Ara MCP

The agent-facing MCP transport and typed workspace tools.

August 7, 2026 — Organization memory on the capability plane

Eligible cloud sessions can use org-wide durable memory through ara.memory.list, ara.memory.read, ara.memory.write, and ara.memory.search.
Memory is organization-scoped markdown (L1 USER.md / MEMORY.md, semantic directories, and episodic/YYYY-MM-DD.md), not repository-scoped notes.
Settings → Memory shows the file tree, editor, history, and Dream now controls.
Gated by ORG_MEMORY_ENABLED and ORG_MEMORY_ORGS.

ara mcp setup now configures every detected supported agent app, installs the shared Ara agent skill, and starts its native OAuth flow without an extra Ara confirmation prompt.
ara device is the short, idempotent path for installing this Mac as a full-access background Ara Device.
Ara agents can test authentication for fixed, curated HTTP MCP connections without receiving secret values or opening custom URLs from the API server.
Ara MCP remains the direct tool surface for coding agents; Ara Device is the separate native worker. The direct Streamable HTTP endpoint is https://api.ara.so/mcp/ara.

The canonical exact-main check now runs the full four-case conformance corpus, including on a clean diff. This keeps the production baseline and changed-case checks aligned.
Its dynamic outcome markers are sentence-shaped rather than token-shaped, so Ara’s safety redaction does not hide the evaluator’s own visible result.
Case-derived nonce components are separated before interpolation as well, including the long failed-recovery case name.

Requests to a configured org MCP server (health checks, OAuth discovery and token exchange, gateway calls) now connect to the exact IP address the private-network guard verified, instead of resolving the server’s hostname a second time at connect time. A DNS name that answers with a public address during validation can no longer swap to an internal or link-local address for the actual connection (DNS rebinding). TLS still validates the server’s certificate against its hostname, so legitimate public MCP servers, including those behind CDNs that require SNI, are unaffected.
Follow-up: the OAuth discovery, registration, and token-exchange steps of this flow are now exercised in tests through an injected transport, so the private-network guard above is always the real one under test. Internal test tooling only; the flow’s outbound behavior is unchanged.
Follow-up: the guard’s DNS lookups are now cancelled the moment their caller gives up, instead of running to the OS timeout in the background. A custom MCP server whose nameserver stalls on purpose can no longer pile up pending lookup work on the API server; legitimate servers resolve exactly as before.

Health checks for a configured org MCP server now validate every redirect hop against the private-network guard, not just the initial URL. A custom MCP server URL can no longer be used to reach internal or link-local addresses via a redirect. Legitimate public MCP servers are unaffected.