Memory connectors

Memory connectors attach Shield360 to external agent memory providers. Use them to browse stored facts, search semantically, add or edit memories, copy between backends, and ask Otter questions grounded in connector data.

Add memory connectors from Settings → Integrations → Connectors (/connectors) under the Memory category, or directly from the Memory page (/memory) when no connector exists yet. Connectors are scoped to the current project and environment.

Mental model

flowchart LR
  subgraph proj [Project + environment]
    MC[Memory connector]
  end
  MC --> API[Vendor memory API]
  MC --> MemPage[Memory page]
  MC --> Otter[Otter chat tools]
  MemPage --> Browse[List / graph / detail]
  Otter --> Tools[list / search / add / update / delete]

Atomic connectors — one Mem0 project endpoint, one Zep tenant, one Claude memory store configuration, or one LangGraph server per connector instance.
Capability-driven UI — each vendor advertises supported operations (list, search, add, update, delete, feedback). Shield360 hides actions the vendor does not support.
Filters — user, session/run, and agent filters are declared per vendor. Some connectors require a session or user before listing memories.
Port links — copying a memory to another connector stores provenance metadata so you can trace copies back to the source.

Supported memory connectors

Connector	Default endpoint	What it’s for
Claude	`https://api.anthropic.com`	Browse and edit memories in Anthropic Claude memory stores (Managed Agents memory beta)
Mem0	`https://api.mem0.ai`	Store and search long-term agent memories scoped by user, run, or agent
Zep	`https://api.getzep.com`	Session memory and knowledge-graph facts for agents
memmesh	`https://app.memmesh.ai`	Browse, search and curate one project’s memories on hosted memmesh
LangGraph	None — enter your server URL	Long-term memories in the Store of a LangGraph Platform deployment or self-hosted LangGraph server

Self-hosted Mem0 or Zep deployments work when you point the connector at a compatible API URL and supply the same authentication style as the hosted service.

Capability matrix

Connector	List	Search	Get	Add	Update	Delete	Feedback	Required filters
Claude	Yes	Yes*	Yes	Yes	Yes	Yes	No	Memory store (session)
Mem0	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Optional user / run / agent
Zep	Yes	Yes	Yes	Yes	No	Yes†	No	User; session required for writes
memmesh	Yes	Yes	Yes	Yes	Yes	Yes	Yes‡	None
LangGraph	Yes	Yes§	Yes	Yes	Yes	Yes	No	Namespace (session) for writes, or the template’s placeholders

* Claude has no dedicated search API — Shield360 filters listed memories locally for search queries.

† Zep delete targets graph edges/nodes, not an entire session.

‡ memmesh has positive and negative ratings; “very negative” is sent as negative, and a rating cannot be cleared.

§ LangGraph search is semantic only when the server has a store index configured. Without one, LangGraph ignores the query and returns items in listing order with no relevance score; Shield360 does not emulate semantic search.

memmesh specifics

Project ID and key are required. The project ID is the 21-character ID from the project’s settings in memmesh; the connector refuses to save without it or without an API key.
Changes are limited to the connector’s project. Before editing, deleting or rating a memory, Shield360 reads it through memmesh’s project-scoped API and refuses (as not found) if it belongs to another project, or to the whole platform rather than this project. This covers the Memory page, /api/memory, and Otter’s update_memory and delete_memory tools.
Status. Lists and searches show current, confirmed memories by default. Pick Pending review, Superseded or Rejected from the Status filter to see the others.
Paging. The Memory page loads 100 memories at a time; use Next page and Previous page to walk the rest.
Session filter. memmesh cannot list by session, so Shield360 reads the project page by page and keeps the matching memories. It stops after a fixed number of pages and marks the result as possibly partial; Next page continues from where it stopped.
Search by person or chatbot. memmesh search cannot narrow by person or chatbot, so Shield360 searches and then keeps the matching hits, fetching more until the limit is filled. The reported score is memmesh’s ranking score.
Filter dropdowns are filled from memmesh’s subject insights and a sample of recent memories, plus ids you have used before.

