Claude-mem adds consent before setup uploads coding prompts Claude-mem adds consent before setup uploads coding prompts

The issue concerned browser onboarding

An October 29 report described the interactive installer on computers where the new setup had not been completed. Opening its first browser screen collected recent user prompts from Claude Code, Codex, Gemini CLI, Antigravity CLI and OpenCode. It sent prompt text, session identifiers, project names, folder paths and timestamps to cmem.ai. The reporter said this happened across supported tools regardless of the tools selected earlier in installation. A checkbox about anonymized setup results did not control that transfer. The maintainers subsequently acknowledged the automatic upload in the release notes. Claude-mem is a third-party memory project; this change is not an update to Anthropic’s Claude Code.

Consent now controls the upload

Setup scans local history, then awaits consent. Its consent panel lists tools and prompt counts, and sends only the selected tools’ prompts. Declining or clearing every selection sends none. The optional analytics choice starts unchecked and remains separate from upload approval. The new consent endpoint accepts requests only from loopback with an origin check. Repeated start requests join the pending scan or upload, preventing duplicate transfers.

The review corrected misleading completion screens

The merged pull request also changed how the interface represents uncertain or empty results. An unsuccessful consent response cannot establish whether the server already received an upload, because the worker waits for that upload before replying. The revised error message tells users the transfer may have happened and directs them to reload for status. While a decision is being sent, both buttons are disabled. The worker records which tools were actually uploaded, so an empty generated result no longer implies that nothing was sent. Closing the tab while consent is pending no longer keeps local work paused; reopening it restores the question. On November 2, maintainer thedotmack reported a real-browser test against a substitute server that logged requests. It recorded zero requests before consent, zero after declining and one upload containing only the selected tool after approval. Those are the maintainer’s test results.

The local viewer is a separate path

The tagged My Work guide describes a viewer backed by the saved local memory database. Displaying recorded requests and results requires no cloud account, new model call or internet connection. Its local review notes live in a separate database and are excluded from cloud sync. Opening the viewer and changing pages can send two anonymous telemetry events carrying page names; the guide provides a separate telemetry-disable command. Optional cloud sync can transmit saved prompt text and observation narratives. The setup decision therefore sits alongside other independently configured sharing features, rather than acting as a universal network switch for the application.