Skip to main content
Glama

Let agents write without turning shared memory into an unreviewed pile. MemoryGuard organizes each write, preserves the evidence behind changes, and keeps governance decisions reversible.

No account. No remote server. No remote telemetry. Local-only usage telemetry is optional and stores bounded, privacy-preserving aggregates locally.

What's New in v0.7.12

v0.7.12 improves MCP discovery, bounded read delivery, and local usage telemetry while preserving the existing governed action checks and MCP name:

  • Compact discovery with a complete catalog: New MCP clients receive 11 day-to-day tools from tools/list, including capability discovery and the governed invocation broker. memoryguard_capabilities provides paginated metadata for registered MCP operations and reviewed headless GUI operations; exact advanced MCP names remain callable for compatibility.

  • Bounded read delivery: Replayable successful reads are capped at 24,000 UTF-8 bytes across the complete MCP envelope. Eligible oversized reads return a short-lived process-local reference rather than truncating data; reads that cannot be safely replayed or exceed the snapshot limit return a bounded narrowing hint. Pages support UTF-8 offsets and field selection. Private references revalidate the original read under the current trusted session and binding before each page. Writes and context bootstrap keep their complete receipt/mandatory-rule contracts and cannot request response paging.

  • Cache-aware local telemetry: Provider-reported cache-read and cache-write input counts are kept separately with complete/partial/unavailable coverage. A measured zero remains zero; missing provider data remains unknown. The deterministic unit estimate is labeled as an estimate and does not claim a measured token reduction.

  • Governed invocation: Mutating broker targets still require confirmation and a non-empty idempotency key, which are forwarded to the target's existing permission, scope, and readiness checks. The MCP name remains io.github.irisxc4/memoryguard.

See the v0.7.12 release note and release history.

Earlier release details are kept in the Changelog and GitHub release records.

Token evidence and demo

Usage events distinguish measured_cached_input from measured_cache_write_input. measured_cache_coverage.cache_read and cache_write report complete, partial, or unavailable; measured zero remains 0, while missing provider data remains None/unavailable. Character-based estimates remain explicitly labelled estimated mg_deterministic_unit, never provider tokens.

Run the benchmark only against an authorized local workspace:

python scripts/benchmark_usage_telemetry.py --workspace . --window-days 7 --sync

Read the benchmark guide for measured, estimated, derived, and unsupported semantics. Use the demo recording checklist for a sanitized walkthrough. The repository's synthetic graph artwork is not a live product capture; it is not evidence of usage or savings.

Related MCP server: GroundMemory

Major V2 refactor in v0.6.0

v0.6.0 was a production data-plane refactor, not a storage-only upgrade:

  • Authoritative V2 domains: Memory, Rules, Evidence, Content, Runtime, Projection, Assets, CodeGraph, Skills, and System state are separated into explicit SQLite domains with governed boundaries.

  • Explicit cutover: V1_ACTIVE → V2_BUILDING → V2_READY → V2_ACTIVE is fail-closed; V2 never silently falls back to legacy stores or dual-writes after READY/ACTIVE.

  • Lossless migration: frozen-source preparation uses coherent SQLite online backups, validates source/target evidence, rechecks live-source drift, and preserves V1 data plus migration backups for rollback.

  • Native routing: MCP, CLI, GUI, and Hook surfaces are classified explicitly; the release closed the 233-surface cutover with 138 implemented routes, 95 retired routes, and zero neutral/blocker routes.

  • Governed intelligence: Rule lifecycle and RuleMerge, extraction/enrichment, External MCP import, provider control-plane, conversation history, Knowledge Library, and GUI governance all use the V2 evidence and decision paths.

  • Operational evidence: Reference Audit, per-domain SQLite health, guarded maintenance, rollback evidence, and safe unbound diagnostics are part of readiness and operations.

Why MemoryGuard

Persistent memory solves storage. It does not solve governance.

When several coding agents write into the same context, records become duplicated, stale, contradictory, over-broad, or unsafe to reuse. MemoryGuard sits between coding agents and their shared memory to keep that context usable.

Without governance

With MemoryGuard

Notes accumulate without a canonical state

Writes are classified, deduplicated, superseded, or surfaced as conflicts

A correction silently destroys the old value

Evidence and supersede chains preserve what changed and why

Tokens and credentials can remain active

Sensitive-looking content is quarantined from active memory

Every write needs manual approval

Agents write normally; people review exceptions and outcomes

Raw chat logs leak into future context

Conversation history remains a separate, explicitly read evidence archive

System architecture

%%{init: {"theme":"base","themeVariables":{"background":"#071521","fontFamily":"Arial, sans-serif","fontSize":"14px","primaryTextColor":"#EEF4F8","lineColor":"#557287","edgeLabelBackground":"#071521","clusterBkg":"#0A1A29","clusterBorder":"#27445A"},"flowchart":{"htmlLabels":true,"curve":"basis","nodeSpacing":32,"rankSpacing":48,"padding":14}}}%%
flowchart TB
    Hosts["CODING-AGENT HOSTS<br/>Claude Code · Codex · Cursor · TRAE&nbsp;&nbsp;&nbsp;&nbsp;"]:::host
    Gateway["LOCAL INTEGRATION<br/>MCP stdio · redirect rules · lifecycle hooks&nbsp;&nbsp;&nbsp;&nbsp;"]:::gateway

    subgraph Core["GOVERNANCE CORE&nbsp;&nbsp;&nbsp;&nbsp;"]
        direction LR
        Identity["TRUST<br/>identity · scope&nbsp;&nbsp;&nbsp;&nbsp;"]:::core
        MemoryAPI["MEMORY<br/>governed I/O&nbsp;&nbsp;&nbsp;&nbsp;"]:::active
        Rules["RULES<br/>scope · assignment&nbsp;&nbsp;&nbsp;&nbsp;"]:::rule
        HistoryAPI["HISTORY<br/>search · timeline&nbsp;&nbsp;&nbsp;&nbsp;"]:::history
        Security["SAFETY<br/>validate · quarantine&nbsp;&nbsp;&nbsp;&nbsp;"]:::danger

