MemoryGuard
MemoryGuard is a governed local-first MCP memory server for coding agents, providing audit, memory management, rule governance, code intelligence, history, and provider integration tools.
Audit & diagnostics: read-only workspace audits, finding explanations, scan summaries, capability/status snapshots, runtime process facts, and canonical/projection status.
Memory operations: read, search, write, update, soft-delete, status, safe merge preflight/merge, and semantic duplicate/conflict checks.
Context bootstrap: build a bounded context packet of mandatory rules and relevant memories for a task.
Rule governance: create rules with scoped scope, record feedback, undo lifecycle mutations, view scope stats, and safely merge duplicate rules with capability-gated approval.
CodeGraph: query symbol metadata, find paths, explain symbols, get affected-impact metadata, update from Graphify exports, and check status.
Knowledge & history: search/read/list knowledge books and candidates; search, timeline, read, export, delete, and extract-preview conversation history.
Binding & group resolution: create/list agent bindings, resolve share groups, and inspect group state.
Import & extraction: preview offline import bundles, import external MCP descriptors, extract memory candidates from files, accept candidates, and run semantic checks.
Enrichment: list pending enrichment tasks, apply host-agent enrichment results, check queue status, and build/enrich memory projections.
Provider integration: install/repair global MCP, redirect rules, and lifecycle hooks for Claude/Codex/Cursor/TRAE.
Governed mutations: most destructive or merging operations require confirmation, idempotency keys, expected revisions, and/or single-use capability tokens.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@MemoryGuardshow memory history for the last hour"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Let agents write without turning shared memory into an unreviewed pile. MemoryGuard organizes each write, preserves the evidence behind changes, and keeps governance decisions reversible.
No account. No remote server. No remote telemetry. Local-only usage telemetry is optional and stores bounded, privacy-preserving aggregates locally.
What's New in v0.7.12
v0.7.12 improves MCP discovery, bounded read delivery, and local usage telemetry while preserving the existing governed action checks and MCP name:
Compact discovery with a complete catalog: New MCP clients receive 11 day-to-day tools from
tools/list, including capability discovery and the governed invocation broker.memoryguard_capabilitiesprovides paginated metadata for registered MCP operations and reviewed headless GUI operations; exact advanced MCP names remain callable for compatibility.Bounded read delivery: Replayable successful reads are capped at 24,000 UTF-8 bytes across the complete MCP envelope. Eligible oversized reads return a short-lived process-local reference rather than truncating data; reads that cannot be safely replayed or exceed the snapshot limit return a bounded narrowing hint. Pages support UTF-8 offsets and field selection. Private references revalidate the original read under the current trusted session and binding before each page. Writes and context bootstrap keep their complete receipt/mandatory-rule contracts and cannot request response paging.
Cache-aware local telemetry: Provider-reported cache-read and cache-write input counts are kept separately with complete/partial/unavailable coverage. A measured zero remains zero; missing provider data remains unknown. The deterministic unit estimate is labeled as an estimate and does not claim a measured token reduction.
Governed invocation: Mutating broker targets still require confirmation and a non-empty idempotency key, which are forwarded to the target's existing permission, scope, and readiness checks. The MCP name remains
io.github.irisxc4/memoryguard.
See the v0.7.12 release note and release history.
Earlier release details are kept in the Changelog and GitHub release records.
Token evidence and demo
Usage events distinguish measured_cached_input from
measured_cache_write_input. measured_cache_coverage.cache_read and
cache_write report complete, partial, or unavailable; measured zero
remains 0, while missing provider data remains None/unavailable.
Character-based estimates remain explicitly labelled
estimated mg_deterministic_unit, never provider tokens.
Run the benchmark only against an authorized local workspace:
python scripts/benchmark_usage_telemetry.py --workspace . --window-days 7 --syncRead the benchmark guide for measured, estimated, derived, and unsupported semantics. Use the demo recording checklist for a sanitized walkthrough. The repository's synthetic graph artwork is not a live product capture; it is not evidence of usage or savings.
Related MCP server: GroundMemory
Major V2 refactor in v0.6.0
v0.6.0 was a production data-plane refactor, not a storage-only upgrade:
Authoritative V2 domains: Memory, Rules, Evidence, Content, Runtime, Projection, Assets, CodeGraph, Skills, and System state are separated into explicit SQLite domains with governed boundaries.
Explicit cutover:
V1_ACTIVE → V2_BUILDING → V2_READY → V2_ACTIVEis fail-closed; V2 never silently falls back to legacy stores or dual-writes after READY/ACTIVE.Lossless migration: frozen-source preparation uses coherent SQLite online backups, validates source/target evidence, rechecks live-source drift, and preserves V1 data plus migration backups for rollback.
Native routing: MCP, CLI, GUI, and Hook surfaces are classified explicitly; the release closed the 233-surface cutover with 138 implemented routes, 95 retired routes, and zero neutral/blocker routes.
Governed intelligence: Rule lifecycle and RuleMerge, extraction/enrichment, External MCP import, provider control-plane, conversation history, Knowledge Library, and GUI governance all use the V2 evidence and decision paths.
Operational evidence: Reference Audit, per-domain SQLite health, guarded maintenance, rollback evidence, and safe unbound diagnostics are part of readiness and operations.
Why MemoryGuard
Persistent memory solves storage. It does not solve governance.
When several coding agents write into the same context, records become duplicated, stale, contradictory, over-broad, or unsafe to reuse. MemoryGuard sits between coding agents and their shared memory to keep that context usable.
Without governance | With MemoryGuard |
Notes accumulate without a canonical state | Writes are classified, deduplicated, superseded, or surfaced as conflicts |
A correction silently destroys the old value | Evidence and supersede chains preserve what changed and why |
Tokens and credentials can remain active | Sensitive-looking content is quarantined from active memory |
Every write needs manual approval | Agents write normally; people review exceptions and outcomes |
Raw chat logs leak into future context | Conversation history remains a separate, explicitly read evidence archive |
System architecture
%%{init: {"theme":"base","themeVariables":{"background":"#071521","fontFamily":"Arial, sans-serif","fontSize":"14px","primaryTextColor":"#EEF4F8","lineColor":"#557287","edgeLabelBackground":"#071521","clusterBkg":"#0A1A29","clusterBorder":"#27445A"},"flowchart":{"htmlLabels":true,"curve":"basis","nodeSpacing":32,"rankSpacing":48,"padding":14}}}%%
flowchart TB
Hosts["CODING-AGENT HOSTS<br/>Claude Code · Codex · Cursor · TRAE "]:::host
Gateway["LOCAL INTEGRATION<br/>MCP stdio · redirect rules · lifecycle hooks "]:::gateway
subgraph Core["GOVERNANCE CORE "]
direction LR
Identity["TRUST<br/>identity · scope "]:::core
MemoryAPI["MEMORY<br/>governed I/O "]:::active
Rules["RULES<br/>scope · assignment "]:::rule
HistoryAPI["HISTORY<br/>search · timeline "]:::history
Security["SAFETY<br/>validate · quarantine "]:::danger
Identity --> MemoryAPI
Identity --> Rules
Identity --> HistoryAPI
MemoryAPI --> Security
end
subgraph Stores["LOCAL GOVERNED STORES "]
direction LR
SharedDB[("V2 DOMAIN STORES<br/>Memory · Rules · Evidence · Content ")]:::store
HistoryDB[("HISTORY STORE<br/>isolated conversations ")]:::historyStore
AuditDB[("RECOVERY STORE<br/>versions · receipts · backups ")]:::store
end
Bootstrap["BOUNDED CONTEXT BOOTSTRAP<br/>mandatory rule pack · relevant recall "]:::bootstrap
Control["HUMAN CONTROL<br/>CLI · desktop governance console "]:::surface
Hosts --> Gateway --> Identity
MemoryAPI --> SharedDB
Rules --> SharedDB
HistoryAPI --> HistoryDB
Security --> AuditDB
SharedDB --> Bootstrap
Control --> Identity
classDef host fill:#12243A,stroke:#38D5C8,color:#EEF4F8,stroke-width:1.4px;
classDef gateway fill:#0D3338,stroke:#38D5C8,color:#EEF4F8,stroke-width:2.4px;
classDef core fill:#12243A,stroke:#557287,color:#EEF4F8,stroke-width:1.4px;
classDef active fill:#0D383A,stroke:#38D5C8,color:#EEF4F8,stroke-width:2px;
classDef rule fill:#3B2C18,stroke:#F3B562,color:#EEF4F8,stroke-width:1.8px;
classDef history fill:#102F45,stroke:#73C7F5,color:#EEF4F8,stroke-width:1.8px;
classDef danger fill:#3A2028,stroke:#EA6A6A,color:#EEF4F8,stroke-width:1.8px;
classDef bootstrap fill:#EEF4F8,stroke:#38D5C8,color:#071521,stroke-width:2.4px;
classDef store fill:#0B1624,stroke:#7F96A8,color:#EEF4F8,stroke-width:1.4px;
classDef historyStore fill:#102436,stroke:#73C7F5,color:#EEF4F8,stroke-width:1.4px;
classDef surface fill:#EEF4F8,stroke:#38D5C8,color:#071521,stroke-width:2px;
style Core fill:#081827,stroke:#27445A,stroke-width:1px,color:#EEF4F8
style Stores fill:#081827,stroke:#27445A,stroke-width:1px,color:#EEF4F8
linkStyle default stroke:#557287,stroke-width:1.4px;Quick start
MCP Registry metadata
This package exposes a local stdio MCP server as io.github.irisxc4/memoryguard.
