Magnemo
OfficialSummary: Magnemo is a local, approval-gated memory MCP server: you can retrieve approved memory, stage drafts for human review, and manage the review queue with provenance and partition scoping.
retrieve: look up canonical, human-approved memory with partition scope and byte budget.stage: draft a memory note into staging only, with mandatory provenance; it never touches canon.bootpack: read the deterministic wake-up pack: charter, autonomy, canon digest, open threads, review queue, handoff, ledger tail.handoff: record a session boundary and stage a handoff note for the next session.keep: promote a staged note only after the person says yes in chat; supportsallwithin a daily cap.drop: reject a staged note with the person's reason; it never becomes Memory.pending: list unanswered staged notes at a pause, or read one staged note's full body and source.
Can be run alongside an existing Obsidian vault as a governed memory layer, complementing current notes without replacing them.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Magnemostage a note: the API base URL is https://api.example.com"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MAGNEMO is Memory for your AI, kept on your computer in plain files. Your AI writes down what it learns as it works; nothing becomes Memory until you approve it, and every Memory shows who wrote it and who approved it.
Your agent writes one line down and keeps working. Say keep, and it is Memory.
Site · Manual · Changelog · X @Magnemo_AI · Known limits
Install in one paste
In three lines:
pip install MAGNEMO # Python 3.11 or newer
magnemo init # makes the vault: a folder of plain files
magnemo mount # writes .mcp.json, the file Claude Code reads, and the first line in CLAUDE.mdOr let your agent do it. Open Claude Code in any of your project folders, and paste this. (Its magnemo mount step writes .mcp.json, the file Claude Code reads, and a short block in CLAUDE.md that tells every new session where this project's Memory is. In Cursor, Windsurf or another client, use the block for your client under "Install in your client".)
Set up MAGNEMO in this project:
1. Install it: pip install MAGNEMO. It needs Python 3.11 or newer. If pip can't find it, install uv (curl -LsSf https://astral.sh/uv/install.sh | sh) and then run: uv tool install MAGNEMO
2. Initialize the vault: magnemo init
3. Register the MCP server: run magnemo mount — it adds MAGNEMO to this project's MCP config and keeps any servers already there.
4. Verify: run magnemo doctor and confirm everything passes.
5. Then ask me to restart you, so MAGNEMO's tools load, and to say this when you are back: "Look around this folder, tell me what this project is for, and stage that as the first note." Your agent never waits on you. When you want something kept, say keep.
If anything fails, show me what went wrong and fix it if you can.Plant the seed: one paste, and your agent grows a Memory.
After the restart, say it: Look around this folder, tell me what this project is for, and stage that as the first note. Your agent writes one line down and keeps working. Say keep, and it is Memory. Then ask what it remembers.
Related MCP server: Engram
Works with
One server, the same in every client. Tested where it says so; the rest follow each client's own docs.
Client | Tested | How |
Claude Code | yes: Oct 26–28, 2026, Claude Code 2.1.309. Seven tools; the yes in the chat; |
|
Claude Desktop | untested end to end | the |
Cursor | untested | the Add to Cursor link below, or |
VS Code | untested |
|
Windsurf | untested |
|
Cline | untested |
|
Continue | untested |
|
Gemini CLI | untested |
|
Codex CLI | untested |
|
Zed | untested |
|
Each client's exact block is under "Install in your client".
How it compares
Five questions, answered from each project's own docs (read Oct 12, 2026, checked again Oct 22; the pages are linked under the table).
