How do I turn authentication back on after upgrading Semantica?

Semantica 0.6.5 adds a require_auth dependency that checks an X-API-Key request header against the SEMANTICA_API_KEY environment variable before any Explorer route runs. Set that variable in the environment where the Explorer API is served. Before this release all 11 Explorer API routers accepted requests with no credentials at all.

Does Semantica still need a separate graph server?

Semantica 0.6.5 ships an embedded Oxigraph TripletStore backend that answers SPARQL 1.1 in-process, so a small deployment no longer has to run and secure an external triplet store. Semantica also gained an Altair Anzo backend that speaks SPARQL 1.1 over HTTP for teams that already run one. The Oxigraph path installs as an extra.

What changed between Semantica 0.6.0 and 0.6.5?

Semantica 0.6.0, released July 21, 2026, was a functionality release: cross-backend SPARQL parity, Databricks and SQLite connectors, and seven correctness fixes in provenance and reasoning. Semantica 0.6.5 is security-led instead, pairing the six advisories with 25 or more correctness fixes and a 34-test SPARQL security suite.

Who found the Semantica vulnerabilities?

All six issues in Semantica 0.6.5 were reported externally rather than found in-house. The published advisory for the SSRF issue, GHSA-8c7v-62gr-hj6g, credits KaifAhmad1 as the reporter. The remaining reports cover missing Explorer API authentication, Cypher injection, SPARQL injection, WebSocket origin validation, and a polynomial regular-expression denial of service.

Semantica · 2026-08-11 · major

Semantica 0.6.5 — six security holes closed in the AI knowledge-graph store

Semantica 0.6.5 fixes six reported vulnerabilities, three of them critical: all 11 Explorer API routes answered without credentials, plus Cypher injection, SPARQL injection and SSRF. It also adds an embedded Oxigraph SPARQL backend.

GitHub social card for the semantica-agi/semantica repository

Semantica shipped a security release after six outside reports, three of them rated critical.

Quick facts

Maker	Semantica (semantica-agi)
Version	v0.6.5, August 11, 2026
License	MIT
Fixed	6 externally reported issues, 3 critical
Must upgrade	Anyone running the Explorer API
New backend	Embedded Oxigraph, in-process SPARQL 1.1
Install	pip install "semantica[tripletstore-oxigraph]"

What is it?

Semantica 0.6.5 is a security release, and its headline finding is blunt: every one of the Explorer API's 11 routers used to answer requests without any credentials. Semantica itself is an MIT-licensed Python library that keeps context for AI agents in a knowledge graph and records where each fact came from. The project sits at 4,788 stars on GitHub and was the second-fastest riser on GitHub's daily trending list.

How does it work?

A new require_auth dependency validates an X-API-Key header against the SEMANTICA_API_KEY environment variable before any Explorer route executes. Fresh validation modules sanitize node labels, property keys and IRIs at every point where a Cypher or SPARQL query gets built, covering the Neptune, Neo4j and FalkorDB backends. URL fetching now follows redirects by hand with a five-hop cap and pins the resolved IP address, and the SPARQL prefix regex was rewritten with character-disjoint quantifiers plus a 10,000-character query limit.

Why does it matter?

Any team that put the Explorer API on a network was running it open to whoever could reach it, so this is an upgrade-now release rather than a nice-to-have. The same version also removes arbitrary code execution through pickle, XML external entity handling in the RDF/XML parser, and a denial of service from unbounded graph materialization. Alongside the fixes, the embedded Oxigraph backend cuts a separate triplet-store server out of small deployments.

Who is it for?

teams running agent memory on a knowledge graph

Frequently asked questions

How do I turn authentication back on after upgrading Semantica?: Semantica 0.6.5 adds a require_auth dependency that checks an X-API-Key request header against the SEMANTICA_API_KEY environment variable before any Explorer route runs. Set that variable in the environment where the Explorer API is served. Before this release all 11 Explorer API routers accepted requests with no credentials at all.
Does Semantica still need a separate graph server?: Semantica 0.6.5 ships an embedded Oxigraph TripletStore backend that answers SPARQL 1.1 in-process, so a small deployment no longer has to run and secure an external triplet store. Semantica also gained an Altair Anzo backend that speaks SPARQL 1.1 over HTTP for teams that already run one. The Oxigraph path installs as an extra.
What changed between Semantica 0.6.0 and 0.6.5?: Semantica 0.6.0, released July 21, 2026, was a functionality release: cross-backend SPARQL parity, Databricks and SQLite connectors, and seven correctness fixes in provenance and reasoning. Semantica 0.6.5 is security-led instead, pairing the six advisories with 25 or more correctness fixes and a 34-test SPARQL security suite.
Who found the Semantica vulnerabilities?: All six issues in Semantica 0.6.5 were reported externally rather than found in-house. The published advisory for the SSRF issue, GHSA-8c7v-62gr-hj6g, credits KaifAhmad1 as the reporter. The remaining reports cover missing Explorer API authentication, Cypher injection, SPARQL injection, WebSocket origin validation, and a polynomial regular-expression denial of service.

Try it

pip install "semantica[tripletstore-oxigraph]"