verifier)
  • src/observations/mod.rs:65 (record_recall, causal Gap 3)
  • src/mcp/tools/recall_observations.rs:16 (memory_recall_observations MCP tool)

h · Denial of service and fatigue-based techniques

structurally addressed

What the NSA warns: MCP servers exposed to high-volume or adversarial query loads can become DoS vectors against the larger automation pipeline.

How ai-memory addresses it (7-layer defense): (1) K8 per-agent quota surfaced via memory_quota_status; (2) cl100k_base token budget guards on the MCP wire surface; (3) HMAC-mandatory fail-CLOSED webhook dispatch under R3-S1.HMAC; (4) SSRF guard with DNS resolution and IP allowlist enforcement (#1053 fail-CLOSED); (5) federation push DLQ with MAX_REPLAY_ATTEMPTS bound; (6) 2 MB HTTP request body cap via Axum DefaultBodyLimit; (7) federation nonce-replay defense (#922).

Honest framing: DoS hardening is perpetual — these seven layers raise the cost of attack but do not eliminate the threat class. Operators tune quotas and rate limits to their deployment.

Code anchors:
  • src/profile.rs:419 (memory_quota_status K8)
  • tests/token_budget_guard.rs (cl100k wire ceilings)
  • src/subscriptions.rs:791-803 (HMAC fail-CLOSED)
  • src/subscriptions.rs:1070-1100 (SSRF guard, #1053)
  • src/federation/push_dlq.rs:195 (MAX_REPLAY_ATTEMPTS)
  • src/lib.rs:512 (DefaultBodyLimit::max(2 * 1024 * 1024))
  • src/federation/signing.rs:42 (REQUIRE_NONCE_ENV)

i · Tool parameter injection (real-world issue)

structurally addressed

What the NSA warns: Attackers embed adversarial parameters in tool-invocation payloads that the MCP server does not adequately validate. The NSA document cites this as a recurring real-world failure class.

How ai-memory addresses it: RequestValidator DTO-bundled validation surface (#966). Every wire-entry layer — 89 HTTP routes, 74 MCP tools, 80 CLI subcommands — routes DTO-bundling validation through RequestValidator::validate_create, validate_update, validate_memory, validate_link_triple, validate_consolidate, validate_id_and_namespace, validate_owner_write, validate_confidence_and_priority. The typed ValidationError { field, reason } carries explicit field attribution while preserving byte-equal wire-side error messages via a Display impl mirroring the legacy bail! shape. Adding a new cross-field invariant is one struct method addition.

Code anchors:
  • src/validate.rs:1027 (pub struct RequestValidator)
  • src/validate.rs:1038/1050 (validate_create / validate_update methods)
  • src/validate.rs:784/808/852 (free-function primitives)

j · Tool invocation path confusion (real-world issue)

structurally addressed

What the NSA warns: MCP clients mounting multiple servers without a robust resolution policy can suffer tool-name collisions — a malicious or misconfigured second server advertising a tool named memory_recall can shadow the legitimate one.

How ai-memory addresses it (composite — both halves shipped):

(1) Client-side identity capture (v0.7.0 baseline): the substrate captures clientInfo.name from the MCP initialize handshake (src/mcp/mod.rs:1607-1611) and threads it through every downstream operation for per-row provenance attribution. This proves WHICH client made a call and supports forensic reconstruction.

(2) Server-side cryptographic identity attestation (#1154, shipped in v0.7.0): the substrate publishes a daemon-Ed25519-signed ai_memory_identity block on every MCP initialize response (src/mcp/server_identity.rs). Clients implement Trust On First Use (TOFU): capture the signature on first connect; refuse subsequent connects that present a different signature. Canonical-bytes discipline mirrors the existing governance-rule signing pattern at src/governance/rules_store.rs:541 — schema_version + daemon_id + public_key + signed_at signed via Ed25519. The implementation is purely additive on the wire (per MCP spec, clients ignore unknown response fields); v0.6.4 / v0.7.0 callers continue to function identically; the block is OMITTED when the daemon has no keypair on disk (preserving the existing "continuing unsigned" posture from src/main.rs:116-118).

Coverage pinned by 47 dedicated tests: 20 module-level tests in src/mcp/server_identity.rs + 27 integration tests in tests/mcp_initialize_server_signing.rs. Zero regression on existing MCP handshake tests (mcp_initialize_handshake_succeeds, the eight d4_*_initialize_round_trip harness coverage tests).

Code anchors:
  • src/mcp/server_identity.rs — DaemonIdentityToSign struct, canonical_bytes_for_identity, build_signed_identity, verify_signed_identity (net-new module, #1154)
  • src/mcp/mod.rs initialize handler — constructs + signs ai_memory_identity block; omits when no keypair
  • src/mcp/mod.rs:1607-1611 (clientInfo capture at initialize, v0.7.0 baseline)
  • src/governance/audit.rs:558 (load_daemon_signing_key — threaded as active_keypair into handle_request)
  • tests/mcp_initialize_server_signing.rs — 27 integration tests covering happy path, no-keypair fallback, backwards compat, tampering rejection, malformed-input rejection, cross-rotation TOFU detection, determinism, performance, schema-version drift
▸ NSA Recommendations · 7 of 7 implemented

NSA-issued recommendations → ai-memory implementation.

