From 9da2bba02d322cb64929151413c59160bc00b4e8 Mon Sep 17 00:00:00 2001
From: ducnmm <ducnmm@ducnmms-MacBook-Pro.local>
Date: Wed, 3 Jun 2026 23:58:28 +0700
Subject: [PATCH 1/8] Fix wallet sign-in copy and relayer URLs

---
 apps/app/src/pages/ConnectMcp.tsx  |  2 +-
 apps/app/src/pages/Dashboard.tsx   | 32 +++++++++++++-----------------
 apps/app/src/pages/LandingPage.tsx |  5 ++++-
 3 files changed, 19 insertions(+), 20 deletions(-)

diff --git a/apps/app/src/pages/ConnectMcp.tsx b/apps/app/src/pages/ConnectMcp.tsx
index 90d70b7f..a53923d0 100644
--- a/apps/app/src/pages/ConnectMcp.tsx
+++ b/apps/app/src/pages/ConnectMcp.tsx
@@ -104,7 +104,7 @@ export default function ConnectMcp() {
     const publicKey = params.get('publicKey') ?? ''
     const delegateAddress = params.get('delegateAddress') ?? ''
     const label = params.get('label') ?? 'Walrus Memory MCP'
-    const relayer = params.get('relayer') ?? 'https://relayer.memwal.ai'
+    const relayer = params.get('relayer') ?? config.memwalServerUrl
     /**
      * Cryptographic state token from the MCP bridge. Must be echoed verbatim
      * in the callback POST — the bridge constant-time compares it to defeat
diff --git a/apps/app/src/pages/Dashboard.tsx b/apps/app/src/pages/Dashboard.tsx
index 1547b740..7d442c47 100644
--- a/apps/app/src/pages/Dashboard.tsx
+++ b/apps/app/src/pages/Dashboard.tsx
@@ -122,7 +122,6 @@ interface OnChainDelegateKey {
 
 const MAX_DELEGATE_KEYS = 20
 const MAX_DELEGATE_KEYS_MESSAGE = 'This wallet already has 20 delegate keys. Remove an old key before creating a new delegate key.'
-const SDK_DEFAULT_SERVER_URL = 'https://relayer.memwal.ai'
 const PRIVATE_KEY_ENV = 'MEMWAL_PRIVATE_KEY'
 const ACCOUNT_ID_ENV = 'MEMWAL_ACCOUNT_ID'
 const SERVER_URL_ENV = 'MEMWAL_SERVER_URL'
@@ -372,9 +371,6 @@ export default function Dashboard({
     const activeEnvironmentLabel = config.suiNetwork === 'mainnet'
         ? 'production / mainnet'
         : 'staging / testnet'
-    const expectedRelayerUrl = config.suiNetwork === 'mainnet'
-        ? 'https://relayer.memwal.ai'
-        : 'https://relayer.memwal.ai'
     const normalizedRelayerUrl = config.memwalServerUrl.toLowerCase()
     const relayerEnvironmentLabel = normalizedRelayerUrl.startsWith('/')
         ? 'local dev proxy / testnet'
@@ -385,6 +381,7 @@ export default function Dashboard({
             : normalizedRelayerUrl.includes('dev')
                 ? 'dev / testnet'
                 : 'production / mainnet'
+    const sdkDefaultServerUrl = config.memwalServerUrl
     const relayerLooksMismatched =
         (config.suiNetwork === 'mainnet' && normalizedRelayerUrl.includes('staging')) ||
         (config.suiNetwork !== 'mainnet' &&
@@ -696,7 +693,7 @@ export default function Dashboard({
 const memwal = MemWal.create({
   key: process.env.${PRIVATE_KEY_ENV} ?? "${PRIVATE_KEY_PLACEHOLDER}",
   accountId: process.env.${ACCOUNT_ID_ENV} ?? "${effectiveAccountObjectId ?? ACCOUNT_ID_PLACEHOLDER}",
-  serverUrl: process.env.${SERVER_URL_ENV} ?? "${SDK_DEFAULT_SERVER_URL}",
+  serverUrl: process.env.${SERVER_URL_ENV} ?? "${sdkDefaultServerUrl}",
 })
 
 // Remember something
@@ -715,7 +712,7 @@ async def main():
     memwal = MemWal.create(
         key=os.environ["${PRIVATE_KEY_ENV}"],
         account_id=os.environ["${ACCOUNT_ID_ENV}"],
-        server_url=os.environ.get("${SERVER_URL_ENV}", "${SDK_DEFAULT_SERVER_URL}"),
+        server_url=os.environ.get("${SERVER_URL_ENV}", "${sdkDefaultServerUrl}"),
     )
 
     await memwal.remember_and_wait("I'm allergic to peanuts")
@@ -738,7 +735,7 @@ import { openai } from "@ai-sdk/openai"
 const model = withMemWal(openai("gpt-4o"), {
   key: process.env.${PRIVATE_KEY_ENV} ?? "${PRIVATE_KEY_PLACEHOLDER}",
   accountId: process.env.${ACCOUNT_ID_ENV} ?? "${effectiveAccountObjectId ?? ACCOUNT_ID_PLACEHOLDER}",
-  serverUrl: process.env.${SERVER_URL_ENV} ?? "${SDK_DEFAULT_SERVER_URL}",
+  serverUrl: process.env.${SERVER_URL_ENV} ?? "${sdkDefaultServerUrl}",
 })
 
 const result = await generateText({
@@ -918,21 +915,20 @@ const result = await generateText({
                         subtitle={`Copy the delegate private key into server env as ${PRIVATE_KEY_ENV}`}
                     >
 
-                    <div className="dashboard-credentials-alert">
-                        <TriangleAlert className="dashboard-credentials-alert-icon" size={24} strokeWidth={2.3} aria-hidden="true" />
-                        <div className="dashboard-credentials-alert-copy">
-                            <p>
-                                <strong>{activeEnvironmentLabel}</strong>
-                                <span>Configured relayer: <code>{config.memwalServerUrl}</code> ({relayerEnvironmentLabel}).</span>
-                                <span>Expected relayer: <code>{expectedRelayerUrl}</code>.</span>
-                            </p>
-                            {relayerLooksMismatched && (
+                    {relayerLooksMismatched && (
+                        <div className="dashboard-credentials-alert">
+                            <TriangleAlert className="dashboard-credentials-alert-icon" size={24} strokeWidth={2.3} aria-hidden="true" />
+                            <div className="dashboard-credentials-alert-copy">
+                                <p>
+                                    <strong>{activeEnvironmentLabel}</strong>
+                                    <span>Configured relayer: <code>{config.memwalServerUrl}</code> ({relayerEnvironmentLabel}).</span>
+                                </p>
                                 <p>
                                     This dashboard network and relayer URL look mismatched; API calls may fail with 401.
                                 </p>
-                            )}
+                            </div>
                         </div>
-                    </div>
+                    )}
 
                     <div className="dashboard-credentials-panel">
                         {effectiveAccountObjectId && (
diff --git a/apps/app/src/pages/LandingPage.tsx b/apps/app/src/pages/LandingPage.tsx
index 03019658..9b31ee5d 100644
--- a/apps/app/src/pages/LandingPage.tsx
+++ b/apps/app/src/pages/LandingPage.tsx
@@ -120,7 +120,10 @@ export default function LandingPage() {
                         </button>
                     )}
                     <div onClick={handleWalletClick} className="wm-signin-wallet">
-                        <ConnectButton connectText="Connect wallet" />
+                        <ConnectButton
+                            connectText="Connect wallet"
+                            walletFilter={(wallet) => !isEnokiWallet(wallet)}
+                        />
                     </div>
                     <p className="wm-signin-tos">
                         By continuing, you agree to our <a href={config.termsOfServiceUrl} target="_blank" rel="noopener noreferrer">Terms of Service</a> and <a href={config.privacyPolicyUrl} target="_blank" rel="noopener noreferrer">Privacy Policy</a>

From b1460d4089cf27c61dff73433d8a40b79cbcaba7 Mon Sep 17 00:00:00 2001
From: ducnmm <ducnmm@ducnmms-MacBook-Pro.local>
Date: Thu, 4 Jun 2026 09:35:46 +0700
Subject: [PATCH 2/8] fix Enoki transient retries

---
 docs/reference/environment-variables.md       |   3 +
 services/server/.env.example                  |   5 +
 .../scripts/__tests__/enoki-retry.test.ts     |  76 +++++++++++++
 services/server/scripts/enoki-retry.ts        |  63 +++++++++++
 services/server/scripts/sidecar-server.ts     | 100 ++++++++++++++----
 5 files changed, 227 insertions(+), 20 deletions(-)
 create mode 100644 services/server/scripts/__tests__/enoki-retry.test.ts
 create mode 100644 services/server/scripts/enoki-retry.ts

diff --git a/docs/reference/environment-variables.md b/docs/reference/environment-variables.md
index 0e41ef68..ead844d4 100644
--- a/docs/reference/environment-variables.md
+++ b/docs/reference/environment-variables.md
@@ -57,6 +57,9 @@ These are not all enforced at boot, but most real deployments need them.
 | `ENOKI_API_KEY` | none | Optional Enoki key for sponsored sidecar transactions |
 | `ENOKI_NETWORK` | `mainnet` | Network used for Enoki-sponsored flows |
 | `ENOKI_FALLBACK_TO_DIRECT_SIGN` | `false` | If true, sidecar pays gas directly with the server wallet when Enoki sponsorship fails or is not configured |
+| `ENOKI_TRANSIENT_MAX_ATTEMPTS` | `2` | Attempts for sidecar-level retries of transient Enoki failures (`429`, `5xx`, network errors) before failing the wallet job |
+| `ENOKI_TRANSIENT_BASE_DELAY_MS` | `5000` | Base delay for transient Enoki retries when the response does not include `Retry-After` or a retry hint |
+| `ENOKI_TRANSIENT_MAX_DELAY_MS` | `30000` | Maximum delay for one transient Enoki retry, including parsed retry hints such as “try again in 30 seconds” |
 | `MEMWAL_RELAYER_URL` | `http://127.0.0.1:$PORT` | Relayer URL passed from the Rust server to the sidecar for MCP tool calls |
 | `MCP_MAX_TOTAL_SESSIONS` | `1000` | Maximum active MCP sessions across SSE and Streamable HTTP transports |
 | `MCP_MAX_SESSIONS_PER_IP` | `16` | Maximum active MCP sessions from one source IP |
diff --git a/services/server/.env.example b/services/server/.env.example
index cf0240e1..d39c91f0 100644
--- a/services/server/.env.example
+++ b/services/server/.env.example
@@ -100,6 +100,11 @@ ENOKI_NETWORK=mainnet
 # Keep false in production so missing/expired/rejected sponsorship retries
 # through Apalis instead of making the server wallet pay gas directly.
 ENOKI_FALLBACK_TO_DIRECT_SIGN=false
+# Retry transient Enoki HTTP failures (429/5xx/network) inside the sidecar
+# before consuming a durable wallet-job retry.
+ENOKI_TRANSIENT_MAX_ATTEMPTS=2
+ENOKI_TRANSIENT_BASE_DELAY_MS=5000
+ENOKI_TRANSIENT_MAX_DELAY_MS=30000
 