        Identity --> MemoryAPI
        Identity --> Rules
        Identity --> HistoryAPI
        MemoryAPI --> Security
    end

    subgraph Stores["LOCAL GOVERNED STORES&nbsp;&nbsp;&nbsp;&nbsp;"]
        direction LR
        SharedDB[("V2 DOMAIN STORES<br/>Memory · Rules · Evidence · Content&nbsp;&nbsp;&nbsp;&nbsp;")]:::store
        HistoryDB[("HISTORY STORE<br/>isolated conversations&nbsp;&nbsp;&nbsp;&nbsp;")]:::historyStore
        AuditDB[("RECOVERY STORE<br/>versions · receipts · backups&nbsp;&nbsp;&nbsp;&nbsp;")]:::store
    end

    Bootstrap["BOUNDED CONTEXT BOOTSTRAP<br/>mandatory rule pack · relevant recall&nbsp;&nbsp;&nbsp;&nbsp;"]:::bootstrap
    Control["HUMAN CONTROL<br/>CLI · desktop governance console&nbsp;&nbsp;&nbsp;&nbsp;"]:::surface

    Hosts --> Gateway --> Identity
    MemoryAPI --> SharedDB
    Rules --> SharedDB
    HistoryAPI --> HistoryDB
    Security --> AuditDB
    SharedDB --> Bootstrap
    Control --> Identity

    classDef host fill:#12243A,stroke:#38D5C8,color:#EEF4F8,stroke-width:1.4px;
    classDef gateway fill:#0D3338,stroke:#38D5C8,color:#EEF4F8,stroke-width:2.4px;
    classDef core fill:#12243A,stroke:#557287,color:#EEF4F8,stroke-width:1.4px;
    classDef active fill:#0D383A,stroke:#38D5C8,color:#EEF4F8,stroke-width:2px;
    classDef rule fill:#3B2C18,stroke:#F3B562,color:#EEF4F8,stroke-width:1.8px;
    classDef history fill:#102F45,stroke:#73C7F5,color:#EEF4F8,stroke-width:1.8px;
    classDef danger fill:#3A2028,stroke:#EA6A6A,color:#EEF4F8,stroke-width:1.8px;
    classDef bootstrap fill:#EEF4F8,stroke:#38D5C8,color:#071521,stroke-width:2.4px;
    classDef store fill:#0B1624,stroke:#7F96A8,color:#EEF4F8,stroke-width:1.4px;
    classDef historyStore fill:#102436,stroke:#73C7F5,color:#EEF4F8,stroke-width:1.4px;
    classDef surface fill:#EEF4F8,stroke:#38D5C8,color:#071521,stroke-width:2px;

    style Core fill:#081827,stroke:#27445A,stroke-width:1px,color:#EEF4F8
    style Stores fill:#081827,stroke:#27445A,stroke-width:1px,color:#EEF4F8
    linkStyle default stroke:#557287,stroke-width:1.4px;

Quick start

MCP Registry metadata

This package exposes a local stdio MCP server as io.github.irisxc4/memoryguard. Registry metadata is kept in server.json, and the marker above ships with the PyPI package README. Releases are published through GitHub OIDC to PyPI and the official MCP Registry. Verify the current package version and the Registry entry's active/latest state through their live public records.

1. Install

python -m pip install agent-memguard

For the desktop governance console:

python -m pip install "agent-memguard[gui]"

2. Authorize the current project

memoryguard source add .

3. Connect or repair your coding agent

Global provider configuration is rebuilt from the real binding in the canonical user data home. The command is idempotent and removes superseded MemoryGuard project-level overrides after a successful global takeover.

# Repair one provider
memoryguard provider repair claude
memoryguard provider repair codex
memoryguard provider repair cursor
memoryguard provider repair trae

# Repair every detected provider
memoryguard provider repair all

Restart the host after installation, then verify the integration:

memoryguard doctor
memoryguard mcp-status
memoryguard hooks status --provider all

Launch the desktop console:

memoryguard gui

memoryguard-gui . remains available for desktop shortcuts. A bare memoryguard gui always opens the canonical user-level control directory (default %LOCALAPPDATA%\MemoryGuard on Windows), so running it from a project or from C:\Windows\System32 cannot silently switch databases. MEMORYGUARD_WORKSPACE is an explicit operator override; an explicit memoryguard gui <project-path> or memoryguard gui --workspace <project-path> selects a specific workspace. It does not remember a previously selected project or open a folder picker. On Windows, memoryguard gui detaches the native window from the terminal, so closing PowerShell does not close the GUI.

Provider-specific setup and behavior:

Stable Codex / Router binding

Codex/Router binds MemoryGuard to the stable local Codex program and control installation. An account profile is an endpoint/alias, not a new memory owner: switching profiles automatically discovers or repairs the profile and reuses the verified Agent binding and active group. Request identity remains fail-closed; this does not share records across machines or with arbitrary accounts.

Upgrade

MemoryGuard currently upgrades through Python's package manager:

python -m pip install --upgrade agent-memguard
memoryguard --version
memoryguard doctor

If you installed the GUI extra, keep it during the upgrade:

python -m pip install --upgrade "agent-memguard[gui]"

There is no package self-update command. The package manager is the authoritative package-upgrade path; memoryguard upgrade below is the explicit workspace migration flow, not a package updater.