MAGNEMO | Mem0 | Zep | Letta | Basic Memory | |
Where the memory lives | Plain markdown files in a folder on your computer | A hosted platform run by Mem0; open source: a local Qdrant store and a SQLite history file | Zep: a managed cloud service, or in your own VPC. Graphiti, its open-source engine: a graph database you run | Markdown files in a git repository that belongs to the agent: hosted by Letta, or on your device in local mode | Markdown files on your disk with a local SQLite index; an optional cloud |
Who approves a write | You. An agent's write waits in staging until your yes | An LLM extracts facts from the messages and stores them; their docs describe no approval step | Messages are ingested into the graph as they arrive; their docs describe no approval step | The agent updates its own memory; the background review "does not ask you for approval" | The assistant writes notes directly; the cloud has suggested edits that can be accepted or rejected |
Author and approver on every entry | Both, in each file's header ( | User, agent, app and run ids, timestamps, and a change history per memory; their docs name no approver field | When a fact was true and when it stopped, traced to its source episode; their docs name no approver field | Every memory edit is a git commit; their docs do not say what the commit records | Title, type, tags and dates; |
Network calls of its own | None. No model call and no embedding call; | OpenAI by default for the model and the embeddings; other providers are listed, Ollama among them | Zep is a cloud API. Graphiti defaults to OpenAI; local model servers are documented | Local mode keeps state on your device; inference goes to the provider you choose, which can be a local one | Runs locally; the default embeddings run on your machine with no API key |
What you can take back | A no is kept with its reason; a replaced note is archived with a forward link; nothing deletes; the files are yours to edit | Delete, update, and a history per memory; export is on the hosted platform | Delete nodes, edges and episodes; a replaced fact is invalidated, not deleted | The git history of every memory edit; the files can be read and edited | Plain files you edit and can track with git; a delete tool; the cloud keeps every saved version |
Where each of them is ahead. Mem0 extracts memories for you, searches them by meaning, and has Python and JavaScript SDKs, a REST API and a hosted platform. Zep keeps a knowledge graph that knows when each fact was true, as a managed service with SDKs in three languages. Letta is a whole agent platform, with an SDK, a CLI and background agents that tend the memory. Basic Memory searches by keyword and by meaning with embeddings that run on your machine, links notes into a graph, and syncs through its cloud. MAGNEMO has none of that: its search is keyword search (KNOWN_LIMITS.md), there is no graph and no hosted service. What it has is the approval and the record.
Their pages: Mem0 overview, platform and open source, add, history, quickstart, delete, export · Zep concepts, facts, security, deleting data, Graphiti · Letta MemFS, memory settings, local mode · Basic Memory README, what it is, tools, note format, semantic search, suggestions, file history. A cell that is wrong or out of date: open an issue and it is fixed.
Listed on the official MCP registry (ai.magnemo/magnemo) · PyPI · mcpservers.org · Glama · awesome-mcp-servers.
Tested on every push, on Python 3.9, 3.11 and 3.12: 370 tests, as of Oct 28, 2026 (the runs).
What's new
0.6.11 · Oct 28, 2026 ·
magnemo mountwrites the first line in CLAUDE.md, so every new session knows where this project's Memory is.pendingreads a note nobody has kept yet.0.6.10 · Oct 26, 2026 · Your agent never stops to ask. Say keep in the chat, and the record says how the yes was given.
0.6.9 · Oct 22, 2026 · A seat's report files itself as a receipt and asks nothing; a yes is for Memory. Sentinel reads a seat's quote as a quote.
Every release: CHANGELOG.md.
For builders. MAGNEMO is an MCP server with four verbs — retrieve, stage,
bootpack, handoff — plus keep, drop, pending, and a CLI for your side: review, promote, reject.
It runs on your machine, in plain markdown files you own. The package imports no network
module (magnemo doctor scans for one on every run); the only traffic is git push to a
backup destination, if you add one. Every promotion is recorded with who wrote the entry,
the name given for the yes, when, and through which gate. Trust is computed from that
record, never asserted. It mounts beside any memory you already
run (a folder of notes, Obsidian, a RAG stack). Python 3.11+, zero dependencies,
Apache-2.0.
Fresh vault? THE CHARTER section will say it isn't promoted yet — that is the
governance speaking: MAGNEMO never fabricates canon. Stage a charter, review it,
promote it, and every boot thereafter serves it back verbatim.