Add a memory connector

Select project and environment

Use the header selectors for the target project and environment.

Open Connectors

Go to Settings → Integrations → Connectors, open the Memory section in the catalog, and choose Add connector.

Pick a vendor

Select Claude, LangGraph, Mem0, Zep, or memmesh.

Configure endpoint and credentials

Set the API URL (defaults work for hosted services), optional SSRF toggles for private networks, and the API key. Mem0 also accepts optional organization and project IDs; memmesh requires its project ID. LangGraph has no default URL, an optional API key, and an optional namespace template (see LangGraph namespaces).

Test and save

Run a health check, then save. Open Memory (/memory) and select the connector from the dropdown.

Fields on every memory connector

Field	What to enter
Name	A name you will recognise. Names must be unique within an environment.
Environment	The environment this connector serves.
Endpoint URL	Prefilled with the vendor’s hosted API. Change it only for a self-hosted or regional deployment.
Allow plain HTTP (self-hosted)	On by default. Turn it off to require `https://`.
Allow private or localhost endpoints	Off by default. Turn it on only for a self-hosted service on `localhost` or a private network.
API key	The vendor credential. It is stored encrypted on the connector. When you edit the connector, leave it blank to keep the stored key.
Deliver to coding agents at session start	Off by default. When on, enrolled machines receive a short, scanned block of this connector’s memory when a Claude Code, Codex or Cursor session starts.
Whose memory	Shown when delivery is on. Shared memories for everyone is the only option that delivers today.

Test connection works after the connector is saved. A working connection shows “Data source is reachable.”

Set up Claude memory

Use a Claude connector to browse, search and edit memories in Anthropic memory stores, the memory used by Claude Managed Agents. Shield360 calls the memory store API with the agent-memory-2026-07-22 beta header.

What you’ll need

An Anthropic API key in the workspace that owns the memory stores.
At least one memory store in that workspace.
Outbound HTTPS from the Shield360 server to api.anthropic.com.

Create an API key

In the Claude Console, open the workspace that holds your memory stores and create an API key. Anthropic API keys are not scoped to single APIs, so create a dedicated key for Shield360 so you can rotate or revoke it on its own. See Claude memory stores.

Add the connector

Select the project and environment in the header, go to Settings → Integrations → Connectors, open the Memory section, choose Add connector, and pick Claude.

Fill in the fields

Endpoint URL: leave https://api.anthropic.com.
API key: the key from step 1. Shield360 sends it as x-api-key.
Deliver to coding agents at session start: optional. Claude memory stores are not divided by person, so only Shared memories for everyone is offered, and every enrolled machine in the environment receives the store. Point it only at a store meant for everyone.

Save and test

Save, then click Test connection. Shield360 lists memory stores (GET /v1/memory_stores?limit=1).

Pick a store

Open Memory (/memory), select the connector, and pick a Memory store. If the workspace has exactly one store, Shield360 uses it automatically.

Message	What to do
`Data source responded 401: …`	The API key is missing, wrong or revoked. Edit the connector and save the key again.
`Data source responded 403: …` or `404: …`	The key’s workspace has no access to the memory store API or to that store. Use a key from the workspace that owns the stores.
`A user, agent, or session is required to list memories.`	The workspace has several stores. Pick a Memory store on the Memory page.
`This memory connector must store its API key on the connector. …`	Edit the connector, enter the API key, and save.

Set up Mem0

Use a Mem0 connector to store and search long-term memories on the Mem0 Platform or a self-hosted Mem0 that serves the same REST API. Memories are scoped by user, run or agent.

What you’ll need

A Mem0 Platform API key, or the URL and key of a self-hosted Mem0 API.
Optional: the Mem0 organization ID and project ID to use.
Outbound HTTPS from the Shield360 server to api.mem0.ai or your endpoint.

Create an API key

In the Mem0 Platform dashboard, create an API key for the project Shield360 should read and write. See the Mem0 API reference. Use a dedicated key so you can revoke it on its own.

