@echomem/mcp 1.4.32 → 1.4.33

package/README.md

@@ -10,7 +10,7 @@ This MCP Server bridges local tools and your EchoMem Cloud API entirely via auth
 - `save_conversation`: Connects to `POST /api/extension/memories/ingest`
 - `get_memories_by_time_range`: Connects to `POST /api/extension/memories/time-range`
 - `search_memories_by_keywords`: Connects to `POST /api/extension/memories/keywords`
-- `search_others_memories`: Connects to MemoryFeed public search without sending the authenticated Echo user id
+- `search_others_memories`: Connects to MemoryFeed public search without trusting a model-supplied identity; the hosted API resolves the caller from the EchoMem credential and the tool returns that authenticated viewer explicitly
 - `delete_memory`: Previews one personal memory and returns a confirmation token; only deletes after a second confirmed call
 
 No direct access to the `IndexedDB` or local files is required.

package/dist/index.js

@@ -1800,6 +1800,22 @@ Details: ${m.details || "N/A"}`)
         const parsed = othersSchema.parse(args ?? {});
         const payload = await this.client.searchOthersMemories(args);
         const memories = payload?.memories ?? [];
+        const authenticatedViewer = isRecord(payload?.authenticatedViewer)
+            ? payload.authenticatedViewer
+            : null;
+        const authenticatedUserId = authenticatedViewer
+            ? readString(authenticatedViewer, "userId")
+            : null;
+        const authenticatedDisplayName = authenticatedViewer
+            ? readString(authenticatedViewer, "displayName")
+            : null;
+        const authenticatedIdentity = authenticatedUserId
+            ? [
+                `Authenticated EchoMem user: ${authenticatedDisplayName ?? "Unknown display name"} (User ID: ${authenticatedUserId}).`,
+                "This identity comes from the EchoMem credential and is authoritative for this tool call.",
+                "EchoMem has already excluded only this authenticated user's own memories. Return every memory below; do not filter again using a Claude account, host profile, git identity, or inferred identity.",
+            ].join("\n")
+            : "EchoMem has already applied credential-based self filtering. Do not filter the returned memories again using a host account, profile, git identity, or inferred identity.";
         if (!memories.length) {
             const scope = parsed.ownerUserId
                 ? ` for peer ${parsed.ownerUserId}`
@@ -1814,7 +1830,7 @@ Details: ${m.details || "N/A"}`)
                                 : "";
             const queryLabel = parsed.query?.trim() ? ` matching the query: ${parsed.query}` : "";
             return {
-                content: [{ type: "text", text: `No others' public memories found${scope}${queryLabel}` }],
+                content: [{ type: "text", text: `${authenticatedIdentity}\n\nNo others' public memories found${scope}${queryLabel}` }],
             };
         }
         const metadata = [
@@ -1848,7 +1864,7 @@ Details: ${m.details || "N/A"}`;
             content: [
                 {
                     type: "text",
-                    text: withMemoryCitationInstruction(`Found ${memories.length} others' public memories${metadata ? ` (${metadata})` : ""}:\n\n${formattedResults}`),
+                    text: withMemoryCitationInstruction(`${authenticatedIdentity}\n\nFound ${memories.length} others' public memories${metadata ? ` (${metadata})` : ""}:\n\n${formattedResults}`),
                 },
             ],
         };
@@ -2033,6 +2049,9 @@ Details: ${m.details || "N/A"}`;
         const text = [
             `Company group: ${readString(group, "name") ?? "Unnamed group"}`,
             readString(group, "description") ? `Description: ${readString(group, "description")}` : "",
+            currentParticipant
+                ? `Authenticated EchoMem member: ${readString(currentParticipant, "displayName") ?? "Unknown display name"} (User ID: ${readString(currentParticipant, "userId") ?? "unknown"}). This identity comes from the EchoMem credential and overrides any conflicting host-account, Claude-profile, git, or inferred identity.`
+                : "EchoMem credential identity is authoritative for this tool; do not substitute a host-account, Claude-profile, git, or inferred identity.",
             `Coverage: ${coveredCount} of ${participantCount} participants have published memories (${totalPublished} total).`,
             "",
             participantText,

package/dist/v1-contract.js

@@ -407,7 +407,7 @@ export function listToolSpecs(opts = {}) {
         },
         {
             name: canonicalToolNames.others,
-            description: `Search public memories from accepted friends or people who share your company group. For onboarding and division-of-work questions, call get_group_context first, then use this tool for current evidence. Returned memories are recorded in memory_views for the owners. ${memoryCitationInstruction}${groupMapSection}`,
+            description: `Search public memories from accepted friends or people who share your company group. EchoMem identifies the caller from the EchoMem credential and has already excluded only that authenticated user's own memories. Present every returned owner; never filter again using a Claude account, host profile, git identity, or inferred identity. For onboarding and division-of-work questions, call get_group_context first, then use this tool for current evidence. Returned memories are recorded in memory_views for the owners. ${memoryCitationInstruction}${groupMapSection}`,
             inputSchema: {
                 type: "object",
                 properties: {
@@ -499,7 +499,7 @@ export function listToolSpecs(opts = {}) {
         },
         {
             name: canonicalToolNames.groupContext,
-            description: `Get your current company group, its participant directory, declared titles and responsibilities, and published-memory coverage. Use this before answering who works on what or suggesting where a new group member could contribute. Treat declared profile fields as facts and memory-derived work as evidence or inference. Conversation sharing is separate; call get_group_session_sharing instead of inferring it.${groupMapSection}`,
+            description: `Get your current company group, its participant directory, declared titles and responsibilities, published-memory coverage, and the current member authenticated by the EchoMem credential. That authenticated EchoMem identity is authoritative over any conflicting Claude account, host profile, git identity, or inference. Use this before answering who works on what or suggesting where a new group member could contribute. Treat declared profile fields as facts and memory-derived work as evidence or inference. Conversation sharing is separate; call get_group_session_sharing instead of inferring it.${groupMapSection}`,
             inputSchema: {
                 type: "object",
                 properties: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@echomem/mcp",
-  "version": "1.4.32",
+  "version": "1.4.33",
   "description": "EchoMem MCP bridge: cloud-first memory tools, local context HUD, and the Agent Doctor workspace forensics report (cost ledger + 3D repo city)",
   "main": "dist/index.js",
   "type": "module",