fleet-memory/hindsight-integrations/agno
Derek Bouius ee4510a762
fix(deps): address critical and high severity security vulnerabilities (#827)
* fix(deps): address critical and high severity security vulnerabilities

Bump vulnerable dependencies to patched versions across the monorepo:

Python (critical/high):
- fastmcp >=2.14.0 → >=3.2.0 (SSRF, path traversal, OAuth confused deputy, command injection)
- langchain-core >=1.2.11 → >=1.2.22 (path traversal in legacy load_prompt)

Python (low):
- cryptography >=46.0.5 → >=46.0.6 (incomplete DNS name constraint enforcement)
- pygments: add >=2.20.0 pin (ReDoS via GUID regex)

Node.js:
- serialize-javascript ^7.0.3 → ^7.0.5 (CPU exhaustion DoS)
- handlebars: add >=4.7.9 override (JS injection via AST type confusion)
- path-to-regexp: add >=0.1.13 override (ReDoS via route params)
- brace-expansion: add version range override (process hang/memory exhaustion)

Also adds type: ignore comments for FastMCP 2.x private attribute access that
ty now flags since FastMCP 3.x removed _tool_manager (guarded by try/except
and hasattr at runtime).

Regenerated all lock files across API, integrations, and tests.

* fix(deps): add ajv v8 scoped overrides for schema-utils and ajv-keywords

The global ajv ^6.14.0 override caused schema-utils and ajv-keywords to
receive ajv v6, but they require ajv v8 (for dist/compile/codegen). Add
scoped overrides to ensure these packages get ajv v8 while the global
override remains for packages that need v6.

* fix(tests): remove stateless_http from FastMCP() constructor calls

FastMCP 3.x no longer accepts stateless_http in the constructor. The
tests call tools directly without HTTP transport, so the parameter is
not needed.

* fix: update MCP tests for FastMCP 3.x _tool_manager removal

FastMCP 3.x removed _tool_manager. Tests now use
_local_provider._components for sync tool dict access and
mcp.list_tools() for async filtered tool listing.

* fix: resolve docusaurus build failures (ajv overrides + missing blog date)

- Remove global ajv ^6.14.0 override and scoped ajv-keywords/schema-utils
  overrides that caused webpack compilation errors manifesting as
  "Cannot read properties of undefined (reading 'date')" during SSR
  and "these parameters are deprecated" warnings. Natural version
  resolution (v6.12.6+ for v6 consumers, v8+ for v8 consumers) already
  satisfies the security fix (>= 6.12.3).
- Add missing date frontmatter to learning-capabilities blog post.

* chore: regenerate openapi spec and docs skill
2026-04-01 09:20:34 +02:00
..
hindsight_agno feat: add Agno integration with Hindsight memory toolkit (#596) 2026-03-18 11:17:23 +01:00
tests feat: add Agno integration with Hindsight memory toolkit (#596) 2026-03-18 11:17:23 +01:00
pyproject.toml fix: add readme field to integration pyproject.toml files for PyPI (#634) 2026-03-20 17:11:20 +01:00
README.md feat: add Agno integration with Hindsight memory toolkit (#596) 2026-03-18 11:17:23 +01:00
uv.lock fix(deps): address critical and high severity security vulnerabilities (#827) 2026-04-01 09:20:34 +02:00

hindsight-agno

Persistent memory tools for Agno agents via Hindsight. Give your agents long-term memory with retain, recall, and reflect — using Agno's native Toolkit pattern.

Features

  • Native Toolkit - Extends Agno's Toolkit base class, just like Mem0Tools
  • Memory Instructions - Pre-recall memories for injection into Agent(instructions=[...])
  • Three Memory Tools - Retain (store), Recall (search), Reflect (synthesize) — include any combination
  • Flexible Bank Resolution - Static bank ID, RunContext.user_id, or custom resolver
  • Simple Configuration - Configure once globally, or pass a client directly

Installation

pip install hindsight-agno

Quick Start

from agno.agent import Agent
from agno.models.openai import OpenAIChat
from hindsight_agno import HindsightTools

agent = Agent(
    model=OpenAIChat(id="gpt-4o-mini"),
    tools=[HindsightTools(
        bank_id="user-123",
        hindsight_api_url="http://localhost:8888",
    )],
)

agent.print_response("Remember that I prefer dark mode")
agent.print_response("What are my preferences?")