The seven primary recommendations plus the two meta-recommendations the NSA document offers. Each row maps to substrate primitives with file-anchored verification.

a · Choose supported MCP projects when possible

implemented

ai-memory v0.7.0 is maintained by AlphaOne LLC under Apache 2.0. Public release cadence visible in CHANGELOG.md, release notes, and the GitHub repository. Security-advisory channel via GitHub Security Advisory + email security@alpha-one.mobi per SECURITY.md. MCP Registry submission tracked under Task H of audit issue #1153.

b · Design for boundaries

implemented

Every boundary is declared, validated, and has a fail-CLOSED secure default: namespace isolation (storage-layer foreign-key invariant); Form 7 agent-EXTERNAL governance (agent-action policy boundary); SAL trait at src/store/mod.rs (storage-adapter boundary, sqlite vs postgres+AGE); federation peer allowlist (network boundary); K3/K9 permissions model (operator-policy boundary); capabilities v3 envelope (wire-shape boundary published to consumers).

c · Validate parameters

implemented

RequestValidator at src/validate.rs:1027 (#966) covers all three protocol surfaces (HTTP, MCP, CLI) via one struct method. Single-field primitives (validate_id, validate_namespace, validate_agent_id, validate_source_uri, validate_citation, validate_source_span) remain the lowest level. Pinned by regression tests in tests/validate.rs.

d · Constrain and sandbox tool execution

implemented

Track G hook pipeline with Allow / Modify / Deny / AskUser decision contract (default-off; ~/.config/ai-memory/hooks.toml is the operator-controlled allowlist); per-namespace standard_policy memory pointers (#800 Batman Mode Crack 1); K9 permissions engine consulted on every write that proposes an agent-EXTERNAL action. Process-level sandboxing (containers, seccomp) is operator-deployment territory; substrate publishes reference configurations under infra/.

e · Sign and verify MCP messages

implemented

Per-agent Ed25519 keypairs for outbound link signing and inbound verification; canonical-bytes signing discipline at src/governance/rules_store.rs:541 (excludes signature + attest_level; includes enabled; both invariants regression-pinned); V-4 signed-events cross-row hash chain; federation nonce-replay defense (#922); daemon-Ed25519-signed serverInfo at MCP initialize (#1154, shipped in v0.7.0).

f · Filter and monitor output pipelines and chained execution

implemented

Seven-Gap Gap 7 verbose-provenance recall decoration at src/mcp/tools/recall.rs:284; Track G post_recall + post_search hooks for operator-installed output filters; Accept-Provenance: verbose HTTP header + MCP capability negotiation flag (#1155, shipped in v0.7.0) so consumers can opt into verbose-default per-session without flipping the wire default (which would be a backwards-compat break).

g · Instrument for logging and detection

implemented

V-4 signed-events chain; Prometheus depth gauge on federation push DLQ (refresh_depth_gauge at src/federation/push_dlq.rs:334); capabilities v3 envelope publishing runtime configuration; Track G 25-event hook pipeline at every memory lifecycle transition; bare /metrics Prometheus surface.

meta · Track and patch MCP-related vulnerabilities

implemented

Apache 2.0 release process with CHANGELOG.md surface; GitHub security-advisory channel; Cargo.lock dependency tracking (~5,479 lines); cargo audit CI gate against the RustSec advisory database.

meta · Scan local network for open or vulnerable MCP servers

operator-side

Network-side scanning is an operator-deployment concern, not substrate-resident. Substrate-side mitigation: substrate_native_verify_family ships substrate-native inspection (ai-memory verify-reflection-chain, verify-signed-events-chain, verify-forensic-bundle) that does NOT use the separate Anthropic MCP-Inspector toolchain (the surface CVE-2025-49596 targeted). Operators using these are not vulnerable to CVE-2025-49596.

▸ Real-world incident class coverage

Real-world incident classes cited by the NSA document.

The NSA CSI document cites five real-world incident classes plus the specific CVE-2025-49596 RCE in MCP-Inspector. ai-memory's substrate-level posture per class.