Add the connector

Select the project and environment in the header, go to Settings → Integrations → Connectors, open the Memory section, choose Add connector, and pick Mem0.

Fill in the fields

Endpoint URL: leave https://api.mem0.ai, or enter your self-hosted Mem0 URL.
API key: the key from step 1. Shield360 sends it as Authorization: Token <key>.
Mem0 organization ID and Mem0 project ID (optional): when set, Shield360 sends them as org_id and project_id on reads and writes, so the connector stays in that project.
Deliver to coding agents at session start and Whose memory: optional; see the fields table above.

Save and test

Save, then click Test connection. Shield360 calls GET /v1/entities/.

Browse memories

Open Memory (/memory) and select the connector. Filter by User, Run or Agent.

Message	What to do
`Data source responded 401: …`	The API key is missing or wrong. Edit the connector and save the key again.
`Data source responded 404: …`	The endpoint does not serve Mem0’s `/v1/` REST API. Check the Endpoint URL.
`Host "<host>" is not allowed. …`	Self-hosted Mem0 on a private address: turn on Allow private or localhost endpoints.
`This memory connector must store its API key on the connector. …`	Edit the connector, enter the API key, and save.

Set up memmesh

Use a memmesh connector to browse, search, curate and rate one project’s memories on hosted memmesh (app.memmesh.ai or another deployment of the same memmesh server). It does not work with a self-hosted serve-mcp binary.

What you’ll need

The memmesh project ID: 21 letters and digits, shown in the project’s settings.
A project API key with memory:read, plus memory:write to add, edit, delete or rate.
Outbound HTTPS from the Shield360 server to app.memmesh.ai.

Create a project API key

In memmesh, open the project and create a project API key. Give it memory:read. Add memory:write only if people will add, edit, delete or rate memories from Shield360. A read-only key is enough to browse, search and deliver memory.

Copy the project ID

Copy the 21-character project ID from the project’s settings.

Add the connector

Select the project and environment in the header, go to Settings → Integrations → Connectors, open the Memory section, choose Add connector, and pick memmesh.

Fill in the fields

Endpoint URL: leave https://app.memmesh.ai unless you use another deployment of the memmesh server.
API key: the key from step 1. Shield360 sends it as a Bearer token. Required: the connector will not save without it.
memmesh project ID: the ID from step 2. Required.
Deliver to coding agents at session start, Whose memory and Brain (optional): optional. Brain (optional) limits delivery to one brain’s memories; it is also a 21-character ID.

Save and test

Save, then click Test connection. Shield360 calls GET /api/v1/projects/{projectId}/admin/memory/stats, which checks the key, the project and read permission in one call.

Message	What to do
`Set the memmesh project ID on this connector.`	Fill in memmesh project ID.
`The memmesh project ID is the 21-character ID of letters and digits …`	Copy the ID again from the project’s settings in memmesh.
`API key required. Edit this connector and save its API key.`	Enter the API key and save.
`The brain ID is the 21-character ID of letters and digits …`	Fix or clear Brain (optional).
`Data source responded 401: …` or `403: …`	The key is wrong, revoked, from another project, or lacks `memory:read`. If only writes fail, the key lacks `memory:write`.

Set up Zep

Use a Zep connector to store and search session memory and knowledge-graph facts in Zep Cloud, or in a self-hosted endpoint that serves the same v2 API.

What you’ll need

A Zep Cloud project API key, or the URL and key of a compatible endpoint.
The Zep user IDs you want to browse. The Memory page requires a user.
Outbound HTTPS from the Shield360 server to api.getzep.com or your endpoint.

Create an API key

In the Zep dashboard, create an API key for the project Shield360 should use. Zep keys belong to one project, so create a dedicated key for Shield360. See the Zep documentation.

Add the connector

Select the project and environment in the header, go to Settings → Integrations → Connectors, open the Memory section, choose Add connector, and pick Zep.

Fill in the fields

Endpoint URL: leave https://api.getzep.com, or enter your compatible endpoint.
API key: the key from step 1. Shield360 sends it as Authorization: Api-Key <key>.
Deliver to coding agents at session start and Whose memory: optional; see the fields table above.

