Public versus account-owned surfaces
Discovery data is deliberately public and contains no secrets. Everything that touches stored memory sits behind an authenticated, owner-scoped boundary.
- Public and read-only: service discovery, the MCP tool catalog, supported client list.
- Account-owned: memory content, agent attribution, deletion and export.
- Never public: tokens, token hashes, or any credential material.
Inspect the public discovery document
The discovery response is safe to fetch without any credential, which is what makes it usable for client setup.
curl https://xmemo.dev/.well-known/memory-os.jsonRetrieval responses are not cached
Search and recall responses carry no-store headers, and audit logs record only whether a query or path was present rather than its content.
Cache-Control: no-store, private
Pragma: no-cacheMemory Console controls
XMemo is not only an MCP endpoint. The Memory Console is the user-facing place to review, correct, remove, and export memory while keeping agent attribution visible.
- View and search memory — Open the console to see saved memories, inspect paths and memory types, and confirm whether a recall should have returned a specific item.
- Edit or correct entries — Correct stale facts, move items to clearer paths, or replace outdated notes so future assistants recall the latest user-approved context.
- Delete and export — Use account workflows to remove memories you no longer want and to locate export paths for account-scoped memory review.
Source: Memory Console controls