Registry metadata is kept in server.json, and the marker above
ships with the PyPI package README. Releases are published through GitHub OIDC
to PyPI and the official MCP Registry. Verify the current package version and
the Registry entry's active/latest state through their live public records.
1. Install
python -m pip install agent-memguardFor the desktop governance console:
python -m pip install "agent-memguard[gui]"2. Authorize the current project
memoryguard source add .3. Connect or repair your coding agent
Global provider configuration is rebuilt from the real binding in the canonical user data home. The command is idempotent and removes superseded MemoryGuard project-level overrides after a successful global takeover.
# Repair one provider
memoryguard provider repair claude
memoryguard provider repair codex
memoryguard provider repair cursor
memoryguard provider repair trae
# Repair every detected provider
memoryguard provider repair allRestart the host after installation, then verify the integration:
memoryguard doctor
memoryguard mcp-status
memoryguard hooks status --provider allLaunch the desktop console:
memoryguard guimemoryguard-gui . remains available for desktop shortcuts. A bare
memoryguard gui always opens the canonical user-level control directory
(default %LOCALAPPDATA%\MemoryGuard on Windows), so running it from a project
or from C:\Windows\System32 cannot silently switch databases.
MEMORYGUARD_WORKSPACE is an explicit operator override; an explicit
memoryguard gui <project-path> or memoryguard gui --workspace <project-path>
selects a specific workspace.
It does not remember a previously selected project or open a folder picker.
On Windows, memoryguard gui detaches the native window from the terminal, so
closing PowerShell does not close the GUI.
Provider-specific setup and behavior:
Stable Codex / Router binding
Codex/Router binds MemoryGuard to the stable local Codex program and control installation. An account profile is an endpoint/alias, not a new memory owner: switching profiles automatically discovers or repairs the profile and reuses the verified Agent binding and active group. Request identity remains fail-closed; this does not share records across machines or with arbitrary accounts.
Upgrade
MemoryGuard currently upgrades through Python's package manager:
python -m pip install --upgrade agent-memguard
memoryguard --version
memoryguard doctorIf you installed the GUI extra, keep it during the upgrade:
python -m pip install --upgrade "agent-memguard[gui]"There is no package self-update command. The package manager is the
authoritative package-upgrade path; memoryguard upgrade below is the explicit
workspace migration flow, not a package updater.
Upgrade an existing V1 data home
Upgrade the package, then run the verified migration. No workspace, data-home, apply, or confirmation arguments are required for the normal user-level data home:
python -m pip install --upgrade agent-memguard
memoryguard --version # confirms installed version
memoryguard upgrade
memoryguard doctorThe command prepares V2, validates the frozen and live source evidence,
migrates Agent/Group control, activates only after all gates pass, and removes
only the backup batch belonging to that successful migration. Re-running it on
V2_ACTIVE is idempotent. For a zero-write report, use:
memoryguard upgrade --previewAdvanced explicit workspace/data-home options remain available for operators managing an isolated installation. A failed gate stays non-active and preserves its evidence; successful activation does not keep a redundant migration backup.
Existing pre-V2 workspaces: explicit V2 cutover
v0.6.0 never auto-activates an existing workspace. Upgrade the package first, then use the packaged operator CLI:
# Read-only manifest status
memoryguard-v2 status -w .
# Build a frozen-source V2 shadow and stop at V2_READY
memoryguard-v2 prepare -w . --apply
# Activate only after the prepare result is V2_READY / ready=true
memoryguard-v2 activate -w . --confirm V2_ACTIVEThe prepare step uses coherent SQLite online backups, preserves V1 and
migration-backups, and rechecks live-source drift before READY. Activation
performs another fresh drift check before changing the manifest. Do not delete
legacy V1 data or migration backups as part of the upgrade.
Knowledge Library
The desktop console can turn a selected folder or file set into one governed local knowledge library. Source files remain where they are; MemoryGuard stores the searchable index in its user data home instead of copying a runtime database into every source project. Knowledge metadata never becomes a second source-body store.
Capability | Current behavior |
File/folder ingestion | Add a folder as a book or selected files as documents |
Structure | Parse documents, preserve chapter/section context, and create traceable chunks |
Retrieval | Full-text search, optional embeddings, and a layered knowledge graph |
Natural synchronization | Re-ingest changed files; a partial or failed scan does not silently remove previously indexed content |
Lifecycle | Move a book to the library trash, restore it, or explicitly purge its recovery snapshot |
Memory candidates | Preview evidence-backed candidates before accepting them into governed long-term memory |
Open the desktop console and choose Knowledge Library. Remote embedding or model-backed indexing is opt-in and requires explicit authorization; local full-text retrieval remains available without sending source text to a remote provider. Background imports, re-ingests, and smart rebuilds have durable task receipts: retrying the same request reuses its task, while reusing that key for a different request is rejected. A live task for a different request reports busy rather than claiming that work was accepted.
CodeGraph refresh
The first CodeGraph build is an explicit, confirmed full build. After a scope
has been built, each successful trusted file write can trigger an incremental
refresh for that scope, subject to strict source-path and active-binding
validation. Unchanged content hashes are a no-op; deleted files are retired;
the next context receives one bounded affected receipt. MemoryGuard does not
run a daemon or watcher for this path and does not infer paths from shell or
free-form text. A projectless MCP caller first builds an already-bound directory
source, then passes its codegraph_source_id to select that exact scope for
query, status, update, and graph reads.
