Repository navigation
Windows / Claude - session.root.cwd path used C:\Windows\system32 when auto_index is True #1183
Description
Version
codebase-memory-mcp 0.9.0
Platform
Windows (x64)
Install channel
GitHub release archive / install.sh / install.ps1
Binary variant
ui
What happened, and what did you expect?
did a clean standard automated install for windows and claude desktop app
set config auto_index to true and opened the claude desktop app and found this in log and ui shows it as indexed project with graph
THIS MAY BE DANGEROUS and should be prevented in indexing "C:\Windows\system32"
2 suggestions
- Allow multiple paths in CBM_ALLOWED_ROOT be it comma separated or semi column
- Add one more EV CBM_BANNED_ROOT comma separated or semi column - to prevent them at all costs
Reproduction
- clean standard automated install for windows via ps1
- set auto_index to true
- started claude
- check the logs and ui
Logs
2026-07-20T06:03:33.054Z [codebase-memory-mcp] [info] Server started and connected successfully { metadata: undefined }
level=info msg=mem.init budget_mb=7167 total_ram_mb=20479
level=info msg=server.start version=0.9.0
level=info msg=watcher.start interval_ms=multi-sec
level=info msg=ui.serving url=http://127.0.0.1:9749 port=9749
2026-07-20T06:03:37.602Z [codebase-memory-mcp] [info] Message from client: method="initialize" id=0 params { metadata: undefined }
level=info msg=session.root.cwd path=C:\Windows\system32
level=info msg=mcp.request protocol=jsonrpc method=initialize status=ok duration_ms=218
level=info msg=autoindex.start project=C-Windows-system32 path=C:\Windows\system32
2026-07-20T06:03:37.924Z [codebase-memory-mcp] [info] Message from server: id=0 result { metadata: undefined }
2026-07-20T06:03:39.446Z [codebase-memory-mcp] [info] Message from client: method="notifications/initialized" { metadata: undefined }
2026-07-20T06:03:39.448Z [codebase-memory-mcp] [info] Message from client: method="tools/list" id=1 params { metadata: undefined }
level=info msg=mcp.request protocol=jsonrpc method=tools/list status=ok duration_ms=0
2026-07-20T06:03:39.450Z [codebase-memory-mcp] [info] Message from server: id=1 result { metadata: undefined }
level=info msg=index.supervisor.reap outcome=clean exit_code=0 signal=0
level=info msg=autoindex.done project=C-Windows-system32 mode=supervised
level=info msg=watcher.watch project=C-Windows-system32 path=C:\Windows\system32
level=info msg=watcher.baseline project=C-Windows-system32 strategy=none
level=info msg=http.request component=graph_ui method=GET path=/ status=200 duration_ms=1 request_bytes=0 response_bytes=484
level=info msg=http.request component=graph_ui method=GET path=/assets/index-DHBFuUo1.js status=200 duration_ms=3 request_bytes=0 response_bytes=1294406
level=info msg=http.request component=graph_ui method=GET path=/assets/index-Bg_AV_yH.css status=200 duration_ms=0 request_bytes=0 response_bytes=43950
level=info msg=http.request component=graph_ui method=GET path=/api/ui-config status=200 duration_ms=5 request_bytes=0 response_bytes=13
level=info msg=mcp.request protocol=jsonrpc method=tools/call tool=list_projects status=ok duration_ms=115
level=info msg=http.request component=graph_ui method=POST path=/rpc status=200 duration_ms=115 request_bytes=95 response_bytes=862
level=warn msg=http.request component=graph_ui method=GET path=/favicon.ico status=404 duration_ms=0 request_bytes=0 response_bytes=9
level=info msg=mcp.request protocol=jsonrpc method=tools/call tool=get_graph_schema status=ok duration_ms=95
level=info msg=http.request component=graph_ui method=POST path=/rpc status=200 duration_ms=97 request_bytes=128 response_bytes=6414
level=info msg=http.request component=graph_ui method=GET path=/api/project-health status=200 duration_ms=16 request_bytes=0 response_bytes=70
level=info msg=http.request component=graph_ui method=GET path=/api/adr status=200 duration_ms=2 request_bytes=0 response_bytes=17
Diagnostics trajectory (memory / performance / leak issues)
Project scale (if relevant)
No response
Confirmations
- I searched existing issues and this is not a duplicate.
- My reproduction uses shareable code (a dummy snippet or a public OSS repository), not proprietary code.
Activity
DeusData commentedon Jul 22, 2026
Thanks for catching this. Auto-indexing
C:\Windows\system32from a client-supplied session cwd is a high-priority0.9.1-rcsafety bug under #395. Review will focus on rejecting operating-system roots and other non-workspace roots by default, validating the client root before watcher registration, and returning an explicit diagnostic rather than silently indexing it. We should fix the root validation rather than require users to maintain a new banned-path environment variable.DeusData commentedon Sep 26, 2026
Thank you, @gotspatel, for catching this! Since v0.10.0, every indexing entry point, auto-index included, enforces one workspace boundary. That boundary refuses
C:\Windows(and Program Files / ProgramData) at any depth, and since v0.11.0 the background path does too. A session whose cwd isC:\Windows\system32now logsautoindex.skip reason=workspace_boundaryand indexes nothing. Could you confirm on v0.11.0?github-actions commentedon Sep 27, 2026
Thanks for the report! To move this forward we need a bit more so we can reproduce it ourselves:
codebase-memory-mcp --versionyou're onOnce that's here we'll pick it straight back up. Heads-up: issues left
awaiting-reporterare automatically closed after a few weeks of silence, but a comment reopens the door anytime.DeusData commentedon Oct 19, 2026
Thank you for flagging the System32 indexing risk. Following the boundary change reported above, the outstanding confirmation is that your Windows/Claude setup skips that cwd on v0.11.0 or newer. There is no need to resend the original logs.