MemoryStore

Frontend

The client application is a React 19 single-page application built with Vite, wrapped inside Capacitor for native mobile deployment. It uses Tailwind CSS for styling with a typography-driven "editorial dark" design system utilizing the Fraunces serif and Inter sans-serif typefaces. Client-side data caching is implemented via IndexedDB, using time-to-live (TTL) based invalidation to enable instant page loads without server round-trips.

Landing Page & Video Performance Optimization

The public landing page (`memorystore.in`) implements specialized performance and media loading strategies to achieve high Core Web Vitals metrics (Largest Contentful Paint < 1.0s, Cumulative Layout Shift = 0):

• Instant 0ms Start-Frame Poster Rendering: Video containers parse Mux playback IDs on initial load and set dynamic background images (`https://image.mux.com/{PLAYBACK_ID}/thumbnail.jpg?time=0&width=640`). This delivers an instant 0ms visual start frame per video without loading heavy video stream chunks (~8 KB per poster vs ~800 KB per video stream).
• Viewport-Aware Lazy Video Stream Loading: Using an `IntersectionObserver` with a 300px root margin, video stream iframe players (`autoplay=muted`) are instantiated only when the user scrolls near the video section. When scrolled out of view, playback is paused via postMessage without unloading DOM state, reducing initial network payload by over 90% (15.5 MB down to ~1.1 MB) and eliminating main-thread JavaScript execution bottlenecks.
• Resource Hints: `` tags for `player.mux.com` and `image.mux.com` eliminate DNS resolution and TLS handshake latencies prior to video stream initiation.

Backend API

The backend runs on Cloudflare Workers, using the Hono web framework. It communicates with:

• Supabase for PostgreSQL database, authentication, and real-time subscriptions
• Cloudflare R2 for object storage (file uploads and thumbnails)
• Upstash Redis for rate limiting and caching
• Google Gemini for AI content processing, embeddings, and chat
• APNs and Firebase Cloud Messaging for push notifications

Cron-triggered background jobs handle push notification campaigns, rate-limit retry, and self-healing of stuck content items.

MCP Server

The repository contains Model Context Protocol server implementations for Cloudflare Workers, account linking,

retrieval, and tool calls. The newer implementation defines six tools—search, list recent, save URL, retrieve video

context, Thought Connect, and account status. Because two MCP code paths target the same worker name, the currently

deployed tool surface must be verified before it is described as live.

Save and Enrich

Users can save any URL, rich-text note, or plain text into their library. The platform auto-detects the source (YouTube, Instagram Reels, TikTok, Google Drive, or a general web page) and applies the appropriate processing pipeline. Saved content is enriched with:

• AI-generated summaries and key points
• Full transcripts (for video content from supported platforms)
• Auto-generated thumbnails
• Source metadata (platform, author, duration)

Semantic Search

Successfully prepared content can be converted into vector embeddings, enabling natural-language

retrieval across available library context. Users can ask questions such as "What was that video about fermentation I

saved last month?" Processing and match quality depend on source access and generated context.

Thought Connect

Thought Connect is a structured AI-assisted retrieval and reasoning workflow with modes such as connect, plan, decide,

zoom, brainstorm, learn, troubleshoot, create, reflect, and compare. It retrieves relevant saved memories for the

current thought or goal. Thought Connect is not the expansion of MCP; MCP means Model Context Protocol and is one

delivery path through which Thought Connect may be exposed.

Organization

• Groups: Saved items can be organized into named collections.
• Pinned items: Frequently accessed content can be pinned for quick access.
• Archive: Content can be archived rather than permanently deleted.
• Vaults (experimental/incomplete): Backend and direct-view work exists, but a general create-and-discover user

journey was not verified. Vaults should not be marketed as a currently available workspace product.

Public Sharing

Users can generate public, read-only links to share collections. The platform also supports an "AI Context" page format — a structured rendering of saved content designed to be consumed by external AI systems.

Third-party Integration

MemoryStore provides several integration pathways:

• Browser Extension: A companion extension, paired via QR code scan, enables saving content directly from the browser.
• MCP Server: A Model Context Protocol server allows ChatGPT and Claude to search and retrieve a user's MemoryStore library during AI conversations. Users authenticate by approving the link from the MemoryStore mobile app.
• Developer Share API (specification only): Repository documentation proposes a REST interface for external

services, but a current public implementation and user-facing key-management journey were not verified.

• iOS Shortcuts: A quick-save endpoint compatible with the Apple Shortcuts app.

Cross-Platform

MemoryStore is available on:

• iOS and Android as native apps, built with Capacitor.
• Web, as a progressive web application.