Desktop console surfaces
The GUI has eight visible navigation entries: seven governance pages plus a separate Token usage-and-savings view:
Governance Overview
Data Sources & Agents
Memory Core
CodeGraph
Rules & Habits
Conversation History
Risk Signals & Governance Console
Token Usage & Savings (separate from the seven governance pages)
Agent lists use readable program/provider names; the underlying ID remains available in the detail view. Empty data is shown as an explicit empty state.
Write and governance lifecycle
%%{init: {"theme":"base","themeVariables":{"background":"#071521","fontFamily":"Arial, sans-serif","fontSize":"14px","primaryTextColor":"#EEF4F8","lineColor":"#557287","edgeLabelBackground":"#071521","clusterBkg":"#0A1A29","clusterBorder":"#27445A"},"flowchart":{"htmlLabels":true,"curve":"basis","nodeSpacing":30,"rankSpacing":42,"padding":14}}}%%
flowchart TD
subgraph Intake["01 · INTAKE "]
direction LR
Write(["Memory write "]):::entry
Scope["Resolve identity<br/>scope · audience "]:::core
Validate{"Authorized? "}:::decision
Reject["Reject<br/>no persistence "]:::danger
Write --> Scope --> Validate
Validate -- NO --> Reject
end
subgraph Organize["02 · ORGANIZE "]
direction TB
Secret{"Sensitive? "}:::decision
Quarantine["Quarantine<br/>outside active set "]:::danger
Compare["Classify · compare<br/>governed records "]:::active
Relation{"Relationship "}:::decision
New["NEW<br/>create active record "]:::result
Duplicate["DUPLICATE<br/>merge provenance "]:::result
Correction["CORRECTION<br/>supersede old record "]:::rule
Conflict["CONFLICT<br/>preserve both sides "]:::danger
Secret -- YES --> Quarantine
Secret -- NO --> Compare --> Relation
Relation --> New
Relation --> Duplicate
Relation --> Correction
Relation --> Conflict
end
subgraph Govern["03 · GOVERN "]
direction LR
Receipt[("Evidence event<br/>version receipt ")]:::store
Review["CLI or desktop review "]:::surface
Action["Correct · merge<br/>restore · delete "]:::rule
Snapshot["Reversible<br/>snapshot "]:::active
Receipt --> Review --> Action --> Snapshot
end
Validate -- YES --> Secret
Quarantine --> Receipt
New --> Receipt
Duplicate --> Receipt
Correction --> Receipt
Conflict --> Receipt
classDef entry fill:#EEF4F8,stroke:#38D5C8,color:#071521,stroke-width:2.4px;
classDef core fill:#12243A,stroke:#557287,color:#EEF4F8,stroke-width:1.5px;
classDef decision fill:#0D3338,stroke:#38D5C8,color:#EEF4F8,stroke-width:2px;
classDef active fill:#0D383A,stroke:#38D5C8,color:#EEF4F8,stroke-width:2px;
classDef result fill:#12243A,stroke:#38D5C8,color:#EEF4F8,stroke-width:1.6px;
classDef rule fill:#3B2C18,stroke:#F3B562,color:#EEF4F8,stroke-width:1.8px;
classDef danger fill:#3A2028,stroke:#EA6A6A,color:#EEF4F8,stroke-width:1.8px;
classDef store fill:#0B1624,stroke:#7F96A8,color:#EEF4F8,stroke-width:1.4px;
classDef surface fill:#EEF4F8,stroke:#38D5C8,color:#071521,stroke-width:2px;
style Intake fill:#081827,stroke:#27445A,stroke-width:1px,color:#EEF4F8
style Organize fill:#081827,stroke:#27445A,stroke-width:1px,color:#EEF4F8
style Govern fill:#081827,stroke:#27445A,stroke-width:1px,color:#EEF4F8
linkStyle default stroke:#557287,stroke-width:1.4px;The console is not an approval queue. Agents keep moving. MemoryGuard records the outcome and exposes the evidence needed to correct it later.
What you can govern
Signal | Governance action |
Duplicate or stale memory | Inspect the canonical record and supersede chain; restore an earlier version when needed |
Conflicting memories | Keep both visible until the conflict is resolved deliberately |
Secrets, tokens, or credentials | Quarantine the record so it cannot enter active shared memory |
Incorrect automatic organization | Correct, merge, lock, restore, or roll back with evidence |
Multiple coding agents | Bind agents to one shared group while preserving source identity and scope |
Mandatory rules | Assign rules to an Agent, project, provider, runtime role, or shared group |
Rules and history stay separate
MemoryGuard deliberately keeps governed long-term memory and raw conversation history on different paths.
Surface | Purpose | Context behavior |
Rules and habits | Preferences, procedures, corrections, facts, projects, and scoped mandatory rules | Mandatory rules use an independent char/token budget after scope, exclude, conflict, and semantic dedup. Effective count above 20 is a health warning, not a hard block; storage is not capped by count. Sensitive, corrupt, per-item oversize, and aggregate overflow still fail closed with no silent truncation. Ordinary records are recalled when relevant |
Conversation history | Local raw-evidence archive with owner and shared-group access controls | Never enters bootstrap automatically; raw text is read only through explicit history tools |
Neuron graph | Navigation and governance over memory, rules, projects, agents, and sessions | History nodes contain safe metadata and summaries, not raw chat content |
History retrieval is progressive: search results, then a bounded timeline, then an explicitly selected turn or session. Extracting from history creates a preview first; it does not silently write a long-term memory.
%%{init: {"theme":"base","themeVariables":{"background":"#071521","fontFamily":"Arial, sans-serif","fontSize":"14px","primaryTextColor":"#EEF4F8","lineColor":"#557287","edgeLabelBackground":"#071521","clusterBkg":"#0A1A29","clusterBorder":"#27445A"},"flowchart":{"htmlLabels":true,"curve":"basis","nodeSpacing":30,"rankSpacing":42,"padding":14}}}%%
flowchart LR
subgraph HistoryPath["CONVERSATION EVIDENCE "]
direction TB
Archive[("Raw local history ")]:::historyStore
Search["Search summaries "]:::history
Timeline["Bounded timeline "]:::history
Read["Explicit turn or session "]:::history
Preview["Evidence-backed<br/>extraction preview "]:::history
Confirm["Explicit acceptance "]:::surface
Isolation["NO AUTOMATIC<br/>BOOTSTRAP PATH "]:::barrier
Archive --> Search --> Timeline --> Read --> Preview --> Confirm
Archive -.-> Isolation
end
subgraph GovernedMemory["GOVERNED LONG-TERM MEMORY "]
direction TB
Mandatory["Scoped mandatory rules "]:::rule
Assignments["Agent · project<br/>role · group scope "]:::core
RulePack["Mandatory-rule<br/>budget "]:::budget
Ordinary["Facts · preferences<br/>projects · procedures "]:::memory
Recall["Task-relevant<br/>recall budget "]:::budget
Context["BOUNDED CONTEXT PACKET "]:::context
Mandatory --> Assignments --> RulePack --> Context
Ordinary --> Recall --> Context
end
HistoryPath ==>|GOVERNED WRITE | GovernedMemory
classDef rule fill:#3B2C18,stroke:#F3B562,color:#EEF4F8,stroke-width:1.8px;
classDef core fill:#12243A,stroke:#557287,color:#EEF4F8,stroke-width:1.4px;
classDef memory fill:#0D383A,stroke:#38D5C8,color:#EEF4F8,stroke-width:1.8px;
classDef budget fill:#12243A,stroke:#38D5C8,color:#EEF4F8,stroke-width:1.6px;
classDef context fill:#EEF4F8,stroke:#38D5C8,color:#071521,stroke-width:2.4px;
classDef history fill:#102F45,stroke:#73C7F5,color:#EEF4F8,stroke-width:1.6px;
classDef historyStore fill:#102436,stroke:#73C7F5,color:#EEF4F8,stroke-width:1.6px;
classDef surface fill:#EEF4F8,stroke:#73C7F5,color:#071521,stroke-width:2px;
classDef barrier fill:#3A2028,stroke:#EA6A6A,color:#EEF4F8,stroke-width:2px;
style GovernedMemory fill:#081827,stroke:#27445A,stroke-width:1px,color:#EEF4F8
style HistoryPath fill:#081827,stroke:#27445A,stroke-width:1px,color:#EEF4F8
linkStyle default stroke:#557287,stroke-width:1.4px;Supported hosts
Host | Integration | Current boundary |
Claude Code | Global MCP binding, redirect rules, user-level lifecycle Hook | Verified takeover path |
Codex | Global MCP binding, redirect rules, user-level lifecycle Hook | Verified takeover path |
Cursor | Global MCP binding, redirect rules, user-level lifecycle Hook | Verified takeover path |
TRAE | MCP binding and redirect rules | No verified Hook seam; reported as a fallback instead of full takeover |
Provider status is reported honestly as redirected, observed, operational, or unsupported. MemoryGuard does not claim it can disable every host's native memory when the host exposes no reliable integration point.