(magnemo not found after install? pip's script folder isn't on PATH —
python3 -m magnemo always works.)
Open beta — read KNOWN_LIMITS.md before trusting it with anything you can't lose. Honest caveats, no fine print.
Install in your client
One server, said ten ways. Every block below is the same thing: uvx magnemo-mcp with MAGNEMO_VAULT pointing at
the folder your Memory lives in (make one with magnemo init ./vault). Tested on this Mac where it says so;
the rest is from each client's own docs and marked untested — corrections welcome, open an issue.
Claude Code — tested: a Claude Code session mounts the server, lists the seven tools and calls them; a yes in the
chat keeps a note, and pending reads a body (last run Oct 28, 2026: Claude Code 2.1.309, the 0.6.11 server).
claude mcp add magnemo -e MAGNEMO_VAULT=/absolute/path/to/vault -- uvx magnemo-mcp(claude mcp list shows magnemo … ✔ Connected. Add -s project to write it into the repo's .mcp.json for your team.)
Only have the desktop app? claude may not be a command in your shell. On a Mac the app keeps its own copy at
~/Library/Application Support/Claude/claude-code/<version>/claude.app/Contents/MacOS/claude; run that in place of claude.
Claude Desktop — untested end to end here. The server this block starts was run the way Claude Desktop starts it
(Oct 28, 2026, the 0.6.11 server). Claude Desktop → Settings → Developer → Edit Config, then
claude_desktop_config.json. Claude Desktop does not read your shell's PATH, so both paths are absolute: which uvx
prints the first.
{
"mcpServers": {
"magnemo": {
"command": "/absolute/path/to/uvx",
"args": ["magnemo-mcp"],
"env": { "MAGNEMO_VAULT": "/absolute/path/to/vault", "MAGNEMO_AGENT": "claude-desktop" }
}
}
}Restart Claude Desktop after saving.
Cursor — untested here (not installed on this Mac); the link and the block follow Cursor's docs.
Or
~/.cursor/mcp.json (or .cursor/mcp.json in the project):
{
"mcpServers": {
"magnemo": {
"command": "uvx",
"args": ["magnemo-mcp"],
"env": { "MAGNEMO_VAULT": "/absolute/path/to/vault" }
}
}
}VS Code / Copilot — untested here; per VS Code's docs.
Or
.vscode/mcp.json in the workspace:
{
"servers": {
"magnemo": {
"type": "stdio",
"command": "uvx",
"args": ["magnemo-mcp"],
"env": { "MAGNEMO_VAULT": "/absolute/path/to/vault" }
}
}
}Windsurf — untested; ~/.codeium/windsurf/mcp_config.json:
{
"mcpServers": {
"magnemo": {
"command": "uvx",
"args": ["magnemo-mcp"],
"env": { "MAGNEMO_VAULT": "/absolute/path/to/vault" }
}
}
}Cline — untested; Cline → MCP Servers → Configure → cline_mcp_settings.json:
{
"mcpServers": {
"magnemo": {
"command": "uvx",
"args": ["magnemo-mcp"],
"env": { "MAGNEMO_VAULT": "/absolute/path/to/vault" },
"disabled": false
}
}
}Continue — untested; ~/.continue/config.yaml (or a file in .continue/mcpServers/):
mcpServers:
- name: magnemo
command: uvx
args: ["magnemo-mcp"]
env:
MAGNEMO_VAULT: /absolute/path/to/vaultGemini CLI — untested; ~/.gemini/settings.json:
{
"mcpServers": {
"magnemo": {
"command": "uvx",
"args": ["magnemo-mcp"],
"env": { "MAGNEMO_VAULT": "/absolute/path/to/vault" }
}
}
}Codex CLI — untested; ~/.codex/config.toml:
[mcp_servers.magnemo]
command = "uvx"
args = ["magnemo-mcp"]
env = { MAGNEMO_VAULT = "/absolute/path/to/vault" }Zed — untested; settings.json → context_servers:
{
"context_servers": {
"magnemo": {
"source": "custom",
"command": "uvx",
"args": ["magnemo-mcp"],
"env": { "MAGNEMO_VAULT": "/absolute/path/to/vault" }
}
}
}After the install, the loop is the same everywhere: your agent writes to staging, you review.