The agent now has three tools it can call:

  • retain_memory — Store information to long-term memory
  • recall_memory — Search long-term memory for relevant facts
  • reflect_on_memory — Synthesize a reasoned answer from memories

With Memory Instructions

Pre-recall relevant memories and inject them into the system prompt:

from hindsight_agno import HindsightTools, memory_instructions

agent = Agent(
    model=OpenAIChat(id="gpt-4o-mini"),
    tools=[HindsightTools(
        bank_id="user-123",
        hindsight_api_url="http://localhost:8888",
    )],
    instructions=[memory_instructions(
        bank_id="user-123",
        hindsight_api_url="http://localhost:8888",
    )],
)

Selecting Tools

Include only the tools you need:

tools = [HindsightTools(
    bank_id="user-123",
    hindsight_api_url="http://localhost:8888",
    enable_retain=True,
    enable_recall=True,
    enable_reflect=False,  # Omit reflect
)]

Bank Resolution

The bank ID is resolved in order:

  1. bank_resolver — Custom callable (RunContext) -> str
  2. bank_id — Static bank ID passed to constructor
  3. run_context.user_id — Automatic per-user banks
# Per-user banks from RunContext
agent = Agent(
    model=OpenAIChat(id="gpt-4o-mini"),
    tools=[HindsightTools(hindsight_api_url="http://localhost:8888")],
    user_id="user-123",  # Used as bank_id
)

# Custom resolver
def resolve_bank(ctx):
    return f"team-{ctx.user_id}"

agent = Agent(
    model=OpenAIChat(id="gpt-4o-mini"),
    tools=[HindsightTools(
        bank_resolver=resolve_bank,
        hindsight_api_url="http://localhost:8888",
    )],
)

Global Configuration

Instead of passing connection details to every toolkit, configure once:

from hindsight_agno import configure, HindsightTools

configure(
    hindsight_api_url="http://localhost:8888",
    api_key="your-api-key",       # Or set HINDSIGHT_API_KEY env var
    budget="mid",                  # Recall budget: low/mid/high
    max_tokens=4096,               # Max tokens for recall results
    tags=["env:prod"],             # Tags for stored memories
    recall_tags=["scope:global"],  # Tags to filter recall
    recall_tags_match="any",       # Tag match mode: any/all/any_strict/all_strict
)

# Now create toolkit without passing connection details
tools = [HindsightTools(bank_id="user-123")]

Configuration Reference

HindsightTools()

Parameter Default Description
bank_id None Static Hindsight memory bank ID
bank_resolver None Callable (RunContext) -> str for dynamic bank ID
client None Pre-configured Hindsight client
hindsight_api_url None API URL (used if no client provided)
api_key None API key (used if no client provided)
budget "mid" Recall/reflect budget level (low/mid/high)
max_tokens 4096 Maximum tokens for recall results
tags None Tags applied when storing memories
recall_tags None Tags to filter when searching
recall_tags_match "any" Tag matching mode
enable_retain True Include the retain (store) tool
enable_recall True Include the recall (search) tool
enable_reflect True Include the reflect (synthesize) tool

memory_instructions()

Parameter Default Description
bank_id required Hindsight memory bank ID
client None Pre-configured Hindsight client
hindsight_api_url None API URL (used if no client provided)
api_key None API key (used if no client provided)
query "relevant context about the user" Recall query for memory injection
budget "low" Recall budget level
max_results 5 Maximum memories to inject
max_tokens 4096 Maximum tokens for recall results
prefix "Relevant memories:\n" Text prepended before memory list
tags None Tags to filter recall results
tags_match "any" Tag matching mode

configure()

Parameter Default Description
hindsight_api_url Production API Hindsight API URL
api_key HINDSIGHT_API_KEY env API key for authentication
budget "mid" Default recall budget level
max_tokens 4096 Default max tokens for recall
tags None Default tags for retain operations
recall_tags None Default tags to filter recall
recall_tags_match "any" Default tag matching mode
verbose False Enable verbose logging

Requirements

  • Python >= 3.10
  • agno
  • hindsight-client >= 0.4.0
  • A running Hindsight API server

License

MIT