Architecture
Layer | Responsibility |
Evidence & Content | Authorized sources, immutable evidence, content-addressed blobs/occurrences, source manifests, and conversation archives |
Memory & Rules | Scoped memory atoms, revisions, bindings, rule definitions, decisions, evidence links, and compensating governance operations |
Runtime & Projection | Bounded working context, scenario/profile projections, CodeGraph, Assets, and Skills metadata |
Cutover & Governance | Four-state manifest, native MCP/CLI/GUI/Hook routing, Reference Audit, maintenance, provider adapters, and rollback evidence |
V2 uses separate authoritative SQLite domains rather than one shared-memory
database. The runtime reads and writes V2 only after the manifest reaches
V2_ACTIVE; V2_BUILDING and V2_READY never silently fall back or dual-write.
Evidence remains traceable without being treated as automatically trusted memory.
Privacy and safety
MemoryGuard runs as a local MCP stdio server.
All governed data stays local unless you explicitly authorize a remote model or embedding operation. Optional usage telemetry is local-only: its measured host token events and deterministic conversion events are stored under
.memoryguard/usage_telemetry.sqlite; it does not upload data. Token savings are estimates based on MemoryGuard deterministic units, not a provider billing statement. Hosts without token reporting remain unsupported in the measured columns.The Knowledge Library database uses
MEMORYGUARD_HOMEor the platform user data directory, so a selected source folder does not receive its own knowledge database.V2 authoritative workspace state is separated under
.memoryguard/into explicit Memory, Rules, Evidence, Content, Runtime, Projection, Assets, CodeGraph, Skills, and System domains; History, Source, Binding, and Group control are V2-native surfaces. Legacy V1 artifacts are preserved as local rollback/audit evidence after cutover and are no longer the active V2 runtime write path; onlymemoryguard.migrationmay read them.Source scanning is read-only by default.
Mutating governance paths use validation, explicit scope, provenance, and reversible state.
Quarantined records stay outside active shared memory.
Raw conversation history is never injected into bootstrap automatically.
Shared-group history access follows current active membership and does not grant deletion rights over another Agent's source.
CLI
The installed memoryguard command exposes these top-level operations:
Command | Purpose |
| Run a read-only audit and generate a report |
| Open the latest interactive report |
| Explain evidence and risk for a finding |
| List, add, remove, or preview authorized sources |
| Scan authorized sources and build the coverage ledger |
| Diagnose V2 manifest, domain availability, and native coverage |
| Inspect V2 MCP/backend health; tenant counts require a bound Agent scope |
| Install, inspect, pause, repair, or remove host Hooks |
| Inspect or repair global provider integrations |
`storage audit | report` |
`storage sweep | compact` |
| Inspect governed group state |
| Launch the interactive governance console |
| Launch the trusted desktop executor |
The old V1 plan, apply, verify, undo, import, and gc workflows may
remain parseable as explicit retired compatibility surfaces, but are not a V1
runtime path. Under V2_ACTIVE they return a stable retired result instead of
writing through a legacy store. Legacy data input is accepted only by the
explicit memoryguard.migration upgrade flow.
Run memoryguard --help or memoryguard <command> --help for the live command
reference.
MCP API
The default MCP discovery surface is intentionally compact. New MCP clients
receive these eleven day-to-day tools through tools/list:
Tool | Purpose |
| Load bounded mandatory rules and relevant memory context |
| Search governed memories by query, lifecycle status, and bounded limit. |
| Read one governed memory |
| Write and organize a governed memory |
| Update the body, kind, recall policy, or priority of one known memory. It does not change lifecycle status. |
| Soft-delete a governed memory |
| Inspect shared-memory status |
| Run a read-only local governance audit |
| Explain one audit finding and its evidence |
| Discover registered MCP operations and reviewed headless GUI operations with bounded pagination and optional on-demand JSON Schema |
| Invoke one discovered MCP or reviewed headless GUI operation; mutating targets require confirmation and an idempotency key |
Advanced governance remains available through the GUI and CLI: rule lifecycle,
bindings and shared groups, source scanning, CodeGraph, knowledge and history
review, provider controls, external MCP import, and maintenance operations.
Existing advanced MCP names remain callable for compatibility when an installed
client invokes an exact name, but they are not returned by the default
tools/list. This reduces discovery/schema overhead without removing those
governance capabilities.
memoryguard_capabilities is the discovery path for the broader compatibility
catalog. It supports exact operation lookup, English or Chinese query text,
domain filtering, and offset pagination; schemas are returned only when
include_schema=true is requested for the selected page. The catalog exposes
162 reviewed headless GUI business operations through memoryguard_invoke.
Eight GUI operations remain explicitly restricted by their existing authority:
desktop-only path/folder actions, desktop-admin CodeGraph selection/build, and
SafeBridge protocol actions.
Bounded read responses
MemoryGuard minifies JSON text by default. A replayable read response is capped
at 24,000 UTF-8 bytes across the complete MCP envelope, including every
content block and existing structuredContent. Small responses keep their
existing shape. An oversized read returns a compact receipt with response_ref
and required identifiers; it does not silently truncate the original result.
Fetch a page through the existing broker, after discovering
memoryguard_response_read with memoryguard_capabilities:
{
"operation": "memoryguard_response_read",
"arguments": {
"response_ref": "opaque-id",
"fields": ["/data/memory_id"],
"offset": 0,
"limit": 3000
}
}Pages are UTF-8 JSON fragments with next_offset; concatenate them in order.
limit is 4–4096 bytes and offsets must be UTF-8 character boundaries. On a
single JSON text payload, fields selects business fields: use a top-level
name or an object-only JSON Pointer such as /data/memory_id. Multi-content
and non-JSON results reject field selection and remain available only as
whole-envelope pages.
Private references live only in the MCP process for at most five minutes: at
most 16 snapshots, each at most 512,000 bytes. They are bound to the exact
trusted session, principal, scope, and active binding revision. Each page
reruns the original read under current authorization and compares its
digest. A denial, changed output, binding/session change, or expired reference
returns a stable refusal such as response_ref_access_denied,
response_ref_expired, or response_ref_result_changed; cached old content
is never used to bypass the current read. Public capability metadata uses its
existing offset pagination. Writes and context bootstrap keep their existing
complete receipt/mandatory-rule contracts and cannot request response
pagination, so a page read never reruns a mutation. If an oversized read cannot
safely create a reference, its bounded receipt reports
delivery.status="unavailable" and action="narrow_query" rather than
promising the whole result can be retrieved.
