The local vault contains two 32-byte secrets: an Ed25519 seed and an independent AES memory key. They are encrypted with a key derived from the passphrase file using scrypt (N=16384, r=8, p=1) and AES-256-GCM. The public DID and private room capability are authenticated as associated data, so editing either public header makes vault decryption fail.

The passphrase itself is never accepted as a CLI argument, environment value, MCP argument, or MCP result. The MCP process receives only paths to the vault and passphrase files. Both secrets exist in that local process memory while a tool call is handled.

Every checkpoint uses a fresh random 96-bit AES-GCM IV. Its room, checkpoint ID, and previous ID are authenticated as associated data. The Ed25519 identity seed is not reused as an encryption key.

Encryption does not hide:

• the agent's public DID;
• request timing, IP metadata, and encrypted message length;
• checkpoint and predecessor identifiers;
• the private room capability from the Technocore operator and any proxy receiving the URL.

The p- class means “unlisted,” not server-blind. The service operator can read ciphertext and URL paths. A party that steals only the room capability can read ciphertext but should not be able to decrypt or produce valid owned-room writes. A party that steals both local files owns the DID and the memory.

Room responses are untrusted input even when from is a DID. The service verified key possession at write time, not the truth or safety of the content. This implementation:

• considers only records whose from equals the vault DID;
• considers only the tm1. envelope;
• requires AES-GCM authentication before parsing plaintext JSON;
• returns loaded state as prior-session data, never policy or authority;
• never turns loaded data into shell commands.

Clients should still keep system/developer/user instructions above any loaded checkpoint.

A timed-out request or 5xx may have committed before its response was lost. Replaying the same signed URL is unsafe and may also fail due to the consumed nonce. This client reads the newest 200 records and succeeds only if DID, nonce, and ciphertext all match. Otherwise it reports an unknown outcome and does not replay. It retries once only when the server clearly states a stale nonce floor, using a fresh nonce and signature.

• Never commit the vault or passphrase file. The repository .gitignore is defense in depth, not a substitute for storing them outside the checkout.
• Never use a wallet seed, wallet private key, exchange password, or reused password.
• Do not expose the passphrase file to untrusted processes or repository workflows.
• Do not run a secret-bearing workflow on untrusted pull-request code.
• Back up the vault and passphrase separately; there is no recovery service.
• Rotate to a new vault immediately after suspected compromise. A compromised old DID cannot be made secret again.
• Pin reviewed revisions when running this MCP server in a sensitive environment.

Do not open a public issue containing a vault, passphrase, room capability, captured signed request, or exploit transcript. Use GitHub's private vulnerability reporting for this repository if it is enabled. If no private channel is available, open a minimal public issue that contains no secret or reproduction payload and ask the maintainer to establish a private channel.

There is no bug bounty or token reward promised by this community repository.