Configuration

Your rules, in the repository, reviewed in a diff like any other file. This is the one you edit.

The agent token, mode 0600. Written by memnox setup, because a GUI-launched editor inherits no shell environment and would otherwise reach the runtime with no credential at all.

Which policy files belong to which project on this machine. Paths only. Rule content never leaves the repository that owns it.

The import graph, written by memnox graph build. Safe to delete and rebuild.

A shared Postgres, so several runtime processes see the same agents, approvals and audit log. Needed the moment you run more than one.

One rate-limit budget and one session-taint store across every process. Without it each process counts alone, so three processes enforce three times the limit you configured. If this is set and Redis is unreachable, startup fails rather than quietly degrading to that.

Where the file-backed stores live. Ignored once a database URL is set.

How long decisions are kept, pruned on an hourly sweep. 0 keeps everything. Choose deliberately: both answers are defensible, and "nobody decided" is the one that causes trouble.

What happens when no rule matches. allow is the default, so a first install observes rather than blocking. block is the hardened posture, and switching to it is the real decision on this page.

Enforce in one environment while still observing in another, so staging can be strict before production is.

How many actions an agent may take in a window. Only an action that actually proceeds spends a slot.

Escalates novel destructive actions, bursts and boundary probing, measured against what this agent normally does rather than a global norm.

Escalates risky actions from an agent whose trust score has fallen.

Escalates the next action from an agent that never reported how its last one turned out.

Governs dependency.add: known-vulnerable versions, and licenses you cannot accept. An unknown license raises nothing, because a lookup failure must never cause a wrongful block.

Path to the import graph. Turns on blast radius, so an edit to a utility is treated as an edit to whatever imports it.

The paths blast radius escalates for, e.g. *payment/*. Repeatable.

Require this bearer token on admin routes.

Serve over TLS, and accept mTLS client certificates as agent identity. The certificate's subject CN is the agent name.

Announce pending approvals to a Slack-compatible endpoint, so a request reaches somebody instead of waiting to be noticed.

The agent credential. Wins over the config file, which is how CI passes one without writing anything to disk, and how the MCP firewall is given one.

Same as --admin-token. This is the form to use in a container: a token on the command line is visible in the process list to anyone on the box.

Same as --database-url. Same reasoning: it usually carries a password.

Same as --redis-url.

The default git ref memnox ci diffs against. Falls back to HEAD~1. Set it in the pipeline so the scan covers the whole branch rather than the last commit.