 # Sponsor endpoint rate limiting (per IP + per sender, sliding window)
 SPONSOR_RATE_LIMIT_PER_MINUTE=10
diff --git a/services/server/scripts/__tests__/enoki-retry.test.ts b/services/server/scripts/__tests__/enoki-retry.test.ts
new file mode 100644
index 00000000..1417bd0f
--- /dev/null
+++ b/services/server/scripts/__tests__/enoki-retry.test.ts
@@ -0,0 +1,76 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import {
+    getEnokiRetryDelayMs,
+    isTransientEnokiStatus,
+    parseRetryAfterMs,
+    parseTryAgainBodyDelayMs,
+} from "../enoki-retry.js";
+
+const policy = {
+    maxAttempts: 2,
+    baseDelayMs: 5_000,
+    maxDelayMs: 30_000,
+};
+
+test("classifies only Enoki rate-limit and server statuses as transient", () => {
+    assert.equal(isTransientEnokiStatus(429), true);
+    assert.equal(isTransientEnokiStatus(500), true);
+    assert.equal(isTransientEnokiStatus(502), true);
+    assert.equal(isTransientEnokiStatus(599), true);
+    assert.equal(isTransientEnokiStatus(400), false);
+    assert.equal(isTransientEnokiStatus(403), false);
+});
+
+test("uses Retry-After seconds before fallback backoff", () => {
+    assert.equal(parseRetryAfterMs("7", 0), 7_000);
+    assert.equal(getEnokiRetryDelayMs({
+        ...policy,
+        attempt: 1,
+        status: 429,
+        retryAfter: "7",
+    }), 7_000);
+});
+
+test("uses Enoki HTML body retry hint for 502 responses", () => {
+    const body = "<h2>The server encountered a temporary error. Please try again in 30 seconds.</h2>";
+    assert.equal(parseTryAgainBodyDelayMs(body), 30_000);
+    assert.equal(getEnokiRetryDelayMs({
+        ...policy,
+        attempt: 1,
+        status: 502,
+        body,
+    }), 30_000);
+});
+
+test("caps long retry hints", () => {
+    assert.equal(getEnokiRetryDelayMs({
+        ...policy,
+        attempt: 1,
+        status: 503,
+        body: "please try again in 2 minutes",
+    }), 30_000);
+});
+
+test("does not retry final attempt or deterministic 400 errors", () => {
+    assert.equal(getEnokiRetryDelayMs({
+        ...policy,
+        attempt: 2,
+        status: 502,
+        body: "please try again in 30 seconds",
+    }), null);
+    assert.equal(getEnokiRetryDelayMs({
+        ...policy,
+        attempt: 1,
+        status: 400,
+        body: "{\"errors\":[{\"code\":\"dry_run_failed\"}]}",
+    }), null);
+});
+
+test("retries transport errors with exponential fallback", () => {
+    assert.equal(getEnokiRetryDelayMs({
+        ...policy,
+        attempt: 1,
+        transportError: true,
+    }), 5_000);
+});
diff --git a/services/server/scripts/enoki-retry.ts b/services/server/scripts/enoki-retry.ts
new file mode 100644
index 00000000..9ab55dff
--- /dev/null
+++ b/services/server/scripts/enoki-retry.ts
@@ -0,0 +1,63 @@
+export type EnokiRetryPolicy = {
+    maxAttempts: number;
+    baseDelayMs: number;
+    maxDelayMs: number;
+};
+
+export type EnokiRetryInput = EnokiRetryPolicy & {
+    attempt: number;
+    status?: number;
+    body?: string;
+    retryAfter?: string | null;
+    transportError?: boolean;
+};
+
+export function isTransientEnokiStatus(status: number): boolean {
+    return status === 429 || (status >= 500 && status <= 599);
+}
+
+export function parseRetryAfterMs(value: string | null | undefined, nowMs = Date.now()): number | null {
+    if (!value) return null;
+    const trimmed = value.trim();
+    if (!trimmed) return null;
+
+    const seconds = Number(trimmed);
+    if (Number.isFinite(seconds) && seconds >= 0) {
+        return Math.round(seconds * 1000);
+    }
+
+    const dateMs = Date.parse(trimmed);
+    if (Number.isFinite(dateMs)) {
+        return Math.max(0, dateMs - nowMs);
+    }
+
+    return null;
+}
+
+export function parseTryAgainBodyDelayMs(body: string | undefined): number | null {
+    if (!body) return null;
+    const match = body.match(/try again in\s+(\d+(?:\.\d+)?)\s*(seconds?|s|minutes?|m)\b/i);
+    if (!match) return null;
+
+    const amount = Number(match[1]);
+    if (!Number.isFinite(amount) || amount < 0) return null;
+
+    const unit = match[2].toLowerCase();
+    const multiplier = unit.startsWith("m") ? 60_000 : 1000;
+    return Math.round(amount * multiplier);
+}
+
+export function getEnokiRetryDelayMs(input: EnokiRetryInput): number | null {
+    if (input.attempt >= input.maxAttempts) return null;
+
+    const retryable = input.transportError
+        || (typeof input.status === "number" && isTransientEnokiStatus(input.status));
+    if (!retryable) return null;
+
+    const hintedDelayMs = parseRetryAfterMs(input.retryAfter)
+        ?? parseTryAgainBodyDelayMs(input.body);
+    const fallbackDelayMs = input.baseDelayMs * 2 ** Math.max(0, input.attempt - 1);
+    const rawDelayMs = hintedDelayMs ?? fallbackDelayMs;
+
+    return Math.max(0, Math.min(input.maxDelayMs, rawDelayMs));
+}
diff --git a/services/server/scripts/sidecar-server.ts b/services/server/scripts/sidecar-server.ts
index 0a97ced3..9d84dcba 100644
--- a/services/server/scripts/sidecar-server.ts
+++ b/services/server/scripts/sidecar-server.ts
@@ -21,6 +21,7 @@ import { SealClient, SessionKey, EncryptedObject } from "@mysten/seal";
 import { WalrusClient } from "@mysten/walrus";
 import { mountMcpRoutes, shutdownMcpSessions } from "./mcp/index.js";
 import { getSealServerConfigsFromEnv, getSealThresholdFromEnv } from "./seal-config.js";
+import { getEnokiRetryDelayMs } from "./enoki-retry.js";
 import {
     isWalrusBlobObjectMissingFromEffects,
     isWalrusObjectLockEquivocation,
@@ -177,6 +178,24 @@ const ENOKI_FALLBACK_TO_DIRECT_SIGN = (() => {
     const raw = (process.env.ENOKI_FALLBACK_TO_DIRECT_SIGN || "false").trim().toLowerCase();
     return raw !== "0" && raw !== "false" && raw !== "no";
 })();
+const ENOKI_TRANSIENT_MAX_ATTEMPTS = parsePositiveIntEnv(
+    "ENOKI_TRANSIENT_MAX_ATTEMPTS",
+    2,
+    1,
+    5,
+);
+const ENOKI_TRANSIENT_BASE_DELAY_MS = parsePositiveIntEnv(
+    "ENOKI_TRANSIENT_BASE_DELAY_MS",
+    5_000,
+    100,
+    60_000,
+);
+const ENOKI_TRANSIENT_MAX_DELAY_MS = parsePositiveIntEnv(
+    "ENOKI_TRANSIENT_MAX_DELAY_MS",
+    30_000,
+    1_000,
+    120_000,
+);
 const WALRUS_CLIENT_MAX_AGE_MS = (() => {
     const parsed = Number.parseInt(process.env.WALRUS_CLIENT_MAX_AGE_MS || "", 10);
     return Number.isFinite(parsed) && parsed > 0 ? parsed : 30 * 60 * 1000;
@@ -561,6 +580,7 @@ function sidecarStateSnapshot(): Record<string, unknown> {
         enokiNetwork,
         enokiEnabled: !!enokiApiKey,
         fallbackToDirectSign: ENOKI_FALLBACK_TO_DIRECT_SIGN,
+        enokiTransientMaxAttempts: ENOKI_TRANSIENT_MAX_ATTEMPTS,
     };
 }
 
@@ -605,28 +625,68 @@ async function callEnoki<T>(path: string, payload: unknown): Promise<T> {
         throw new Error("ENOKI_API_KEY is not configured");
     }
 
-    const resp = await fetch(`${ENOKI_API_BASE_URL}${path}`, {
-        method: "POST",
-        headers: {
-            "Content-Type": "application/json",
-            Authorization: `Bearer ${enokiApiKey}`,
-        },
-        body: JSON.stringify(payload),
-    });
+    for (let attempt = 1; ; attempt += 1) {
+        let resp: Response;
+        try {
+            resp = await fetch(`${ENOKI_API_BASE_URL}${path}`, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    Authorization: `Bearer ${enokiApiKey}`,
+                },
+                body: JSON.stringify(payload),
+            });
+        } catch (err) {
+            const retryDelayMs = getEnokiRetryDelayMs({
+                attempt,
+                maxAttempts: ENOKI_TRANSIENT_MAX_ATTEMPTS,
+                baseDelayMs: ENOKI_TRANSIENT_BASE_DELAY_MS,
+                maxDelayMs: ENOKI_TRANSIENT_MAX_DELAY_MS,
+                transportError: true,
+            });
+            if (retryDelayMs === null) throw err;
+            console.warn(`[enoki] transport_retry ${JSON.stringify({
+                path: redactEnokiPath(path),
+                network: enokiNetwork,
+                attempt,
+                maxAttempts: ENOKI_TRANSIENT_MAX_ATTEMPTS,
+                retryDelayMs,
+                error: errorMessage(err),
+            })}`);
+            await sleep(retryDelayMs);
+            continue;
+        }
 
-    const text = await resp.text();
-    if (!resp.ok) {
-        console.error(`[enoki] api_error ${JSON.stringify({
-            path: redactEnokiPath(path),
-            status: resp.status,
-            network: enokiNetwork,
-            ...summarizeEnokiError(text),
-        })}`);
-        throw new Error(`Enoki API error (${resp.status}): ${text}`);
-    }
+        const text = await resp.text();
+        if (!resp.ok) {
+            const retryDelayMs = getEnokiRetryDelayMs({
+                attempt,
+                maxAttempts: ENOKI_TRANSIENT_MAX_ATTEMPTS,
+                baseDelayMs: ENOKI_TRANSIENT_BASE_DELAY_MS,
+                maxDelayMs: ENOKI_TRANSIENT_MAX_DELAY_MS,
+                status: resp.status,
+                retryAfter: resp.headers.get("retry-after"),
+                body: text,
+            });
+            console.error(`[enoki] api_error ${JSON.stringify({
+                path: redactEnokiPath(path),
+                status: resp.status,
+                network: enokiNetwork,
+                attempt,
+                maxAttempts: ENOKI_TRANSIENT_MAX_ATTEMPTS,
+                retryDelayMs,
+                ...summarizeEnokiError(text),
+            })}`);
+            if (retryDelayMs !== null) {
+                await sleep(retryDelayMs);
+                continue;
+            }
+            throw new Error(`Enoki API error (${resp.status}): ${text}`);
+        }
 
-    const parsed = JSON.parse(text) as EnokiDataWrapper<T>;
-    return parsed.data;
+        const parsed = JSON.parse(text) as EnokiDataWrapper<T>;
+        return parsed.data;
+    }
 }
 
 function isSponsoredTransactionExpired(err: unknown): boolean {

From df7642e6053c3218d560ebcdbbc8a45029c68634 Mon Sep 17 00:00:00 2001
From: ducnmm <ducnmm@ducnmms-MacBook-Pro.local>
Date: Thu, 4 Jun 2026 10:11:59 +0700
Subject: [PATCH 3/8] Add Walrus Memory project install prompt

---
 apps/app/public/skills/memwal-install | 109 ++++++++++++++
 apps/app/server.mjs                   |   1 +
 apps/app/src/index.css                | 206 ++++++++++++++++++++++++++
 apps/app/src/pages/Dashboard.tsx      |  25 ++++
 apps/app/src/pages/LandingPage.tsx    | 146 +++++++++++++-----
 5 files changed, 453 insertions(+), 34 deletions(-)
 create mode 100644 apps/app/public/skills/memwal-install

diff --git a/apps/app/public/skills/memwal-install b/apps/app/public/skills/memwal-install
new file mode 100644
index 00000000..2a826280
--- /dev/null
+++ b/apps/app/public/skills/memwal-install
@@ -0,0 +1,109 @@
+Install Walrus Memory in this project.
+
+You are operating inside a user's existing code project. Do not configure this AI client's MCP settings, and do not install `@mysten-incubation/memwal-mcp` unless the user explicitly asks for an AI-client MCP integration. The goal is to wire Walrus Memory into the app/repo itself.
+
+Goal:
+- Add the Walrus Memory SDK to the current project.
+- Keep credentials server-side in environment variables.
+- Add the smallest useful integration for the project's existing stack.
+- Run the project's normal checks and explain exactly how the user can verify memory works.
+
+First inspect the project:
+- Detect the package manager and framework (`package.json`, lockfiles, `pyproject.toml`, `requirements.txt`, app/router structure, API routes, AI provider usage).
+- Prefer TypeScript/JavaScript instructions when a `package.json` exists.
+- Prefer Python instructions when the project is Python-only.
+- If the project already uses the Vercel AI SDK, LangChain, OpenAI SDK, or an agent framework, integrate Walrus Memory at the nearest existing model/tool boundary instead of creating an unrelated demo.
+
+Install packages:
+- npm: `npm install @mysten-incubation/memwal`
+- pnpm: `pnpm add @mysten-incubation/memwal`
+- yarn: `yarn add @mysten-incubation/memwal`
+- bun: `bun add @mysten-incubation/memwal`
+- Python: `pip install memwal`
+
+Optional packages:
+- For Vercel AI SDK middleware, add `ai` if the project does not already have it.
+- For Python OpenAI integrations, use `pip install memwal[openai]`.
+- For Python LangChain integrations, use `pip install memwal[langchain]`.
+- For the TypeScript manual client flow only, add `@mysten/sui @mysten/seal @mysten/walrus`.
+
+Environment variables:
+- Add placeholders to the project's env example file if one exists.
+- Do not commit real secrets.
+- Use these names unless the project has an established config convention:
+
+MEMWAL_PRIVATE_KEY=
+MEMWAL_ACCOUNT_ID=
+MEMWAL_SERVER_URL=https://relayer.memory.walrus.xyz
+MEMWAL_NAMESPACE=default
+
+Tell the user to get `MEMWAL_PRIVATE_KEY` and `MEMWAL_ACCOUNT_ID` from the Walrus Memory dashboard: https://memory.walrus.xyz/dashboard
+
+Recommended TypeScript helper:
+
+```ts
+import { MemWal } from "@mysten-incubation/memwal";
+
+export function createMemWal(namespace = process.env.MEMWAL_NAMESPACE ?? "default") {
+  const key = process.env.MEMWAL_PRIVATE_KEY;
+  const accountId = process.env.MEMWAL_ACCOUNT_ID;
+
+  if (!key || !accountId) {
+    throw new Error("Walrus Memory is not configured. Set MEMWAL_PRIVATE_KEY and MEMWAL_ACCOUNT_ID.");
+  }
+
+  return MemWal.create({
+    key,
+    accountId,
+    serverUrl: process.env.MEMWAL_SERVER_URL ?? "https://relayer.memory.walrus.xyz",
+    namespace,
+  });
+}
+```
+
+Recommended Vercel AI SDK integration:
+
+```ts
+import { withMemWal } from "@mysten-incubation/memwal/ai";
+
+const modelWithMemory = withMemWal(model, {
+  key: process.env.MEMWAL_PRIVATE_KEY!,
+  accountId: process.env.MEMWAL_ACCOUNT_ID!,
+  serverUrl: process.env.MEMWAL_SERVER_URL ?? "https://relayer.memory.walrus.xyz",
+  namespace: process.env.MEMWAL_NAMESPACE ?? "default",
+  autoSave: true,
+});
+```
+
+Recommended Python helper:
+
+```py
+import os
+from typing import Optional
+from memwal import MemWal
+
+def create_memwal(namespace: Optional[str] = None):
+    return MemWal.create(
+        key=os.environ["MEMWAL_PRIVATE_KEY"],
+        account_id=os.environ["MEMWAL_ACCOUNT_ID"],
+        server_url=os.environ.get("MEMWAL_SERVER_URL", "https://relayer.memory.walrus.xyz"),
+        namespace=namespace or os.environ.get("MEMWAL_NAMESPACE", "default"),
+    )
+```
+
+Wire it into the project:
+- For chat/agent apps, recall relevant memory before generation and save or analyze useful user facts after user messages.
+- For API routes, keep Walrus Memory calls on the server side.
+- For UI-only apps, add a server route/action first rather than exposing the private key to the browser.
+- For non-AI apps, add explicit `remember` and `recall` helpers around the workflow the user names.
+
+Verification:
+- Add or update a small smoke test, script, API route, or README snippet that remembers a test fact and recalls it.
+- Run the project's typecheck, tests, lint, or build commands that are already present.
+- If checks cannot run because credentials are missing, verify compilation and document the exact env vars the user must set.
+
+Finish by reporting:
+- Files changed.
+- Packages installed.
+- Env vars the user must set.
+- The command or app flow to verify Walrus Memory in this project.
diff --git a/apps/app/server.mjs b/apps/app/server.mjs
index 30956d8c..2589e0f8 100644
--- a/apps/app/server.mjs
+++ b/apps/app/server.mjs
@@ -11,6 +11,7 @@ const port = Number(process.env.PORT || 4173)
 const host = process.env.HOST || '0.0.0.0'
 
 const contentTypes = new Map([
+  ['', 'text/plain; charset=utf-8'],
   ['.css', 'text/css; charset=utf-8'],
   ['.gif', 'image/gif'],
   ['.html', 'text/html; charset=utf-8'],
diff --git a/apps/app/src/index.css b/apps/app/src/index.css
index 88eb4455..e899c0f5 100644
--- a/apps/app/src/index.css
+++ b/apps/app/src/index.css
@@ -9671,6 +9671,49 @@ h1, h2, h3 {
   }
 }
 