magnemo yes # promote the top of the queue (yes <id-fragment> · yes --all)
magnemo no <id> --reason "…" # reject one — the reason is required; rejections teach
magnemo review # the interactive queue, when you want to read first
magnemo doctor # python, vault, config, ledger, and the mount — scans the package for network modules tooAnything that speaks MCP over stdio mounts the same way. The remote door (ChatGPT and hosted clients) is on its way in 0.7.0.
How it works
The yes is checked: nothing becomes Memory without a yes, and the engine can tell a person's yes from an agent's; a yes in the chat counts, and the record says how it was given.
MAGNEMO is Memory with a constitution: every fact carries provenance, every agent write waits in your review queue before it becomes Memory, and every decision lands in a Trust Ledger.
Your agent gets four verbs and cannot keep a note on its own authority; it carries your yes, and the record says so.
Say yes in the chat and keep carries it, ledgered unverified; a click your client draws or a yes at your terminal is a verified one. KNOWN_LIMITS.md says what that does and does not stop; docs/MCP.md has the clients it works in.
Actor | Door | Can do |
Agents | MCP server (stdio) |
|
You | CLI + git (any editor) | review the queue · promote / reject · edit anything · own everything |
Zero dependencies. Pure Python standard library, 3.11 or newer. Nothing else to install, nothing to trust but this code.
The vault
vault/
dev/ knowledge/ playbooks/ decisions/ debt/ ← example: a dev team's partition
ops/ knowledge/ playbooks/ clients/ decisions/ style/ ← example: an ops team's partition
shared/ tickets/ changelog/ ← interop bus (gated)
_staging/ agent writes await review here
_index/ machine-managed
_ledger/ trust_ledger.jsonl — append-only, never forgetsEvery note is markdown with provenance frontmatter (author, written, source, status, reviewed_by, supersedes, strength). Provenance is the file format.
Privacy
Your Memory lives on your computer, in plain files you can open. No network calls of its own. Add a backup remote and it pushes there, nowhere else.
The precise version: the package imports no network module, and magnemo doctor scans for one every time it runs. If you add a backup destination, the engine runs git push to it. The full page: https://magnemo.ai/privacy
Guarantees (Phase 1 — Governed Recall)
Through the MCP server, agent writes NEVER reach canonical stores directly — staging only, always.
Search returns canonical (promoted) notes only. Staged notes are not searched. The boot pack shows staged material marked as staged: the titles of open threads and of the top staged notes, and the last handoff's cut line with a pointer to its note.
Partition walls enforced per agent (
MAGNEMO_PARTITIONS); cross-partition = DENIED.Supersession is explicit: old notes archive with a forward link. Nothing deletes.
Rejections are kept and recorded — rejections teach.
Every promote/reject lands in the append-only Trust Ledger with actor + reason.
Tests
python -m unittest discover -s tests -v # incl. full MCP round-trips (legacy + four-verb)
# or: pip install -e ".[test]" && pytestThe same suite runs on every push, on Python 3.9, 3.11 and 3.12: the runs.
Everything that shipped
Release by release, with the design notes that used to live here: CHANGELOG.md.
— Silver Valley Technologies Inc. · Phase 1 of 3 · The memory that learns is the memory that is governed.