Upgrade an existing V1 data home

Upgrade the package, then run the verified migration. No workspace, data-home, apply, or confirmation arguments are required for the normal user-level data home:

python -m pip install --upgrade agent-memguard
memoryguard --version                    # confirms installed version
memoryguard upgrade
memoryguard doctor

The command prepares V2, validates the frozen and live source evidence, migrates Agent/Group control, activates only after all gates pass, and removes only the backup batch belonging to that successful migration. Re-running it on V2_ACTIVE is idempotent. For a zero-write report, use:

memoryguard upgrade --preview

Advanced explicit workspace/data-home options remain available for operators managing an isolated installation. A failed gate stays non-active and preserves its evidence; successful activation does not keep a redundant migration backup.

Existing pre-V2 workspaces: explicit V2 cutover

v0.6.0 never auto-activates an existing workspace. Upgrade the package first, then use the packaged operator CLI:

# Read-only manifest status
memoryguard-v2 status -w .

# Build a frozen-source V2 shadow and stop at V2_READY
memoryguard-v2 prepare -w . --apply

# Activate only after the prepare result is V2_READY / ready=true
memoryguard-v2 activate -w . --confirm V2_ACTIVE

The prepare step uses coherent SQLite online backups, preserves V1 and migration-backups, and rechecks live-source drift before READY. Activation performs another fresh drift check before changing the manifest. Do not delete legacy V1 data or migration backups as part of the upgrade.

Knowledge Library

The desktop console can turn a selected folder or file set into one governed local knowledge library. Source files remain where they are; MemoryGuard stores the searchable index in its user data home instead of copying a runtime database into every source project. Knowledge metadata never becomes a second source-body store.

Capability

Current behavior

File/folder ingestion

Add a folder as a book or selected files as documents

Structure

Parse documents, preserve chapter/section context, and create traceable chunks

Retrieval

Full-text search, optional embeddings, and a layered knowledge graph

Natural synchronization

Re-ingest changed files; a partial or failed scan does not silently remove previously indexed content

Lifecycle

Move a book to the library trash, restore it, or explicitly purge its recovery snapshot

Memory candidates

Preview evidence-backed candidates before accepting them into governed long-term memory

Open the desktop console and choose Knowledge Library. Remote embedding or model-backed indexing is opt-in and requires explicit authorization; local full-text retrieval remains available without sending source text to a remote provider. Background imports, re-ingests, and smart rebuilds have durable task receipts: retrying the same request reuses its task, while reusing that key for a different request is rejected. A live task for a different request reports busy rather than claiming that work was accepted.

CodeGraph refresh

The first CodeGraph build is an explicit, confirmed full build. After a scope has been built, each successful trusted file write can trigger an incremental refresh for that scope, subject to strict source-path and active-binding validation. Unchanged content hashes are a no-op; deleted files are retired; the next context receives one bounded affected receipt. MemoryGuard does not run a daemon or watcher for this path and does not infer paths from shell or free-form text. A projectless MCP caller first builds an already-bound directory source, then passes its codegraph_source_id to select that exact scope for query, status, update, and graph reads.

Desktop console surfaces

The GUI has eight visible navigation entries: seven governance pages plus a separate Token usage-and-savings view:

  1. Governance Overview

  2. Data Sources & Agents

  3. Memory Core

  4. CodeGraph

  5. Rules & Habits

  6. Conversation History

  7. Risk Signals & Governance Console

  8. Token Usage & Savings (separate from the seven governance pages)

Agent lists use readable program/provider names; the underlying ID remains available in the detail view. Empty data is shown as an explicit empty state.

Write and governance lifecycle

%%{init: {"theme":"base","themeVariables":{"background":"#071521","fontFamily":"Arial, sans-serif","fontSize":"14px","primaryTextColor":"#EEF4F8","lineColor":"#557287","edgeLabelBackground":"#071521","clusterBkg":"#0A1A29","clusterBorder":"#27445A"},"flowchart":{"htmlLabels":true,"curve":"basis","nodeSpacing":30,"rankSpacing":42,"padding":14}}}%%
flowchart TD
    subgraph Intake["01 · INTAKE&nbsp;&nbsp;&nbsp;&nbsp;"]
        direction LR
        Write(["Memory write&nbsp;&nbsp;&nbsp;&nbsp;"]):::entry
        Scope["Resolve identity<br/>scope · audience&nbsp;&nbsp;&nbsp;&nbsp;"]:::core
        Validate{"Authorized?&nbsp;&nbsp;&nbsp;&nbsp;"}:::decision
        Reject["Reject<br/>no persistence&nbsp;&nbsp;&nbsp;&nbsp;"]:::danger
        Write --> Scope --> Validate
        Validate -- NO --> Reject
    end

    subgraph Organize["02 · ORGANIZE&nbsp;&nbsp;&nbsp;&nbsp;"]
        direction TB
        Secret{"Sensitive?&nbsp;&nbsp;&nbsp;&nbsp;"}:::decision
        Quarantine["Quarantine<br/>outside active set&nbsp;&nbsp;&nbsp;&nbsp;"]:::danger
        Compare["Classify · compare<br/>governed records&nbsp;&nbsp;&nbsp;&nbsp;"]:::active
        Relation{"Relationship&nbsp;&nbsp;&nbsp;&nbsp;"}:::decision
        New["NEW<br/>create active record&nbsp;&nbsp;&nbsp;&nbsp;"]:::result
        Duplicate["DUPLICATE<br/>merge provenance&nbsp;&nbsp;&nbsp;&nbsp;"]:::result
        Correction["CORRECTION<br/>supersede old record&nbsp;&nbsp;&nbsp;&nbsp;"]:::rule
        Conflict["CONFLICT<br/>preserve both sides&nbsp;&nbsp;&nbsp;&nbsp;"]:::danger