+.dash-page .dashboard-project-install-code {
+  min-height: 96px !important;
+  padding: 24px 78px 24px 32px !important;
+  display: flex;
+  align-items: center;
+  white-space: pre-wrap;
+  word-break: break-word;
+}
+
+.dash-page .dashboard-project-install-card {
+  min-height: 0;
+  padding-bottom: 32px;
+}
+
+.dash-page .dashboard-project-install-card .card-header {
+  margin-bottom: 24px;
+}
+
+.dash-page .dashboard-project-install-card .dashboard-quickstart-copy {
+  top: 50%;
+  right: 20px;
+  transform: translateY(-50%);
+}
+
+.dash-page .dashboard-project-install-card .dashboard-quickstart-copy:hover:not(:disabled) {
+  transform: translateY(-50%);
+}
+
+@media (max-width: 860px) {
+  .dash-page .dashboard-project-install-code {
+    min-height: 112px !important;
+    padding: 22px 62px 22px 22px !important;
+  }
+
+  .dash-page .dashboard-project-install-card .card-header {
+    margin-bottom: 20px !important;
+  }
+
+  .dash-page .dashboard-project-install-card .dashboard-quickstart-copy {
+    right: 14px;
+  }
+}
+
 /* ── Sign-in screen (Figma 2556:112) ───────────────────────── */
 .wm-signin {
   position: fixed;
@@ -9959,6 +10002,169 @@ h1, h2, h3 {
   }
 }
 
+.wm-install-prompt {
+  position: relative;
+  z-index: 1;
+  background:
+    radial-gradient(90% 120% at 16% 8%, rgba(152, 239, 228, 0.16) 0%, rgba(152, 239, 228, 0) 52%),
+    linear-gradient(180deg, #050608 0%, #0b1114 100%);
+  color: #faf8f5;
+  padding: clamp(64px, 7vw, 112px) 0;
+  font-family: var(--font-sans);
+}
+
+.wm-install-prompt-inner {
+  width: min(1160px, calc(100% - 48px));
+  margin: 0 auto;
+  display: grid;
+  grid-template-columns: minmax(280px, 0.8fr) minmax(420px, 1.2fr);
+  gap: clamp(28px, 5vw, 72px);
+  align-items: center;
+}
+
+.wm-install-prompt-copy {
+  min-width: 0;
+}
+
+.wm-install-prompt-eyebrow {
+  margin: 0 0 16px;
+  color: #98efe4;
+  font-family: var(--font-mono);
+  font-size: 14px;
+  font-weight: 600;
+  line-height: 1;
+  letter-spacing: 0;
+}
+
+.wm-install-prompt-copy h2 {
+  margin: 0;
+  max-width: 520px;
+  color: #faf8f5;
+  font-size: clamp(42px, 5vw, 72px);
+  font-weight: 500;
+  line-height: 0.94;
+  letter-spacing: 0;
+}
+
+.wm-install-prompt-copy p:last-child {
+  margin: 22px 0 0;
+  max-width: 520px;
+  color: #b8bbbe;
+  font-size: clamp(17px, 1.5vw, 21px);
+  font-weight: 400;
+  line-height: 1.38;
+}
+
+.wm-install-prompt-panel {
+  min-width: 0;
+  border: 1px solid rgba(250, 248, 245, 0.14);
+  border-radius: 18px;
+  background:
+    linear-gradient(180deg, rgba(250, 248, 245, 0.08) 0%, rgba(250, 248, 245, 0.035) 100%),
+    rgba(0, 0, 0, 0.44);
+  box-shadow: 0 28px 90px rgba(0, 0, 0, 0.36);
+  overflow: hidden;
+}
+
+.wm-install-prompt-panel-head {
+  min-height: 64px;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 18px;
+  padding: 14px 16px 14px 22px;
+  border-bottom: 1px solid rgba(250, 248, 245, 0.12);
+}
+
+.wm-install-prompt-panel-head span {
+  color: #8f9294;
+  font-family: var(--font-mono);
+  font-size: 13px;
+  font-weight: 600;
+  line-height: 1;
+}
+
+.wm-install-prompt-copy-button {
+  min-height: 40px;
+  min-width: 132px;
+  padding: 0 16px;
+  border: 1px solid rgba(152, 239, 228, 0.5);
+  border-radius: 999px;
+  background: rgba(152, 239, 228, 0.13);
+  color: #faf8f5;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: 8px;
+  font-family: var(--font-sans);
+  font-size: 14px;
+  font-weight: 600;
+  line-height: 1;
+  letter-spacing: 0;
+  cursor: pointer;
+  transition: background 160ms ease, border-color 160ms ease, transform 160ms ease;
+}
+
+.wm-install-prompt-copy-button:hover {
+  border-color: #98efe4;
+  background: rgba(152, 239, 228, 0.2);
+  transform: translateY(-1px);
+}
+
+.wm-install-prompt-copy-button svg {
+  flex: 0 0 auto;
+}
+
+.wm-install-prompt-code {
+  margin: 0;
+  min-height: 150px;
+  padding: 28px;
+  color: #faf8f5;
+  font-family: var(--font-mono);
+  font-size: clamp(15px, 1.25vw, 18px);
+  font-weight: 500;
+  line-height: 1.55;
+  white-space: pre-wrap;
+  word-break: break-word;
+}
+
+.wm-install-prompt-code code {
+  font-family: inherit;
+  color: inherit;
+}
+
+@media (max-width: 900px) {
+  .wm-install-prompt {
+    padding: 56px 0 72px;
+  }
+
+  .wm-install-prompt-inner {
+    width: calc(100% - 40px);
+    grid-template-columns: 1fr;
+    gap: 28px;
+  }
+
+  .wm-install-prompt-copy h2 {
+    font-size: clamp(38px, 11vw, 56px);
+  }
+
+  .wm-install-prompt-panel-head {
+    min-height: auto;
+    flex-direction: column;
+    align-items: stretch;
+    padding: 18px;
+  }
+
+  .wm-install-prompt-copy-button {
+    width: 100%;
+  }
+
+  .wm-install-prompt-code {
+    min-height: 160px;
+    padding: 22px 18px;
+  }
+}
+
 /* Setup flow: align the create-key screen with the dashboard visual system. */
 .setup-classic {
   background: #000000;
diff --git a/apps/app/src/pages/Dashboard.tsx b/apps/app/src/pages/Dashboard.tsx
index 7d442c47..3b1f0443 100644
--- a/apps/app/src/pages/Dashboard.tsx
+++ b/apps/app/src/pages/Dashboard.tsx
@@ -748,6 +748,12 @@ const result = await generateText({
     const docsHref = config.docsUrl || 'https://docs.memwal.ai'
     const githubHref = 'https://github.com/MystenLabs/memwal'
     const discordHref = 'https://discord.gg/walrusprotocol'
+    const appOrigin =
+        typeof window === 'undefined'
+            ? 'https://memory.walrus.xyz'
+            : window.location.origin
+    const projectInstallPromptUrl = `${appOrigin}/skills/memwal-install`
+    const projectInstallPrompt = `Run \`curl -sL ${projectInstallPromptUrl}\` and use the returned instructions to install Walrus Memory in this project.`
     const installCommand = pkgManager === 'npm' ? 'npm install @mysten-incubation/memwal' :
         pkgManager === 'pnpm' ? 'pnpm add @mysten-incubation/memwal' :
         pkgManager === 'yarn' ? 'yarn add @mysten-incubation/memwal' :
@@ -907,6 +913,25 @@ const result = await generateText({
                 </div>
 
 
+                {/* Project install prompt */}
+                <Card
+                    className="dashboard-quickstart-card dashboard-project-install-card"
+                    title="Install Walrus Memory"
+                    subtitle="Copy one prompt into Claude Desktop, ChatGPT Desktop, Cursor, Codex, or another AI client with project access"
+                >
+                    <div className="dashboard-quickstart-codewrap">
+                        <button
+                            className="btn btn-secondary btn-sm dashboard-quickstart-copy"
+                            onClick={() => copyToClipboard(projectInstallPrompt, 'project-install-prompt')}
+                            aria-label="Copy project install prompt"
+                        >
+                            <Copy size={14} />
+                            <span className="dashboard-quickstart-copy-label">{copied === 'project-install-prompt' ? 'done' : 'copy'}</span>
+                        </button>
+                        <pre className="demo-code-block dashboard-project-install-code"><code>$ {projectInstallPrompt}</code></pre>
+                    </div>
+                </Card>
+
                 {/* Current Delegate Key */}
                 {delegateKey && (
                     <Card
diff --git a/apps/app/src/pages/LandingPage.tsx b/apps/app/src/pages/LandingPage.tsx
index 71901a2e..0df48e51 100644
--- a/apps/app/src/pages/LandingPage.tsx
+++ b/apps/app/src/pages/LandingPage.tsx
@@ -15,7 +15,8 @@ import {
     useWallets,
 } from '@mysten/dapp-kit'
 import { isEnokiWallet, type EnokiWallet, type AuthProvider } from '@mysten/enoki'
-import { useRef, useEffect, useCallback } from 'react'
+import { Check, Copy } from 'lucide-react'
+import { useRef, useEffect, useCallback, useState } from 'react'
 import { useNavigate } from 'react-router-dom'
 import { config } from '../config'
 import { trackEvent } from '../utils/analytics'
@@ -25,6 +26,7 @@ type AuthMethod = 'enoki' | 'wallet' | null
 const AUTH_METHOD_KEY = 'memwal_auth_method'
 const MARKETING_ASSET_VERSION = 'walm61-20260529c'
 const marketingAsset = (path: string) => `${path}?v=${MARKETING_ASSET_VERSION}`
+const DEFAULT_INSTALL_ORIGIN = 'https://memory.walrus.xyz'
 
 function persistAuthMethod(method: AuthMethod) {
     if (method) {
@@ -40,6 +42,23 @@ function getPersistedAuthMethod(): AuthMethod {
     return null
 }
 
+async function writeTextToClipboard(text: string) {
+    if (navigator.clipboard?.writeText) {
+        await navigator.clipboard.writeText(text)
+        return
+    }
+
+    const textarea = document.createElement('textarea')
+    textarea.value = text
+    textarea.setAttribute('readonly', '')
+    textarea.style.position = 'fixed'
+    textarea.style.left = '-9999px'
+    document.body.appendChild(textarea)
+    textarea.select()
+    document.execCommand('copy')
+    document.body.removeChild(textarea)
+}
+
 const signinLogos = [
     { label: 'Allium', src: marketingAsset('/walrus-trust-allium.png'), w: 143 },
     { label: 'inflectiv', src: marketingAsset('/walrus-trust-inflectiv.svg'), w: 162 },
@@ -66,6 +85,15 @@ export default function LandingPage() {
 
     const walletClickedRef = useRef(false)
     const signInTrackedRef = useRef(false)
+    const copyResetRef = useRef<number | null>(null)
+    const [installPromptCopied, setInstallPromptCopied] = useState(false)
+
+    const installOrigin =
+        typeof window === 'undefined'
+            ? DEFAULT_INSTALL_ORIGIN
+            : window.location.origin
+    const installPromptUrl = `${installOrigin}/skills/memwal-install`
+    const installPrompt = `Run \`curl -sL ${installPromptUrl}\` and use the returned instructions to install Walrus Memory in this project.`
 
     const updateAuthMethod = useCallback((method: AuthMethod) => {
         persistAuthMethod(method)
@@ -100,45 +128,95 @@ export default function LandingPage() {
         trackEvent('sign_in_start', { auth_method: 'wallet', location: 'sign_in' })
     }
 
