feat(cipher): Cipher Memory MCP bridge + Claude config unification

[POWERFULMOVES]

Summary

• Cipher MCP Bridge (pmoves-cipher-mcp/): Python MCP server (stdio transport) bridging Claude Code CLI to Cipher Memory via HTTP. 4 tools: store, search, store_reasoning, reasoning_patterns.
• Docker service (cipher-api): Added to pmoves/docker-compose.yml on port 8096 (agents profile), sharing existing Neo4j + NATS. Hardened with *tier-agent-hardened anchor.
• Claude Code config (.claude/mcp.json): Registers the MCP server for automatic tool availability.
• Skill definition (.claude/skills/pmoves-cipher-memory/): SKILL.md with usage patterns, categories, memory hints + skill.json manifest.
• Hooks wiring (.claude/settings.json): Registered existing damage-control PreToolUse hooks (Bash/Edit/Write) that were on disk but unregistered.
• Context docs: Updated services-catalog.md, submodules.md, and CLAUDE.md with Cipher Memory entries.

Architecture

Claude Code CLI ──stdio──► cipher_mcp (Python MCP) ──HTTP──► cipher-api (Node.js/Neo4j)
                                   │
                             NATS announce
                             health loop

Files Changed (20 files, +1458 lines)

Action	Path
Create	pmoves-cipher-mcp/ (11 files: server, tools, client, health, announcer, common, registry, main, pyproject, README)
Create	.claude/mcp.json
Create	.claude/skills/pmoves-cipher-memory/SKILL.md
Create	.claude/skills/pmoves-cipher-memory/skill.json
Modify	.claude/settings.json — hooks wiring
Modify	pmoves/docker-compose.yml — cipher-api service
Modify	.gitignore — cipher MCP entries
Modify	.claude/CLAUDE.md, .claude/context/services-catalog.md, .claude/context/submodules.md

Test plan

• git submodule status Pmoves-cipher — shows 51eea54 (main)
• Python imports: from cipher_mcp.server import app — OK
• docker compose --profile agents config --services | grep cipher — shows cipher-api
• All JSON validated: mcp.json, skill.json, settings.json
• Full smoke test after cipher-api container build (requires Neo4j + NATS running)
• Verify MCP tools appear in Claude Code CLI tool list

🤖 Generated with Claude Code

In general, the problem is that data derived from a secrets source (cgp["points"]) is being logged directly. To fix this without changing core functionality, we should avoid printing sensitive or potentially sensitive identifiers and instead log only non-sensitive, aggregate information (e.g., counts) or use redacted placeholders. The goal is to preserve some feedback to the operator that the script is doing work, while ensuring that no secret-related identifiers from secrets are written to output.

The best minimal change here is to remove or neutralize the per-secret log lines on 31 and 39 so they do not interpolate label. We can replace them with generic messages that do not include label, such as "Updated 1 secret entry" or similar, or even omit those logs entirely and rely on the existing final summary line 45, which already logs only the count of credentials: len(secrets) (a non-sensitive integer). Given the desire to keep progress indications, a safe compromise is to print generic messages without referencing label. Concretely:

• In pmoves/scripts/update_env_from_cgp.py, change line 31 from print(f"Updated: {label}") to print("Updated one credential entry") (or just remove it).
• Similarly change line 39 from print(f"Updated (empty): {label}") to print("Updated one previously empty credential entry").
  No new imports or methods are required; we simply adjust the string literals passed to print to avoid using tainted data.

Generally, to fix clear-text logging of sensitive information, remove sensitive values (and often identifiers closely tied to them) from logs, or replace them with non-sensitive, non-identifying summaries (counts, generic messages, or redacted forms). Any code path that takes data from a secrets structure and passes it into a logging or printing function should be treated as suspect.

In this script, the label is derived from a secrets file and used in two log messages: print(f"Updated: {label}") and print(f"Updated (empty): {label}"). To preserve existing functionality while improving security, we can change these prints to avoid including the label. Since the primary function of the log is to show progress, we can instead print a generic message like "Updated a secret from CGP" and "Updated an empty secret from CGP", or similar wording, without interpolating label. This requires only small modifications to the two print statements within the loop (lines 31 and 39) in pmoves/scripts/update_env_from_cgp.py; no new imports or helper methods are needed.

Concretely:

• In the first update branch (lines 28–32), replace print(f"Updated: {label}") with a non-identifying message, e.g. print("Updated a secret from CGP").
• In the second branch for empty values (lines 36–40), replace print(f"Updated (empty): {label}") with something like print("Updated an empty secret from CGP").