        Secret -- YES --> Quarantine
        Secret -- NO --> Compare --> Relation
        Relation --> New
        Relation --> Duplicate
        Relation --> Correction
        Relation --> Conflict
    end

    subgraph Govern["03 · GOVERN&nbsp;&nbsp;&nbsp;&nbsp;"]
        direction LR
        Receipt[("Evidence event<br/>version receipt&nbsp;&nbsp;&nbsp;&nbsp;")]:::store
        Review["CLI or desktop review&nbsp;&nbsp;&nbsp;&nbsp;"]:::surface
        Action["Correct · merge<br/>restore · delete&nbsp;&nbsp;&nbsp;&nbsp;"]:::rule
        Snapshot["Reversible<br/>snapshot&nbsp;&nbsp;&nbsp;&nbsp;"]:::active
        Receipt --> Review --> Action --> Snapshot
    end

    Validate -- YES --> Secret
    Quarantine --> Receipt
    New --> Receipt
    Duplicate --> Receipt
    Correction --> Receipt
    Conflict --> Receipt

    classDef entry fill:#EEF4F8,stroke:#38D5C8,color:#071521,stroke-width:2.4px;
    classDef core fill:#12243A,stroke:#557287,color:#EEF4F8,stroke-width:1.5px;
    classDef decision fill:#0D3338,stroke:#38D5C8,color:#EEF4F8,stroke-width:2px;
    classDef active fill:#0D383A,stroke:#38D5C8,color:#EEF4F8,stroke-width:2px;
    classDef result fill:#12243A,stroke:#38D5C8,color:#EEF4F8,stroke-width:1.6px;
    classDef rule fill:#3B2C18,stroke:#F3B562,color:#EEF4F8,stroke-width:1.8px;
    classDef danger fill:#3A2028,stroke:#EA6A6A,color:#EEF4F8,stroke-width:1.8px;
    classDef store fill:#0B1624,stroke:#7F96A8,color:#EEF4F8,stroke-width:1.4px;
    classDef surface fill:#EEF4F8,stroke:#38D5C8,color:#071521,stroke-width:2px;

    style Intake fill:#081827,stroke:#27445A,stroke-width:1px,color:#EEF4F8
    style Organize fill:#081827,stroke:#27445A,stroke-width:1px,color:#EEF4F8
    style Govern fill:#081827,stroke:#27445A,stroke-width:1px,color:#EEF4F8
    linkStyle default stroke:#557287,stroke-width:1.4px;

The console is not an approval queue. Agents keep moving. MemoryGuard records the outcome and exposes the evidence needed to correct it later.

What you can govern

Signal

Governance action

Duplicate or stale memory

Inspect the canonical record and supersede chain; restore an earlier version when needed

Conflicting memories

Keep both visible until the conflict is resolved deliberately

Secrets, tokens, or credentials

Quarantine the record so it cannot enter active shared memory

Incorrect automatic organization

Correct, merge, lock, restore, or roll back with evidence

Multiple coding agents

Bind agents to one shared group while preserving source identity and scope

Mandatory rules

Assign rules to an Agent, project, provider, runtime role, or shared group

Rules and history stay separate

MemoryGuard deliberately keeps governed long-term memory and raw conversation history on different paths.

Surface

Purpose

Context behavior

Rules and habits

Preferences, procedures, corrections, facts, projects, and scoped mandatory rules

Mandatory rules use an independent char/token budget after scope, exclude, conflict, and semantic dedup. Effective count above 20 is a health warning, not a hard block; storage is not capped by count. Sensitive, corrupt, per-item oversize, and aggregate overflow still fail closed with no silent truncation. Ordinary records are recalled when relevant

Conversation history

Local raw-evidence archive with owner and shared-group access controls

Never enters bootstrap automatically; raw text is read only through explicit history tools

Neuron graph

Navigation and governance over memory, rules, projects, agents, and sessions

History nodes contain safe metadata and summaries, not raw chat content

History retrieval is progressive: search results, then a bounded timeline, then an explicitly selected turn or session. Extracting from history creates a preview first; it does not silently write a long-term memory.

%%{init: {"theme":"base","themeVariables":{"background":"#071521","fontFamily":"Arial, sans-serif","fontSize":"14px","primaryTextColor":"#EEF4F8","lineColor":"#557287","edgeLabelBackground":"#071521","clusterBkg":"#0A1A29","clusterBorder":"#27445A"},"flowchart":{"htmlLabels":true,"curve":"basis","nodeSpacing":30,"rankSpacing":42,"padding":14}}}%%
flowchart LR
    subgraph HistoryPath["CONVERSATION EVIDENCE&nbsp;&nbsp;&nbsp;&nbsp;"]
        direction TB
        Archive[("Raw local history&nbsp;&nbsp;&nbsp;&nbsp;")]:::historyStore
        Search["Search summaries&nbsp;&nbsp;&nbsp;&nbsp;"]:::history
        Timeline["Bounded timeline&nbsp;&nbsp;&nbsp;&nbsp;"]:::history
        Read["Explicit turn or session&nbsp;&nbsp;&nbsp;&nbsp;"]:::history
        Preview["Evidence-backed<br/>extraction preview&nbsp;&nbsp;&nbsp;&nbsp;"]:::history
        Confirm["Explicit acceptance&nbsp;&nbsp;&nbsp;&nbsp;"]:::surface
        Isolation["NO AUTOMATIC<br/>BOOTSTRAP PATH&nbsp;&nbsp;&nbsp;&nbsp;"]:::barrier