The native apps support offline saving and queuing, push notifications, camera access, and file system integration.

Features

• Quick Save: Save any URL instantly with a single click.
• Batch Save: Save up to 20 URLs at once.
• Save with Content Extraction: Extract and save page title, description, full text, screenshots, tags, and notes alongside the URL.
• URL Check (Deduplication): Instantly check if a URL is already saved in your library.
• Recent Saves: View recently saved items directly in the extension popup.
• Group Management: List existing groups and create new ones from the extension.
• Device Management: View all linked extensions and disconnect unused ones.
• Apple Shortcuts Integration: Save content via Apple Shortcuts for iOS automation.

Supported Browsers

The extension supports all major browser platforms:

• Google Chrome (chrome-extension://)
• Safari (safari-web-extension://)

QR Pairing Mechanism

The extension uses a secure QR-based pairing system to link with a user's MemoryStore account:

1. Initialization: The browser extension calls POST /extension/pair/start to receive a pairing ID, a 6-character alphanumeric code, a 32-byte random token, and a QR data URL.
2. Scanning: The user scans the displayed QR code using the MemoryStore mobile app's built-in scanner (or via the device's camera using Universal Links).
3. Authorization: The app calls POST /extension/pair/complete to authorize the pairing on the backend.
4. Polling: The extension polls GET /extension/pair/status until the status changes to authorized.
5. Authentication: Once authorized, the extension authenticates using custom headers X-Extension-User-Id and X-Extension-Pairing-Id, validated against the extension_pairings database table.

Security Details

• Pairing Codes: 6-character alphanumerics with ambiguous characters (0, O, 1, I) excluded to prevent human error.
• Pairing Tokens: 32-byte cryptographically random hex strings, stored as SHA-256 hashes on the server.
• Time-to-Live: Pairing sessions expire after 10 minutes if not completed.
• Replay Protection: A replay guard system prevents the same QR code from being processed multiple times. Handled pairings are stored with a 15-minute TTL and a maximum of 12 entries.
• Status Gates: The backend validates that the pairing status is either authorized or consumed and checks expiry before allowing API access.
• Path Restriction: Extension identity authentication is only allowed on paths starting with /api/extension.

Deep Link Integration

The extension pairing is deeply integrated into the native mobile apps:

• iOS: SceneDelegate.swift routes extension-pair and open-extension-scanner deep links directly to the ExtensionPairing page.
• Android: MainActivity.java captures deep links so the JavaScript layer can process them.
• Web: The QrConnect.jsx bridge page handles QR codes scanned via the device's built-in camera, redirecting to the pairing flow.

Authentication

• Session Token Model: Cryptographically random 64-hex-character tokens (256-bit) generated via Web Crypto API. Stored as SHA-256 hashes in the database. Valid for 1 year with auto-extension.
• JWT Fallback: Legacy Supabase JWT tokens verified with HS256 algorithm via the jose library. The system is fail-closed — if the JWT secret is not configured, the legacy path is completely disabled.
• Token Transport: Authorization: SessionToken <token> or Authorization: Bearer <token> header, or ms_session cookie (HttpOnly, Secure, SameSite=None).
• Last-Used Debounce: 60-second debounce to reduce database write pressure when tracking token usage.

CSRF and XSS Protection

• Origin Validation: All state-changing requests (POST, PUT, PATCH, DELETE) with an Origin header are validated against a strict allowlist. Blocked origins are logged with [security][origin] prefix.
• Input Sanitization: Regex-based middleware strips <script> tags, inline on* event handlers, javascript: URIs, data:text/html URIs, <iframe>, <object>, <embed>, and <link> tags from all JSON request bodies.
• Secure Headers: hono/secure-headers middleware applies HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and other security headers globally.
• HTML Entity Escaping: All user-facing text in the MCP widget is HTML-escaped before rendering.

Rate Limiting

MemoryStore implements four layers of rate limiting:

1. Global IP Rate Limiting: 300 requests/minute per IP via Upstash Redis. In-memory fail-closed (60 req/min) when Redis is unavailable.
2. Per-User Rate Limiting: The implementation contains request-rate buckets labelled Free, Basic, Pro, and

Ultimate. These code-level labels include legacy states; they are not the customer-facing daily quotas and do not

establish that Free or Ultimate is an active public offer. The current public plan model is Basic and Pro. Writes can

carry a higher internal cost weight than reads.

1. Auth Endpoint Rate Limiting: Cloudflare Cache API-based distributed rate limiting. OTP send: 3 per email per 5 min, 6 per IP per 5 min. OTP verify: 10 per email per 10 min, 30 per IP per 10 min (brute-force prevention).
2. MCP Tool Rate Limiting: Per-tool token-bucket rate limits — Thought Connect: 12/min, Video Context: 24/min, Search: 60/min, Save: 30/min. Anonymous requests receive 0.25x multiplier.

