Repository navigation
bm_write similar-notes advice includes executable bm_edit/bm_delete calls #2011
Description
Problem
When bm_write creates a note and the similarity probe finds close matches, the response adds a "Similar existing notes" section. Its "same topic" row spells out ready-to-run mutation calls:
| The same topic | `bm_edit(identifier='<closest>', command='append', content='...', project='...')`, then `bm_delete(identifier='<new note>', project='...')` |
The user only authorized creating the note. A tool result that contains executable-looking bm_edit and bm_delete calls reads like an instruction, and an agent may act on it: append to an unrelated note and delete the note it was just asked to write. The similarity signal is also loose (a near-duplicate and a merely related note score in the same band), so the suggested target is sometimes wrong.
Reported by a customer who saw this across several independent sessions (a dated agent run log, a security-warning record). Their agents did not act on it, but they flagged the agent-safety risk.
Where
src/basic_memory/mcp/similar_notes.pyformat_similar_notes_sectionsrc/basic_memory/mcp/tools/write.py_format_text(same_topiclambda)
Proposed change
Keep the similar-notes list. Make the advice informational only:
- Drop the literal
bm_edit/bm_deletecalls from the response. - Word it as a note to the user, for example: "If this duplicates an existing note, ask the user whether to merge it." No call should suggest deleting the note that was just written.
- Check the other callers of
format_similar_notes_sectionfor the same pattern. - Add a test that the
bm_writeresponse contains nobm_delete(orbm_edit(text.
Activity
claude commentedon Nov 2, 2026
Claude finished @phernandez's task in 15s —— View job
Triage
Type: Enhancement (agent-safety hardening of tool output)
Component: MCP tools (
bm_write), no cloud-specific behaviorPriority: Medium. It is a prompt-injection-style risk where tool output reads as an instruction. No exploit has been observed, and the customer's agents did not act on it.
Complexity: Simple
Findings
bm_edit(...)andbm_delete(...)calls are built insrc/basic_memory/mcp/tools/write.py:446-451, in thesame_topicrow passed toformat_similar_notes_section(src/basic_memory/mcp/similar_notes.py:210).write.py:259. It builds abm_edit(identifier=..., command='append', ...)string, which looks like a "Try instead" hint. The issue didn't mention it, so it should be checked as part of the "other callers" item. Thebm-write(3).mdman page (line 78) shows the same hint and should stay in sync with any change.format_similar_notes_sectionhas only one caller, inwrite.py.Suggested scope
write.py:259and the man page example. Decide whether that "Try instead" hint is acceptable because it responds to a failed call the user explicitly requested, or whether it needs the same treatment.bm_writeresponse with similar notes contains nobm_delete(orbm_edit(text.Per the triage-only scope, I have not made any code changes.