No other changes are necessary to maintain behavior: the environment file content is unchanged; only log verbosity/contents are reduced.

---

In general, to fix uncontrolled data in path expressions, either (1) constrain user input to a safe subset (e.g., a whitelist of allowed characters or patterns), or (2) build the path under a fixed root and verify the normalized result stays within that root. Here the user-controlled value is not intended to be an arbitrary filesystem path; it is a Hugging Face model ID. The most compatible fix is to sanitize and validate hf_id before using it as a directory name, ensuring we only use safe characters and a reasonable maximum length, while still allowing all typical HF model IDs.

Concretely, we can introduce a small helper function, e.g. def _safe_model_cache_key(model_id: str) -> str, that:

• Replaces / with -- (as currently).
• Replaces or removes any characters outside a safe allow‑list (letters, digits, -, _, ., :).
• Optionally truncates the resulting name to a reasonable length to avoid filesystem issues.
  Then we use this sanitized key when constructing cache_dir, i.e. safe_key = _safe_model_cache_key(hf_id) and cache_dir = Path(HF_HUB_CACHE) / "models" / safe_key. This preserves existing behavior for normal IDs while ensuring that even malicious values cannot inject problematic path characters.

All changes occur in pmoves/services/hf-mcp-server/main.py. We only need to add the helper function (no new imports beyond the standard library that is already in use) and adjust the cache_dir assignment to use it.

In general, the fix is to sanitize or validate any user-controlled value before using it to construct filesystem paths. For this case, we only need the cache subdirectory derived from model_id to be a safe name under HF_HUB_CACHE / "models". We can achieve this by (1) mapping the model ID to a directory-friendly name (already partially done with .replace("/", "--")), and (2) ensuring that the resulting name is free of problematic characters and does not become an absolute path or contain path separators. One robust approach is to reduce the name to a limited character set (for example, alphanumerics, dash, underscore, and dot), substituting anything else with a safe character like _. This preserves functionality (different model_ids will still map to deterministic directory names) while eliminating potential path traversal or weird-platform edge cases.

The single best fix here without changing existing behavior much is to introduce a small helper to "sanitize" the model-id-derived directory name, and then use that sanitized name instead of raw model_id.replace("/", "--") in hf_model_convert_gguf. Since we can only edit the shown file, we’ll:

• Add an import re at the top (using only standard library).
• Define a helper function, e.g. _safe_model_cache_dir_name(model_id: str) -> str, that:
  • Replaces / with -- (keeping existing behavior).
  • Uses a regex to replace any character not in [A-Za-z0-9._-] with _.
  • Optionally strips leading dots to avoid hidden or special names like ...
  • Ensures we never accidentally introduce path separators.
• Change the construction of cache_dir in hf_model_convert_gguf (line 611) to use this helper instead of inlining model_id.replace("/", "--").

All changes will be within pmoves/services/hf-mcp-server/main.py. No other files are modified.

[github-actions]

Docker Hardening Validation

Hardening Validation Report

Validated: Mon 16 Feb 2026 12:21:05 AM UTC

Services Checked

PMOVES.AI Docker Hardening Validation

[INFO] Checking: pmoves/docker-compose.hardened.yml

[INFO] Validating: hi-rag-gateway-v2
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: extract-worker
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: langextract
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: presign
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: render-webhook
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: retrieval-eval
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: pdf-ingest
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: jellyfin-bridge
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: invidious-companion-proxy
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: ffmpeg-whisper
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: media-video
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: media-audio
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: hi-rag-gateway-v2-gpu
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: hi-rag-gateway-gpu
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: deepresearch
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: supaserch
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: publisher-discord
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: mesh-agent
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: nats-echo-req
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: nats-echo-res
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: publisher
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: analysis-echo
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: graph-linker
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: comfy-watcher
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: grayjay-plugin-host
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: agent-zero
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: archon
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: channel-monitor
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: pmoves-yt
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: notebook-sync
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: supabase_service_role_key
[WARN] No user directive
[WARN] No read_only directive
[WARN] No cap_drop: ["ALL"]
[WARN] No no-new-privileges
[WARN] No resource limits

[INFO] Validating: supabase_jwt_secret
[WARN] No user directive
[WARN] No read_only directive
[WARN] No cap_drop: ["ALL"]
[WARN] No no-new-privileges
[WARN] No resource limits

======================================
Summary: 120 passed, 40 warnings, 0 errors