vision-memory-mcp handles local workspace visual state caching, perceptual hashing, and LanceDB database storage. We take security seriously.

If you discover a security vulnerability in vision-memory-mcp (e.g., path traversal, unsafe local file reading, or database file permissions exposure), please report it responsibly:

1. Do NOT open a public GitHub issue.
2. Send an email to security@putervision.com or report via GitHub Security Advisory.
3. Include detailed steps to reproduce, impact analysis, and proof-of-concept if available.

• We will acknowledge receipt of your vulnerability report within 48 hours.
• We will coordinate a security patch release before public disclosure.

vision-memory-mcp captures and caches visual state screenshots locally in .vision-memory-mcp/. Users and organization administrators are solely responsible for ensuring that captured screenshots do not contain confidential information, credentials, API keys, passwords, Personally Identifiable Information (PII), or regulated data (such as HIPAA or PCI-DSS protected information). PuterVision LLC and the software authors assume no liability for sensitive data stored or exposed within local visual cache directories.

By default, visual cache data is stored unencrypted at the application layer on the local filesystem. For sensitive development environments, users are strongly advised to enable OS-level filesystem encryption (such as Linux fscrypt/LUKS, macOS APFS Encrypted Sparse Images, or Windows BitLocker) as documented in docs/STORAGE_ENCRYPTION.md.

If Optional L4 LLM Vision Fallback is enabled (VISION_MODEL_ENABLED=true), external API requests may be transmitted to third-party providers (e.g. OpenAI, Anthropic, OpenRouter). PuterVision LLC and the software authors are not responsible for any API usage fees, billing overages, rate limits, or financial liabilities resulting from execution or automated agent loops.