Available Tools
7 toolsbootpackRead what this agent wakes up knowingARead-onlyIdempotent
The boot pack: Charter first (verbatim, never fabricated), then the Gate Map, YOUR AUTONOMY (this agent's own trust levels), canon digest, open threads, salience-ranked review queue, last handoff, ledger tail. Read it FIRST on every wake. Deterministic: same vault state, same bytes.
| Name | Required | Description | Default |
|---|---|---|---|
| class | No | worker = lean; partner = adds the relationship layer when a codex exists | worker |
| scope | No | partition to orient on (must be inside MAGNEMO_SCOPE) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark it read-only, idempotent, and non-destructive, so the bar is lower. The description goes further by disclosing the deterministic output property ('same vault state, same bytes'), the strict ordering requirement, and the anti-fabrication rule ('Charter first, verbatim, never fabricated'). This adds meaningful behavioral context beyond the structured annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two dense sentences with no filler. It front-loads the core object and rule, lists contents in a natural reading order, and closes with a deterministic guarantee. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only boot tool with no required parameters and no output schema, this is complete. It tells the agent what will be read, in what order, when to call it, and what property to expect. Nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with both parameters (class and scope) having enums and descriptions. The tool description adds no parameter-specific details, but it doesn't need to because the schema fully documents them. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the resource ('boot pack'), specifies the action (read it FIRST), and enumerates the exact ordered contents. It also adds the deterministic property ('same vault state, same bytes'), which makes the tool's purpose unambiguous and distinct from generic retrieval.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly prescribes when to use the tool: 'Read it FIRST on every wake.' This is clear contextual guidance. It doesn't explicitly contrast with siblings like retrieve or handoff, but the every-wake-first instruction is strong enough that an agent can infer this is the mandatory entry point.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dropDrop a note the person said no toAIdempotent
Call drop only when the person has said no to this note in their own words in this conversation. The note is set aside as rejected, with their reason, and never becomes Memory.
| Name | Required | Description | Default |
|---|---|---|---|
| note | Yes | the staged note's id, or its last 8 characters | |
| reason | No | the person's reason, in their words, if they gave one |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, idempotentHint=true, destructiveHint=false, so the safety profile is covered; the description adds the real state outcome — the note is marked rejected with the reason attached and permanently excluded from Memory. It does not say whether a drop can be undone or what happens if the gate condition is violated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, with the gating condition front-loaded ahead of the effect. Every clause carries information an agent needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter mutation with full schema coverage and annotations, the description supplies the precondition and the resulting state, which is what an agent needs to call it correctly. No output schema exists, so the only minor gap is error/reversal behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters are already documented, including the id-or-last-8-characters convention and that reason should be the person's own words. The description only echoes 'with their reason', adding no format or fallback guidance beyond the schema; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: it sets a staged note aside as rejected, recording the reason, and the note never becomes Memory. That is enough for an agent to tell it apart from siblings like keep or stage without opening a schema, though it never names those siblings directly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a sharp, explicit precondition — call it only when the person has rejected the note in their own words in this conversation — which also implies the negative case (don't drop on your own inference). It stops short of naming keep or stage as the alternative when that condition isn't met.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
handoffRecord where this session stoppedA
Record a session boundary: appends telemetry (usage %, trigger, what was cut) to the append-only handoffs ledger AND stages a provenance-complete handoff note. The next bootpack inherits it. Doctrine: hand off at ~88-90%, do not ride to the wall. A pause: where the client can draw a question, the person is asked once about every note still staged (keep all / pick / later); later or no answer leaves them staged and blocks nothing.
