Memory and skills

Turning it on

Memory & skills is off for every workspace until an owner or admin turns it on under Memory in the dashboard. Automatic capture is a second switch, also off, and needs a model key first. Nothing about tools changes: an agent that never uses memory sees the same endpoint it did before, plus three read tools.

Paths

Context is a set of small text files. Personal paths belong to the person behind the credential: the OAuth user, or the person who created the API key.

Tools

Reading needs call:tools. Writing needs write:memory, a separate permission on the key (OAuth scope spyn3:memory:write), so a key can read team context without being able to change it.

Any MCP client can use these. Every write is recorded in the workspace audit log with the path and the key or agent that made it, never the text.

Claude Code and Codex

The spyn3-memory plugin uses the lifecycle hooks both clients offer, so memory works without the agent having to remember to call a tool:

export SPYN3_API_KEY=spyn3_live_...   # call:tools + write:memory
curl -fsSL -H "Authorization: Bearer $SPYN3_API_KEY" \
  https://api.spyn3.com/agent/plugin/install.sh | sh

export SPYN3_MEMORY_OFF=1             # optional: off for one session

The plugin is available to SPYN3 users only: the installer is served to a valid key, downloads the plugin with it, saves the key for the hooks in ~/.spyn3/config.json (readable only by you) and registers it with Claude Code and/or Codex. In Codex, enable it in /plugins and trust its hooks in /hooks. The plugin is a handful of Node scripts with no dependencies; read them in ~/.spyn3/plugins/ before you trust the hooks.

Capture and your model key

Extraction needs a model, and SPYN3 does not supply one. Add your own under Memory: any OpenAI-compatible provider (base URL, chat model, optional embedding model, key). The key is tested with a real call before it is saved, stored encrypted, and never shown again.

With capture on, the plugin uploads the text of user and assistant messages. Tool calls and their output are left out, and system reminders and common secret formats (provider keys, tokens, JWTs, private keys, passwords in connection strings) are removed on your machine and again on ours. When a session ends, your model extracts preferences, facts, decisions and procedures and merges them into spyn3://me/memories/. The raw turns are then deleted.

Search

By default, search is Postgres full-text search over the path and text of each file; no model is involved and nothing leaves the EU database. With an embedding model on your key, a semantic leg is added and the two result lists are fused. Vectors are only compared within your current model; changing the model clears them.

Isolation and safety

Personal memory is filtered by person in every query and again by row-level security in the database, so another member of the same workspace cannot read it. Raw turns and model keys cannot be read by any client role at all. Recalled memory reaches the agent inside a block labelled as recorded data, not instructions: memory one agent writes is context another agent reads, and that label is the defence against it being treated as a command. Your account export includes your memories, skills and notes.

Limits

5,000 files per workspace and 64 KB per file. Context tool calls and per-prompt recall count as tool calls on your plan; session start, uploads and commits do not.