        Archive --> Search --> Timeline --> Read --> Preview --> Confirm
        Archive -.-> Isolation
    end

    subgraph GovernedMemory["GOVERNED LONG-TERM MEMORY&nbsp;&nbsp;&nbsp;&nbsp;"]
        direction TB
        Mandatory["Scoped mandatory rules&nbsp;&nbsp;&nbsp;&nbsp;"]:::rule
        Assignments["Agent · project<br/>role · group scope&nbsp;&nbsp;&nbsp;&nbsp;"]:::core
        RulePack["Mandatory-rule<br/>budget&nbsp;&nbsp;&nbsp;&nbsp;"]:::budget
        Ordinary["Facts · preferences<br/>projects · procedures&nbsp;&nbsp;&nbsp;&nbsp;"]:::memory
        Recall["Task-relevant<br/>recall budget&nbsp;&nbsp;&nbsp;&nbsp;"]:::budget
        Context["BOUNDED CONTEXT PACKET&nbsp;&nbsp;&nbsp;&nbsp;"]:::context

        Mandatory --> Assignments --> RulePack --> Context
        Ordinary --> Recall --> Context
    end

    HistoryPath ==>|GOVERNED WRITE&nbsp;&nbsp;&nbsp;&nbsp;| GovernedMemory

    classDef rule fill:#3B2C18,stroke:#F3B562,color:#EEF4F8,stroke-width:1.8px;
    classDef core fill:#12243A,stroke:#557287,color:#EEF4F8,stroke-width:1.4px;
    classDef memory fill:#0D383A,stroke:#38D5C8,color:#EEF4F8,stroke-width:1.8px;
    classDef budget fill:#12243A,stroke:#38D5C8,color:#EEF4F8,stroke-width:1.6px;
    classDef context fill:#EEF4F8,stroke:#38D5C8,color:#071521,stroke-width:2.4px;
    classDef history fill:#102F45,stroke:#73C7F5,color:#EEF4F8,stroke-width:1.6px;
    classDef historyStore fill:#102436,stroke:#73C7F5,color:#EEF4F8,stroke-width:1.6px;
    classDef surface fill:#EEF4F8,stroke:#73C7F5,color:#071521,stroke-width:2px;
    classDef barrier fill:#3A2028,stroke:#EA6A6A,color:#EEF4F8,stroke-width:2px;

    style GovernedMemory fill:#081827,stroke:#27445A,stroke-width:1px,color:#EEF4F8
    style HistoryPath fill:#081827,stroke:#27445A,stroke-width:1px,color:#EEF4F8
    linkStyle default stroke:#557287,stroke-width:1.4px;

Supported hosts

Host

Integration

Current boundary

Claude Code

Global MCP binding, redirect rules, user-level lifecycle Hook

Verified takeover path

Codex

Global MCP binding, redirect rules, user-level lifecycle Hook

Verified takeover path

Cursor

Global MCP binding, redirect rules, user-level lifecycle Hook

Verified takeover path

TRAE

MCP binding and redirect rules

No verified Hook seam; reported as a fallback instead of full takeover

Provider status is reported honestly as redirected, observed, operational, or unsupported. MemoryGuard does not claim it can disable every host's native memory when the host exposes no reliable integration point.

Architecture

Layer

Responsibility

Evidence & Content

Authorized sources, immutable evidence, content-addressed blobs/occurrences, source manifests, and conversation archives

Memory & Rules

Scoped memory atoms, revisions, bindings, rule definitions, decisions, evidence links, and compensating governance operations

Runtime & Projection

Bounded working context, scenario/profile projections, CodeGraph, Assets, and Skills metadata

Cutover & Governance

Four-state manifest, native MCP/CLI/GUI/Hook routing, Reference Audit, maintenance, provider adapters, and rollback evidence

V2 uses separate authoritative SQLite domains rather than one shared-memory database. The runtime reads and writes V2 only after the manifest reaches V2_ACTIVE; V2_BUILDING and V2_READY never silently fall back or dual-write. Evidence remains traceable without being treated as automatically trusted memory.

Privacy and safety

  • MemoryGuard runs as a local MCP stdio server.

  • All governed data stays local unless you explicitly authorize a remote model or embedding operation. Optional usage telemetry is local-only: its measured host token events and deterministic conversion events are stored under .memoryguard/usage_telemetry.sqlite; it does not upload data. Token savings are estimates based on MemoryGuard deterministic units, not a provider billing statement. Hosts without token reporting remain unsupported in the measured columns.

  • The Knowledge Library database uses MEMORYGUARD_HOME or the platform user data directory, so a selected source folder does not receive its own knowledge database.

  • V2 authoritative workspace state is separated under .memoryguard/ into explicit Memory, Rules, Evidence, Content, Runtime, Projection, Assets, CodeGraph, Skills, and System domains; History, Source, Binding, and Group control are V2-native surfaces. Legacy V1 artifacts are preserved as local rollback/audit evidence after cutover and are no longer the active V2 runtime write path; only memoryguard.migration may read them.

  • Source scanning is read-only by default.

  • Mutating governance paths use validation, explicit scope, provenance, and reversible state.

  • Quarantined records stay outside active shared memory.

  • Raw conversation history is never injected into bootstrap automatically.

  • Shared-group history access follows current active membership and does not grant deletion rights over another Agent's source.

CLI

The installed memoryguard command exposes these top-level operations:

Command

Purpose

audit [path]

Run a read-only audit and generate a report

open [path]

Open the latest interactive report

explain <finding_id>

Explain evidence and risk for a finding

source <action>

List, add, remove, or preview authorized sources

scan

Scan authorized sources and build the coverage ledger

doctor

Diagnose V2 manifest, domain availability, and native coverage

mcp-status

Inspect V2 MCP/backend health; tenant counts require a bound Agent scope

hooks <action>

Install, inspect, pause, repair, or remove host Hooks

provider <action>

Inspect or repair global provider integrations

`storage audit

report`

`storage sweep

compact`

groups <action>

Inspect governed group state

gui [path]

Launch the interactive governance console

desktop

Launch the trusted desktop executor

The old V1 plan, apply, verify, undo, import, and gc workflows may remain parseable as explicit retired compatibility surfaces, but are not a V1 runtime path. Under V2_ACTIVE they return a stable retired result instead of writing through a legacy store. Legacy data input is accepted only by the explicit memoryguard.migration upgrade flow.