Example discovery and invocation using the published schemas:
{"operation":"memoryguard_task_list","include_schema":true,"limit":1}{"operation":"memoryguard_task_list","arguments":{"limit":20}}For a mutating target, the invoke envelope must also carry
"confirmed":true and a non-empty "idempotency_key"; the broker forwards
those proofs to the target's existing permission and scope checks.
The underlying compatibility catalog also covers:
governed memory read, search, write, update, delete, and status;
bounded context bootstrap with mandatory-rule isolation;
rule creation, feedback, merge governance, undo, and scope statistics;
Agent binding and shared-group inspection;
source scanning, graph projection, import previews, and build planning;
external MCP discovery and import;
document extraction previews and candidate acceptance;
conversation-history search, timeline, explicit read, export, deletion, and extraction preview;
provider installation and host-agent enrichment.
Use MCP tools/list for the compact default discovery set. Use
memoryguard_capabilities for the registered compatibility catalog and its
reviewed operation metadata.
Project links
Roadmap
Release history: v0.7.9 consolidates canonical governance, local-only token evidence, readable multi-agent governance, and public distribution through GitHub, PyPI, and the official MCP Registry. v0.7.8 records the preceding governance, telemetry, and Codex runtime work; v0.7.7 makes bare provider repair safe in a verified, uniquely bound control home and aligns installed Codex MCP/Hook repairs to the current interpreter while preserving Agent and shared-group identity. v0.7.6 makes Codex Hook/MCP runtime selection consistent through one immutable snapshot, shortens Hook state lock windows, and keeps bootstrap success/failure state honest with explicit mandatory-overflow fail-closed handling. Earlier release records retain the detailed v0.7.5 conflict-review, v0.7.4 canonical-governance, v0.7.3 shared-history, and v0.7.2 write/read and Codex lifecycle changes. The v0.7.1 V2-only migration and desktop lifecycle work remains documented as historical release context.
Acceptance boundary: the Graphify evidence is the focused
3 / 3result plus the real full-repository export/projection described above. It does not claim that upstream Graphify's full-repository test suite passed.Next after release: broader CodeGraph/Skills ingestion, more operator-friendly maintenance reports, and additional migration observability. Long-term records are not retired merely because they are old.
Later: team and enterprise capabilities only after validated demand.
Contributing
Issues and pull requests are welcome. Read CONTRIBUTING.md before submitting a change. Pull requests require agreement to the CLA.
License
Available Tools
11 toolsmemoryguard_auditARead-onlyIdempotent
Use when checking local V2 reference integrity before repair or release. Do not use to read a memory record, modify data, or assess general Agent quality.
| Name | Required | Description | Default |
|---|---|---|---|
| workspace | No | workspace path (default: .) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare read-only, idempotent, and non-destructive behavior, and the description adds useful context beyond those: the audit targets local V2 reference integrity and is deliberately not a general memory/quality inspection. It does not describe the audit's exact output shape, but the annotation burden is low.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences carry the primary use case, the timing, and the key exclusions. There is no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, has one optional parameter, and its safety profile is covered by annotations. The only gap is that no output schema exists and the description does not indicate what the audit returns or how its result is reported.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter, workspace, is fully described in the schema with a default value, so the description does not need to repeat it. With 100% schema description coverage, the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific action ('checking local V2 reference integrity') and a clear scope ('local V2') with an explicit timing ('before repair or release'). The exclusions ('Do not use to read a memory record, modify data, or assess general Agent quality') distinguish it from its siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives an explicit when-to-use condition ('before repair or release') and an explicit when-not-to-use list covering reading, modifying, and general quality assessment. This is unambiguous routing guidance even though sibling tool names are not repeated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
memoryguard_capabilitiesARead-onlyIdempotent
Discover registered MCP operations and every GUI operation with its current headless availability. Reads only V2 manifest state and registry metadata; requires no memory binding or source access. Use operation/query plus offset pagination; request include_schema=true only for a selected page.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | page size | |
| query | No | optional English or Chinese search text | |
| domain | No | optional capability domain, such as knowledge, codegraph, or runtime | |
| offset | No | zero-based page offset | |
| operation | No | optional exact MCP or GUI operation name | |
| include_schema | No | include MCP JSON Schemas for this page |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, but the description adds valuable behavioral context: 'Reads only V2 manifest state and registry metadata; requires no memory binding or source access.' This explains what exactly is read and what prerequisites are absent, going beyond the annotations to clarify side-effect-free execution.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler. The first sentence front-loads the purpose and scope, the second provides crisp usage directives. Every phrase earns its place, making it easy for an agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only discovery tool with six optional parameters and no output schema, the description is quite complete. It covers purpose, scope, prerequisites, and usage patterns. It doesn't describe the response format, but given the tool's nature (listing capabilities), the agent can infer reasonable output. The absence of an output schema doesn't leave a critical gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all six parameters are individually documented. The description adds usage semantics that the schema lacks: it specifies pagination strategy (operation/query plus offset) and advises to use include_schema only for a selected page. This helps the agent understand how to combine parameters effectively, adding value beyond the raw schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: discovering registered MCP operations and GUI operations with their headless availability. It specifies the resource (operations) and the action (discover), and distinguishes itself from sibling tools that perform memory operations or audits. The mention of reading V2 manifest state and registry metadata further clarifies scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage guidance: 'Use operation/query plus offset pagination; request include_schema=true only for a selected page.' This tells the agent how to navigate results efficiently and when to include schemas. It doesn't explicitly list alternatives, but the nature of the tool (capabilities discovery) is distinct from siblings, so the context is clear enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
memoryguard_context_bootstrapA
Use when starting one new task to build bounded mandatory rules and relevant governed memory context. Do not use for exact record lookup or repeatedly within same task. Uses trusted binding and may mark one pending local CodeGraph receipt consumed.
| Name | Required | Description | Default |
|---|---|---|---|
| task | Yes | current task or request; required | |
| max_chars | No | maximum characters for optional recalled content; mandatory rules use their separate budget | |
| max_items | No | maximum optional memories to include; mandatory rules use their separate budget | |
| read_path | No | Phase5 canonical read path: auto uses canonical only when the group is canonically ready, otherwise the native compatibility read path; rule-intelligence prefers the rule-intelligence layer, deduplicating merged duplicates only after the active/audience/exclude match | auto |
| max_tokens | No | optional total-token budget forwarded to the V2 ContextEngine | |
| project_hint | No | optional project/repository hint used only for relevance |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are all false and uninformative, so the description carries the behavioral burden. It adds a meaningful non-obvious side effect: 'may mark one pending local CodeGraph receipt consumed.' This exceeds annotation coverage and helps an agent anticipate state change, though 'Uses trusted binding' remains somewhat vague about what that entails.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the primary use case, followed by exclusions and side effects. Every clause contributes something: when to use, when not to use, and behavioral caveats. There is no padding or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with six parameters and no output schema, the description covers the essential operational context: purpose, usage boundaries, and side effects. The schema covers parameters, so the remaining gap is minor—terms like 'trusted binding' and 'pending local CodeGraph receipt' are not explained, but the overall call guidance is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the input schema already documents each parameter, including defaults, bounds, and enums. The description itself does not elaborate on individual parameters, so it adds no semantic value beyond the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific use case and resource: 'starting one new task to build bounded mandatory rules and relevant governed memory context.' It also actively distinguishes itself from siblings by saying 'Do not use for exact record lookup or repeatedly within same task,' so an agent can tell it apart from recall and search tools without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit when-to-use ('Use when starting one new task') and when-not-to-use guidance ('Do not use for exact record lookup or repeatedly within same task'). While it does not name sibling tools, the positive and negative instructions are unambiguous enough to route an agent correctly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
memoryguard_explainARead-onlyIdempotent
Use when a memoryguard_audit finding_id needs its evidence, impact, and suggested repair. Do not use for generic memory lookup or to apply a repair.