Incident classSubstrate postureMechanism
Tool parameter injection in open MCP agents structurally addressed RequestValidator at src/validate.rs:1027 — every wire boundary validates DTO-bundled parameters; typed ValidationError preserves field attribution
Tool invocation path confusion structurally addressed (post #1154) v0.7.0 captures clientInfo at initialize; #1154 (shipped in v0.7.0) adds daemon-Ed25519-signed serverInfo so clients can pin-on-first-connect
Unrestricted private/public repository access (GitHub-based MCP tools) out_of_scope ai-memory is a memory substrate, not a GitHub-MCP tool. Form 7 governance + namespace isolation allow operators to express resource-access policies but the substrate itself does not mediate repository access.
Exploitation via messaging platforms (WhatsApp + MCP) consumer responsibility Substrate provides per-row provenance attribution; messaging-platform session security is consumer-side.
Poisoning output for downstream automation structurally addressed (post #1155) Verbose-provenance recall decoration at src/mcp/tools/recall.rs:284 surfaces Form 4 citations, Form 5 ConfidenceTier, Form 6 MemoryKind; #1155 (shipped in v0.7.0) adds Accept-Provenance capability negotiation so consumers opt-in per-session
CVE-2025-49596 RCE in MCP-Inspector structurally addressed Substrate ships its own verify-* CLI family (verify-reflection-chain, verify-signed-events-chain, verify-forensic-bundle) — not vulnerable to the separate MCP-Inspector toolchain CVE
▸ For procurement reviewers

How to independently verify every claim on this page.

Procurement-grade evidence is reproducible. Every claim on this page traces to a capability_id in the codegraph-verified inventory; every capability traces to a file path + line number; every file path + line number can be checked out at the verification commit. Procurement reviewers may run the following commands to verify the substrate's posture from a fresh checkout.

1. Checkout the verification commit

# Clone the public repository
git clone https://github.com/alphaonedev/ai-memory-mcp.git
cd ai-memory-mcp

# Check out the verification commit cited by this page
git checkout 4add7a8528d4c16d696b391ec6e2890269669a84

2. Verify the schema version anchor

grep -n 'CURRENT_SCHEMA_VERSION' src/storage/migrations.rs
# Expected: line 554: const CURRENT_SCHEMA_VERSION: i64 = 53;

3. Verify the MCP tool count anchors

cargo test --lib profile::tests::profile_full_matches_registry_all
cargo test --lib profile::tests::profile_core_loads_only_core_family
cargo test --lib profile::tests::profile_graph_loads_core_plus_graph
cargo test --lib profile::tests::profile_admin_loads_core_lifecycle_governance
cargo test --lib profile::tests::profile_power_loads_core_plus_power

4. Verify the HookEvent variant count (25)

# Codegraph approach (preferred)
mcp__codegraph__codegraph_node HookEvent

# Or count via grep on the enum block
awk '/^pub enum HookEvent/,/^\}/' src/hooks/events.rs | grep -cE '^\s+[A-Z][a-zA-Z]+,'

5. Verify the Memory struct field count (26)

# Codegraph approach (preferred)
mcp__codegraph__codegraph_node Memory

6. Run the test suite and observe pin invariants

# Schema parity (sqlite + postgres lockstep)
AI_MEMORY_NO_CONFIG=1 cargo test --test postgres_schema_parity

# If-Match optimistic concurrency (Gap 1)
AI_MEMORY_NO_CONFIG=1 cargo test --test http_if_match_concurrency

# Capabilities v3 envelope shape
AI_MEMORY_NO_CONFIG=1 cargo test --test capabilities_v3

# Token budget guards
AI_MEMORY_NO_CONFIG=1 cargo test --test token_budget_guard
AI_MEMORY_NO_CONFIG=1 cargo test --test budget_tokens

7. Inspect the capability inventory JSON

cat docs/compliance/_inventory/v0.7.0-capabilities.json | jq '.capabilities[] | {id, verified_in_v0_7_0, verified_at_paths}'

8. Spot-check any concern → primitive trace

# For example, concern (h) DoS → 7-layer defense:
# Layer 1: K8 quota
grep -n 'memory_quota_status' src/profile.rs

# Layer 3: HMAC-mandatory webhook
grep -n 'hmac_secret configured' src/subscriptions.rs

# Layer 6: HTTP body cap
grep -n 'DefaultBodyLimit' src/lib.rs

# Each grep returns the line number cited on this page.

9. Re-derive the inventory at any future commit

The inventory artefact carries a verification_commit_sha field. To re-derive at a future commit, follow the codegraph methodology documented in _inventory/v0.7.0-summary.md §5 Reproducibility.

▸ Honest boundaries

What ai-memory does NOT defend against.

Substrate honesty is the procurement asset, not aspirational coverage. The companion document honest-limitations.md documents the genuine boundaries the substrate cannot reach — operating-system layer vulnerabilities, hardware attestation (an AgenticMem commercial-layer concern), LLM hallucination above the substrate, operator policy authoring errors, prompt injection at the LLM input layer, and more. These are NOT NSA CSI gaps (we address every NSA CSI concern). They are substrate boundaries that exist regardless of any compliance framework.

The pair of documents (this NSA CSI mapping + the honest-limitations companion) is the procurement-grade evidence pair. Read in sequence to form a complete picture of substrate coverage.

→ Read the honest-limitations companion document