A validator for Claude's memory tool — built around a real CVE, not a hypothetical one

Anthropic's memory tool (memory_20250818) lets Claude keep files across conversations — six commands (view, create, str_replace, insert, delete, rename), all executed by your application, not Anthropic's. Claude only ever asks for the operation; your handler decides whether it's safe. That split is the whole point of the design, and it's also exactly where things go wrong.

Anthropic's own docs carry a blunt warning about it: a path like /memories/../../secrets.env has to be rejected, or it walks straight out of the sandbox. That's not a theoretical footnote. GitHub Security Advisory GHSA-5474-4w2j-mq4c (CVE-2026-34451, CVSS 6.3) documents this exact bug class shipping in @anthropic-ai/sdk 0.79.0–0.80.x: a path check that tested path.startsWith('/memories') with no boundary guard, so /memories-backup/secrets.env — a sibling directory that merely shares a string prefix with the real memory root — sailed straight through. Fixed in 0.81.0.

That's a specific, patchable mistake, but it's an easy one to reintroduce in any hand-rolled handler, because the vulnerable check and the correct one look almost identical at a glance. So the new tool at /tools/claude-memory-tool-validator/ runs every path you give it through both, side by side: a "naive" check that deliberately reproduces the CVE's own vulnerable logic, and a "hardened" check that decodes, normalizes ./.. segments, and verifies real containment. Paste /memories/../../etc/passwd or a URL-encoded traversal attempt and you'll see the naive check say PASS while the hardened one says FAIL — which is the entire bug, made visible instead of theoretical.

It also validates the structural shape of each of the six memory commands against Anthropic's documented schema (catching things like a rename targeting the memory root itself, which the tool description explicitly says Claude can't do), plus a second panel for the newer context_management config (the clear_tool_uses_20250919 / clear_thinking_20251015 strategies that trim old tool results or thinking blocks from long conversations) — including the easy-to-miss rule that when you combine both strategies, clear_thinking_20251015 has to come first in the array.

Everything runs client-side, as always here — no API key, no network calls, nothing you paste leaves your browser.