| Name | Required | Description | Default |
|---|---|---|---|
| workspace | No | workspace path (default: .) | |
| finding_id | Yes | finding id from audit |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds that it returns evidence, impact, and suggested repair, and explicitly states it does not apply repairs, reinforcing the non-destructive nature. This goes beyond the annotations by specifying the output content and what it does not do.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler. The primary usage is stated first, followed by clear exclusions. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with one required parameter, the description covers purpose, usage, exclusions, and return content (evidence, impact, repair). Annotations cover safety. Nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and both parameters have descriptions. The tool description adds meaning by clarifying that finding_id comes from a memoryguard_audit and that the tool explains the finding's evidence/impact/repair, which enriches the schema's minimal 'finding id from audit' with usage context.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: it explains a memoryguard_audit finding by providing evidence, impact, and suggested repair. It explicitly differentiates from generic memory lookup and repair application, making its scope unambiguous relative to the sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly says when to use it (for audit findings needing explanation) and when not to (not for generic lookup or repair). However, it does not name specific alternative tools, only implies them. It could be improved by pointing to memory_search or memory_read for lookup, but the exclusion guidance is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
memoryguard_invokeADestructive
Invoke one explicitly registered MCP operation found through memoryguard_capabilities. Never accepts native handler or GUI method names. Mutating targets require confirmed=true and idempotency_key.
| Name | Required | Description | Default |
|---|---|---|---|
| arguments | Yes | arguments for that registered operation | |
| confirmed | No | required for a mutating target | |
| operation | Yes | registered MCP operation name from capability catalog | |
| idempotency_key | No | required retry key for a mutating target |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds useful behavioral constraints beyond the annotations: operations must be explicitly registered, native/GUI names are rejected, and mutating targets require confirmed=true and idempotency_key. This complements the destructiveHint and readOnlyHint flags without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences carry all essential information with no redundant phrasing. The core constraint is front-loaded, and the mutation safety requirements follow immediately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The definition is complete enough for a generic invocation tool: it names the discovery source, restricts accepted operation names, and explains the safety contract for mutations. It does not describe return values, but those are operation-dependent and no output schema is provided, so this is a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds modest extra meaning by tying operation to the capabilities catalog and specifying that confirmed must be true for mutating targets, which is slightly more precise than the schema's 'required for a mutating target.'
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as a generic dispatcher for registered MCP operations discovered via memoryguard_capabilities, using the concrete verb 'Invoke' and specifying the resource type. It also distinguishes itself from sibling tools by stating it never accepts native handler or GUI method names, so an agent can understand its unique role.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit context about when to invoke: only for operations found through memoryguard_capabilities, and only with the required confirmation/idempotency for mutations. It states a clear when-not ('Never accepts native handler or GUI method names'), though it does not explicitly enumerate the direct sibling tools as alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
memoryguard_memory_deleteAIdempotent
Use when owner must remove one known memory from future recall. Do not use for irreversible erasure: this is a local soft-delete recorded as status=deleted.
| Name | Required | Description | Default |
|---|---|---|---|
| memory_id | Yes | memory record ID | |
| idempotency_key | Yes | required retry key bound to this target; makes repeated deletion safe | |
| agent_instance_id | No | optional identity consistency check; trusted MCP environment is authoritative |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare idempotentHint=true and destructiveHint=false, but the description adds key behavioral context: it is a local soft-delete recorded as status=deleted and affects future recall. This goes beyond the annotations and clarifies the non-destructive nature explicitly, with no contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no waste; the primary usage is front-loaded, and the clarifying soft-delete note is brief and valuable. It is efficiently structured for quick parsing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 3-parameter tool with no output schema, the description covers purpose, usage, and behavioral outcome. It does not explicitly mention the requirement of idempotency_key or prerequisites, but these are captured in the schema. It is largely complete, with only minor gaps like potential audit implications.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so each parameter is already described (memory_id, idempotency_key, agent_instance_id). The description does not add additional semantic meaning beyond the schema, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb (remove) and resource (one known memory) with scope ('from future recall'), clearly distinguishing it from write/update/read siblings. It also clarifies it is a soft-delete, not irreversible erasure, which is a precise behavioral distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use ('Use when owner must remove one known memory from future recall') and when not to ('Do not use for irreversible erasure'), but does not name a specific alternative tool. It gives clear guidance without naming a sibling, so it is slightly below the 5 threshold.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
memoryguard_memory_readARead-onlyIdempotent
Use when an exact memory_id is already known and its governed record is needed. Do not use for discovery; use memoryguard_memory_search instead.
| Name | Required | Description | Default |
|---|---|---|---|
| memory_id | Yes | memory record ID | |
| agent_instance_id | No | optional identity consistency check; trusted MCP environment is authoritative |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is well covered. The description adds the qualifier 'governed record,' which hints at access control or authorization context, but does not elaborate on what governance entails or potential errors. It adds a small amount of behavioral context beyond annotations, but not enough to warrant a higher score.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is exactly two sentences, with the primary usage condition front-loaded and the exclusion/alternative stated immediately after. There is zero filler, and every word earns its place. It is a model of conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-by-ID tool with annotations covering safety and no output schema required, the description is complete. It specifies when to use, when not to use, and the alternative. Nothing an agent needs to correctly invoke this tool is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for both parameters (memory_id and agent_instance_id), so the schema already documents their purpose. The description does not add any additional parameter-level semantics beyond what the schema provides. Baseline 3 is appropriate when the schema handles parameter documentation fully.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (reading a memory record) and the specific precondition (exact memory_id already known). It also differentiates from the discovery-oriented sibling memoryguard_memory_search by explicitly naming it as the alternative. This makes the tool's purpose unambiguous and distinct from its siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit when-to-use guidance ('Use when an exact memory_id is already known') and when-not-to-use guidance ('Do not use for discovery'), and directs the agent to the correct alternative (memoryguard_memory_search). This is textbook usage routing with no ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
memoryguard_memory_searchARead-onlyIdempotent
Use when finding governed memories by text and lifecycle status. Do not use when an exact memory_id is known; use memoryguard_memory_read instead.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | maximum results to return (default: 5 for conversation recall) | |
| query | No | search query | |
| status | No | lifecycle status filter; defaults to active | |