Run memoryguard --help or memoryguard <command> --help for the live command reference.

MCP API

The default MCP discovery surface is intentionally compact. New MCP clients receive these eleven day-to-day tools through tools/list:

Tool

Purpose

memoryguard_context_bootstrap

Load bounded mandatory rules and relevant memory context

memoryguard_memory_search

Search governed memories by query, lifecycle status, and bounded limit. kind is not an MCP search filter; semantic duplicate/conflict checks are separate advanced governance.

memoryguard_memory_read

Read one governed memory

memoryguard_memory_write

Write and organize a governed memory

memoryguard_memory_update

Update the body, kind, recall policy, or priority of one known memory. It does not change lifecycle status.

memoryguard_memory_delete

Soft-delete a governed memory

memoryguard_memory_status

Inspect shared-memory status

memoryguard_audit

Run a read-only local governance audit

memoryguard_explain

Explain one audit finding and its evidence

memoryguard_capabilities

Discover registered MCP operations and reviewed headless GUI operations with bounded pagination and optional on-demand JSON Schema

memoryguard_invoke

Invoke one discovered MCP or reviewed headless GUI operation; mutating targets require confirmation and an idempotency key

Advanced governance remains available through the GUI and CLI: rule lifecycle, bindings and shared groups, source scanning, CodeGraph, knowledge and history review, provider controls, external MCP import, and maintenance operations. Existing advanced MCP names remain callable for compatibility when an installed client invokes an exact name, but they are not returned by the default tools/list. This reduces discovery/schema overhead without removing those governance capabilities.

memoryguard_capabilities is the discovery path for the broader compatibility catalog. It supports exact operation lookup, English or Chinese query text, domain filtering, and offset pagination; schemas are returned only when include_schema=true is requested for the selected page. The catalog exposes 162 reviewed headless GUI business operations through memoryguard_invoke. Eight GUI operations remain explicitly restricted by their existing authority: desktop-only path/folder actions, desktop-admin CodeGraph selection/build, and SafeBridge protocol actions.

Bounded read responses

MemoryGuard minifies JSON text by default. A replayable read response is capped at 24,000 UTF-8 bytes across the complete MCP envelope, including every content block and existing structuredContent. Small responses keep their existing shape. An oversized read returns a compact receipt with response_ref and required identifiers; it does not silently truncate the original result.

Fetch a page through the existing broker, after discovering memoryguard_response_read with memoryguard_capabilities:

{
  "operation": "memoryguard_response_read",
  "arguments": {
    "response_ref": "opaque-id",
    "fields": ["/data/memory_id"],
    "offset": 0,
    "limit": 3000
  }
}

Pages are UTF-8 JSON fragments with next_offset; concatenate them in order. limit is 4–4096 bytes and offsets must be UTF-8 character boundaries. On a single JSON text payload, fields selects business fields: use a top-level name or an object-only JSON Pointer such as /data/memory_id. Multi-content and non-JSON results reject field selection and remain available only as whole-envelope pages. Private references live only in the MCP process for at most five minutes: at most 16 snapshots, each at most 512,000 bytes. They are bound to the exact trusted session, principal, scope, and active binding revision. Each page reruns the original read under current authorization and compares its digest. A denial, changed output, binding/session change, or expired reference returns a stable refusal such as response_ref_access_denied, response_ref_expired, or response_ref_result_changed; cached old content is never used to bypass the current read. Public capability metadata uses its existing offset pagination. Writes and context bootstrap keep their existing complete receipt/mandatory-rule contracts and cannot request response pagination, so a page read never reruns a mutation. If an oversized read cannot safely create a reference, its bounded receipt reports delivery.status="unavailable" and action="narrow_query" rather than promising the whole result can be retrieved.

Example discovery and invocation using the published schemas:

{"operation":"memoryguard_task_list","include_schema":true,"limit":1}
{"operation":"memoryguard_task_list","arguments":{"limit":20}}

For a mutating target, the invoke envelope must also carry "confirmed":true and a non-empty "idempotency_key"; the broker forwards those proofs to the target's existing permission and scope checks.

The underlying compatibility catalog also covers:

  • governed memory read, search, write, update, delete, and status;

  • bounded context bootstrap with mandatory-rule isolation;

  • rule creation, feedback, merge governance, undo, and scope statistics;

  • Agent binding and shared-group inspection;

  • source scanning, graph projection, import previews, and build planning;

  • external MCP discovery and import;

  • document extraction previews and candidate acceptance;

  • conversation-history search, timeline, explicit read, export, deletion, and extraction preview;

  • provider installation and host-agent enrichment.

Use MCP tools/list for the compact default discovery set. Use memoryguard_capabilities for the registered compatibility catalog and its reviewed operation metadata.

Roadmap

  • Release history: v0.7.9 consolidates canonical governance, local-only token evidence, readable multi-agent governance, and public distribution through GitHub, PyPI, and the official MCP Registry. v0.7.8 records the preceding governance, telemetry, and Codex runtime work; v0.7.7 makes bare provider repair safe in a verified, uniquely bound control home and aligns installed Codex MCP/Hook repairs to the current interpreter while preserving Agent and shared-group identity. v0.7.6 makes Codex Hook/MCP runtime selection consistent through one immutable snapshot, shortens Hook state lock windows, and keeps bootstrap success/failure state honest with explicit mandatory-overflow fail-closed handling. Earlier release records retain the detailed v0.7.5 conflict-review, v0.7.4 canonical-governance, v0.7.3 shared-history, and v0.7.2 write/read and Codex lifecycle changes. The v0.7.1 V2-only migration and desktop lifecycle work remains documented as historical release context.

