Memory Vault v1.0.9

Fixes

• Pool checkout validation: AsyncConnectionPool now runs a liveness
  check on checkout, so connections that died while idle are discarded
  and replaced transparently instead of surfacing as query failures.
  Fixes the "server closed the connection unexpectedly" errors common
  on remote-Postgres deployments. (contributed by @hmodes, #118)

• Version reporting: every runtime and release surface now agrees with
  the released tag. /api/health, FastAPI//openapi.json,
  docker-compose.yml, server.json, and memory-vault diagnose all
  report the real installed package version, resolved via
  importlib.metadata. The release workflow now blocks a tag whose
  descriptors drift. (reported by @lcj-codex-coder — Leonard Janke / lcjanke2020, working with GPT-5.6-Sol through OpenAI Codex — #97, fix in #120)

No breaking changes. Upgrade is drop-in.

v1.0.8

Memory Vault 1.0.7

Patch release focused on packaging correctness. If you install Memory Vault with pip install memory-vault, this is the release that makes the memory-vault CLI actually work.

memory-vault CLI is now pip-installable. Every subcommand (status, migrate, ingest, search, mcp, api, token, space, diagnose) failed with ModuleNotFoundError: No module named 'src' immediately on invocation for pip-installed deployments across every prior 1.0.x release. Docker deployments accidentally kept working because they bypassed the broken install with PYTHONPATH=/app + a raw source-tree copy. The refactor moves the code under a proper memory_vault package, updates the entry point, bundles the SQL migrations with the wheel, and removes the Docker workaround so containers and pip installs now share a single, correct install path. (#76, #84)

pyproject.toml version now tracks the git tag. The package reported version 0.4.0 regardless of which 1.0.x tag was installed, because the release workflow never bumped the version file. A one-time correction to 1.0.6 (now 1.0.7) plus a version-guard job in release.yml prevent the drift from recurring: future tags fail early if pyproject.toml doesn't match. (#75, #78)

Docker base image aligned to Python 3.13. Docker used python:3.14-slim, but spaCy (a heavy C-extension dependency) has no cp314 wheel yet — Python 3.14 is very recent and its wheel ecosystem hasn't caught up. Every docker build on main failed at pip install. Base image downgraded to python:3.13-slim, which has full wheel coverage across all deps and matches the CI pytest matrix. Also added a dependabot.yml ignore entry to prevent automatic bumps back to the bleeding edge. (#79, #80)

• Windows ProactorEventLoop startup warnings on stdio MCP deployments with remote Postgres. Reproduces on Windows 11 + Python 3.12 + psycopg async pool. Needs a controlled repro before choosing the fix. Landing in a future patch. (#77)

• Docker: docker pull ghcr.io/mihaibuilds/memory-vault:1.0.7 (or docker compose pull if using the standard compose file).

• pip: pip install --upgrade memory-vault. First release where the console script actually works after pip install.

The packaging bugs in this release were surfaced by @git-pharos via an unusually thorough diagnostic bundle in #74. The bundle exposed not just the reported issues but the underlying pip-install breakage and the version-frozen state, which drove three of the four fixes above.

Patch release — corrects casing of the io.modelcontextprotocol.server.name OCI annotation on memory-vault-mcp. No behavior changes; drop-in replacement for v1.0.5.

What's fixed

The MCP Registry compares the OCI ownership label against the GitHub login casing exactly. The label value was lowercase (io.github.mihaibuilds/memory-vault) but our GitHub org login is mixed case (MihaiBuilds). Publishing to the registry was blocked with a 403 until this is corrected.

Fix: label value is now io.github.MihaiBuilds/memory-vault to match the org login.

Upgrade

docker compose pull
docker compose up -d

Or pin explicitly:

docker pull ghcr.io/mihaibuilds/memory-vault:1.0.6
docker pull ghcr.io/mihaibuilds/memory-vault-mcp:1.0.6

170 tests passing in CI on Python 3.14 + Postgres 16 + pgvector. Both images built multi-arch (amd64 + arm64).

Full changelog

Compare: v1.0.5...v1.0.6

Patch release — adds the io.modelcontextprotocol.server.name OCI annotation to memory-vault-mcp for official MCP Registry submission. No behavior changes, no API changes; drop-in replacement for v1.0.4.