Save and test

Save, then click Test connection. Shield360 lists users (GET /api/v2/users-ordered, falling back to /api/v2/users).

Browse memories

Open Memory (/memory), select the connector, and pick a User. Adding memories also needs a Session.

Message	What to do
`Data source responded 401: …`	The API key is missing or wrong. Edit the connector and save the key again.
`Data source responded 404: …`	The endpoint does not serve Zep’s `/api/v2` API. Check the Endpoint URL.
`A user, agent, or session is required to list memories.`	Pick a User on the Memory page.
`A session id is required for this memory connector.`	Pick or enter a Session before adding a memory.

Set up LangGraph

Use a LangGraph connector to browse, search and edit long-term memories in the Store of a LangGraph Platform (LangSmith) deployment or a self-hosted LangGraph server. Both serve the same /store/* routes; only authentication differs.

What you’ll need

The URL of a LangGraph Platform deployment, or of a self-hosted LangGraph server such as http://localhost:2024.
LangGraph Platform: a LangSmith API key. A self-hosted server without authentication needs none.
Optional: a namespace template such as memories/{user_id}.
Network access from the Shield360 server to the LangGraph server.

Create an API key (LangGraph Platform only)

In LangSmith, create an API key for the workspace that owns the deployment. Use a dedicated key so you can revoke it on its own. See the LangGraph Agent Server documentation. Skip this step for a self-hosted server without authentication.

Add the connector

Select the project and environment in the header, go to Settings → Integrations → Connectors, open the Memory section, choose Add connector, and pick LangGraph.

Fill in the fields

Endpoint URL: the server URL. There is no default, and the connector will not save without one.
Allow private or localhost endpoints: turn it on for a self-hosted server on localhost or a private network.
API key: optional. Shield360 sends it as x-api-key. Bearer tokens and custom auth handlers are not supported.
Namespace template: optional; see LangGraph namespaces. An invalid template is refused when you save.
Deliver to coding agents at session start: optional. LangGraph has no built-in notion of a person, so only Shared memories for everyone is offered. Without a template every enrolled machine in the environment receives memories from the whole Store under the connector’s scope; with a {user_id} template, items tied to a user are left out.

Save and test

Save, then click Test connection. Shield360 lists one namespace (POST /store/namespaces), because /ok and /info do not check credentials.

Browse memories

Open Memory (/memory) and select the connector. Without a template, pick a Namespace or thread to narrow the list; adding a memory needs one.

LangGraph namespaces

LangGraph Store items live in a namespace (an ordered list of labels) under a key. LangGraph gives namespace labels no meaning of their own, so Shield360 only maps them to user, session, and agent filters when you declare it with a namespace template:

Namespace template	Behavior
(empty)	Each discovered namespace is a Namespace or thread (session) filter, for example `memories.u1`. Writes go to the selected namespace.
`memories`	Same, limited to namespaces under `memories`.
`memories/{user_id}`	The second label is the user.
`memories/{user_id}/{thread_id}/{assistant_id}`	Labels map to user, session (thread), and agent filters. Writes need a value for every placeholder.

Fixed template segments must match exactly; placeholders are {user_id}, {thread_id}, and {assistant_id}. Labels cannot be empty or contain .. Items deeper than the template still match; items that do not fit it are hidden, and reading, editing or deleting one by its ID is refused as not found.

Memory content is read from the LangMem shapes {"kind": ..., "content": {"content": "..."}} and {"content": "..."}, falling back to the JSON of the whole value, including arrays and primitives. The original value is always shown in metadata under langgraph. New memories are written as {"content": "..."}. Updates change only the field the content was read from and keep every other field. Shield360 refuses to edit a value that is not an object, or a non-text content or metadata field, because that would overwrite data. Because LangGraph has no compare-and-swap, an update can overwrite a concurrent change made between Shield360’s read and write.