  • Acceptance boundary: the Graphify evidence is the focused 3 / 3 result plus the real full-repository export/projection described above. It does not claim that upstream Graphify's full-repository test suite passed.

  • Next after release: broader CodeGraph/Skills ingestion, more operator-friendly maintenance reports, and additional migration observability. Long-term records are not retired merely because they are old.

  • Later: team and enterprise capabilities only after validated demand.

Contributing

Issues and pull requests are welcome. Read CONTRIBUTING.md before submitting a change. Pull requests require agreement to the CLA.

License

MIT

Available Tools

11 tools
memoryguard_auditA
Read-onlyIdempotent

Use when checking local V2 reference integrity before repair or release. Do not use to read a memory record, modify data, or assess general Agent quality.

ParametersJSON Schema
NameRequiredDescriptionDefault
workspaceNoworkspace path (default: .)

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare read-only, idempotent, and non-destructive behavior, and the description adds useful context beyond those: the audit targets local V2 reference integrity and is deliberately not a general memory/quality inspection. It does not describe the audit's exact output shape, but the annotation burden is low.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences carry the primary use case, the timing, and the key exclusions. There is no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple, has one optional parameter, and its safety profile is covered by annotations. The only gap is that no output schema exists and the description does not indicate what the audit returns or how its result is reported.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter, workspace, is fully described in the schema with a default value, so the description does not need to repeat it. With 100% schema description coverage, the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific action ('checking local V2 reference integrity') and a clear scope ('local V2') with an explicit timing ('before repair or release'). The exclusions ('Do not use to read a memory record, modify data, or assess general Agent quality') distinguish it from its siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit when-to-use condition ('before repair or release') and an explicit when-not-to-use list covering reading, modifying, and general quality assessment. This is unambiguous routing guidance even though sibling tool names are not repeated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

memoryguard_capabilitiesA
Read-onlyIdempotent

Discover registered MCP operations and every GUI operation with its current headless availability. Reads only V2 manifest state and registry metadata; requires no memory binding or source access. Use operation/query plus offset pagination; request include_schema=true only for a selected page.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNopage size
queryNooptional English or Chinese search text
domainNooptional capability domain, such as knowledge, codegraph, or runtime
offsetNozero-based page offset
operationNooptional exact MCP or GUI operation name
include_schemaNoinclude MCP JSON Schemas for this page

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, but the description adds valuable behavioral context: 'Reads only V2 manifest state and registry metadata; requires no memory binding or source access.' This explains what exactly is read and what prerequisites are absent, going beyond the annotations to clarify side-effect-free execution.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no filler. The first sentence front-loads the purpose and scope, the second provides crisp usage directives. Every phrase earns its place, making it easy for an agent to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only discovery tool with six optional parameters and no output schema, the description is quite complete. It covers purpose, scope, prerequisites, and usage patterns. It doesn't describe the response format, but given the tool's nature (listing capabilities), the agent can infer reasonable output. The absence of an output schema doesn't leave a critical gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all six parameters are individually documented. The description adds usage semantics that the schema lacks: it specifies pagination strategy (operation/query plus offset) and advises to use include_schema only for a selected page. This helps the agent understand how to combine parameters effectively, adding value beyond the raw schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: discovering registered MCP operations and GUI operations with their headless availability. It specifies the resource (operations) and the action (discover), and distinguishes itself from sibling tools that perform memory operations or audits. The mention of reading V2 manifest state and registry metadata further clarifies scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage guidance: 'Use operation/query plus offset pagination; request include_schema=true only for a selected page.' This tells the agent how to navigate results efficiently and when to include schemas. It doesn't explicitly list alternatives, but the nature of the tool (capabilities discovery) is distinct from siblings, so the context is clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

memoryguard_context_bootstrapA

Use when starting one new task to build bounded mandatory rules and relevant governed memory context. Do not use for exact record lookup or repeatedly within same task. Uses trusted binding and may mark one pending local CodeGraph receipt consumed.

ParametersJSON Schema
NameRequiredDescriptionDefault
taskYescurrent task or request; required
max_charsNomaximum characters for optional recalled content; mandatory rules use their separate budget
max_itemsNomaximum optional memories to include; mandatory rules use their separate budget
read_pathNoPhase5 canonical read path: auto uses canonical only when the group is canonically ready, otherwise the native compatibility read path; rule-intelligence prefers the rule-intelligence layer, deduplicating merged duplicates only after the active/audience/exclude matchauto
max_tokensNooptional total-token budget forwarded to the V2 ContextEngine
project_hintNooptional project/repository hint used only for relevance

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations are all false and uninformative, so the description carries the behavioral burden. It adds a meaningful non-obvious side effect: 'may mark one pending local CodeGraph receipt consumed.' This exceeds annotation coverage and helps an agent anticipate state change, though 'Uses trusted binding' remains somewhat vague about what that entails.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the primary use case, followed by exclusions and side effects. Every clause contributes something: when to use, when not to use, and behavioral caveats. There is no padding or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with six parameters and no output schema, the description covers the essential operational context: purpose, usage boundaries, and side effects. The schema covers parameters, so the remaining gap is minor—terms like 'trusted binding' and 'pending local CodeGraph receipt' are not explained, but the overall call guidance is sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the input schema already documents each parameter, including defaults, bounds, and enums. The description itself does not elaborate on individual parameters, so it adds no semantic value beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific use case and resource: 'starting one new task to build bounded mandatory rules and relevant governed memory context.' It also actively distinguishes itself from siblings by saying 'Do not use for exact record lookup or repeatedly within same task,' so an agent can tell it apart from recall and search tools without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit when-to-use ('Use when starting one new task') and when-not-to-use guidance ('Do not use for exact record lookup or repeatedly within same task'). While it does not name sibling tools, the positive and negative instructions are unambiguous enough to route an agent correctly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

memoryguard_explainA
Read-onlyIdempotent

Use when a memoryguard_audit finding_id needs its evidence, impact, and suggested repair. Do not use for generic memory lookup or to apply a repair.