+    const handleInstallPromptCopy = async () => {
+        await writeTextToClipboard(installPrompt)
+        setInstallPromptCopied(true)
+        trackEvent('copy_action', {
+            label: 'project-install-prompt',
+            location: 'landing',
+        })
+        if (copyResetRef.current !== null) {
+            window.clearTimeout(copyResetRef.current)
+        }
+        copyResetRef.current = window.setTimeout(() => {
+            setInstallPromptCopied(false)
+            copyResetRef.current = null
+        }, 1800)
+    }
+
+    useEffect(() => {
+        return () => {
+            if (copyResetRef.current !== null) {
+                window.clearTimeout(copyResetRef.current)
+            }
+        }
+    }, [])
+
     return (
         <div className="wm-page">
-        <div className="wm-signin wm-signin--page" role="main" aria-label="Sign in">
-            <img className="wm-signin-aurora" src={marketingAsset('/walrus-signin-bg.png')} alt="" aria-hidden="true" />
-            <div className="wm-signin-inner">
-                <div className="wm-signin-card">
-                    <img className="wm-signin-logo" src={marketingAsset('/walrus-memory-logo.svg')} alt="Walrus Memory" />
-                    <p className="wm-signin-sub">Sign in to start building with portable memory across apps and workflows.</p>
-                    {hasEnokiConfig && googleWallet && (
-                        <button className="wm-signin-google" onClick={handleEnokiConnect}>
-                            <svg width="20" height="20" viewBox="0 0 24 24" aria-hidden="true">
-                                <path d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92a5.06 5.06 0 0 1-2.2 3.32v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.1z" fill="#4285F4" />
-                                <path d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z" fill="#34A853" />
-                                <path d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z" fill="#FBBC05" />
-                                <path d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z" fill="#EA4335" />
-                            </svg>
-                            Continue with Google
-                        </button>
-                    )}
-                    <div onClick={handleWalletClick} className="wm-signin-wallet">
-                        <ConnectButton
-                            connectText="Connect wallet"
-                            walletFilter={(wallet) => !isEnokiWallet(wallet)}
-                        />
+            <div className="wm-signin wm-signin--page" role="main" aria-label="Sign in">
+                <img className="wm-signin-aurora" src={marketingAsset('/walrus-signin-bg.png')} alt="" aria-hidden="true" />
+                <div className="wm-signin-inner">
+                    <div className="wm-signin-card">
+                        <img className="wm-signin-logo" src={marketingAsset('/walrus-memory-logo.svg')} alt="Walrus Memory" />
+                        <p className="wm-signin-sub">Sign in to start building with portable memory across apps and workflows.</p>
+                        {hasEnokiConfig && googleWallet && (
+                            <button className="wm-signin-google" onClick={handleEnokiConnect}>
+                                <svg width="20" height="20" viewBox="0 0 24 24" aria-hidden="true">
+                                    <path d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92a5.06 5.06 0 0 1-2.2 3.32v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.1z" fill="#4285F4" />
+                                    <path d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z" fill="#34A853" />
+                                    <path d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z" fill="#FBBC05" />
+                                    <path d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z" fill="#EA4335" />
+                                </svg>
+                                Continue with Google
+                            </button>
+                        )}
+                        <div onClick={handleWalletClick} className="wm-signin-wallet">
+                            <ConnectButton
+                                connectText="Connect wallet"
+                                walletFilter={(wallet) => !isEnokiWallet(wallet)}
+                            />
+                        </div>
+                        <p className="wm-signin-tos">
+                            By continuing, you agree to our <a href={config.termsOfServiceUrl} target="_blank" rel="noopener noreferrer">Terms of Service</a> and <a href={config.privacyPolicyUrl} target="_blank" rel="noopener noreferrer">Privacy Policy</a>
+                        </p>
                     </div>
-                    <p className="wm-signin-tos">
-                        By continuing, you agree to our <a href={config.termsOfServiceUrl} target="_blank" rel="noopener noreferrer">Terms of Service</a> and <a href={config.privacyPolicyUrl} target="_blank" rel="noopener noreferrer">Privacy Policy</a>
-                    </p>
-                </div>
-                <div className="wm-signin-trusted" aria-hidden="true">
-                    <h2>Trusted by teams<br />building <span>reliable</span><br />AI systems</h2>
-                    <div className="wm-signin-logos">
-                        {signinLogos.map((logo) => (
-                            <img key={logo.label} src={logo.src} alt={logo.label} style={{ width: `${logo.w}px` }} />
-                        ))}
+                    <div className="wm-signin-trusted" aria-hidden="true">
+                        <h2>Trusted by teams<br />building <span>reliable</span><br />AI systems</h2>
+                        <div className="wm-signin-logos">
+                            {signinLogos.map((logo) => (
+                                <img key={logo.label} src={logo.src} alt={logo.label} style={{ width: `${logo.w}px` }} />
+                            ))}
+                        </div>
                     </div>
                 </div>
             </div>
-        </div>
+            <section className="wm-install-prompt" aria-labelledby="wm-install-prompt-title">
+                <div className="wm-install-prompt-inner">
+                    <div className="wm-install-prompt-copy">
+                        <p className="wm-install-prompt-eyebrow">// WALRUS MEMORY INSTALL</p>
+                        <h2 id="wm-install-prompt-title">Paste this into your AI client.</h2>
+                        <p>
+                            One short prompt tells Claude Desktop, ChatGPT Desktop, Cursor, Codex, and other AI clients with project access how to wire Walrus Memory into your project.
+                        </p>
+                    </div>
+                    <div className="wm-install-prompt-panel">
+                        <div className="wm-install-prompt-panel-head">
+                            <span>install-prompt</span>
+                            <button
+                                type="button"
+                                className="wm-install-prompt-copy-button"
+                                onClick={handleInstallPromptCopy}
+                                aria-label={installPromptCopied ? 'Install prompt copied' : 'Copy install prompt'}
+                            >
+                                {installPromptCopied ? <Check size={16} aria-hidden="true" /> : <Copy size={16} aria-hidden="true" />}
+                                {installPromptCopied ? 'Copied' : 'Copy prompt'}
+                            </button>
+                        </div>
+                        <pre className="wm-install-prompt-code"><code>$ {installPrompt}</code></pre>
+                    </div>
+                </div>
+            </section>
         </div>
     )
 }

From a10b7b7af79a586ab9e06d7a2ec3cc9bea7410dd Mon Sep 17 00:00:00 2001
From: Harry Phan <phanhoangvinhhien@gmail.com>
Date: Thu, 4 Jun 2026 14:07:29 +0700
Subject: [PATCH 4/8] fix(mcp): point defaults at memory.walrus.xyz + rename
 OAuth-reserved state param (WALM-86)

- MCP defaults and env presets now resolve to memory.walrus.xyz (prod) and
  relayer-staging / staging.memory.walrus.xyz (staging), removing the temporary
  Cloudflare memwal.ai redirect dependency. dev preset unchanged.
- Rename the connect-URL CSRF query param `state` -> `connectState`. `state` is
  a reserved OAuth 2.0 response parameter: the consent page reuses the current
  page URL as the Google/Enoki redirect_uri, and Google rejects any redirect_uri
  carrying a reserved param ("invalid_request: Invalid redirect_uri contains
  reserved response param state"). The callback POST body field stays `state`;
  ConnectMcp reads `connectState` with a `state` fallback for older bridges.
---
 apps/app/src/pages/ConnectMcp.tsx | 11 ++++++++++-
 packages/mcp/src/auth-required.ts |  5 +++--
 packages/mcp/src/index.ts         | 14 +++++++-------
 packages/mcp/src/login.ts         | 16 ++++++++++++----
 services/server/src/mcp_proxy.rs  |  2 +-
 5 files changed, 33 insertions(+), 15 deletions(-)

diff --git a/apps/app/src/pages/ConnectMcp.tsx b/apps/app/src/pages/ConnectMcp.tsx
index a53923d0..386fd38d 100644
--- a/apps/app/src/pages/ConnectMcp.tsx
+++ b/apps/app/src/pages/ConnectMcp.tsx
@@ -9,6 +9,7 @@
  *               &delegateAddress=<0x-prefixed Sui address>
  *               &label=<URL-encoded label>
  *               &relayer=<URL-encoded relayer base URL>
+ *               &connectState=<64-hex CSRF token>  (legacy bridges: `state`)
  *
  * Flow:
  *   1. Render consent screen — show requested permissions + key fingerprint.
@@ -110,8 +111,16 @@ export default function ConnectMcp() {
      * in the callback POST — the bridge constant-time compares it to defeat
      * cross-origin CSRF (audit C2). Empty string if absent (older bridge);
      * the bridge will then reject our callback with 400.
+     *
+     * Read from `connectState` (current bridge) with a fallback to the legacy
+     * `state` param. The bridge renamed this param away from `state` because
+     * `state` is a reserved OAuth 2.0 response parameter: when this page starts
+     * Enoki/Google sign-in it reuses the current URL as the OAuth redirect_uri,
+     * and Google rejects any redirect_uri carrying a reserved param (WALM-86:
+     * "Access blocked: invalid_request — Invalid redirect_uri contains reserved
+     * response param state"). We still echo it back in the POST body as `state`.
      */
-    const state = params.get('state') ?? ''
+    const state = params.get('connectState') ?? params.get('state') ?? ''
 
     const [step, setStep] = useState<Step>('consent')
     const [errorMsg, setErrorMsg] = useState('')
diff --git a/packages/mcp/src/auth-required.ts b/packages/mcp/src/auth-required.ts
index 1af3b6a4..e1d935bc 100644
--- a/packages/mcp/src/auth-required.ts
+++ b/packages/mcp/src/auth-required.ts
@@ -153,7 +153,8 @@ function readStdinLines(onLine: (line: string) => void): Promise<void> {
 
 /** Config passed in by the entry point (`index.ts`) so the login flow uses
  * the same web/relayer URLs as the rest of the CLI (e.g. `--dev` →
- * dashboard at `https://dev.memwal.ai`, not the prod default). */
+ * dashboard at `https://dev.memwal.ai`, not the prod default at
+ * `https://memory.walrus.xyz`). */
 export interface AuthRequiredConfig {
     relayerUrl: string;
     webUrl: string;
@@ -211,7 +212,7 @@ async function handleLoginToolCall(
         // Fire loginFlow but DO NOT await — it runs in the background.
         // openBrowser: false because (a) child-process spawning a browser is
         // unreliable across MCP clients, and (b) macOS `open <url>` often
-        // foregrounds an existing memwal.ai tab instead of navigating to
+        // foregrounds an existing memory.walrus.xyz tab instead of navigating to
         // the full /connect/mcp?... URL — so user lands on the homepage,
         // not the consent screen. The agent surfaces the clickable URL
         // from the tool result instead.
diff --git a/packages/mcp/src/index.ts b/packages/mcp/src/index.ts
index 3012be58..74fc2e99 100644
--- a/packages/mcp/src/index.ts
+++ b/packages/mcp/src/index.ts
@@ -33,9 +33,9 @@ interface ParsedArgs {
 /** Per-environment URL shortcuts. `--dev`/`--staging`/`--local` set both
  *  relayer + web in one flag. Explicit `--relayer` / `--web-url` override. */
 const ENV_PRESETS: Record<string, { relayer: string; web: string }> = {
-    prod: { relayer: "https://relayer.memwal.ai", web: "https://memwal.ai" },
+    prod: { relayer: "https://relayer.memory.walrus.xyz", web: "https://memory.walrus.xyz" },
     dev: { relayer: "https://relayer.dev.memwal.ai", web: "https://dev.memwal.ai" },
-    staging: { relayer: "https://relayer.staging.memwal.ai", web: "https://staging.memwal.ai" },
+    staging: { relayer: "https://relayer-staging.memory.walrus.xyz", web: "https://staging.memory.walrus.xyz" },
     local: { relayer: "http://127.0.0.1:8000", web: "http://localhost:5173" },
 };
 
@@ -114,9 +114,9 @@ export async function main(argv: string[] = process.argv.slice(2)): Promise<void
 
     // Resolve URLs: CLI > env > default.
     const relayerUrl =
-        args.relayerUrl ?? process.env.MEMWAL_SERVER_URL ?? "https://relayer.memwal.ai";
+        args.relayerUrl ?? process.env.MEMWAL_SERVER_URL ?? "https://relayer.memory.walrus.xyz";
     const webUrl =
-        args.webUrl ?? process.env.MEMWAL_WEB_URL ?? "https://memwal.ai";
+        args.webUrl ?? process.env.MEMWAL_WEB_URL ?? "https://memory.walrus.xyz";
     // Label is the on-chain delegate-key name shown in the dashboard. We
     // default to a generic value at registration time — the bridge updates
     // it to the actual client's `clientInfo.name` ("Cursor", "Claude",
@@ -176,7 +176,7 @@ export async function main(argv: string[] = process.argv.slice(2)): Promise<void
             // Pass the resolved URLs through so `memwal_login` (called as a
             // tool from the MCP client) opens the correct dashboard. Before
             // this fix `--dev` was silently dropped here and the flow always
-            // routed to prod (https://memwal.ai).
+            // routed to prod (https://memory.walrus.xyz).
             await runAuthRequiredServer({ relayerUrl, webUrl, label, namespace });
             return;
         }
@@ -236,11 +236,11 @@ function printHelp(): void {
         "",
         "Options:",
         "  --relayer <url>                  Override the relayer base URL.",
-        "                                   Default: https://relayer.memwal.ai",
+        "                                   Default: https://relayer.memory.walrus.xyz",
         "                                   (or saved value from credentials).",
         "  --web-url <url>                  Override the dashboard URL the",
         "                                   browser opens during login.",
-        "                                   Default: https://memwal.ai",
+        "                                   Default: https://memory.walrus.xyz",
         "  --label <text>                   Friendly delegate-key label",
         "                                   registered on-chain. Default:",
         '                                   "Walrus Memory MCP"',
diff --git a/packages/mcp/src/login.ts b/packages/mcp/src/login.ts
index fa5a12e0..ceb6a815 100644
--- a/packages/mcp/src/login.ts
+++ b/packages/mcp/src/login.ts
@@ -46,8 +46,8 @@ export interface LoginOptions {
 }
 
 const DEFAULTS: Required<Omit<LoginOptions, "label" | "onUrl">> & { label: string } = {
-    webUrl: process.env.MEMWAL_WEB_URL ?? "https://memwal.ai",
-    relayerUrl: process.env.MEMWAL_SERVER_URL ?? "https://relayer.memwal.ai",
+    webUrl: process.env.MEMWAL_WEB_URL ?? "https://memory.walrus.xyz",
+    relayerUrl: process.env.MEMWAL_SERVER_URL ?? "https://relayer.memory.walrus.xyz",
     label: process.env.MEMWAL_CLIENT_LABEL ?? "Walrus Memory MCP",
     timeoutMs: 5 * 60_000,
     openBrowser: true,
@@ -100,7 +100,7 @@ function stateEquals(a: string, b: string): boolean {
 }
 
 /**
- * Strip trailing slashes so `https://memwal.ai/` and `https://memwal.ai`
+ * Strip trailing slashes so `https://memory.walrus.xyz/` and `https://memory.walrus.xyz`
  * compare equal. The `Origin` request header never carries a trailing slash.
  */
 function normalizeOrigin(url: string): string {
@@ -191,7 +191,15 @@ export async function loginFlow(opts: LoginOptions = {}): Promise<MemWalCredenti
         `&delegateAddress=${encodeURIComponent(keypair.suiAddress)}` +
         `&label=${encodeURIComponent(cfg.label)}` +
         `&relayer=${encodeURIComponent(cfg.relayerUrl)}` +
-        `&state=${stateToken}`;
+        // NOTE: the query param is named `connectState`, NOT `state`. `state`
+        // is a reserved OAuth 2.0 response parameter — when the consent page
+        // kicks off Enoki/Google sign-in it reuses the current page URL as the
+        // OAuth `redirect_uri`, and Google rejects any redirect_uri that
+        // carries a reserved param (`Access blocked: invalid_request — Invalid
+        // redirect_uri contains reserved response param state`). See WALM-86.
+        // The callback POST *body* field stays `state` (localhost POST, never
+        // part of a redirect_uri, so no collision there).
+        `&connectState=${stateToken}`;
 
     note(`Opening browser to authorize this MCP client...`);
     note(`If your browser doesn't open, visit: ${connectUrl}`);
diff --git a/services/server/src/mcp_proxy.rs b/services/server/src/mcp_proxy.rs
index eb9c3bf4..7863b342 100644
--- a/services/server/src/mcp_proxy.rs
+++ b/services/server/src/mcp_proxy.rs
@@ -274,7 +274,7 @@ pub async fn messages_proxy(
 /// and DELETE (close session). The MailGate / Linear / Figma MCP servers
 /// all use this newer transport — clients just configure a single URL:
 ///
-///     claude mcp add --transport http memwal https://relayer.memwal.ai/api/mcp
+///     claude mcp add --transport http memwal https://relayer.memory.walrus.xyz/api/mcp
 ///
 /// We proxy verbatim to the sidecar's `/mcp` endpoint (whose SDK
 /// `StreamableHTTPServerTransport` does all the protocol heavy-lifting).

