vaultzero 0.1.2__tar.gz → 0.1.3__tar.gz

{vaultzero-0.1.2 → vaultzero-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: vaultzero
-Version: 0.1.2
+Version: 0.1.3
 Summary: MCP server for a privacy-first agent memory vault: memories are encrypted on the client before they reach the server.
 Project-URL: Homepage, https://vaultzero.cc
 Project-URL: Documentation, https://github.com/xo0ps/VaultZero-Client#readme
@@ -39,6 +39,8 @@ Description-Content-Type: text/markdown
 [![MCP](https://img.shields.io/badge/MCP-server-blueviolet)](https://modelcontextprotocol.io)
 [![Python 3.10+](https://img.shields.io/badge/python-3.10%2B-blue.svg)](https://www.python.org)
 
+[![Listed on mcpservers.org](https://mcpservers.org/badge.svg)](https://mcpservers.org/servers/xo0ps/vaultzero-client)
+
 **An MCP server that gives an AI agent long-term memory it cannot read.** VaultZero is a
 privacy-first memory vault: this package embeds and encrypts every memory on your machine
 before it is sent, so the server stores ciphertext and vectors and never holds a key.
@@ -79,7 +81,7 @@ pip install vaultzero    # or: uv tool install vaultzero
   "mcpServers": {
     "vaultzero": {
       "command": "uvx",
-      "args": ["vaultzero-mcp"],
+      "args": ["--from", "vaultzero", "vaultzero-mcp"],
       "env": {
         "VZ_BASE_URL": "https://api.vaultzero.cc",
         "VZ_CREDENTIAL": "<your 64-hex-character bearer credential>",
@@ -91,6 +93,11 @@ pip install vaultzero    # or: uv tool install vaultzero
 }
 ```
 
+`--from vaultzero` is not optional. `vaultzero-mcp` is the console script *inside* the
+`vaultzero` package, not a package name, so `uvx vaultzero-mcp` fails with "Because
+vaultzero-mcp was not found in the package registry". The flag tells uvx which package to
+install before running that script.
+
 `VZ_BASE_URL` and `VZ_CREDENTIAL` are required. The other three are strongly recommended and
 are described under [Configuration](#configuration).
 

{vaultzero-0.1.2 → vaultzero-0.1.3}/README.md

@@ -4,6 +4,8 @@
 [![MCP](https://img.shields.io/badge/MCP-server-blueviolet)](https://modelcontextprotocol.io)
 [![Python 3.10+](https://img.shields.io/badge/python-3.10%2B-blue.svg)](https://www.python.org)
 
+[![Listed on mcpservers.org](https://mcpservers.org/badge.svg)](https://mcpservers.org/servers/xo0ps/vaultzero-client)
+
 **An MCP server that gives an AI agent long-term memory it cannot read.** VaultZero is a
 privacy-first memory vault: this package embeds and encrypts every memory on your machine
 before it is sent, so the server stores ciphertext and vectors and never holds a key.
@@ -44,7 +46,7 @@ pip install vaultzero    # or: uv tool install vaultzero
   "mcpServers": {
     "vaultzero": {
       "command": "uvx",
-      "args": ["vaultzero-mcp"],
+      "args": ["--from", "vaultzero", "vaultzero-mcp"],
       "env": {
         "VZ_BASE_URL": "https://api.vaultzero.cc",
         "VZ_CREDENTIAL": "<your 64-hex-character bearer credential>",
@@ -56,6 +58,11 @@ pip install vaultzero    # or: uv tool install vaultzero
 }
 ```
 
+`--from vaultzero` is not optional. `vaultzero-mcp` is the console script *inside* the
+`vaultzero` package, not a package name, so `uvx vaultzero-mcp` fails with "Because
+vaultzero-mcp was not found in the package registry". The flag tells uvx which package to
+install before running that script.
+
 `VZ_BASE_URL` and `VZ_CREDENTIAL` are required. The other three are strongly recommended and
 are described under [Configuration](#configuration).
 

{vaultzero-0.1.2 → vaultzero-0.1.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "vaultzero"
-version = "0.1.2"
+version = "0.1.3"
 # This string is what MCP directories show next to the listing, so it names the thing a
 # prospective user is looking for (an MCP server) before the architecture behind it.
 description = "MCP server for a privacy-first agent memory vault: memories are encrypted on the client before they reach the server."

