mimvo

Integration

Scan Qdrant for memory poisoning, prompt injection and leaked secrets

Qdrant often holds an agent's long-term memory in production: points carry the embedding and a payload with the remembered text. Mimvo scrolls through the collection, checks every payload and vector, and reports which points to review, quarantine or delete. It never writes to the collection.

Install#

Mimvo is an open-source Python package for Python 3.11+, published on PyPI. The qdrant extra adds the Qdrant client and nothing else.

bash
pip install "mimvo[qdrant]"

Scan Qdrant from the command line#

One command reads every record, runs the secrets, injection and poisoning checks, and writes a self-contained HTML report you can forward.

bash
mimvo scan qdrant \  --url http://localhost:6333 \  --collection agent_memory \  --report report.html
mimvo scan qdrant options
OptionWhat it does
--urlQdrant HTTP URL.
--collectionCollection name.
--api-keyAPI key. Defaults to QDRANT_API_KEY; use a read-only key.
--text-fieldPayload field that holds the text.
  • Use a read-only API key. --api-key defaults to the QDRANT_API_KEY environment variable.
  • By default Mimvo looks for the text in common payload keys such as content, text, page_content, document and memory. Set --text-field if your app uses another key.
  • On a large collection, start with --sample 10000 for a quick look, then run the full scan in CI.

Scan from Python#

The same scan from your own code, for a scheduled job or a notebook.

python
from pathlib import Pathfrom mimvo import Mimvofrom mimvo.scan import QdrantScanSource, render_htmlsource = QdrantScanSource(url="http://localhost:6333", collection="agent_memory")report = Mimvo().scan(source.records(sample=10_000))report.source = "qdrant:agent_memory"Path("report.html").write_text(render_html(report), encoding="utf-8")

What Mimvo finds in Qdrant#

Thirteen finding codes across three checks. Each finding comes with a severity, a recommended action, the evidence (secrets masked), fix steps, and an OWASP and CWE mapping. Details are in the finding code reference.

Mimvo finding codes
FindingCodeSeverityAction
Leaked secretsecret_detectedCriticaldelete
Personal datapii_detectedMediumreview
Hidden instructionpersistent_instructionHighreview
Canary instruction droppedknown_answerMediumreview
Injection embeddingembedding_injectionMediumreview
Poisoned factmemory_poisoningHighquarantine
Destination redirectdestination_redirectHighreview
Adversarial textadversarial_textMediumreview
Tampered vectorembedding_mismatchMediumquarantine
Contradicts older memorytemporal_contradictionMediumreview
Answer flipretrieval_flipMediumreview
Poisoning clusterpoisoning_clusterLowreview
Retrieval hubhub_recordLowreview

Gate CI on the results#

Fail the job on high-severity findings, send results to GitHub code scanning as SARIF, and put a summary on the run page. See Use in CI for a full GitHub Actions workflow.

bash
mimvo scan qdrant \  --url http://localhost:6333 \  --collection agent_memory \  --fail-on high \  --sarif mimvo.sarif \  --markdown "$GITHUB_STEP_SUMMARY"

Is it safe to run against production Qdrant?#

Reads points with scroll. Never upserts or deletes points.

The default detectors run on your machine with no API key and no model download, so memory text does not leave it. Secret values are masked in every report. Hosted detectors are opt-in.

Try it without connecting anything

Open the live dashboard to browse a sample scan, or read the guide to AI agent memory poisoning.
Read the docsView on GitHub

Other integrations#