| Name | Required | Description | Default |
|---|---|---|---|
| cut | No | what was cut / deferred at the boundary | |
| usage | Yes | context usage percent at the boundary | |
| trigger | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, idempotentHint=false and destructiveHint=false; the description corroborates the non-idempotent append model ('appends telemetry ... to the append-only handoffs ledger') and clarifies that nothing is destroyed ('later or no answer leaves them staged and blocks nothing'). It also discloses the staging side effect and the keep/pick/later prompt, which annotations cannot convey. It stops short of stating permissions or error behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core purpose and its two side effects are front-loaded in the first sentence, and the downstream inheritance follows immediately. The trailing 'A pause:' sentence is dense and awkwardly phrased ('where the client can draw a question'), costing some readability, but no sentence is pure filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a non-idempotent mutation with no output schema, the description covers what is written, where it goes, the staging side effect, and what the next bootpack does with it. Safety is covered by annotations. The only gap is that the pause/prompt flow is described in terms an agent may find hard to act on, but nothing needed to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 67%; the one undocumented field (`trigger`) is only an enum. The description maps all three parameters in the parenthetical 'usage %, trigger, what was cut' and gives semantic meaning to the `wall` trigger via the doctrine ('do not ride to the wall'). It adds modest value over the schema but does not fully explain when to choose 'compaction' vs 'other'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: records a session boundary by appending telemetry to an append-only ledger AND staging a handoff note. An agent can tell this is the boundary-recording tool rather than a plain staging tool. It does not explicitly distinguish itself from the sibling `stage`, which also stages notes, leaving some ambiguity about overlap.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The doctrine line ('hand off at ~88-90%, do not ride to the wall') gives a concrete condition for calling it, and 'The next bootpack inherits it' explains the downstream purpose. However, it never names an alternative or an exclusion ('use X instead when...'), so the when-not case is absent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keepKeep a note the person said yes toAIdempotent
Call keep only when the person has said yes to this note in their own words in this conversation; never draw a panel, and never keep on your own judgment. The note becomes Memory, and the record says the yes was given in the chat (unverified). A note Sentinel is holding is not kept this way. "all" keeps every note pending lists, when the person said keep all; each is its own ledger line. The cap: at most 50 notes a day are kept by a yes in the chat, counted in the local day of the computer the vault is on and reset at its midnight. Two ways past it: the person's own terminal (magnemo yes ), or the one question their client draws at a pause (handoff).
| Name | Required | Description | Default |
|---|---|---|---|
| note | Yes | the staged note's id, its last 8 characters, or "all" |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare the write/idempotent/safe profile; the description adds substantial behavior beyond them: the resulting Memory record is tagged 'unverified' consent, the Sentinel-held case is excluded, 'all' expands to every pending note as separate ledger lines, and a hard cap of 50 keeps per local day resetting at the vault machine's midnight with two documented ways around it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The gating condition is front-loaded in the first clause and every sentence carries information (consent rule, result state, exclusion, all-branch, cap, workarounds). It is dense and slightly run-on in places ('A note Sentinel is holding is not kept this way'), which costs a point but no filler is present.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and a single documented parameter, the description covers the consent gate, the resulting side effects, the batch case, the rate limit, and the escape hatches — enough to invoke correctly. It stops short of saying what the call returns or what a failed cap does to the note's pending state.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and already documents id / last-8 / "all", so the baseline applies. The description still adds meaning the schema lacks: what the "all" branch actually does ('keeps every note pending lists, when the person said keep all; each is its own ledger line') and that cap counting applies per note.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource — keep a staged note that the person consented to — and immediately names the resulting state ('The note becomes Memory'). It also carves out cases handled elsewhere ('A note Sentinel is holding is not kept this way'), so an agent can distinguish it from stage/drop/handoff without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit precondition ('only when the person has said yes to this note in their own words in this conversation'), an explicit prohibition ('never keep on your own judgment', 'never draw a panel'), and names the alternative escalation paths ('magnemo yes <id>' or the client's one-question handoff). When-to-use, when-not-to-use, and alternatives are all present.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pendingList what waits for the person's keepARead-onlyIdempotent
The staged notes nobody has answered yet, and the one line to say about them. Call it at a pause, at the end of your own turn, never mid-work; say its line once ('N notes staged since you left. keep all / pick / later.'). Later, or no answer, is fine: nothing blocks and nothing is lost. With a note's id, it returns that staged note's full body and where it came from, labelled 'staged · not yet Memory' (a note Sentinel holds gives its alert, not its body).
