mimvo

Integration

Scan Postgres and pgvector for memory poisoning, prompt injection and leaked secrets

Many teams keep agent memory in the Postgres they already run, with the pgvector extension for similarity search. Mimvo reads the memory table with SELECT queries only, checks every row's text and, if you name it, its embedding, and reports the rows to review, quarantine or delete.

Install#

Mimvo is an open-source Python package for Python 3.11+, published on PyPI. The pgvector extra adds the Postgres and pgvector client and nothing else.

bash
pip install "mimvo[pgvector]"

Scan Postgres and pgvector from the command line#

One command reads every record, runs the secrets, injection and poisoning checks, and writes a self-contained HTML report you can forward.

bash
mimvo scan pgvector \  --dsn postgresql://localhost/app \  --table memories \  --text-column content \  --embedding-column embedding \  --report report.html
mimvo scan pgvector options
OptionWhat it does
--dsnPostgres connection string. Use a SELECT-only role.
--tableTable name (schema.table allowed).
--text-columnColumn that holds the memory text.
--id-columnColumn that holds the record id. Default id.
--embedding-columnpgvector column, so the vector detectors can run.
--created-at-columnTimestamp column, for TemporalNLIDetector ordering.
  • Connect with a role limited to SELECT on the memory table. Mimvo runs SELECT queries only.
  • Pass --embedding-column so the vector detectors (TrustRAG near-duplicate clusters, hub records) can run.
  • Pass --created-at-column to order records in time, so newer memories that contradict older ones can be flagged.
  • --table accepts schema.table, and --id-column defaults to id.

Scan from Python#

The same scan from your own code, for a scheduled job or a notebook.

python
from pathlib import Pathfrom mimvo import Mimvofrom mimvo.scan import PgVectorScanSource, render_htmlsource = PgVectorScanSource(    dsn="postgresql://localhost/app",    table="memories",    text_column="content",    embedding_column="embedding",)report = Mimvo().scan(source)report.source = "pgvector:memories"Path("report.html").write_text(render_html(report), encoding="utf-8")

What Mimvo finds in Postgres and pgvector#

Thirteen finding codes across three checks. Each finding comes with a severity, a recommended action, the evidence (secrets masked), fix steps, and an OWASP and CWE mapping. Details are in the finding code reference.

Mimvo finding codes
FindingCodeSeverityAction
Leaked secretsecret_detectedCriticaldelete
Personal datapii_detectedMediumreview
Hidden instructionpersistent_instructionHighreview
Canary instruction droppedknown_answerMediumreview
Injection embeddingembedding_injectionMediumreview
Poisoned factmemory_poisoningHighquarantine
Destination redirectdestination_redirectHighreview
Adversarial textadversarial_textMediumreview
Tampered vectorembedding_mismatchMediumquarantine
Contradicts older memorytemporal_contradictionMediumreview
Answer flipretrieval_flipMediumreview
Poisoning clusterpoisoning_clusterLowreview
Retrieval hubhub_recordLowreview

Gate CI on the results#

Fail the job on high-severity findings, send results to GitHub code scanning as SARIF, and put a summary on the run page. See Use in CI for a full GitHub Actions workflow.

bash
mimvo scan pgvector \  --dsn postgresql://localhost/app \  --table memories \  --text-column content \  --embedding-column embedding \  --fail-on high \  --sarif mimvo.sarif \  --markdown "$GITHUB_STEP_SUMMARY"

Is it safe to run against production Postgres and pgvector?#

Runs SELECT queries only. Connect with a role limited to SELECT.

The default detectors run on your machine with no API key and no model download, so memory text does not leave it. Secret values are masked in every report. Hosted detectors are opt-in.

Try it without connecting anything

Open the live dashboard to browse a sample scan, or read the guide to AI agent memory poisoning.
Read the docsView on GitHub

Other integrations#