| agent_instance_id | No | optional identity consistency check; trusted MCP environment is authoritative |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, covering the safety profile. The description adds minimal behavioral context beyond purpose, such as the governance aspect of memories, but does not describe return format, pagination, or other runtime behaviors. Given annotation coverage, a score of 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the primary use case and followed by an exclusion with a clear alternative. No redundant phrasing or unnecessary detail; every word serves a purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a search tool with all parameters optional and fully described in the schema, the description adequately covers the core purpose and usage guidance. It does not explain the return format, but this is common for search tools and the schema covers parameter semantics. The absence of an output schema is compensated by the description's clarity on when to use the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all four parameters (limit, query, status, agent_instance_id) with meaningful descriptions. The tool description does not add any parameter-level insight beyond what the schema provides, meeting the baseline expectation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (finding) and resource (governed memories) with specific criteria (text and lifecycle status). It explicitly differentiates from the sibling memoryguard_memory_read by noting it should not be used when an exact memory_id is known, which prevents confusion between search and direct read operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit when-to-use (finding memories by text and status) and when-not-to-use (exact memory_id known) conditions, and names the alternative tool to use instead. This leaves no ambiguity for the agent in selecting the correct tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
memoryguard_memory_statusARead-onlyIdempotent
Use when checking shared-memory availability, bound scope, total and active records, lifecycle and kind counts, and evidence-link count. Do not use to search or read individual memory content.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_instance_id | No | optional identity consistency check; trusted MCP environment is authoritative |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is fully covered. The description adds value by enumerating what the status covers (metrics categories), but does not disclose additional behavior such as freshness of counts, failure modes, or return structure. With annotations carrying the safety burden, a 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero filler. The primary use case is front-loaded, followed immediately by a clear exclusion. Every word contributes.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only status tool with zero required parameters and no output schema, the description conveys the essential return categories (availability, scope, counts) so an agent knows what to expect. Minor gap: no hint about return shape or whether counts are live, but the metric list largely covers the agent's needs.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the single optional parameter agent_instance_id is already documented as an 'optional identity consistency check.' The description adds no parameter detail, but with full schema coverage the baseline of 3 is correct per the rubric.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear purpose: checking shared-memory availability, scope, record counts, lifecycle/kind counts, and evidence-link counts. It differentiates from siblings via 'Do not use to search or read individual memory content,' which maps to memory_read and memory_search, though it doesn't name those alternatives explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit when-to-use context ('Use when checking shared-memory availability...') and an explicit exclusion ('Do not use to search or read individual memory content'). It stops short of a 5 because it doesn't name the sibling tools to use instead, leaving the routing slightly implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
memoryguard_memory_updateA
Use when owner must correct body, kind, recall policy, or priority of one known memory. Do not use to create a record, change lifecycle status, or modify another owner's memory.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | new body | |
| kind | No | replacement kind; omit to preserve current kind | |
| atom_id | No | V2 atom ID; use the source-mapping target when a migrated logical ID is ambiguous | |
| audience | No | replace mandatory-rule assignments; only allowed for always records | |
| priority | No | new priority | |
| memory_id | Yes | memory record ID | |
| idempotency_key | No | optional retry key bound to this target and payload | |
| injection_policy | No | new injection policy | |
| agent_instance_id | No | optional identity consistency check; trusted MCP environment is authoritative |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already signal a write operation (readOnly=false) and non-idempotence, and the description adds ownership and scope constraints beyond those annotations. However, it does not disclose partial-update behavior, return semantics, or identity-check consequences, so behavioral disclosure is only moderate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with no filler: the use condition is front-loaded and each clause carries routing or exclusion information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with nine parameters and no output schema, the description supplies the needed selection criteria and exclusions while the schema covers parameter details. It could specify update result/return semantics, but what is needed to choose the tool correctly is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3 and the schema documents all parameters. The description lightly maps 'recall policy' to injection_policy and emphasizes which fields are correctable, but it does not add substantive meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific action: owner correcting body, kind, recall policy, or priority of one known memory. It clearly distinguishes from memory_write by excluding record creation and from memory_status by excluding lifecycle changes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides an explicit when-to-use condition ('Use when owner must correct ... one known memory') and explicit exclusions (not for creating a record, changing lifecycle status, or modifying another owner's memory). This is strong routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
memoryguard_memory_writeA
Use when user explicitly asks to retain a durable fact, preference, project decision, or procedure. Do not use for raw transcripts or temporary task notes. Writes locally and may organize duplicates or conflicts.
| Name | Required | Description | Default |
|---|---|---|---|
| body | Yes | memory content | |
| kind | No | optional kind override; omit for native classification | |
| audience | No | mandatory-rule assignments; omitted always defaults to the trusted current agent | |
| metadata | No | optional metadata from agent | |
| priority | No | stable ordering within the mandatory rule package | |
| write_policy | No | optional write policy; propose_only creates a low_confidence candidate, while omission uses automatic organization | |
| idempotency_key | No | optional retry key bound to content, metadata, kind and policy | |
| injection_policy | No | relevant participates in task recall; always is a mandatory rule | relevant |
| agent_instance_id | No | optional identity consistency check; trusted MCP environment is authoritative |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate a non-read-only, non-idempotent, non-destructive operation. The description adds value by disclosing local write behavior and the potential to organize duplicates or conflicts, which goes beyond the annotation flags. No contradiction found.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with zero filler. The primary use case is front-loaded, and the exclusion and behavioral notes are placed efficiently. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers purpose, usage boundaries, and key behavioral traits. With a high-coverage schema and no output schema, it provides sufficient context for an agent to call the tool correctly. Minor gaps like success return values are acceptable given the lack of an output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so all parameters are documented. The description enriches the meaning of the primary parameter 'body' by providing concrete examples of durable content (facts, preferences, decisions, procedures), which goes beyond the schema's generic 'memory content'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('retain a durable fact, preference, project decision, or procedure') and the resource (durable memory). It also differentiates from siblings by explicitly excluding raw transcripts and temporary task notes, making its scope unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit triggers ('when user explicitly asks to retain') and exclusions ('do not use for raw transcripts or temporary task notes'). While it doesn't name alternative tools like memory_read or memory_update, the guidance is clear enough for an agent to decide when to invoke this write tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
59 tool updates
v0.7.12- Removed
memoryguard_accept_candidates - Removed
memoryguard_apply_enrichments - Removed
memoryguard_binding_create - Removed
memoryguard_binding_list - Removed
memoryguard_build_and_enrich - Removed
memoryguard_canonical_status - Added
memoryguard_capabilities - Removed
memoryguard_codegraph_affected - Removed
memoryguard_codegraph_explain - Removed
memoryguard_codegraph_path - Removed
memoryguard_codegraph_query - Removed
memoryguard_codegraph_status - Removed