{vaultzero-0.1.2 → vaultzero-0.1.3}/tests/unit/test_sdk_and_mcp.py

@@ -9,7 +9,7 @@ from uuid import uuid4
 import pytest
 
 from vaultzero.client._net import require_secure_url
-from vaultzero.client.embeddings import HashingTestEmbeddings
+from vaultzero.client.embeddings import EmbeddingSpace, HashingTestEmbeddings
 from vaultzero.client.mcp_server import UNTRUSTED_HEADER, create_mcp_server
 from vaultzero.client.sdk import (
     Context,
@@ -92,6 +92,83 @@ def test_recalled_envelope_must_match_requested_scope_and_space() -> None:
     assert not match(ctx, {**item, "subject_epoch": str(uuid4())}, frozenset({"medical"}), "s1")
 
 
+# -- embedding space bootstrap ------------------------------------------------------------
+
+
+def _ctx_with_spaces(spaces: dict) -> Context:
+    return Context(
+        tenant_id=uuid4(),
+        user_id=uuid4(),
+        agent_id=uuid4(),
+        subject_epoch=uuid4(),
+        scopes=frozenset({"preferences"}),
+        embedding_spaces=spaces,
+    )
+
+
+def _client_for(space_id: str) -> VaultZeroClient:
+    return VaultZeroClient(
+        base_url="https://example.invalid",
+        credential="0" * 64,
+        key_store=InMemoryKeyStore(),
+        embedding_provider=HashingTestEmbeddings(
+            EmbeddingSpace(
+                space_id=space_id,
+                model="vaultzero-hashing",
+                revision="1",
+                preprocessing="nfc-strip-v1",
+            )
+        ),
+    )
+
+
+def test_empty_embedding_spaces_allows_the_first_write() -> None:
+    """Regression: a brand-new tenant could never store anything.
+
+    /v1/context lists only spaces the tenant already HAS MEMORIES IN, which is
+    deliberate: unfiltered, it leaked every other tenant's space ids. But the client
+    treated an empty list as "not registered" and refused to write, so a tenant with no
+    memories could never create its first one:
+
+        no memories -> empty list -> client refuses -> no memories
+
+    Found by an end-to-end run against production, not by any unit test.
+    """
+    client = _client_for("test-hashing-v1")
+    ctx = _ctx_with_spaces({})
+    assert client._require_space(ctx) == "test-hashing-v1"
+
+
+def test_unknown_space_is_still_refused_when_others_exist() -> None:
+    """The leak fix must not be undone: a tenant that writes elsewhere still gets refused.
+
+    Only the ambiguous empty case is relaxed. If the tenant has memories in other spaces
+    and this one is absent, that is a genuine mismatch, and silently using it would store
+    vectors that can never be matched.
+    """
+    client = _client_for("not-registered")
+    ctx = _ctx_with_spaces({"some-other-space": {"space_id": "some-other-space"}})
+    with pytest.raises(VaultZeroClientError, match="not registered"):
+        client._require_space(ctx)
+
+
+def test_matching_space_with_wrong_configuration_is_refused() -> None:
+    client = _client_for("test-hashing-v1")
+    ctx = _ctx_with_spaces(
+        {
+            "test-hashing-v1": {
+                "space_id": "test-hashing-v1",
+                "model": "a-different-model",
+                "revision": "1",
+                "preprocessing": "nfc-strip-v1",
+                "dimensions": 1536,
+            }
+        }
+    )
+    with pytest.raises(VaultZeroClientError, match="differs from the registry"):
+        client._require_space(ctx)
+
+
 # -- MCP ----------------------------------------------------------------------------------
 
 

{vaultzero-0.1.2 → vaultzero-0.1.3}/vaultzero/client/sdk.py

@@ -263,7 +263,20 @@ class VaultZeroClient:
         space = self._embeddings.space
         entry = ctx.embedding_spaces.get(space.space_id)
         if entry is None:
-            raise VaultZeroClientError("embedding space not registered on the server")
+            # /v1/context lists only the spaces the tenant ALREADY HAS MEMORIES IN. That
+            # scoping is deliberate: unfiltered, it leaked every other tenant's space ids
+            # and model names. But it makes an empty list mean "nothing written yet", not
+            # "not registered", and treating the two the same deadlocked every new tenant:
+            # no memories -> empty list -> the client refused to write -> no memories.
+            #
+            # An empty list therefore passes. A NON-empty list that lacks this space still
+            # raises: the tenant writes to other spaces, so this one is genuinely unknown to
+            # it, and quietly using a space the server never agreed to risks storing vectors
+            # that can never be matched. The server independently checks the global registry
+            # (_require_space in memory_engine), so this is not the only line of defence.
+            if ctx.embedding_spaces:
+                raise VaultZeroClientError("embedding space not registered on the server")
+            return space.space_id
         if not space.matches_registry(entry):
             # Same identifier, different model/revision/preprocessing: vectors would be
             # silently incomparable, so refuse.