What's in this release

memory-vault-mcp ownership label

Adds LABEL io.modelcontextprotocol.server.name="io.github.mihaibuilds/memory-vault" to Dockerfile.mcp. The official MCP Registry uses this OCI annotation to verify that the publisher of a server.json actually controls the image.

Required as prep for submitting Memory Vault to https://registry.modelcontextprotocol.io. No effect on image runtime, no size change.

Upgrade existing deployments

docker compose pull
docker compose up -d

Or pin explicitly:

docker pull ghcr.io/mihaibuilds/memory-vault:1.0.5
docker pull ghcr.io/mihaibuilds/memory-vault-mcp:1.0.5

170 tests passing in CI on Python 3.14 + Postgres 16 + pgvector. Both images built multi-arch (amd64 + arm64).

Full changelog

Compare: v1.0.4...v1.0.5

Distribution release — Memory Vault now ships as two Docker images:

• ghcr.io/mihaibuilds/memory-vault:1.0.4 — the existing all-in-one image (API + dashboard + MCP)
• ghcr.io/mihaibuilds/memory-vault-mcp:1.0.4 — new — thin MCP-only image for connecting to an external Postgres+pgvector

No code changes, no behavior changes for existing users. Drop-in replacement for v1.0.3.

What's new

memory-vault-mcp image

A second Docker image that ships ONLY the MCP stdio server. Connects to an external Postgres+pgvector via env vars (DB_HOST, DB_PORT, DB_NAME, DB_USER, DB_PASSWORD). Intended for:

• Direct use in mcp.json configurations where you already have Postgres running elsewhere
• MCP catalog registries (official MCP registry + Docker MCP Toolkit submissions coming next)
• Integration in larger Docker Compose setups where Postgres is shared with other services

Use it

docker pull ghcr.io/mihaibuilds/memory-vault-mcp:1.0.4

Or in Claude Desktop mcp.json:

{
  "mcpServers": {
    "memory-vault": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "DB_HOST=host.docker.internal",
        "-e", "DB_PORT=5432",
        "-e", "DB_NAME=memory_vault",
        "-e", "DB_USER=memory_vault",
        "-e", "DB_PASSWORD=memory_vault",
        "ghcr.io/mihaibuilds/memory-vault-mcp:1.0.4"
      ]
    }
  }
}

The existing all-in-one image continues to work exactly as before — docker compose up from the published docker-compose.yml is unchanged.

Upgrade existing deployments

docker compose pull
docker compose up -d

170 tests passing in CI on Python 3.14 + Postgres 16 + pgvector. Both images built multi-arch (amd64 + arm64).

Full changelog

Compare: v1.0.3...v1.0.4

Maintenance release — dependency updates, CI/runtime alignment, and small code-quality cleanups. No API or behavioral changes; drop-in replacement for v1.0.2.

What's in this release

Runtime upgrades

• Docker base images: python:3.11-slim → python:3.14-slim, node:20-slim → node:26-slim
• CI runners aligned to the same Python 3.14 / Node 26 (previously tests ran on 3.11/20 while the image shipped on 3.14/26 — a tested-vs-shipped divergence now closed)
• Tailwind CSS v3 → v4 (web dashboard): full migration via official codemod, including PostCSS plugin rename and config-as-CSS via @theme
• GitHub Actions: actions/checkout@v4 → v6, actions/cache@v4 → v5, plus 5 Dependabot-bumped CI actions

Dependency updates

Python: fastapi >=0.136.1, numpy >=2.4.5, pytest >=9.0.3, ruff >=0.15.13, python-dotenv >=1.2.2.

Web: react 19.2.6, react-router-dom 7.15.0, @tanstack/react-query 5.100.9, vite 8.0.11, eslint 10.4.0, tailwindcss 4.3.0, plus minor/patch bumps across 12 grouped deps.

Code quality

• Documented 4 intentional empty-except fallback sites (CodeQL "Empty except") in chat.py, adapters/base.py, diagnose.py, tests/test_chat_api.py. No behavior change — comments only.

