Report privately via GitHub Security Advisories: https://github.com/hansakoch/cf-memory-plugin/security/advisories Do not open a public issue for token leaks or remote-code bugs.
Nothing locally except optional non-secret config:
{ "namespace": "hermes", "profile": "default" }Memories live in Cloudflare Agent Memory on your account. This plugin never defaults to another account.
Follow Cloudflare: https://developers.cloudflare.com/fundamentals/api/get-started/create-token/
- Create a user API token, not a Global API Key.
- Grant only Agent Memory on the target account.
- Put it in
MCP_CLOUDFLARE_API_KEY. Never commit it. - Rotate it from https://dash.cloudflare.com/profile/api-tokens if leaked.
| Call | Payload |
|---|---|
| remember | the text you pass |
ingest / Hermes sync_turn |
user + assistant messages (and optional tool messages if the host supplies them) |
| recall | the query string |
Do not ingest secrets, passwords, payment data, or customer PII you are not allowed to store with a processor.
- All API calls go to
https://api.cloudflare.comover TLS. - The A2A helper binds to
127.0.0.1by default. Binding to0.0.0.0exposes an unauthenticated JSON-RPC surface — do not do that on a public host.