| Name | Required | Description | Default |
|---|---|---|---|
| note | No | optional: a staged note's id, or its last 8 characters, to read its body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover read-only, idempotent, non-destructive, closed-world, so the bar is low; the description still adds real behavior – that the call is non-blocking, that unanswered notes are not lost, and that a Sentinel-held note returns only its alert rather than its body. That last caveat is a genuine edge case an agent could otherwise get wrong.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose is front-loaded and there is little outright filler, but the metaphorical register ('the one line to say about them', 'the person's keep') costs tokens without adding precision. Two of the three sentences do real work; the framing sentence does not.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-param, read-only, no-output-schema tool, the definition covers return shape (note body, provenance, the 'staged · not yet Memory' label) and the Sentinel exception, which is what an agent needs to call and interpret it. Only the sibling boundary is absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and already defines the id/last-8-characters format, so the baseline is 3. The description goes further by explaining what supplying the id actually yields – the full body plus provenance – which is semantic meaning the schema does not convey.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The core is decipherable – it lists staged notes that nobody has answered yet – but it is wrapped in in-group metaphor ('the person's keep', 'Sentinel', 'staged · not yet Memory') that an agent unfamiliar with this vocabulary must reverse-engineer. It does not name any of the siblings (retrieve, keep, stage) to draw the boundary, so differentiation is inferred rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Timing is unusually explicit: 'at a pause, at the end of your own turn, never mid-work', plus the reassurance that 'later, or no answer, is fine: nothing blocks and nothing is lost.' What's missing is routing against alternatives such as retrieve, but the when-to-call guidance itself is concrete.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
retrieveLook something up in memoryARead-onlyIdempotent
Retrieve canonical (keyholder-approved) memory relevant to a query. Returns a scored, BUDGETED payload: mn:// pointers plus snippet renditions, never raw dumps. Scope is partition-walled; payload size is logged to the Foresight counters. Cite the returned rid when the action resolves.
| Name | Required | Description | Default |
|---|---|---|---|
| k | No | ||
| query | Yes | what you need to remember | |
| scope | No | partition to search (must be inside this agent's MAGNEMO_SCOPE) | |
| budget | No | max payload bytes; results are truncated/downgraded to fit and the truncation is logged |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, openWorldHint=false, idempotentHint=true, and destructiveHint=false Score. The description goes beyond annotations by disclosing that the payload is budgeted and truncated/downgraded to fit, that scope is partition-walled, that payload size is logged to Foresight counters, and that results are never raw dumps. This materially enriches the agent's understanding of side effects and constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two dense sentences that front-load the core purpose and then add essential behavioral details. Every clause adds value, and there is no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the absence of an output schema, the description reasonably explains the return shape: mn:// pointers plus snippet renditions, never raw dumps. It also covers budget truncation, scope constraints, and logging. It stops short of explaining edge cases like empty results or what rid means, but for a retrieval tool with rich annotations and schema, it is largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 75%, so the schema documents most parameters. The description adds meaning by explaining that budget controls payload truncation/downgrade and that scope is partition-walled. It also clarifies that results are scored and budgeted, which relates to the budget parameter. The k parameter is not explicitly addressed, but the schema provides range and default context.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: retrieve canonical, keyholder-approved memory relevant to a query. It also distinguishes the tool's behavior from a general memory lookup by specifying scored, budgeted payloads with mn:// pointers and snippet renditions. This clearly separates it from the unrelated sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use this tool: when canonical memory relevant to a query is needed segments. It also provides a usage instruction ('Cite the returned rid when the action resolves'). However, it does not explicitly state when not to use it or name alternatives, missing the top tier of guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
stageDraft an entry for a person to reviewA
Remembering means proposing: this stages a note; the person's keep makes it Memory. Contact details are kept as written and labelled; the label is checked once before anything leaves this computer. Stage a memory candidate for the person's review. This is the only write verb: the note lands in _staging/ with mandatory provenance and never touches canon. It never waits and asks nothing: keep working. Returns the staged id, its salience, a duplicate flag, and one line to say: 'Staged. Say keep when you want it kept.' Ask about what you staged only at a pause (see pending), never mid-work. Malformed or paperless (no provenance) notes are refused.