From ff6561b7bc0ef9ccfcf2dfbe9aedcfda3390d829 Mon Sep 17 00:00:00 2001
From: Harry Phan <phanhoangvinhhien@gmail.com>
Date: Thu, 4 Jun 2026 14:53:56 +0700
Subject: [PATCH 5/8] fix(app): pin Google OAuth redirect_uri to app root for
 MCP connect flow (WALM-86)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signing in with Google from /connect/mcp failed with redirect_uri_mismatch:
Enoki defaults its redirect_uri to window.location.href, so the dynamic
/connect/mcp?...&connectState=... URL was sent as the redirect_uri and never
matched a registered Authorized redirect URI (the dashboard works because its
redirect_uri is the already-registered app root).

- Pin the Google provider redirectUrl to `${origin}/` (the registered root),
  so MCP-connect Google sign-in reuses the same redirect_uri the dashboard
  uses — no Google Console change needed.
- Preserve the /connect/mcp request across the OAuth round-trip in
  sessionStorage; PostAuthRedirect re-opens /connect/mcp with the params
  restored after the redirect lands on the root. Cleared on success.
---
 apps/app/src/App.tsx              | 37 +++++++++++++++++++++++++++++--
 apps/app/src/pages/ConnectMcp.tsx | 17 ++++++++++++++
 2 files changed, 52 insertions(+), 2 deletions(-)

diff --git a/apps/app/src/App.tsx b/apps/app/src/App.tsx
index 8240b039..5e0e0586 100644
--- a/apps/app/src/App.tsx
+++ b/apps/app/src/App.tsx
@@ -181,7 +181,18 @@ function RegisterEnokiWallets() {
     const { unregister } = registerEnokiWallets({
       apiKey: config.enokiApiKey,
       providers: {
-        google: { clientId: config.googleClientId },
+        google: {
+          clientId: config.googleClientId,
+          // Pin the Google OAuth redirect_uri to the app origin root — a URL
+          // already registered for this client (the dashboard sign-in uses it,
+          // which is why dashboard Google login works). Enoki otherwise defaults
+          // to window.location.href, so signing in from
+          // /connect/mcp?...&connectState=... would send a redirect_uri with a
+          // non-registered path + query → Google rejects it (redirect_uri_mismatch).
+          // The /connect/mcp params survive the round-trip via sessionStorage
+          // (ConnectMcp persists them; PostAuthRedirect restores them). WALM-86.
+          redirectUrl: `${window.location.origin}/`,
+        },
       },
       client,
       network,
@@ -205,6 +216,28 @@ function RoutePending() {
   )
 }
 
+/** sessionStorage key holding an in-flight /connect/mcp request, so the flow
+ *  can resume after the Google OAuth redirect bounces through the app root.
+ *  Shared with ConnectMcp.tsx (kept as a literal there to avoid a circular import). */
+const MCP_CONNECT_STORAGE_KEY = 'memwal_mcp_connect'
+
+/** Lands here after a successful sign-in (the OAuth redirect_uri is the app
+ *  root). If a /connect/mcp flow was interrupted by that redirect, resume it
+ *  by restoring the saved query string; otherwise go to the dashboard. */
+function PostAuthRedirect() {
+  const pending = sessionStorage.getItem(MCP_CONNECT_STORAGE_KEY)
+  if (pending) {
+    // Consume once — prevents a redirect loop on later visits to `/`.
+    sessionStorage.removeItem(MCP_CONNECT_STORAGE_KEY)
+    try {
+      const params = JSON.parse(pending) as Record<string, string>
+      const qs = new URLSearchParams(params).toString()
+      if (qs) return <Navigate to={`/connect/mcp?${qs}`} replace />
+    } catch { /* fall through to dashboard */ }
+  }
+  return <Navigate to="/dashboard" replace />
+}
+
 function AppContent() {
   const currentAccount = useCurrentAccount()
   const autoConnectStatus = useAutoConnectWallet()
@@ -220,7 +253,7 @@ function AppContent() {
     <Routes>
       <Route path="/" element={
         authPending ? <RoutePending /> :
-        currentAccount ? <Navigate to="/dashboard" replace /> : <LandingPage />
+        currentAccount ? <PostAuthRedirect /> : <LandingPage />
       } />
       <Route path="/dashboard" element={requireAccount(<Dashboard />)} />
       <Route path="/setup" element={requireAccount(
diff --git a/apps/app/src/pages/ConnectMcp.tsx b/apps/app/src/pages/ConnectMcp.tsx
index 386fd38d..66152f56 100644
--- a/apps/app/src/pages/ConnectMcp.tsx
+++ b/apps/app/src/pages/ConnectMcp.tsx
@@ -237,6 +237,9 @@ export default function ConnectMcp() {
             setCallbackPayload(payload)
             setStep('callback')
             const delivered = await postCallback(payload)
+            // Flow done — drop the OAuth-resume breadcrumb so a later visit to
+            // `/` goes to the dashboard instead of looping back here.
+            sessionStorage.removeItem('memwal_mcp_connect')
             setStep('success')
             trackEvent('mcp_connect_complete', { callback_delivered: delivered })
         } catch (err) {
@@ -262,6 +265,20 @@ export default function ConnectMcp() {
         trackEvent('mcp_connect_failed', { error_type: 'invalid_request' })
     }, [paramsValid])
 
+    // Persist the connect request so it survives the Google OAuth redirect.
+    // Enoki's redirect_uri is pinned to the app root (App.tsx), so signing in
+    // with Google leaves this page and returns to `/` — losing the query
+    // string. App's PostAuthRedirect reads this back and re-opens
+    // /connect/mcp with the params restored. Keyed identically to the URL
+    // params (note `connectState`, not `state`). Cleared on success below.
+    useEffect(() => {
+        if (!paramsValid) return
+        sessionStorage.setItem(
+            'memwal_mcp_connect',
+            JSON.stringify({ port, publicKey, delegateAddress, label, relayer, connectState: state }),
+        )
+    }, [paramsValid, port, publicKey, delegateAddress, label, relayer, state])
+
     // If the wallet popup completes after we asked it to open, auto-proceed.
     useEffect(() => {
         if (!walletPickerOpen && currentAccount && step === 'consent') {

From 5f7748b81e2e70f35051d9e27445c8cd7e777118 Mon Sep 17 00:00:00 2001
From: Harry Phan <phanhoangvinhhien@gmail.com>
Date: Thu, 4 Jun 2026 15:20:26 +0700
Subject: [PATCH 6/8] =?UTF-8?q?chore(mcp):=20add=20changeset=20for=20WALM-?=
 =?UTF-8?q?86=20(domain=20+=20connectState)=20=E2=80=94=20patch=20bump=20t?=
 =?UTF-8?q?o=200.0.3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .changeset/mcp-domain-connectstate.md | 14 ++++++++++++++
 1 file changed, 14 insertions(+)
 create mode 100644 .changeset/mcp-domain-connectstate.md

diff --git a/.changeset/mcp-domain-connectstate.md b/.changeset/mcp-domain-connectstate.md
new file mode 100644
index 00000000..b56030d2
--- /dev/null
+++ b/.changeset/mcp-domain-connectstate.md
@@ -0,0 +1,14 @@
+---
+"@mysten-incubation/memwal-mcp": patch
+---
+
+Point the MCP client at memory.walrus.xyz and fix Google sign-in (WALM-86).
+
+- Default relayer/web URLs and `--prod`/`--staging` presets now resolve to
+  `memory.walrus.xyz` / `relayer.memory.walrus.xyz` (staging:
+  `staging.memory.walrus.xyz` / `relayer-staging.memory.walrus.xyz`), removing
+  the temporary Cloudflare `memwal.ai` redirect dependency.
+- Rename the connect-URL CSRF query param `state` → `connectState`. `state` is a
+  reserved OAuth 2.0 response parameter, so the consent page's redirect_uri was
+  rejected by Google (`invalid_request`). The callback POST body field is
+  unchanged.

From 2a68f5c488fbb12a82b96c0cd9fc10268bfa94b6 Mon Sep 17 00:00:00 2001
From: Harry Phan <phanhoangvinhhien@gmail.com>
Date: Thu, 4 Jun 2026 15:27:03 +0700
Subject: [PATCH 7/8] =?UTF-8?q?chore(mcp):=20bump=20version=20to=200.0.3?=
 =?UTF-8?q?=20(remove=20changeset=20=E2=80=94=20repo=20flow=20bumps=20pack?=
 =?UTF-8?q?age.json=20directly)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .changeset/mcp-domain-connectstate.md | 14 --------------
 packages/mcp/package.json             |  2 +-
 2 files changed, 1 insertion(+), 15 deletions(-)
 delete mode 100644 .changeset/mcp-domain-connectstate.md

diff --git a/.changeset/mcp-domain-connectstate.md b/.changeset/mcp-domain-connectstate.md
deleted file mode 100644
index b56030d2..00000000
--- a/.changeset/mcp-domain-connectstate.md
+++ /dev/null
@@ -1,14 +0,0 @@
----
-"@mysten-incubation/memwal-mcp": patch
----
-
-Point the MCP client at memory.walrus.xyz and fix Google sign-in (WALM-86).
-
-- Default relayer/web URLs and `--prod`/`--staging` presets now resolve to
-  `memory.walrus.xyz` / `relayer.memory.walrus.xyz` (staging:
-  `staging.memory.walrus.xyz` / `relayer-staging.memory.walrus.xyz`), removing
-  the temporary Cloudflare `memwal.ai` redirect dependency.
-- Rename the connect-URL CSRF query param `state` → `connectState`. `state` is a
-  reserved OAuth 2.0 response parameter, so the consent page's redirect_uri was
-  rejected by Google (`invalid_request`). The callback POST body field is
-  unchanged.
diff --git a/packages/mcp/package.json b/packages/mcp/package.json
index 8a8b8829..e5decc8d 100644
--- a/packages/mcp/package.json
+++ b/packages/mcp/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@mysten-incubation/memwal-mcp",
-    "version": "0.0.2",
+    "version": "0.0.3",
     "description": "Walrus Memory MCP client — single-binary stdio MCP server that bridges Cursor / Claude Desktop / Antigravity / Claude Code to the Walrus Memory relayer. Handles browser-based wallet login on first run.",
     "type": "module",
     "engines": {

From 6a857d725cfc497e1b4bbe92a1344b85724ccffa Mon Sep 17 00:00:00 2001
From: ducnmm <ducnmm@ducnmms-MacBook-Pro.local>
Date: Thu, 4 Jun 2026 15:51:15 +0700
Subject: [PATCH 8/8] Add MCP setup skill and protect analytics secrets

