fix(mcp): preserve scoped memory URL paths by phernandez · Pull Request #1092 · basicmachines-co/basic-memory

phernandez · 2026-07-16T22:32:19Z

Summary

treat a forbidden project-prefix probe as an unqualified note path only when a read-only request already has that authorized project cached
keep delete_note and move_note on strict project routing so scope-hidden prefixes fail before mutation
cover scoped read fallback, uncached denial, strict resolver behavior, and the concrete mutating tool call sites

Why

A project-scoped API key can successfully select its authorized project, then fail build_context for a URL such as memory://acceptance/mcp/note. The first directory segment is probed as a project route, and the scoped credential returns an access denial instead of the project-not-found response used by path fallback.

This change only permits fallback when the current MCP context already contains the requested authorized project and the route is read-only. Strict mutation routes and uncached access denials still propagate, so an inaccessible route cannot become a write, move, delete, or unauthorized project context.

Supports basicmachines-co/basic-memory-cloud#1521.

Verification

just fast-check
uv run pytest tests/mcp/test_project_context_scoped_key.py tests/mcp/test_project_context.py -q (81 passed)
uv run pytest tests/mcp/tools/test_mutating_memory_url_routing.py tests/mcp/test_project_context_scoped_key.py tests/mcp/test_project_context.py tests/mcp/test_tool_delete_note.py tests/mcp/test_tool_move_note.py test-int/bughunt_fixes/test_move_note_edge_cases.py -q (163 passed)
uv run pytest test-int/mcp/test_delete_directory_integration.py::test_delete_directory_empty test-int/mcp/test_move_directory_integration.py::test_move_directory_empty -q (2 passed)

Signed-off-by: phernandez <paul@basicmachines.co>

phernandez · 2026-07-16T22:32:34Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 28ee7aade3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Signed-off-by: phernandez <paul@basicmachines.co>

phernandez · 2026-07-16T22:36:40Z

@codex review\n\nPlease review exact head ec84309.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ec8430932f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Signed-off-by: phernandez <paul@basicmachines.co>

phernandez · 2026-07-16T22:41:50Z

@codex review\n\nPlease review exact head 7154e8b after the P1 fix.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7154e8b152

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Signed-off-by: phernandez <paul@basicmachines.co>

phernandez · 2026-07-16T22:50:23Z

@codex review

Signed-off-by: phernandez <paul@basicmachines.co>

phernandez · 2026-07-16T22:58:41Z

@codex review

Please review exact head 6bf8181 after preserving the legacy missing-project path fallback for existing-target move/delete mutations while keeping scope-hidden access denials fail-closed.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6bf8181648

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Signed-off-by: phernandez <paul@basicmachines.co>

phernandez · 2026-07-16T23:11:08Z

@codex review

Please review exact head cec709b after the two zero-match directory result fixes.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cec709bbdd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Signed-off-by: phernandez <paul@basicmachines.co>

phernandez · 2026-07-16T23:18:27Z

@codex review

Please review exact head 47d9764. This only restores legacy empty-directory response wording after the reviewed zero-match behavior fix; the exact integration tests and 160-test focused suite pass.

chatgpt-codex-connector · 2026-07-16T23:22:32Z

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: 47d9764bd6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Signed-off-by: phernandez <paul@basicmachines.co>

phernandez · 2026-07-16T23:24:39Z

@codex review

Please review exact head ddd20b8 after the cross-project move cache-preservation fix. Static checks and the 163-test focused/integration suite pass.

chatgpt-codex-connector · 2026-07-16T23:28:46Z

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: ddd20b80b0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

fix(mcp): preserve scoped memory URL paths

28ee7aa

Signed-off-by: phernandez <paul@basicmachines.co>

chatgpt-codex-connector Bot reviewed Jul 16, 2026

View reviewed changes

Comment thread src/basic_memory/mcp/project_context.py

test(mcp): require cached scoped project

ec84309

Signed-off-by: phernandez <paul@basicmachines.co>

chatgpt-codex-connector Bot reviewed Jul 16, 2026

View reviewed changes

Comment thread src/basic_memory/mcp/project_context.py

fix(mcp): keep note mutations strict

7154e8b

Signed-off-by: phernandez <paul@basicmachines.co>

chatgpt-codex-connector Bot reviewed Jul 16, 2026

View reviewed changes

Comment thread src/basic_memory/mcp/tools/move_note.py Outdated

fix(mcp): route directory moves strictly

5047b65

Signed-off-by: phernandez <paul@basicmachines.co>

fix(mcp): preserve existing path mutations

6bf8181

Signed-off-by: phernandez <paul@basicmachines.co>

chatgpt-codex-connector Bot reviewed Jul 16, 2026

View reviewed changes

Comment thread src/basic_memory/mcp/tools/delete_note.py

Comment thread src/basic_memory/mcp/tools/move_note.py

fix(mcp): reject empty directory mutations

cec709b

Signed-off-by: phernandez <paul@basicmachines.co>

chatgpt-codex-connector Bot reviewed Jul 16, 2026

View reviewed changes

Comment thread src/basic_memory/mcp/tools/move_note.py

fix(mcp): preserve empty directory messages

47d9764

Signed-off-by: phernandez <paul@basicmachines.co>

fix(mcp): preserve move project context

ddd20b8

Signed-off-by: phernandez <paul@basicmachines.co>

phernandez merged commit a513ed3 into main Jul 16, 2026
25 checks passed

phernandez deleted the codex-scoped-memory-url branch July 16, 2026 23:42

Uh oh!

Conversation

phernandez commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why

Verification

Uh oh!

phernandez commented Jul 16, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

phernandez commented Jul 16, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

phernandez commented Jul 16, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

phernandez commented Jul 16, 2026

Uh oh!

phernandez commented Jul 16, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

phernandez commented Jul 16, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

phernandez commented Jul 16, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jul 16, 2026

Uh oh!

phernandez commented Jul 16, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jul 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

phernandez commented Jul 16, 2026 •

edited

Loading