Security posture

The short version: Memnox is a control that other controls depend on, so it is built to be inspectable rather than to be trusted.

What it never stores

The argument one deserves expanding. A rule can match on the contents of a call, command: ["*rm -rf*"], and the raw payload is the one thing a control plane should not collect. So @memnox/local-gate evaluates it in-process, inside the MCP firewall or the editor hook, and the runtime is told the tool, the target, and the rule ids that matched. The SDK strips arguments before any request leaves the machine.

What it does store

Source events with their permalinks, decisions with their approvers, audit events with their hashes, people with their resolved identities, and the configuration you set. Each table is classified in the data inventory, including whether it is encrypted at rest.

Authentication

Agent tokens are stored at ~/.memnox/config.json, mode 0600. The environment wins when set, which is how CI passes one.

An unknown token is blocked and audited as critical. Fail closed.

Inbound verification

Every webhook route verifies over raw bytes, before parsing, and every shared-token comparison is constant-time.

Rate limiting applies per workspace on every inbound route. See Webhooks and signatures.

Where models are, and are not

That table is the security argument for the whole product. Everything that decides is deterministic; the one thing that guesses cannot act.

Fail-closed, and the one exception

Unknown identity, unreadable state or ambiguous input blocks.

Advisors are the exception in the other direction: an advisor that cannot run raises nothing, because a broken advisor must not stop work. Provenance is the exception to that, an unreadable taint store means the session is treated as tainted.

Break-glass leaves a mark

An admin override requires a reason, is audited as critical, and opens an incident. Irreversible actions (project.delete, database.drop) refuse break-glass with a 403 and audit the attempt.

Tamper evidence and its limit

The audit chain detects edits to a log you control. It does not stop an operator with database access from rewriting the whole chain.

If you need a stronger property, ship every decision to a sink outside the same trust boundary, an S3 bucket with object lock, or a Kafka topic your security team owns.

Reporting a vulnerability

The runtime repository carries a SECURITY.md with the disclosure process. Please use it rather than a public issue.