---
 apps/app/public/skills/mcp-setup             | 341 +++++++++++++++++++
 apps/app/public/skills/memwal-install        | 117 +------
 apps/app/src/components/Card.tsx             |   7 +-
 apps/app/src/components/SecretValueInput.tsx |  37 ++
 apps/app/src/index.css                       | 233 ++-----------
 apps/app/src/pages/Dashboard.tsx             |  44 +--
 apps/app/src/pages/LandingPage.tsx           |  80 +----
 apps/app/src/pages/Playground.tsx            |   8 +-
 apps/app/src/pages/SetupWizard.tsx           |   9 +-
 apps/app/src/utils/analytics.ts              |  48 ++-
 10 files changed, 493 insertions(+), 431 deletions(-)
 create mode 100644 apps/app/public/skills/mcp-setup
 create mode 100644 apps/app/src/components/SecretValueInput.tsx

diff --git a/apps/app/public/skills/mcp-setup b/apps/app/public/skills/mcp-setup
new file mode 100644
index 00000000..395d6f4a
--- /dev/null
+++ b/apps/app/public/skills/mcp-setup
@@ -0,0 +1,341 @@
+---
+name: mcp-setup
+description: >-
+  Set up Walrus Memory in MCP-aware AI clients such as Claude Desktop,
+  Cursor, Codex, Claude Code, ChatGPT, Antigravity, or another MCP host.
+  This is for normal users who want portable memory in their AI client.
+license: Apache-2.0
+metadata:
+  author: Walrus Memory
+  version: "1.0"
+  requires: Node.js 20+ for local stdio MCP clients; a Sui-compatible wallet
+---
+
+# Walrus Memory MCP - One-Prompt Setup
+
+## Purpose
+
+Set up Walrus Memory for a normal user inside their AI client. This flow is for
+Claude Desktop, Cursor, Codex, Claude Code, ChatGPT, Antigravity, and other
+MCP-aware clients.
+
+When invoked through the dashboard prompt:
+
+```text
+Run `curl -sL https://memory.walrus.xyz/skills/mcp-setup` and use the
+returned instructions to connect Walrus Memory to this AI client.
+```
+
+fetch this file, configure the user's AI client for Walrus Memory MCP, sign in
+with their Sui wallet, restart the client, and verify memory works.
+
+## Scope
+
+Do this:
+
+- connect Walrus Memory MCP to the user's AI client
+- help the user sign in through `memwal_login` or the MCP package login command
+- verify `memwal_remember` and `memwal_recall`
+
+Do not do this in this flow:
+
+- configure MCP only because a code project exists
+- install the Walrus Memory SDK or edit app source code
+
+If the user explicitly asks for SDK or app-code integration, stop and say this
+one-prompt setup is for MCP clients. Point them to the SDK docs or ask whether
+they want a separate developer integration.
+
+## Rules
+
+1. Treat MCP client setup as the primary goal.
+2. Ask which AI client to configure if the user did not name one.
+3. Detect whether this AI client can execute local shell commands and edit
+   local user config files on the user's machine.
+4. If this AI client cannot access the user's local terminal or filesystem
+   (common in Claude Desktop and other desktop chats), do not pretend setup is
+   automatic. Give the exact command/config for the user to run or paste
+   manually, then wait for them to report the result.
+5. If local shell/file access is available, show the command or config file
+   before changing user-level MCP config.
+6. Merge config into existing `mcpServers`; do not remove other MCP servers.
+7. Never commit or print real delegate private keys from
+   `~/.memwal/credentials.json`.
+8. Prefer local stdio MCP for clients that support `command + args`.
+9. Use remote Streamable HTTP only when the client clearly supports remote MCP
+   servers with custom headers.
+10. ChatGPT custom MCP apps use a remote MCP flow. Do not invent a local `npx`
+   ChatGPT Desktop config.
+11. After config changes, tell the user to fully quit and reopen the AI client.
+12. Stop at the first failure and report the exact blocker.
+
+## Execution modes
+
+### Guided mode
+
+Use guided mode when the AI client cannot directly run terminal commands or
+write local files on the user's machine. This is common for Claude Desktop,
+ChatGPT, and other desktop/web chat clients.
+
+In guided mode:
+
+- tell the user which config file to open
+- show the exact JSON/TOML block to paste
+- show the exact terminal command to run, if needed
+- ask the user to confirm what happened before continuing
+- do not say that you installed or configured anything yourself
+
+### Agentic mode
+
+Use agentic mode only when this session has explicit local shell and filesystem
+access on the user's machine.
+
+In agentic mode:
+
+- inspect existing config before editing it
+- preserve other MCP servers
+- show a short summary of the edit
+- still ask the user to restart the AI client manually
+
+## Step 1 - Check Node.js
+
+First decide whether you are in guided mode or agentic mode.
+
+For local stdio clients, Node.js must be checked on the user's machine. In
+guided mode, ask the user to run:
+
+```bash
+node -v
+```
+
+In agentic mode, run it yourself. Walrus Memory MCP requires Node.js 20 or
+newer. If Node.js is missing or older than 20, tell the user to install Node.js
+20+ from https://nodejs.org/ and stop.
+
+The user also needs a Sui-compatible wallet available in the browser for login.
+
+## Step 2 - Pick the client
+
+If the user did not name a client, ask:
+
+```text
+Which AI client should I connect to Walrus Memory: Claude Desktop, Cursor,
+Codex, Claude Code, ChatGPT, or another MCP client?
+```
+
+Use local stdio config for:
+
+- Claude Desktop
+- Cursor
+- Codex
+- Claude Code
+- Antigravity or another local-command MCP host
+
+Use remote MCP guidance for:
+
+- ChatGPT custom MCP apps
+- clients that do not support local `command + args`
+
+## Step 3 - Configure local stdio MCP
+
+Use this MCP server command:
+
+```bash
+npx -y @mysten-incubation/memwal-mcp
+```
+
+### Cursor
+
+Edit `~/.cursor/mcp.json` and merge:
+
+```json
+{
+  "mcpServers": {
+    "memwal": {
+      "command": "npx",
+      "args": ["-y", "@mysten-incubation/memwal-mcp"]
+    }
+  }
+}
+```
+
+### Claude Desktop
+
+Edit:
+
+- macOS: `~/Library/Application Support/Claude/claude_desktop_config.json`
+- Windows: `%APPDATA%\Claude\claude_desktop_config.json`
+
+Merge:
+
+```json
+{
+  "mcpServers": {
+    "memwal": {
+      "command": "npx",
+      "args": ["-y", "@mysten-incubation/memwal-mcp"]
+    }
+  }
+}
+```
+
+### Codex
+
+Edit `~/.codex/config.toml` and append:
+
+```toml
+[mcp_servers.memwal]
+command = "npx"
+args = ["-y", "@mysten-incubation/memwal-mcp"]
+```
+
+### Claude Code
+
+Run:
+
+```bash
+claude mcp add --scope user memwal -- npx -y @mysten-incubation/memwal-mcp
+```
+
+Verify:
+
+```bash
+claude mcp list
+```
+
+### Other local MCP clients
+
+Add:
+
+- name: `memwal`
+- command: `npx`
+- args: `["-y", "@mysten-incubation/memwal-mcp"]`
+
+## Step 4 - Sign in
+
+Prefer inline login after the client is configured and restarted:
+
+```text
+Use memwal_login to sign me in to Walrus Memory.
+```
+
+The tool opens a browser flow. The user connects their Sui wallet and approves
+the delegate key. Credentials are saved locally at:
+
+```text
+~/.memwal/credentials.json
+```
+
+If inline login is not available yet, run manual login in a real terminal:
+
+```bash
+npx -y @mysten-incubation/memwal-mcp login --prod
+```
+
+## Step 5 - Restart the client
+
+Fully quit and reopen the AI client. On macOS, use `Cmd+Q`; closing the window
+is not enough. The first start may take 5-10 seconds while `npx` fetches the
+package.
+
+## Step 6 - Verify tools
+
+Ask the AI client:
+
+```text
+What MCP tools do you have available?
+```
+
+Expected Walrus Memory tools:
+
+- `memwal_remember`
+- `memwal_recall`
+- `memwal_analyze`
+- `memwal_restore`
+- `memwal_login`
+- `memwal_logout`
+
+If only `memwal_login` works, credentials are missing. Run `memwal_login` or
+the manual login command again.
+
+## Step 7 - Verify memory
+
+Ask:
+
+```text
+Use memwal_remember to save: "My favorite programming language is Rust and I drink black coffee in the mornings."
+```
+
+Wait a few seconds, then ask:
+
+```text
+Use memwal_recall to search for: "what is my favorite language?"
+```
+
+The client should retrieve the saved Rust memory.
+
+## ChatGPT
+
+ChatGPT custom MCP apps use remote MCP servers, not a local `npx` stdio config.
+
+If the user's ChatGPT account supports custom MCP apps / developer mode:
+
+1. Confirm they can create a custom MCP app in ChatGPT settings.
+2. Use this remote MCP endpoint:
+
+```text
+https://relayer.memory.walrus.xyz/api/mcp
+```
+
+3. Authenticate with headers:
+
+```text
+Authorization: Bearer <delegatePrivateKey>
+x-memwal-account-id: <accountId>
+```
+
+The values come from `~/.memwal/credentials.json` after a successful
+`memwal-mcp login --prod`.
+
+If ChatGPT cannot attach the required headers or the user's plan/workspace does
+not allow custom MCP apps, explain the blocker and offer Claude Desktop,
+Cursor, Codex, or Claude Code as the local MCP path.
+
+## Remote MCP / Streamable HTTP
+
+Use this only when a client supports remote MCP servers with custom headers:
+
+```json
+{
+  "mcpServers": {
+    "memwal": {
+      "url": "https://relayer.memory.walrus.xyz/api/mcp",
+      "headers": {
+        "Authorization": "Bearer <YOUR_DELEGATE_PRIVATE_KEY>",
+        "x-memwal-account-id": "<YOUR_ACCOUNT_ID>"
+      }
+    }
+  }
+}
+```
+
+Treat the bearer token like an API key. Do not save it in a repo file.
+
+## Troubleshooting
+
+| Symptom | Fix |
+| --- | --- |
+| `node: command not found` | Install Node.js 20+ from https://nodejs.org/. |
+| `npx` fails | Confirm Node/npm is installed and internet access works. |
+| No Walrus Memory tools after restart | Check the MCP config path and fully restart the client. |
+| Only `memwal_login` works | Credentials are missing. Run `memwal_login` or `npx -y @mysten-incubation/memwal-mcp login --prod`. |
+| Memory tools return 401 | The delegate key may be stale or revoked. Run `npx -y @mysten-incubation/memwal-mcp login --prod` again. |
+| User wants to sign out | Run `npx -y @mysten-incubation/memwal-mcp --logout`. This removes local credentials but does not revoke the on-chain delegate key. |
+
+Finish by reporting:
+
+- AI client configured
+- config file changed or command run
+- whether login succeeded
+- whether `memwal_remember` / `memwal_recall` passed
+- any restart or follow-up the user still needs
diff --git a/apps/app/public/skills/memwal-install b/apps/app/public/skills/memwal-install
index 2a826280..fefbeb6c 100644
--- a/apps/app/public/skills/memwal-install
+++ b/apps/app/public/skills/memwal-install
@@ -1,109 +1,16 @@
-Install Walrus Memory in this project.
+---
+name: memwal-install
+description: Legacy alias for the Walrus Memory MCP setup skill.
+license: Apache-2.0
+metadata:
+  author: Walrus Memory
+  version: "1.0"
+---
 
-You are operating inside a user's existing code project. Do not configure this AI client's MCP settings, and do not install `@mysten-incubation/memwal-mcp` unless the user explicitly asks for an AI-client MCP integration. The goal is to wire Walrus Memory into the app/repo itself.
+# Walrus Memory MCP Setup
 
-Goal:
-- Add the Walrus Memory SDK to the current project.
-- Keep credentials server-side in environment variables.
-- Add the smallest useful integration for the project's existing stack.
-- Run the project's normal checks and explain exactly how the user can verify memory works.
+This route is a compatibility alias. Use the MCP setup skill instead:
 
