Privacy Controls & Tag Stripping
Relevant source files
The following files were used as context for generating this wiki page:
Claude-mem implements a robust privacy framework designed to prevent sensitive or redundant data from being persisted in its long-term memory. This is achieved through a Dual-Tag System that allows both users and the system to mark specific content for exclusion. The privacy layer operates at the edge, processing data in the lifecycle hooks before it ever reaches the worker service or the SQLite database.
Sources: CLAUDE.md:38-41, README.md:120-125
The Dual-Tag System
The core of the privacy architecture relies on two distinct XML-style tags that control meta-observation storage.
System-Level Controls
The <claude-mem-context> tag is used for system-level meta-observation control. It identifies auto-injected observations from previous sessions. Stripping these tags prevents recursive storage, ensuring that the memory system does not inadvertently "remember" its own previous injections as new data.
User-Level Controls
The <private> tag provides manual privacy control for the end user. Users can wrap sensitive information—such as credentials, proprietary logic, or personal data—within these tags to explicitly exclude that content from being stored in the database.
Sources: CLAUDE.md:39-41, src/utils/tag-stripping.ts:3-13
Edge Processing Architecture
Privacy filtering follows an Edge Processing Pattern. Tag stripping occurs at the hook layer (the point of data capture) rather than within the central worker service. This design keeps the worker service simple and enforces a one-way data stream where only "clean" data is transmitted for processing and storage.
The diagram shows how privacy checks are performed early in the lifecycle to protect the persistence layer from sensitive data.
Sources: CLAUDE.md:42-43, src/utils/tag-stripping.ts:13-15, cursor-hooks/REVIEW.md:57-60
Implementation Logic
The implementation relies on regex-based stripping supported by security checks to prevent exploitation.
Security: ReDoS Protection
To protect against Regular Expression Denial of Service (ReDoS) attacks—where malicious nested or unclosed tags could cause catastrophic backtracking—the system implements a MAX_TAG_COUNT limit. If the total number of opening tags exceeds 100, the system logs a warning while continuing to process.
Processing Functions
The utility provides two primary entry points for cleaning content:
| Function | Targeted Content |
|---|---|
stripMemoryTagsFromJson | Stringified JSON from tool inputs/responses. |
stripMemoryTagsFromPrompt | Raw user text provided in the prompt. |
Sources: src/utils/tag-stripping.ts:20-65
Core Stripping Regex
The internal stripping logic uses the following patterns:
- System Tags:
/<claude-mem-context>[\s\S]*?<\/claude-mem-context>/g - Private Tags:
/<private>[\s\S]*?<\/private>/g
Sources: src/utils/tag-stripping.ts:40-48
Session and Settings Integration
Privacy is also managed through session initialization and global settings.
Session Initialization
During session startup (e.g., in session-init.sh), the system performs a privacy check. If a session is identified as "privacy-skipped," the hook will exit silently without calling the /api/sessions/init endpoint, effectively disabling memory for that specific interaction.
Global Settings
The SettingsRoutes.ts allows for the configuration of observation filtering. While not strictly stripping, these settings allow users to define which types of observations or concepts are allowed into the injected context, providing a broader level of control over data visibility.
Sources: cursor-hooks/REVIEW.md:76-85, src/services/worker/http/routes/SettingsRoutes.ts:95-115
Summary
Privacy Controls and Tag Stripping represent the primary defensive layer of the Claude-mem project. By utilizing a dual-tag system processed at the hook level, the project ensures that sensitive user data and redundant system context are excluded from the permanent record. This architecture prioritizes security through ReDoS protection and efficiency by filtering data before it reaches the core AI processing services.