What's NOT in this release

• No security fixes in the v1.0.2 sense — v1.0.2 closed real CodeQL vulnerabilities; this release is hygiene.
• No new features. Deployment-hardening docs (per #18) are deferred to v1.1.

Upgrade

docker compose pull
docker compose up -d

Or pin explicitly:

docker pull ghcr.io/mihaibuilds/memory-vault:1.0.3

170 tests passing in CI on Python 3.14 + Postgres 16 + pgvector.

Full changelog

Compare: v1.0.2...v1.0.3

Security release — fixes from the M8 CodeQL pass. No API or behavioral changes; drop-in replacement for v1.0.1.

What's fixed

Path traversal in SPA fallback (High). The unauthenticated SPA fallback route accepted user-controlled paths and composed them with the static directory, allowing requests like GET /../../etc/passwd to escape. Fixed via _safe_static_path using os.path.commonpath + os.path.realpath plus pre-composition rejection of empty / null-byte / leading-slash / explicit-traversal inputs. Three independent layers of defense.

Information exposure in chat stream (Medium). The inner SSE error handler in /api/chat/stream interpolated raw exception text into the response. Fixed: server-side logger.exception(...), generic client message.

Out of scope

CodeQL flagged 3 partial-SSRF findings on the llm_url field in ChatRequest. These were dismissed as architectural — Memory Vault is single-tenant self-hosted with bearer-token auth; the llm_url field is intentional operator configuration. Hardening guidance for non-default deployments (publicly exposed cloud VMs, multi-user environments) is tracked in #18 for v1.1.

Full PR with test plan: #19.

Upgrade

docker compose pull
docker compose up -d

Or pin explicitly:

docker pull ghcr.io/mihaibuilds/memory-vault:1.0.2

170 tests passing in CI.

Patch release — fixes the bundled docker-compose.yml to use the published multi-arch image instead of building from source.

What changed

• docker-compose.yml now references ghcr.io/mihaibuilds/memory-vault:1.0.1 instead of build: .
• First-run on a fresh clone is now ~30 seconds (image pull) instead of ~5 minutes (local build)
• The README's "one-command Docker" promise is now actually one command

Recommended starting point

Use v1.0.1 — it's the same code as v1.0.0 with a faster install path. If you've already cloned v1.0.0, run:

git pull
docker compose pull && docker compose up -d

Quick start (fresh clone)

git clone https://github.com/MihaiBuilds/memory-vault
cd memory-vault
cp .env.example .env
docker compose up -d

Open http://localhost:8000 and you're running.

v1.0 capabilities

Same as v1.0.0 — no functionality changes.

Memory Vault v1.0 — first stable release.

A long-term memory layer for AI assistants and the apps you build on top of them. Postgres + pgvector underneath, hybrid search on top, MCP server so Claude can read and write directly, knowledge graph without an LLM bill, local LLM chat with retrieved-source citations. Self-hosted. MIT-licensed. No API keys, no cloud, no telemetry.

What's in v1.0

• Hybrid search — pgvector HNSW + tsvector GIN, merged with Reciprocal Rank Fusion
• MCP server — recall, remember, forget, status for Claude Desktop / Claude Code
• Knowledge graph — spaCy NER + co-occurrence, no LLM cost, Cytoscape visualization
• Local LLM chat — LM Studio with a sources panel showing retrieved chunks per answer
• REST API — FastAPI, bearer auth, OpenAPI at /docs
• Memory spaces — namespacing for different contexts (work, personal, projects)
• One-command Docker — multi-arch image (linux/amd64 + linux/arm64)
• 163 tests passing in CI against a real Postgres + pgvector service container

Quick start

git clone https://github.com/MihaiBuilds/memory-vault
cd memory-vault
cp .env.example .env
docker compose up -d

Open http://localhost:8000 and you're running.

Docs

• README — quick start, MCP setup, REST API, dashboard
• ARCHITECTURE.md — schema, hybrid search internals, design decisions
• Launch blog post — the full v1.0 writeup with architectural reasoning

Known limitation

The bundled docker-compose.yml in v1.0.0 builds the image from source instead of pulling the published image. First-run is slower than the README implies. Fixed in v1.0.1 — recommended starting point.