-First inspect the project:
-- Detect the package manager and framework (`package.json`, lockfiles, `pyproject.toml`, `requirements.txt`, app/router structure, API routes, AI provider usage).
-- Prefer TypeScript/JavaScript instructions when a `package.json` exists.
-- Prefer Python instructions when the project is Python-only.
-- If the project already uses the Vercel AI SDK, LangChain, OpenAI SDK, or an agent framework, integrate Walrus Memory at the nearest existing model/tool boundary instead of creating an unrelated demo.
-
-Install packages:
-- npm: `npm install @mysten-incubation/memwal`
-- pnpm: `pnpm add @mysten-incubation/memwal`
-- yarn: `yarn add @mysten-incubation/memwal`
-- bun: `bun add @mysten-incubation/memwal`
-- Python: `pip install memwal`
-
-Optional packages:
-- For Vercel AI SDK middleware, add `ai` if the project does not already have it.
-- For Python OpenAI integrations, use `pip install memwal[openai]`.
-- For Python LangChain integrations, use `pip install memwal[langchain]`.
-- For the TypeScript manual client flow only, add `@mysten/sui @mysten/seal @mysten/walrus`.
-
-Environment variables:
-- Add placeholders to the project's env example file if one exists.
-- Do not commit real secrets.
-- Use these names unless the project has an established config convention:
-
-MEMWAL_PRIVATE_KEY=
-MEMWAL_ACCOUNT_ID=
-MEMWAL_SERVER_URL=https://relayer.memory.walrus.xyz
-MEMWAL_NAMESPACE=default
-
-Tell the user to get `MEMWAL_PRIVATE_KEY` and `MEMWAL_ACCOUNT_ID` from the Walrus Memory dashboard: https://memory.walrus.xyz/dashboard
-
-Recommended TypeScript helper:
-
-```ts
-import { MemWal } from "@mysten-incubation/memwal";
-
-export function createMemWal(namespace = process.env.MEMWAL_NAMESPACE ?? "default") {
-  const key = process.env.MEMWAL_PRIVATE_KEY;
-  const accountId = process.env.MEMWAL_ACCOUNT_ID;
-
-  if (!key || !accountId) {
-    throw new Error("Walrus Memory is not configured. Set MEMWAL_PRIVATE_KEY and MEMWAL_ACCOUNT_ID.");
-  }
-
-  return MemWal.create({
-    key,
-    accountId,
-    serverUrl: process.env.MEMWAL_SERVER_URL ?? "https://relayer.memory.walrus.xyz",
-    namespace,
-  });
-}
+```text
+Run `curl -sL https://memory.walrus.xyz/skills/mcp-setup` and use the returned instructions to connect Walrus Memory to this AI client.
 ```
-
-Recommended Vercel AI SDK integration:
-
-```ts
-import { withMemWal } from "@mysten-incubation/memwal/ai";
-
-const modelWithMemory = withMemWal(model, {
-  key: process.env.MEMWAL_PRIVATE_KEY!,
-  accountId: process.env.MEMWAL_ACCOUNT_ID!,
-  serverUrl: process.env.MEMWAL_SERVER_URL ?? "https://relayer.memory.walrus.xyz",
-  namespace: process.env.MEMWAL_NAMESPACE ?? "default",
-  autoSave: true,
-});
-```
-
-Recommended Python helper:
-
-```py
-import os
-from typing import Optional
-from memwal import MemWal
-
-def create_memwal(namespace: Optional[str] = None):
-    return MemWal.create(
-        key=os.environ["MEMWAL_PRIVATE_KEY"],
-        account_id=os.environ["MEMWAL_ACCOUNT_ID"],
-        server_url=os.environ.get("MEMWAL_SERVER_URL", "https://relayer.memory.walrus.xyz"),
-        namespace=namespace or os.environ.get("MEMWAL_NAMESPACE", "default"),
-    )
-```
-
-Wire it into the project:
-- For chat/agent apps, recall relevant memory before generation and save or analyze useful user facts after user messages.
-- For API routes, keep Walrus Memory calls on the server side.
-- For UI-only apps, add a server route/action first rather than exposing the private key to the browser.
-- For non-AI apps, add explicit `remember` and `recall` helpers around the workflow the user names.
-
-Verification:
-- Add or update a small smoke test, script, API route, or README snippet that remembers a test fact and recalls it.
-- Run the project's typecheck, tests, lint, or build commands that are already present.
-- If checks cannot run because credentials are missing, verify compilation and document the exact env vars the user must set.
-
-Finish by reporting:
-- Files changed.
-- Packages installed.
-- Env vars the user must set.
-- The command or app flow to verify Walrus Memory in this project.
diff --git a/apps/app/src/components/Card.tsx b/apps/app/src/components/Card.tsx
index d6672b1c..edb04068 100644
--- a/apps/app/src/components/Card.tsx
+++ b/apps/app/src/components/Card.tsx
@@ -1,6 +1,6 @@
-import type { CSSProperties, ReactNode } from 'react'
+import type { CSSProperties, HTMLAttributes, ReactNode } from 'react'
 
-interface CardProps {
+interface CardProps extends Omit<HTMLAttributes<HTMLDivElement>, 'title'> {
     /** Extra class(es) appended to the base `card` class (e.g. `dashboard-keys-card`, `demo-step`). */
     className?: string
     style?: CSSProperties
@@ -29,6 +29,7 @@ export function Card({
     leading,
     leadingRowClassName,
     children,
+    ...props
 }: CardProps) {
     const titleGroup = title != null || subtitle != null ? (
         <div>
@@ -47,7 +48,7 @@ export function Card({
     const hasHeader = title != null || subtitle != null || action != null || leading != null
 
     return (
-        <div className={className ? `card ${className}` : 'card'} style={style}>
+        <div {...props} className={className ? `card ${className}` : 'card'} style={style}>
             {hasHeader && (
                 <div className="card-header">
                     {headerLeft}
diff --git a/apps/app/src/components/SecretValueInput.tsx b/apps/app/src/components/SecretValueInput.tsx
new file mode 100644
index 00000000..b5425d57
--- /dev/null
+++ b/apps/app/src/components/SecretValueInput.tsx
@@ -0,0 +1,37 @@
+import type { InputHTMLAttributes } from 'react'
+
+interface SecretValueInputProps extends Omit<InputHTMLAttributes<HTMLInputElement>, 'children' | 'readOnly' | 'type' | 'value'> {
+    value: string
+    masked?: boolean
+    maskLength?: number
+}
+
+export function SecretValueInput({
+    value,
+    masked = false,
+    maskLength = 48,
+    className,
+    onFocus,
+    placeholder,
+    ...props
+}: SecretValueInputProps) {
+    return (
+        <input
+            {...props}
+            className={className ? `secret-value-input ${className}` : 'secret-value-input'}
+            type="text"
+            value={masked ? '' : value}
+            placeholder={masked ? '•'.repeat(maskLength) : placeholder}
+            readOnly
+            autoCapitalize="off"
+            autoComplete="off"
+            autoCorrect="off"
+            spellCheck={false}
+            data-analytics-redact="true"
+            onFocus={(event) => {
+                if (!masked) event.currentTarget.select()
+                onFocus?.(event)
+            }}
+        />
+    )
+}
diff --git a/apps/app/src/index.css b/apps/app/src/index.css
index e899c0f5..6cd13e1c 100644
--- a/apps/app/src/index.css
+++ b/apps/app/src/index.css
@@ -1222,6 +1222,33 @@ h1, h2, h3 {
   user-select: all;
 }
 
+.secret-value-input {
+  width: 100%;
+  min-width: 0;
+  border: 0;
+  background: transparent;
+  padding: 0;
+  color: inherit;
+  font-family: var(--font-mono);
+  font-size: inherit;
+  font-weight: inherit;
+  line-height: inherit;
+  letter-spacing: 0;
+  outline: none;
+  box-shadow: none;
+}
+
+.secret-value-input::placeholder {
+  color: inherit;
+  opacity: 1;
+}
+
+.secret-value-input:focus {
+  outline: 1px solid rgba(232, 255, 117, 0.55);
+  outline-offset: 4px;
+  border-radius: 4px;
+}
+
 .key-display .key-actions {
   display: flex;
   gap: 8px;
@@ -9671,49 +9698,6 @@ h1, h2, h3 {
   }
 }
 
-.dash-page .dashboard-project-install-code {
-  min-height: 96px !important;
-  padding: 24px 78px 24px 32px !important;
-  display: flex;
-  align-items: center;
-  white-space: pre-wrap;
-  word-break: break-word;
-}
-
-.dash-page .dashboard-project-install-card {
-  min-height: 0;
-  padding-bottom: 32px;
-}
-
-.dash-page .dashboard-project-install-card .card-header {
-  margin-bottom: 24px;
-}
-
-.dash-page .dashboard-project-install-card .dashboard-quickstart-copy {
-  top: 50%;
-  right: 20px;
-  transform: translateY(-50%);
-}
-
-.dash-page .dashboard-project-install-card .dashboard-quickstart-copy:hover:not(:disabled) {
-  transform: translateY(-50%);
-}
-
-@media (max-width: 860px) {
-  .dash-page .dashboard-project-install-code {
-    min-height: 112px !important;
-    padding: 22px 62px 22px 22px !important;
-  }
-
-  .dash-page .dashboard-project-install-card .card-header {
-    margin-bottom: 20px !important;
-  }
-
-  .dash-page .dashboard-project-install-card .dashboard-quickstart-copy {
-    right: 14px;
-  }
-}
-
 /* ── Sign-in screen (Figma 2556:112) ───────────────────────── */
 .wm-signin {
   position: fixed;
@@ -10002,169 +9986,6 @@ h1, h2, h3 {
   }
 }
 
-.wm-install-prompt {
-  position: relative;
-  z-index: 1;
-  background:
-    radial-gradient(90% 120% at 16% 8%, rgba(152, 239, 228, 0.16) 0%, rgba(152, 239, 228, 0) 52%),
-    linear-gradient(180deg, #050608 0%, #0b1114 100%);
-  color: #faf8f5;
-  padding: clamp(64px, 7vw, 112px) 0;
-  font-family: var(--font-sans);
-}
-
-.wm-install-prompt-inner {
-  width: min(1160px, calc(100% - 48px));
-  margin: 0 auto;
-  display: grid;
-  grid-template-columns: minmax(280px, 0.8fr) minmax(420px, 1.2fr);
-  gap: clamp(28px, 5vw, 72px);
-  align-items: center;
-}
-
-.wm-install-prompt-copy {
-  min-width: 0;
-}
-
-.wm-install-prompt-eyebrow {
-  margin: 0 0 16px;
-  color: #98efe4;
-  font-family: var(--font-mono);
-  font-size: 14px;
-  font-weight: 600;
-  line-height: 1;
-  letter-spacing: 0;
-}
-
-.wm-install-prompt-copy h2 {
-  margin: 0;
-  max-width: 520px;
-  color: #faf8f5;
-  font-size: clamp(42px, 5vw, 72px);
-  font-weight: 500;
-  line-height: 0.94;
-  letter-spacing: 0;
-}
-
-.wm-install-prompt-copy p:last-child {
-  margin: 22px 0 0;
-  max-width: 520px;
-  color: #b8bbbe;
-  font-size: clamp(17px, 1.5vw, 21px);
-  font-weight: 400;
-  line-height: 1.38;
-}
-
-.wm-install-prompt-panel {
-  min-width: 0;
-  border: 1px solid rgba(250, 248, 245, 0.14);
-  border-radius: 18px;
-  background:
-    linear-gradient(180deg, rgba(250, 248, 245, 0.08) 0%, rgba(250, 248, 245, 0.035) 100%),
-    rgba(0, 0, 0, 0.44);
-  box-shadow: 0 28px 90px rgba(0, 0, 0, 0.36);
-  overflow: hidden;
-}
-
-.wm-install-prompt-panel-head {
-  min-height: 64px;
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: 18px;
-  padding: 14px 16px 14px 22px;
-  border-bottom: 1px solid rgba(250, 248, 245, 0.12);
-}
-
-.wm-install-prompt-panel-head span {
-  color: #8f9294;
-  font-family: var(--font-mono);
-  font-size: 13px;
-  font-weight: 600;
-  line-height: 1;
-}
-
-.wm-install-prompt-copy-button {
-  min-height: 40px;
-  min-width: 132px;
-  padding: 0 16px;
-  border: 1px solid rgba(152, 239, 228, 0.5);
-  border-radius: 999px;
-  background: rgba(152, 239, 228, 0.13);
-  color: #faf8f5;
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  gap: 8px;
-  font-family: var(--font-sans);
-  font-size: 14px;
-  font-weight: 600;
-  line-height: 1;
-  letter-spacing: 0;
-  cursor: pointer;
-  transition: background 160ms ease, border-color 160ms ease, transform 160ms ease;
-}
-
-.wm-install-prompt-copy-button:hover {
-  border-color: #98efe4;
-  background: rgba(152, 239, 228, 0.2);
-  transform: translateY(-1px);
-}
-
-.wm-install-prompt-copy-button svg {
-  flex: 0 0 auto;
-}
-
-.wm-install-prompt-code {
-  margin: 0;
-  min-height: 150px;
-  padding: 28px;
-  color: #faf8f5;
-  font-family: var(--font-mono);
-  font-size: clamp(15px, 1.25vw, 18px);
-  font-weight: 500;
-  line-height: 1.55;
-  white-space: pre-wrap;
-  word-break: break-word;
-}
-
-.wm-install-prompt-code code {
-  font-family: inherit;
-  color: inherit;
-}
-
-@media (max-width: 900px) {
-  .wm-install-prompt {
-    padding: 56px 0 72px;
-  }
-
-  .wm-install-prompt-inner {
-    width: calc(100% - 40px);
-    grid-template-columns: 1fr;
-    gap: 28px;
-  }
-
-  .wm-install-prompt-copy h2 {
-    font-size: clamp(38px, 11vw, 56px);
-  }
-
-  .wm-install-prompt-panel-head {
-    min-height: auto;
-    flex-direction: column;
-    align-items: stretch;
-    padding: 18px;
-  }
-
-  .wm-install-prompt-copy-button {
-    width: 100%;
-  }
-
-  .wm-install-prompt-code {
-    min-height: 160px;
-    padding: 22px 18px;
-  }
-}
-
 /* Setup flow: align the create-key screen with the dashboard visual system. */
 .setup-classic {
   background: #000000;
diff --git a/apps/app/src/pages/Dashboard.tsx b/apps/app/src/pages/Dashboard.tsx
index 3b1f0443..f9750a66 100644
--- a/apps/app/src/pages/Dashboard.tsx
+++ b/apps/app/src/pages/Dashboard.tsx
@@ -23,6 +23,7 @@ SyntaxHighlighter.registerLanguage('javascript', js)
 SyntaxHighlighter.registerLanguage('python', python)
 import { useDelegateKey } from '../App'
 import { Card } from '../components/Card'
+import { SecretValueInput } from '../components/SecretValueInput'
 import { config } from '../config'
 import { getAnalyticsErrorType, trackEvent } from '../utils/analytics'
 import {
@@ -748,12 +749,6 @@ const result = await generateText({
     const docsHref = config.docsUrl || 'https://docs.memwal.ai'
     const githubHref = 'https://github.com/MystenLabs/memwal'
     const discordHref = 'https://discord.gg/walrusprotocol'
-    const appOrigin =
-        typeof window === 'undefined'
-            ? 'https://memory.walrus.xyz'
-            : window.location.origin
-    const projectInstallPromptUrl = `${appOrigin}/skills/memwal-install`
-    const projectInstallPrompt = `Run \`curl -sL ${projectInstallPromptUrl}\` and use the returned instructions to install Walrus Memory in this project.`
     const installCommand = pkgManager === 'npm' ? 'npm install @mysten-incubation/memwal' :
         pkgManager === 'pnpm' ? 'pnpm add @mysten-incubation/memwal' :
         pkgManager === 'yarn' ? 'yarn add @mysten-incubation/memwal' :
@@ -913,31 +908,13 @@ const result = await generateText({
                 </div>
 
 
-                {/* Project install prompt */}
-                <Card
-                    className="dashboard-quickstart-card dashboard-project-install-card"
-                    title="Install Walrus Memory"
-                    subtitle="Copy one prompt into Claude Desktop, ChatGPT Desktop, Cursor, Codex, or another AI client with project access"
-                >
-                    <div className="dashboard-quickstart-codewrap">
-                        <button
-                            className="btn btn-secondary btn-sm dashboard-quickstart-copy"
-                            onClick={() => copyToClipboard(projectInstallPrompt, 'project-install-prompt')}
-                            aria-label="Copy project install prompt"
-                        >
-                            <Copy size={14} />
-                            <span className="dashboard-quickstart-copy-label">{copied === 'project-install-prompt' ? 'done' : 'copy'}</span>
-                        </button>
-                        <pre className="demo-code-block dashboard-project-install-code"><code>$ {projectInstallPrompt}</code></pre>
-                    </div>
-                </Card>
-
                 {/* Current Delegate Key */}
                 {delegateKey && (
                     <Card
