doobidoo/mcp-memory-service v10.26.0

v10.26.0 - Credentials Tab + Settings Restructure + Sync Owner

on GitHub

Summary

This release brings a major dashboard upgrade: a new Credentials tab lets you manage Cloudflare credentials directly from the Settings modal without editing config files. A new Sync Owner setting (MCP_HYBRID_SYNC_OWNER) lets HTTP server own all Cloudflare sync, removing the need for a Cloudflare token in the MCP server config.

Added

• Credentials tab in Settings modal (GET /api/config/credentials, POST /api/config/credentials/test, POST /api/config/credentials): Manage Cloudflare API token, Account ID, D1 Database ID, and Vectorize Index directly from the dashboard. Credentials shown with partial-reveal (masked) display and an eye-toggle for full reveal.
• Connection test gate (test-gate pattern): Credentials must pass a live connection test before they can be saved, preventing accidental misconfiguration.
• Sync Owner selector (MCP_HYBRID_SYNC_OWNER: http / both / mcp): Control which server handles Cloudflare sync in hybrid mode. Default is http (recommended) — HTTP server owns all sync; MCP server (Claude Desktop) uses SQLite-Vec only, removing the need for a Cloudflare token in the MCP config.
• Settings tabs restructured: The Backup tab is split into three focused tabs — Quality, Backup, and Server — bringing the total to 7 tabs.

Security

• SSRF protection: account_id validated against [a-f0-9]{32} regex before Cloudflare API calls
• Newline injection prevention: credential values sanitised to reject embedded newlines
• sync_owner allowlist: only http, both, mcp accepted

Documentation

• CLAUDE.md and README.md updated: MCP_HYBRID_SYNC_OWNER=http documented as the recommended configuration for hybrid mode
• CI: Claude Code Review workflow disabled (OAuth token expiry issues — will be migrated to API key auth)

Tests

1,420 tests total (no new tests in this release).

Installation

pip install --upgrade mcp-memory-service

Recommended Hybrid Mode Config

export MCP_HYBRID_SYNC_OWNER=http   # HTTP server owns all Cloudflare sync
# MCP server (Claude Desktop) then needs no Cloudflare token

Full changelog: https://github.com/doobidoo/mcp-memory-service/blob/main/CHANGELOG.md