Message	What to do
`LangGraph rejected the credentials. …`	The API key is missing, wrong or revoked, or the server does not accept `x-api-key`. Save the key again, or clear it for a server without authentication.
`The LangGraph Store API was not found at this URL. …`	The URL is not a LangGraph server, or its store routes are disabled. Check the Endpoint URL.
`The namespace template is invalid. …`	Fix the Namespace template.
`This connector's namespace template needs … to write a memory.`	Pick a value for every placeholder the template names before adding a memory.

Memory page features

Once a connector is configured, the Memory page provides:

Feature	Description
Connector selector	Switch between memory connectors in the current environment
Filters	User, session/run, and agent filters when the vendor supports them
Memory list	Paginated list with search
Detail sheet	Full memory content, metadata, history, and feedback (when supported)
Graph view	Relationship visualization for graph-capable vendors (for example Zep)
Write actions	Add, update, or delete memories when the connector advertises those capabilities
Copy	Copy selected memories to another write-capable connector in the same environment
Ask Otter	Natural-language search and Q&A grounded in connector list/search APIs

Otter memory tools

When Otter runs on the Memory page or in chat with memory context, it can call connector-backed tools:

Tool	When available
`list_memories`	Connector supports `list`
`search_memories`	Connector supports `search`
`add_memory`	Connector supports `add`
`update_memory`	Connector supports `update`
`delete_memory`	Connector supports `delete`

Otter passes required filter arguments (user, session, agent) when the vendor mandates them. Enterprise builds apply the same RBAC and audit hooks as the /api/memory routes.

Authentication

Connector	Auth style	Notes
Claude	API key (`x-api-key`)	Sends the `agent-memory-2026-07-22` beta header for memory store APIs
Mem0	Token (`Authorization: Token <apiKey>`)	Works with Mem0 Platform or self-hosted compatible endpoints
Zep	API key (`Authorization: Api-Key <apiKey>`)	Works with Zep Cloud or self-hosted compatible endpoints
memmesh	Bearer (`Authorization: Bearer <apiKey>`)	Hosted memmesh project API key with memory read and write permission
LangGraph	None, or API key (`x-api-key`)	Leave the key empty for self-hosted servers without auth; use a LangSmith API key for LangGraph Platform. Bearer tokens and custom auth handlers are not supported

API keys are stored encrypted on the connector (enc:v1:…) and decrypted only server-side for outbound requests.

Copy between connectors

Use Copy on the Memory page to duplicate memories into another write-capable connector in the same project and environment. Shield360:

Reads the source memory from the origin connector
Writes to the destination connector when add is supported
Stores metadata.shield360.port on the destination memory and links the destination connector back to the source for traceability

Copy requires connectors:update (or equivalent memory mutation permission in enterprise).

Security and reliability

Endpoints validated (http/https only); credentials in URLs rejected; private/metadata SSRF targets blocked where applicable.
Secrets encrypted on the connector instance, redacted from errors, never logged.
Outbound calls use the shared safe-fetch layer with the same SSRF controls as data-source connectors.
Content limits: memory body up to 20,000 characters; metadata JSON up to 4,000 characters.

Vendor documentation

Claude memory

Anthropic Managed Agents memory stores.

Mem0 API

Mem0 Platform REST API reference.

Zep SDK

Zep Cloud API and graph memory.

LangGraph Agent Server

LangGraph server and Store API.

Connectors overview

Shared connector registry and project scope.

Data-source connectors

Tempo, Loki, Prometheus, Jaeger, and ClickHouse.

Scanner connectors

Trustabl scans of GitHub repositories.

Otter (AI Copilot)

Chat with Otter across Shield360 surfaces.

Environments

Partition memory connectors by environment.

Memory connectors

Mental model

Supported memory connectors

Capability matrix

memmesh specifics

Add a memory connector

Fields on every memory connector

Set up Claude memory

Set up Mem0

Set up memmesh

Set up Zep

Set up LangGraph

LangGraph namespaces

Memory page features

Otter memory tools

Authentication

Copy between connectors

Security and reliability

Vendor documentation

Related