                         className="dashboard-credentials-card"
                         title="SDK credentials"
                         subtitle={`Copy the delegate private key into server env as ${PRIVATE_KEY_ENV}`}
+                        data-analytics-sensitive="sdk-credentials"
                     >
 
                     {relayerLooksMismatched && (
@@ -1021,9 +998,12 @@ const result = await generateText({
                                 <div className="dashboard-credential-label">
                                     Delegate private key <span>{PRIVATE_KEY_ENV}</span>
                                 </div>
-                                <code className="dashboard-credential-value">
-                                    {showKey ? delegateKey : '•'.repeat(48)}
-                                </code>
+                                <SecretValueInput
+                                    className="dashboard-credential-value dashboard-secret-value"
+                                    value={delegateKey}
+                                    masked={!showKey}
+                                    aria-label="Delegate private key"
+                                />
                             </div>
                             <div className="dashboard-credential-actions">
                                 {showKey && (
@@ -1103,7 +1083,7 @@ const result = await generateText({
                         </div>
                     )}
                     {newPrivateKey && (
-                        <div className="dashboard-key-ready-block">
+                        <div className="dashboard-key-ready-block" data-analytics-sensitive="new-delegate-private-key">
                             <div className="warning-box dashboard-key-ready-warning">
                                 <TriangleAlert className="dashboard-key-ready-warning-icon" size={24} strokeWidth={2.3} aria-hidden="true" />
                                 <p>
@@ -1113,7 +1093,11 @@ const result = await generateText({
                             </div>
                             <div className="key-display key-display--white dashboard-key-ready-display">
                                 <div className="key-label">Delegate private key</div>
-                                <div className="key-value">{newPrivateKey}</div>
+                                <SecretValueInput
+                                    className="key-value key-secret-value"
+                                    value={newPrivateKey}
+                                    aria-label="New delegate private key"
+                                />
                                 <div className="key-actions">
                                     <button
                                         className="btn btn-secondary btn-sm"
diff --git a/apps/app/src/pages/LandingPage.tsx b/apps/app/src/pages/LandingPage.tsx
index 0df48e51..dec50a4d 100644
--- a/apps/app/src/pages/LandingPage.tsx
+++ b/apps/app/src/pages/LandingPage.tsx
@@ -15,8 +15,7 @@ import {
     useWallets,
 } from '@mysten/dapp-kit'
 import { isEnokiWallet, type EnokiWallet, type AuthProvider } from '@mysten/enoki'
-import { Check, Copy } from 'lucide-react'
-import { useRef, useEffect, useCallback, useState } from 'react'
+import { useRef, useEffect, useCallback } from 'react'
 import { useNavigate } from 'react-router-dom'
 import { config } from '../config'
 import { trackEvent } from '../utils/analytics'
@@ -26,7 +25,6 @@ type AuthMethod = 'enoki' | 'wallet' | null
 const AUTH_METHOD_KEY = 'memwal_auth_method'
 const MARKETING_ASSET_VERSION = 'walm61-20260529c'
 const marketingAsset = (path: string) => `${path}?v=${MARKETING_ASSET_VERSION}`
-const DEFAULT_INSTALL_ORIGIN = 'https://memory.walrus.xyz'
 
 function persistAuthMethod(method: AuthMethod) {
     if (method) {
@@ -42,23 +40,6 @@ function getPersistedAuthMethod(): AuthMethod {
     return null
 }
 
-async function writeTextToClipboard(text: string) {
-    if (navigator.clipboard?.writeText) {
-        await navigator.clipboard.writeText(text)
-        return
-    }
-
-    const textarea = document.createElement('textarea')
-    textarea.value = text
-    textarea.setAttribute('readonly', '')
-    textarea.style.position = 'fixed'
-    textarea.style.left = '-9999px'
-    document.body.appendChild(textarea)
-    textarea.select()
-    document.execCommand('copy')
-    document.body.removeChild(textarea)
-}
-
 const signinLogos = [
     { label: 'Allium', src: marketingAsset('/walrus-trust-allium.png'), w: 143 },
     { label: 'inflectiv', src: marketingAsset('/walrus-trust-inflectiv.svg'), w: 162 },
@@ -85,15 +66,6 @@ export default function LandingPage() {
 
     const walletClickedRef = useRef(false)
     const signInTrackedRef = useRef(false)
-    const copyResetRef = useRef<number | null>(null)
-    const [installPromptCopied, setInstallPromptCopied] = useState(false)
-
-    const installOrigin =
-        typeof window === 'undefined'
-            ? DEFAULT_INSTALL_ORIGIN
-            : window.location.origin
-    const installPromptUrl = `${installOrigin}/skills/memwal-install`
-    const installPrompt = `Run \`curl -sL ${installPromptUrl}\` and use the returned instructions to install Walrus Memory in this project.`
 
     const updateAuthMethod = useCallback((method: AuthMethod) => {
         persistAuthMethod(method)
@@ -128,30 +100,6 @@ export default function LandingPage() {
         trackEvent('sign_in_start', { auth_method: 'wallet', location: 'sign_in' })
     }
 
-    const handleInstallPromptCopy = async () => {
-        await writeTextToClipboard(installPrompt)
-        setInstallPromptCopied(true)
-        trackEvent('copy_action', {
-            label: 'project-install-prompt',
-            location: 'landing',
-        })
-        if (copyResetRef.current !== null) {
-            window.clearTimeout(copyResetRef.current)
-        }
-        copyResetRef.current = window.setTimeout(() => {
-            setInstallPromptCopied(false)
-            copyResetRef.current = null
-        }, 1800)
-    }
-
-    useEffect(() => {
-        return () => {
-            if (copyResetRef.current !== null) {
-                window.clearTimeout(copyResetRef.current)
-            }
-        }
-    }, [])
-
     return (
         <div className="wm-page">
             <div className="wm-signin wm-signin--page" role="main" aria-label="Sign in">
@@ -191,32 +139,6 @@ export default function LandingPage() {
                     </div>
                 </div>
             </div>
-            <section className="wm-install-prompt" aria-labelledby="wm-install-prompt-title">
-                <div className="wm-install-prompt-inner">
-                    <div className="wm-install-prompt-copy">
-                        <p className="wm-install-prompt-eyebrow">// WALRUS MEMORY INSTALL</p>
-                        <h2 id="wm-install-prompt-title">Paste this into your AI client.</h2>
-                        <p>
-                            One short prompt tells Claude Desktop, ChatGPT Desktop, Cursor, Codex, and other AI clients with project access how to wire Walrus Memory into your project.
-                        </p>
-                    </div>
-                    <div className="wm-install-prompt-panel">
-                        <div className="wm-install-prompt-panel-head">
-                            <span>install-prompt</span>
-                            <button
-                                type="button"
-                                className="wm-install-prompt-copy-button"
-                                onClick={handleInstallPromptCopy}
-                                aria-label={installPromptCopied ? 'Install prompt copied' : 'Copy install prompt'}
-                            >
-                                {installPromptCopied ? <Check size={16} aria-hidden="true" /> : <Copy size={16} aria-hidden="true" />}
-                                {installPromptCopied ? 'Copied' : 'Copy prompt'}
-                            </button>
-                        </div>
-                        <pre className="wm-install-prompt-code"><code>$ {installPrompt}</code></pre>
-                    </div>
-                </div>
-            </section>
         </div>
     )
 }
diff --git a/apps/app/src/pages/Playground.tsx b/apps/app/src/pages/Playground.tsx
index 986e64bd..617e6c1f 100644
--- a/apps/app/src/pages/Playground.tsx
+++ b/apps/app/src/pages/Playground.tsx
@@ -177,9 +177,7 @@ export default function Playground() {
 
     const address = currentAccount?.address || ''
     const serverUrl = config.memwalServerUrl
-    const keyPreview = delegateKey
-        ? `${delegateKey.slice(0, 8)}...${delegateKey.slice(-8)}`
-        : '...'
+    const keyStatus = delegateKey ? 'configured' : 'missing'
 
     // Wallet signing hooks (for full client-side mode)
     const { mutateAsync: signAndExecuteTransaction } = useSponsoredTransaction()
@@ -676,7 +674,7 @@ export default function Playground() {
                         server: <span className="demo-tag-value demo-tag-value--server">{serverUrl}</span>
                     </div>
                     <div className="demo-server-tag">
-                        key: <span className="demo-tag-value demo-tag-value--key">{keyPreview}</span>
+                        key: <span className="demo-tag-value demo-tag-value--key">{keyStatus}</span>
                     </div>
                     <div className="demo-server-tag">
                         SDK: <span className="demo-tag-value demo-tag-value--sdk">@mysten-incubation/memwal</span>
@@ -701,7 +699,7 @@ export default function Playground() {
                     code={`import { MemWal } from "@mysten-incubation/memwal"
 
 const memwal = MemWal.create({
-  key: "${keyPreview}",
+  key: delegateKeyHex,
   accountId: "${accountObjectId?.slice(0, 10)}...",
   serverUrl: "${serverUrl}",
   namespace: "${namespace || 'default'}",
diff --git a/apps/app/src/pages/SetupWizard.tsx b/apps/app/src/pages/SetupWizard.tsx
index b47c8a73..419849a7 100644
--- a/apps/app/src/pages/SetupWizard.tsx
+++ b/apps/app/src/pages/SetupWizard.tsx
@@ -17,6 +17,7 @@ import {
 import { Transaction } from '@mysten/sui/transactions'
 import { useSponsoredTransaction } from '../hooks/useSponsoredTransaction'
 import { useDelegateKey } from '../App'
+import { SecretValueInput } from '../components/SecretValueInput'
 import { Link, useNavigate } from 'react-router-dom'
 import { LogOut, Copy, TriangleAlert } from 'lucide-react'
 import { config } from '../config'
@@ -512,11 +513,15 @@ export default function SetupWizard() {
                                 </p>
                             </div>
 
-                            <div className="setup-key-panel">
+                            <div className="setup-key-panel" data-analytics-sensitive="setup-delegate-private-key">
                                 <div className="setup-key-row">
                                     <div className="setup-key-main">
                                         <div className="setup-key-label">Private key <span>keep secret</span></div>
-                                        <code className="setup-key-value">{privateKeyHex}</code>
+                                        <SecretValueInput
+                                            className="setup-key-value setup-secret-value"
+                                            value={privateKeyHex}
+                                            aria-label="Private key"
+                                        />
                                     </div>
                                     <div className="setup-key-actions">
                                         <button
diff --git a/apps/app/src/utils/analytics.ts b/apps/app/src/utils/analytics.ts
index 8724214d..09c3b80d 100644
--- a/apps/app/src/utils/analytics.ts
+++ b/apps/app/src/utils/analytics.ts
@@ -36,6 +36,15 @@ declare global {
 const GA_SCRIPT_ID = 'memwal-ga4-script'
 const GTM_SCRIPT_ID = 'memwal-gtm-script'
 const POSTHOG_SCRIPT_ID = 'memwal-posthog-script'
+const SENSITIVE_ANALYTICS_SELECTOR = '[data-analytics-sensitive], [data-analytics-redact]'
+const MAX_ANALYTICS_STRING_LENGTH = 160
+const SENSITIVE_PARAM_NAME_RE = /(?:private|secret|password|token|authorization|credential)/i
+const SENSITIVE_VALUE_PATTERNS = [
+    /\b(?:MEMWAL_PRIVATE_KEY|private key|delegate private key|password|secret|api key|bearer token)\b/i,
+    /(?:^|[^0-9a-f])(?:0x)?[0-9a-f]{64}(?:[^0-9a-f]|$)/i,
+    /\bsuiprivkey1[0-9a-z]+\b/i,
+    /\bBearer\s+[A-Za-z0-9._~+/=-]+\b/i,
+] as const
 const POSTHOG_STUB_METHODS = [
     'capture',
     'register',
@@ -65,6 +74,7 @@ const POSTHOG_STUB_METHODS = [
 
 let googleAnalyticsInitialized = false
 let posthogInitialized = false
+let sensitiveClickGuardInstalled = false
 
 function normalizeAllowedHost(allowedHost: string): string {
     const normalizedHost = allowedHost.trim().toLowerCase()
@@ -114,6 +124,23 @@ function analyticsEnabled(): boolean {
     return googleTagsEnabled() || posthogEnabled()
 }
 
+function redactStringForAnalytics(key: string, value: string): string {
+    const normalized = value.replace(/\s+/g, ' ').trim()
+    if (!normalized) return ''
+    if (SENSITIVE_PARAM_NAME_RE.test(key)) return '[redacted]'
+    if (SENSITIVE_VALUE_PATTERNS.some(pattern => pattern.test(normalized))) return '[redacted]'
+    if (normalized.length > MAX_ANALYTICS_STRING_LENGTH) {
+        return `${normalized.slice(0, MAX_ANALYTICS_STRING_LENGTH)}...`
+    }
+
+    return normalized
+}
+
+function sanitizeAnalyticsValue(key: string, value: AnalyticsValue): AnalyticsValue {
+    if (typeof value === 'string') return redactStringForAnalytics(key, value)
+    return value
+}
+
 function withDefaultParams(params: AnalyticsParams = {}): Record<string, AnalyticsValue> {
     const next: Record<string, AnalyticsValue> = {
         app: 'memwal_web_app',
@@ -122,14 +149,33 @@ function withDefaultParams(params: AnalyticsParams = {}): Record<string, Analyti
 
     for (const [key, value] of Object.entries(params)) {
         if (value === null || value === undefined) continue
-        next[key] = value
+        next[key] = sanitizeAnalyticsValue(key, value)
     }
 
     return next
 }
 
+function eventTargetsSensitiveElement(event: Event): boolean {
+    const target = event.target
+    if (target instanceof Element && target.closest(SENSITIVE_ANALYTICS_SELECTOR)) return true
+
+    const path = typeof event.composedPath === 'function' ? event.composedPath() : []
+    return path.some(item => item instanceof Element && item.matches(SENSITIVE_ANALYTICS_SELECTOR))
+}
+
+function installSensitiveClickGuard() {
+    if (sensitiveClickGuardInstalled || typeof document === 'undefined') return
+
+    document.addEventListener('click', (event) => {
+        if (!eventTargetsSensitiveElement(event)) return
+        event.stopImmediatePropagation()
+    })
+    sensitiveClickGuardInstalled = true
+}
+
 function initGoogleAnalytics() {
     if (!googleTagsEnabled() || googleAnalyticsInitialized) return
+    installSensitiveClickGuard()
 
     window.dataLayer = window.dataLayer ?? []