memoryguard_codegraph_update - Changed
memoryguard_context_bootstrap2 fields changed- added
Input schema / properties / max_chars / descriptionAdded value: +"maximum characters for optional recalled content; mandatory rules use their separate budget" - added
Input schema / properties / max_items / descriptionAdded value: +"maximum optional memories to include; mandatory rules use their separate budget"
- Removed
memoryguard_diagnostics_snapshot - Removed
memoryguard_enrichment_status - Removed
memoryguard_external_mcp_import - Removed
memoryguard_external_mcp_list - Removed
memoryguard_extract_memories - Removed
memoryguard_history_delete - Removed
memoryguard_history_export - Removed
memoryguard_history_extract_preview - Removed
memoryguard_history_list_sessions - Removed
memoryguard_history_read - Removed
memoryguard_history_search - Removed
memoryguard_history_timeline - Removed
memoryguard_import_preview - Added
memoryguard_invoke - Removed
memoryguard_knowledge_book - Removed
memoryguard_knowledge_candidates - Removed
memoryguard_knowledge_list - Removed
memoryguard_knowledge_read - Removed
memoryguard_knowledge_search - Removed
memoryguard_list_pending_enrichments - Removed
memoryguard_list_sources - Changed
memoryguard_memory_delete2 fields changed- changed
Input schema / properties / idempotency_key / descriptionPrevious value: -"optional retry key bound to this target"New value: +"required retry key bound to this target; makes repeated deletion safe" - changed
Input schema / requiredPrevious value: -[ - "memory_id" -]New value: +[ + "memory_id", + "idempotency_key" +]
- Removed
memoryguard_memory_merge_safe - Removed
memoryguard_memory_merge_safe_preview - Changed
memoryguard_memory_search4 fields changed- removed
Input schema / properties / kindRemoved value: -{ - "description": "filter by kind: preference|fact|project|procedure|episode|correction", - "type": "string" -} - removed
Input schema / properties / semanticRemoved value: -{ - "description": "optional semantic recall mode (default: off)", - "enum": [ - "off", - "heuristic", - "model" - ], - "type": "string" -} - changed
Input schema / properties / status / descriptionPrevious value: -"filter by status: active (default)|low_confidence|shadowed|conflicted|quarantined|deleted"New value: +"lifecycle status filter; defaults to active" - added
Input schema / properties / status / enumAdded value: +[ + "active", + "low_confidence", + "shadowed", + "conflicted", + "quarantined", + "deleted" +]
- Changed
memoryguard_memory_update3 fields changed- changed
Input schema / properties / kind / descriptionPrevious value: -"new kind"New value: +"replacement kind; omit to preserve current kind" - added
Input schema / properties / kind / enumAdded value: +[ + "preference", + "fact", + "project", + "procedure", + "episode", + "correction" +] - removed
Input schema / properties / statusRemoved value: -{ - "description": "new status", - "type": "string" -}
- Changed
memoryguard_memory_write3 fields changed- changed
Input schema / properties / kind / descriptionPrevious value: -"override kind (default: auto-classify). Valid: preference|fact|project|procedure|episode|correction"New value: +"optional kind override; omit for native classification" - added
Input schema / properties / kind / enumAdded value: +[ + "preference", + "fact", + "project", + "procedure", + "episode", + "correction" +] - changed
Input schema / properties / write_policy / descriptionPrevious value: -"write policy: auto_accept (default) | auto_quarantine_on_risk | propose_only. propose_only creates a low_confidence candidate without modifying existing memories"New value: +"optional write policy; propose_only creates a low_confidence candidate, while omission uses automatic organization"
- Removed
memoryguard_neuron_graph - Removed
memoryguard_projection_status - Removed
memoryguard_provider_install - Removed
memoryguard_resolve_group - Removed
memoryguard_rule_create_auto - Removed
memoryguard_rule_decision_read - Removed
memoryguard_rule_feedback - Removed
memoryguard_rule_merge_acknowledge - Removed
memoryguard_rule_merge_approve - Removed
memoryguard_rule_merge_capability_issue - Removed
memoryguard_rule_merge_cooldown_clear - Removed
memoryguard_rule_merge_safe - Removed
memoryguard_rule_merge_safe_preview - Removed
memoryguard_rule_scope_stats - Removed
memoryguard_rule_undo - Removed
memoryguard_runtime_processes - Removed
memoryguard_scan_summary - Removed
memoryguard_semantic_check
4 tool updates
v0.7.11- Added
memoryguard_memory_merge_safe - Added
memoryguard_memory_merge_safe_preview - Added
memoryguard_rule_merge_safe - Added
memoryguard_rule_merge_safe_preview
57 tool updates
v0.7.8- First observed
memoryguard_accept_candidates - First observed
memoryguard_apply_enrichments - First observed
memoryguard_audit - First observed
memoryguard_binding_create - First observed
memoryguard_binding_list - First observed
memoryguard_build_and_enrich - First observed
memoryguard_canonical_status - First observed
memoryguard_codegraph_affected - First observed
memoryguard_codegraph_explain - First observed
memoryguard_codegraph_path - First observed
memoryguard_codegraph_query - First observed
memoryguard_codegraph_status - First observed
memoryguard_codegraph_update - First observed
memoryguard_context_bootstrap - First observed
memoryguard_diagnostics_snapshot - First observed
memoryguard_enrichment_status - First observed
memoryguard_explain - First observed
memoryguard_external_mcp_import - First observed
memoryguard_external_mcp_list - First observed
memoryguard_extract_memories - First observed
memoryguard_history_delete - First observed
memoryguard_history_export - First observed
memoryguard_history_extract_preview - First observed
memoryguard_history_list_sessions - First observed
memoryguard_history_read - First observed
memoryguard_history_search - First observed
memoryguard_history_timeline - First observed
memoryguard_import_preview - First observed
memoryguard_knowledge_book - First observed
memoryguard_knowledge_candidates - First observed
memoryguard_knowledge_list - First observed
memoryguard_knowledge_read - First observed
memoryguard_knowledge_search - First observed
memoryguard_list_pending_enrichments - First observed
memoryguard_list_sources - First observed
memoryguard_memory_delete - First observed
memoryguard_memory_read - First observed
memoryguard_memory_search - First observed
memoryguard_memory_status - First observed
memoryguard_memory_update - First observed
memoryguard_memory_write - First observed
memoryguard_neuron_graph - First observed
memoryguard_projection_status - First observed
memoryguard_provider_install - First observed
memoryguard_resolve_group - First observed
memoryguard_rule_create_auto - First observed
memoryguard_rule_decision_read - First observed
memoryguard_rule_feedback - First observed
memoryguard_rule_merge_acknowledge - First observed
memoryguard_rule_merge_approve - First observed
memoryguard_rule_merge_capability_issue - First observed
memoryguard_rule_merge_cooldown_clear - First observed
memoryguard_rule_scope_stats - First observed
memoryguard_rule_undo - First observed
memoryguard_runtime_processes - First observed
memoryguard_scan_summary - First observed
memoryguard_semantic_check
TDQS
Scored across 11 tools
Every tool has a clearly distinct role, and descriptions actively prevent misselection (e.g., memory_read vs memory_search, audit vs explain, capabilities vs invoke). The lifecycle operations also explicitly state what they should not be used for.
All tools share the memoryguard_ prefix and use readable snake_case, with memory operations following a consistent memory_<action> pattern. However, audit, explain, capabilities, invoke, and context_bootstrap deviate from a uniform verb_noun convention, creating minor inconsistency.
Eleven tools is well-scoped for a governed-memory server: CRUD/search/status, audit/explain, context bootstrap, and a capability-discovery/invocation pair. Each tool has a meaningful place and the count feels neither bloated nor thin.
The surface covers memory creation, reading, searching, updating, soft-deletion, status inspection, audit, explanation, and task context bootstrapping. Minor gaps remain around explicit lifecycle transitions (e.g., restore/archive) and applying audit repairs, though the generic invoke tool provides a partial extension path.
Maintenance
Related MCP Connectors
- memnodeOAuthdev.memnode
Persistent, inspectable memory for AI agents with lineage, correction, and a hosted MCP endpoint.
Hosted MCP memory for coding agents: persistent across sessions, editable markdown, team sharing.
1Shared, governed long-term memory for AI agents across tools and sessions via MCP and REST.
An MCP memory server. One memory your agents share — across models, devices and apps.
Related MCP Servers
- AlicenseAqualityAmaintenanceMCP-native, local-first memory for coding agents that turns real sessions into reusable decisions, gotchas, and domain knowledge.176MIT
- AlicenseNot gradedqualityCmaintenanceAn MCP-native, local-first memory server that gives AI agents persistent, structured memory across sessions and tools, enabling them to maintain identity and context without reconfiguration.3MIT
- FlicenseNot gradedqualityCmaintenanceA local-first MCP server that manages developer memory for coding agents, enabling shared project context, permissions, and audit trails across different agents.1-
- FlicenseNot gradedqualityDmaintenanceShared memory and orchestration for coding agents, enabling persistent knowledge, multi-agent coordination, and a canonical workflow across MCP-compatible AI clients.59 npm110-