Subagents limited in what they can do with account memory

What

An account memory server is an MCP server, a plug-in tool provider, that stores things Claude remembers about you across sessions. Subagents are helper agents Claude starts to handle part of a task. They now have restricted access to that memory.

• The server can advertise an experimental capability named anthropic/memory. Its subagent_memory field can be all, read_only or none, and subagent_note can hold up to 4096 characters.
  • If several servers set it, the most restrictive value wins.
  • A value that cannot be read counts as none.
  • If no server sets it, the mode is read_only.
• The tools handed to a subagent are filtered by a new subagentMemoryMode. Tools from the memory server are removed unless they are on a read-only list, and none removes them all.
• Forked slash commands and observer agents now pass the current permission mode as subagentMemoryMode when their tools are chosen.
• A subagent, teammate, fork or backgrounded query that tries to change account memory is refused. The message says only the session's main agent can change it, and asks it to say in its reply what should be saved.
• Subagents no longer see the memory server's resources, and reading one directly fails with a message pointing them to the server's tools.
• Separately, --resume now records the source session's sourceSessionId and transcriptPath.

Why

Helper agents can no longer freely rewrite what Claude remembers about you. Changes to account memory go through the main agent, and the memory server decides how much subagents may read.