Security

Neutron AI should be integrated as a server-side capability. Keep tokens, provider credentials, authorization decisions, and customer identity inside your platform boundary.

Integration Checklist

• Store Neutron tokens only in server-side environment variables or a managed secrets system.
• Never expose Neutron tokens in browser code, mobile apps, public repositories, logs, or analytics.
• Use workspace API keys for setup and Nucleus access tokens for runtime memory calls where possible.
• Validate the current user before choosing nucleusId and scopeId.
• Send only the minimum memory content needed for future tasks.
• Avoid storing credentials, payment details, raw access tokens, or unnecessary personal data.
• Use forget when users delete, revoke, or correct memory.
• Log request IDs, status, duration, and safe scope labels. Do not log raw memory text by default.

Tenant and Scope Safety

Your app should treat Nucleus and scope IDs as authorization-sensitive. Do not accept arbitrary scope IDs from the browser without checking that the current user or agent may access them. tenantId remains a legacy alias for nucleusId.

const allowed_scope_ids = await getAllowedMemoryScopes(current_user);

const context_pack = await client.agentContext({
  scopeIds: allowed_scope_ids,
  agentId: "agent_support",
  task: "Prepare a customer support answer"
});

MCP Safety

For MCP hosts, issue tokens with the narrowest useful access. Limit allowed tools when a host only needs context retrieval.

const allowed_tools = ["memory_agent_context", "memory_recall"];

Use write-capable MCP tools only when the host is trusted to store or delete memory.

User Controls

Expose clear controls for:

• viewing saved memory
• correcting memory
• deleting memory
• disabling memory for a workflow
• exporting or auditing memory where your product requires it