Input Validation

• Zod Schema Validation: All MCP server inputs are strictly typed with minimum/maximum bounds.
• URL Validation: URLs restricted to http: and https: protocols only, with a maximum length of 2048 characters.
• Email Normalization: Consistent trim().toLowerCase() applied.
• Password Validation: Minimum 6 characters.
• Database Constraints: Check constraints enforce valid status values and guard against invalid data states.

Encryption

• In Transit: All cookies use Secure; HttpOnly; SameSite=None.
• At Rest: Session tokens, ingest API keys, and pairing tokens are stored as SHA-256 hashes, not plaintext.
• End-to-End Encryption: Not established as a production capability. A subscription flag and unused crypto

helpers do not support a public end-to-end or zero-knowledge encryption claim.

• Gemini API Key Protection: User-provided API keys stored in a dedicated table, excluded from all API responses.

OAuth Flows

• Google OAuth 2.0: Standard authorization code flow with validated redirect hosts.
• ChatGPT MCP OAuth: Full OAuth 2.0 server with PKCE (Proof Key for Code Exchange). PKCE is mandatory (code_challenge_method: S256 required). Codes are single-use, stored in Durable Objects with automatic expiry.

Database Security

• Row-Level Security (RLS): Enabled on all sensitive tables (chat_messages, persistent_sessions, users view). Policies gate access to auth.uid() = user_id.
• SECURITY DEFINER Functions: All RPC functions use SECURITY DEFINER with SET search_path = public to prevent search path injection attacks.
• Service Role Isolation: Service role keys are strictly validated — anon and publishable keys are rejected with clear errors.

API Key Management

• Ingest API Keys: SHA-256 hashed, validated against database, support for revoked_at timestamp.
• Developer Share API Keys (specification only): Proposed formats and behaviors are documented, but a current

public key-management implementation was not verified.

• Idempotency: Full idempotency key implementation using api_idempotency_keys table. Header: X-Idempotency-Key (12-256 chars). Replay returns original response. Same key + different body = 409 Conflict. Auto-TTL: 24 hours.

Additional Security Measures

• Webhook Signature Verification: RevenueCat webhooks use constant-time comparison against expected auth keys.
• Worker Dispatch Guard: Prevents duplicate worker dispatches via database guardrails table + in-memory cooldown (90-second default).
• Sentry PII Protection: beforeSend hook strips authorization, cookie, and x-admin-key headers before sending errors to Sentry.
• Request Tracing: X-Request-ID header on all API responses for traceability.
• Structured Security Logging: [security] prefixed logs for rate limit blocks, auth failures, and origin blocks.
• robots.txt: Disallows all crawlers on the API server.
• Health Endpoint Protection: Protected by X-Health-Secret header or known monitoring user agents.

Vulnerability Fix History

The codebase documents extensive security evolution:

• JWT decode-only → signature verified: Switched from jose.decodeJwt (trust only) to jose.jwtVerify with HS256.
• ChatGPT link exchange replay protection: Single-use exchange via atomic database transition with row-count verification.
• OTP verify brute-force: Added per-email and per-IP rate limiting.
• URL scheme validation: MCP save parser restricts to http(s) only.
• CORS wildcard → allowlist: Both main API and MCP server use explicit origin allowlists instead of *.

MCP Tools

• memorystore_search_library: Search the user's library using natural language.
• memorystore_list_recent: List recently saved items.
• memorystore_save_url: Save a URL directly into the user's library.
• memorystore_retrieve_video_context: Retrieve full video transcripts and context.
• memorystore_thought_connect: Use the structured thinking assistant.
• memorystore_account_status: Check account subscription status and quotas.

Authentication Model

The MCP server uses a mobile-first account linking flow:

1. User initiates connection from ChatGPT/Claude.
2. MemoryStore MCP server generates a pairing token.
3. User opens MemoryStore mobile app and approves the link.
4. MCP server exchanges the pairing token for a persistent session.

This flow is designed for a predominantly mobile user base, eliminating the need for traditional desktop OAuth flows.

Technical Architecture

• Runtime: Cloudflare Workers
• Stateful Sessions: Cloudflare Durable Objects maintain SSE (Server-Sent Events) connections that survive request lifetimes.
• OAuth Server: Full implementation of OAuth 2.0 Authorization Code flow with mandatory PKCE.
• Rate Limiting: Per-tool token buckets with anonymous request throttling.
• Widget: Inline HTML widget rendered within ChatGPT's interface showing search results, connection status, and rendered cards.

