mimvo

Integration

Scan Chroma for memory poisoning, prompt injection and leaked secrets

Chroma is a common default for agent memory and RAG prototypes: the agent embeds what it learns and writes it to a local collection, then retrieves it as context later. Mimvo opens the same persist directory, reads every record and its stored vector, and reports the records to review, quarantine or delete.

Install#

Mimvo is an open-source Python package for Python 3.11+, published on PyPI. The chroma extra adds the Chroma client and nothing else.

bash
pip install "mimvo[chroma]"

Scan Chroma from the command line#

One command reads every record, runs the secrets, injection and poisoning checks, and writes a self-contained HTML report you can forward.

bash
mimvo scan chroma \  --path ./chroma_db \  --collection agent_memory \  --report report.html
mimvo scan chroma options
OptionWhat it does
--pathPath to the Chroma database directory.
--collectionCollection name.
  • Point --path at the directory your app passes to Chroma's PersistentClient, and --collection at the collection the agent writes to.
  • Stored embeddings are read along with the text, so the vector detectors (near-duplicate clusters, hub records) run without extra setup.
  • Mimvo only calls get(). It never adds, updates, upserts or deletes, so it is safe to run next to a live app.

Scan from Python#

The same scan from your own code, for a scheduled job or a notebook.

python
from pathlib import Pathfrom mimvo import Mimvofrom mimvo.scan import ChromaScanSource, render_htmlsource = ChromaScanSource(path="./chroma_db", collection="agent_memory")report = Mimvo().scan(source)report.source = "chroma:agent_memory"Path("report.html").write_text(render_html(report), encoding="utf-8")

What Mimvo finds in Chroma#

Thirteen finding codes across three checks. Each finding comes with a severity, a recommended action, the evidence (secrets masked), fix steps, and an OWASP and CWE mapping. Details are in the finding code reference.

Mimvo finding codes
FindingCodeSeverityAction
Leaked secretsecret_detectedCriticaldelete
Personal datapii_detectedMediumreview
Hidden instructionpersistent_instructionHighreview
Canary instruction droppedknown_answerMediumreview
Injection embeddingembedding_injectionMediumreview
Poisoned factmemory_poisoningHighquarantine
Destination redirectdestination_redirectHighreview
Adversarial textadversarial_textMediumreview
Tampered vectorembedding_mismatchMediumquarantine
Contradicts older memorytemporal_contradictionMediumreview
Answer flipretrieval_flipMediumreview
Poisoning clusterpoisoning_clusterLowreview
Retrieval hubhub_recordLowreview

Gate CI on the results#

Fail the job on high-severity findings, send results to GitHub code scanning as SARIF, and put a summary on the run page. See Use in CI for a full GitHub Actions workflow.

bash
mimvo scan chroma \  --path ./chroma_db \  --collection agent_memory \  --fail-on high \  --sarif mimvo.sarif \  --markdown "$GITHUB_STEP_SUMMARY"

Is it safe to run against production Chroma?#

Reads records with get(). Never calls add, update, upsert, or delete.

The default detectors run on your machine with no API key and no model download, so memory text does not leave it. Secret values are masked in every report. Hosted detectors are opt-in.

Try it without connecting anything

Open the live dashboard to browse a sample scan, or read the guide to AI agent memory poisoning.
Read the docsView on GitHub

Other integrations#