Skip to main content

​
Auto-Redaction

claude-mem can automatically detect and redact common secrets before observations and summaries are stored. Unlike the manual <private> tag, this is a deterministic regex pipeline that catches secrets you never typed yourself — for example, an API key printed by a curl response or echoed by a Bash command.

​
How it works

When enabled, redaction runs at the same single point where <private> tags are stripped, so it covers the capture paths at once: tool inputs and outputs, your prompts (including stored prompt history) and the assistant’s last message used for summaries. The server runtime also redacts every text value of an event body before it stores the event, and the worker and hook logs redact the tool line they write (for example a Bash command). One exception: server-runtime session and event metadata (such as the opening prompt in session metadata) is tag-stripped only when a string contains a tag, so redaction does not run on it. Content is scanned for a curated set of high-confidence secret patterns, and matches are replaced inline with a self-closing <redacted type='...'/> placeholder, preserving the surrounding context so search and observation quality stay intact.
When a payload contains a marker, the observer prompt tells the model to treat it as a placeholder and not to infer the literal value. Prompts without markers are unchanged, so redaction adds no tokens when it finds nothing.

​
Enable it

Add to ~/.claude-mem/settings.json:
That is all you need for the 11 built-in patterns to kick in. Add "CLAUDE_MEM_REDACT_GENERIC_ENABLED": "true" to also turn on the 3 generic patterns.

​
Built-in patterns

​
Generic patterns

Credentials without a vendor prefix (a database password, an internal token) need a lower-confidence match on the key name. These three patterns are off until you opt in:
They run after every vendor pattern, so a vendor-shaped value (a sk-… key, a JWT, …) keeps its specific marker. To keep false positives away they only fire when the value is 8+ characters, contains at least one letter, and consists solely of secret-typical characters — so max_tokens=4096, short PINs, purely numeric values and the PWD / OLDPWD working-directory variables are left alone. In server-runtime event bodies, a string value under a credential-named key (client_secret, db_password, token, …) is redacted whole. Like every built-in, each can be disabled by name.

​
Disable a single built-in

CSV format. The other built-ins stay active.

​
Add a custom pattern

name is required and surfaces in the <redacted type='...'/> marker. Custom patterns are evaluated before built-ins, so you can override the built-in detection for a specific token family. If your regex fails to compile or your JSON is malformed, claude-mem logs a warning and skips the broken entry — the rest keep working.

​
Diagnostic logging

Writes a pattern,count line per invocation to the worker log. The original matched bytes are never logged.

​
Limits

  • Fails closed on huge fields: a single field over about 1M characters (UTF-16 code units) is replaced whole by <redacted type='oversize'/> rather than stored unscanned, and a warning is logged. There is no cap on the number of matches: every match is redacted.
  • aws_secret_key shape: the lookbehind only anchors KEY=val (shell) and KEY: val (yaml) styles. JSON-style "AWS_SECRET_ACCESS_KEY": "value" is not matched because the lookbehind expects = or : directly after the key name. If you commonly handle JSON config, write a custom pattern for it. (The generic built-ins do anchor JSON-style keys, but only the password/*_TOKEN/*_SECRET/*_API_KEY families.)
  • Coverage gap: Built-ins do not cover Azure / GCP service-account JSON / IBM Cloud / private IDC tokens — use custom patterns for those.
  • Unreadable settings.json: if the file stops parsing (for example after a bad hand edit) while redaction is on, claude-mem keeps redacting, with the last configuration that loaded or the built-in patterns, and logs a warning. It does not fall back to the default (off). Repair the file to change the configuration, or set CLAUDE_MEM_REDACT_ENABLED=false in the environment to turn redaction off.
  • Server-beta scope: in multi-tenant server-beta deployments, the redaction config is currently read from the worker’s local ~/.claude-mem/settings.json rather than from tenant-scoped settings. For team deployments, configure redaction at the worker level. A future change will source tenant-scoped redaction config.
  • Destructive: this is destructive replacement, not encryption. Redacted bytes cannot be recovered. If you need reversible protection, use the <private> tag and keep the secrets out of the conversation entirely.

​
Comparison with <private> tags

Both can be used together — <private> blocks are removed first, then auto-redaction scans what remains, so a wrapped <private> block has its content removed entirely regardless of what’s inside.