Authentication

• Header: Authorization: Bearer ms_share_live_xxx
• Keys are user-generated with hash-only server-side storage.

Features

• Idempotency: Idempotency-Key header prevents duplicate saves.
• Scopes: share:write (default). Future: library:read, library:search, groups:read.
• Rate Limits: 60 requests/minute per key, 1000 requests/day per user.
• Error Handling: Structured error codes and responses.

Endpoint

POST https://mcp.memorystore.in/v1/share
Content-Type: application/json
Authorization: Bearer ms_share_live_xxx
Idempotency-Key: demo-001
{
  "url": "https://example.com/article"
}

Multimodal Video & Text Processing Pipeline

• Google Gemini Engine: MemoryStore uses Google Gemini infrastructure for applicable processing and chat.

Transcription, visual analysis, summaries, and tags depend on usable source text, a transcript, or a permitted media

file, as well as consent, plan limits, and processing success.

• Vector Embeddings & Semantic Search: Successfully prepared text and derived context can be converted into vector

embeddings for meaning-based retrieval. No blanket sub-second performance guarantee is made here.

Model Context Protocol (MCP) Service

MemoryStore operates a dedicated Model Context Protocol (MCP) server deployed on Cloudflare Workers utilizing Cloudflare Durable Objects to maintain stateful SSE streaming sessions:

• Cross-LLM Memory Retrieval: Enables leading AI assistants — including ChatGPT, Claude, and Google Gemini — to query a user's private MemoryStore library during conversational sessions.
• Tool Suite: The newer implementation defines six tools: `search_saves`, `list_recent_saves`, `save_url`,

`retrieve_video_context`, `thought_connect`, and `account_status`. Verify the deployed worker before claiming that exact

set is live.

• Secure Handshake: Users pair third-party AI clients using QR-code or app-approved OAuth handshakes without exposing raw credentials.

Thought Connect Engine

An active cognitive assistant embedded in the application offering ten interactive reasoning modes (Connect, Plan, Decide, Zoom, Brainstorm, Learn, Troubleshoot, Create, Reflect, Compare). Thought Connect dynamically injects user-saved memories into the LLM context window to ground AI outputs in authentic personal experience.

AI Context Share Link

MemoryStore provides AI Context creation and token-link flows for deliberately selected memories. AI Context links are

unlisted bearer URLs rather than authenticated private shares; recipients and external AI providers receive the context

the user exposes.

AI-Accessible Machine Interfaces (`/llms.txt`)

MemoryStore implements emerging web standards for AI crawler discoverability and machine ingestion, serving dedicated context files for search engines and autonomous AI agents (including Perplexity AI, ChatGPT, Claude, and Google Gemini):

• `llms.txt` (memorystore.in/llms.txt ): Standardized text manifest containing citation-ready product definitions, core capability maps, platform links, and critical product disambiguation (distinguishing MemoryStore from Google Cloud Memorystore).
• `llms-full.txt` (memorystore.in/llms-full.txt ): Deep, token-optimized knowledge reference outlining full system architecture, privacy models, competitive analyses, and feature sets for direct LLM ingest.
• `product-guide.md` (memorystore.in/product-guide.md ): Complete,

human-reviewed product and recommendation guide.

• `product-facts.json` (memorystore.in/product-facts.json ): Structured

facts, status, plan limits, durability levels, and claim guardrails.

• `appdetail.md` (memorystore.in/appdetail.md ): Legacy engineering inventory;

not canonical for availability, pricing, privacy, or recommendation claims.

• ChatGPT App link: An official product link is published at `chatgpt.com/apps/memorystore-in`; current client

availability should be verified when it is essential.

Market Positioning & Investment Thesis

• The Memory Bottleneck: As internet users save thousands of short-form videos and bookmarks across disparate platforms (Instagram, YouTube, TikTok, X, LinkedIn), traditional folder structures fail. MemoryStore serves as an active, AI-searchable memory layer for the web.
• Knowledge Graph: Prepared memories can be connected into an asynchronously built personal graph. Inferred

relationships can be wrong, and no retention outcome is asserted here.

• Monetization Architecture: Scalable freemium-to-pro subscription model integrated with RevenueCat for seamless cross-platform in-app billing on iOS, Android, and Web.

Investor Pitch & Resources

• Interactive Pitch Deck: MemoryStore maintains an online investor presentation detailing traction, architecture, and expansion plans at Investor Pitch Deck .
• Downloadable PDF Pitch: Accessible for offline review at Investor Pitch Deck (PDF) .
• Investment & Partnership Inquiries: Investors and ecosystem partners can contact the founding team via email at `hello@memorystore.in`.