| Name | Required | Description | Default |
|---|---|---|---|
| note | Yes | ||
| provenance | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well past the annotations: declares it is 'the only write verb', that notes land in _staging/ with mandatory provenance, that malformed or paperless notes are refused, and that the call is non-blocking and returns the staged id, salience, a duplicate flag and a scripted line. With no output schema, this return-value disclosure is especially valuable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The opening 'Remembering means proposing' is a philosophical preamble that delays the operational content, and the middle sentence about contact details and labels is cryptic. The substantive material (staging location, refusal rules, return values, non-blocking behaviour) is present but scattered rather than front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 2-parameter nested write tool with no output schema and no annotations beyond safety hints, the description covers lifecycle placement, refusal conditions, non-blocking semantics and return contents. The main gap is guidance on the nested note fields (partition/store/impact/supersedes) that the schema leaves undescribed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is reported at 0%, so the description has to carry the load, and it only partially does: 'mandatory provenance' explains the provenance object's role and the 'paperless' refusal clarifies source is required, plus a hint about labelling untrusted content (taint). It says nothing about note.partition, note.store, note.impact, note.supersedes or how tags are used.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Stage a memory candidate for the person's review') and pins down the scope: it writes only into _staging/ and 'never touches canon'. It implicitly distinguishes itself from siblings by naming keep as the act that makes the note Memory, so an agent can tell staging apart from promotion.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear operating context: 'It never waits and asks nothing: keep working', and 'Ask about what you staged only at a pause (see pending), never mid-work' routes follow-up questions to the pending sibling. It doesn't spell out when staging is inappropriate versus just using retrieve, but the alternative paths are named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
v0.6.11- Added
drop - Added
keep - Added
pending
4 tool updates
v0.6.4- First observed
bootpack - First observed
handoff - First observed
retrieve - First observed
stage
TDQS
Scored across 7 tools
Each tool has a clearly stated role in the memory lifecycle (stage/keep/drop/pending/retrieve) plus session tools (handoff/bootpack). Minor overlap exists: handoff also stages a note (overlapping with stage), and pending and bootpack both surface staged/review content, but the descriptions delineate their boundaries well enough.
Names are all lowercase single tokens with no case-style inconsistencies, but they mix verbs (stage, keep, drop, retrieve) and nouns (handoff, pending, bootpack) with no predictable verb_noun pattern. Readable but not a consistent convention.
Seven tools map cleanly onto the vault's capture-review-approve-retrieve-session lifecycle; each tool earns its place and none appears redundant filler.
Core lifecycle is covered: propose, approve, reject, list pending, retrieve canon, boot context, and session handoff. Gaps exist around editing/amending a staged note and managing canon directly (no update/delete of Memory), but agents can work around these via stage/drop.
Maintenance
Related MCP Connectors
One memory, every AI. A shared, user-owned markdown memory your AI clients read and write over MCP.
An MCP memory server. One memory your agents share — across models, devices and apps.
Markdown-based note-taking with a hosted MCP server. Your notes serve you and your AI.
Cloud-hosted MCP server for durable AI memory
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceA local-first MCP server that gives AI assistants long-term memory by storing, searching, and recalling notes as Markdown files on your machine.5 npmMIT
- AlicenseAqualityCmaintenanceA self-hosted MCP server that gives AI agents shared, long-term memory over a git-backed folder of markdown, enabling persistent knowledge search, read, and write without a database.1667 npm18MIT
- AlicenseAqualityBmaintenanceA local-first MCP server that provides a shared Markdown-based memory for AI coding agents, enabling cross-agent context persistence via tools like memory_search and memory_capture.161MIT
- AlicenseAqualityAmaintenanceAn MCP server that gives AI agents durable, temporal memory over local markdown vaults, with tools for searching, asserting facts, querying point-in-time state, and reinforcing useful knowledge.15167 npmMIT