// SCAN REPORT

Vault Memory

21 tools. 8 can modify or destroy data without limits.

2 destructive tools with no built-in limits. Policy required.

Last updated: 3 Jul 2026

8 can modify or destroy data

13 read-only

21 tools total

Community server · catalogue entry verified 03/07/2026

How to control Vault Memory ↓

TOOL MAP

What Vault Memory exposes to your agents

Read (13) Write / Execute (6) Destructive / Financial (2)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Vault Memory tools

Destructive · High delete_note Deletion of notes is irreversible data destruction. Destructive · High vacuum_embeddings This tool performs irreversible deletion of embedding data from the vault's index. Execute · Medium start_shadow_index Backfilling embeddings is a computational task that triggers indexing logic, modifies internal indexes, and potentially consumes resources. Write · Medium compile_brief The tool creates a new document (brief) by aggregating source materials and writing it to a designated location.

8 of Vault Memory's 21 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Vault Memory

PolicyLayer is an MCP gateway — it sits between your AI agents and Vault Memory, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "delete_note": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "compile_brief": {
    "limits": [
      {
        "counter": "compile_brief_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "audit_log": {
    "limits": [
      {
        "counter": "audit_log_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Vault Memory — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON VAULT MEMORY →

Instant setup, no code required.

FULL CATALOGUE

All 21 Vault Memory tools

DESTRUCTIVE 2 tools

Destructive delete_note Delete a note. Requires write_enabled=true AND expected_hash (no blind deletes). Destructive vacuum_embeddings Drop orphaned embedding rows whose chunk_id no longer exists in

EXECUTE 1 tools

Execute start_shadow_index Backfill embeddings for a secondary (shadow) model over every

WRITE 5 tools

Write compile_brief Compile a brief from caller-supplied source documents and write it to the briefs sink. Write record_observation Record a new memory observation under the labeled MemorySink for a vault. Write supersede Mark an existing memory document as superseded by a replacement document. Write switch_active_model Atomically promote a registered model to active. Fails with Write write_note Atomically create or overwrite a note. Requires write_enabled=true. Use expected_hash for safe overwrites (rea

READ 13 tools

Read audit_log Query the write audit trail for a vault. Filterable by note path, operation type, or time. Default limit 50. Read find_broken_links List all wikilinks in a vault that point to non-existent notes. Read get_brief Look up a brief by target slug. D-13 decision tree: staleness dominates; age is Read index_runs List recent index runs for a vault — what was scanned, when, how long, errors. Read list_forward_links List all wikilinks FROM a given note. Optionally include broken links. Read list_vaults List configured vaults with their status (note count, last indexed run). Read query_frontmatter Filter notes by their YAML frontmatter. Supports equality, $in, $exists, $contains predicates. Multiple keys a Read read_note Read the full content + frontmatter of a note by its vault-relative path. Read recall Retrieve memory documents from one or more labeled MemorySinks, filtered by Read search_sections Section-level retrieval. Composes the v1 hybrid (semantic + BM25 + RRF) pipeline with Read search_semantic Semantic search via embedding cosine similarity. Searches all vaults by default. Read search_text Full-text BM25 search via SQLite FTS5. Best for exact-word and phrase matches. Read suggest_frontmatter Suggest frontmatter fields for a note based on folder-conventions, wikilink-neighborhood, and title/body conte

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Vault Memory

Can an AI agent delete data through the Vault Memory MCP server? +

Yes. The Vault Memory server exposes 2 destructive tools including delete_note, vacuum_embeddings. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Vault Memory? +

The Vault Memory server has 5 write tools including compile_brief, record_observation, supersede. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Vault Memory.

How many tools does the Vault Memory MCP server expose? +

21 tools across 4 categories: Destructive, Execute, Read, Write. 13 are read-only. 8 can modify, create, or delete data.

How do I enforce a policy on Vault Memory? +

Register the Vault Memory MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Vault Memory tool call.

Deterministic rules across all 21 Vault Memory tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON VAULT MEMORY →

Instant setup, no code required.

21 Vault Memory tools catalogued and risk-classified — across an index of 43,000+ MCP servers.