ParametersJSON Schema
NameRequiredDescriptionDefault
workspaceNoworkspace path (default: .)
finding_idYesfinding id from audit

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds that it returns evidence, impact, and suggested repair, and explicitly states it does not apply repairs, reinforcing the non-destructive nature. This goes beyond the annotations by specifying the output content and what it does not do.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no filler. The primary usage is stated first, followed by clear exclusions. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only tool with one required parameter, the description covers purpose, usage, exclusions, and return content (evidence, impact, repair). Annotations cover safety. Nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and both parameters have descriptions. The tool description adds meaning by clarifying that finding_id comes from a memoryguard_audit and that the tool explains the finding's evidence/impact/repair, which enriches the schema's minimal 'finding id from audit' with usage context.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: it explains a memoryguard_audit finding by providing evidence, impact, and suggested repair. It explicitly differentiates from generic memory lookup and repair application, making its scope unambiguous relative to the sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says when to use it (for audit findings needing explanation) and when not to (not for generic lookup or repair). However, it does not name specific alternative tools, only implies them. It could be improved by pointing to memory_search or memory_read for lookup, but the exclusion guidance is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

memoryguard_invokeA
Destructive

Invoke one explicitly registered MCP operation found through memoryguard_capabilities. Never accepts native handler or GUI method names. Mutating targets require confirmed=true and idempotency_key.

ParametersJSON Schema
NameRequiredDescriptionDefault
argumentsYesarguments for that registered operation
confirmedNorequired for a mutating target
operationYesregistered MCP operation name from capability catalog
idempotency_keyNorequired retry key for a mutating target

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds useful behavioral constraints beyond the annotations: operations must be explicitly registered, native/GUI names are rejected, and mutating targets require confirmed=true and idempotency_key. This complements the destructiveHint and readOnlyHint flags without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences carry all essential information with no redundant phrasing. The core constraint is front-loaded, and the mutation safety requirements follow immediately.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The definition is complete enough for a generic invocation tool: it names the discovery source, restricts accepted operation names, and explains the safety contract for mutations. It does not describe return values, but those are operation-dependent and no output schema is provided, so this is a minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds modest extra meaning by tying operation to the capabilities catalog and specifying that confirmed must be true for mutating targets, which is slightly more precise than the schema's 'required for a mutating target.'

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool as a generic dispatcher for registered MCP operations discovered via memoryguard_capabilities, using the concrete verb 'Invoke' and specifying the resource type. It also distinguishes itself from sibling tools by stating it never accepts native handler or GUI method names, so an agent can understand its unique role.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit context about when to invoke: only for operations found through memoryguard_capabilities, and only with the required confirmation/idempotency for mutations. It states a clear when-not ('Never accepts native handler or GUI method names'), though it does not explicitly enumerate the direct sibling tools as alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

memoryguard_memory_deleteA
Idempotent

Use when owner must remove one known memory from future recall. Do not use for irreversible erasure: this is a local soft-delete recorded as status=deleted.

ParametersJSON Schema
NameRequiredDescriptionDefault
memory_idYesmemory record ID
idempotency_keyYesrequired retry key bound to this target; makes repeated deletion safe
agent_instance_idNooptional identity consistency check; trusted MCP environment is authoritative

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare idempotentHint=true and destructiveHint=false, but the description adds key behavioral context: it is a local soft-delete recorded as status=deleted and affects future recall. This goes beyond the annotations and clarifies the non-destructive nature explicitly, with no contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no waste; the primary usage is front-loaded, and the clarifying soft-delete note is brief and valuable. It is efficiently structured for quick parsing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 3-parameter tool with no output schema, the description covers purpose, usage, and behavioral outcome. It does not explicitly mention the requirement of idempotency_key or prerequisites, but these are captured in the schema. It is largely complete, with only minor gaps like potential audit implications.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so each parameter is already described (memory_id, idempotency_key, agent_instance_id). The description does not add additional semantic meaning beyond the schema, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb (remove) and resource (one known memory) with scope ('from future recall'), clearly distinguishing it from write/update/read siblings. It also clarifies it is a soft-delete, not irreversible erasure, which is a precise behavioral distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use ('Use when owner must remove one known memory from future recall') and when not to ('Do not use for irreversible erasure'), but does not name a specific alternative tool. It gives clear guidance without naming a sibling, so it is slightly below the 5 threshold.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

memoryguard_memory_readA
Read-onlyIdempotent

Use when an exact memory_id is already known and its governed record is needed. Do not use for discovery; use memoryguard_memory_search instead.

ParametersJSON Schema
NameRequiredDescriptionDefault
memory_idYesmemory record ID
agent_instance_idNooptional identity consistency check; trusted MCP environment is authoritative

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is well covered. The description adds the qualifier 'governed record,' which hints at access control or authorization context, but does not elaborate on what governance entails or potential errors. It adds a small amount of behavioral context beyond annotations, but not enough to warrant a higher score.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is exactly two sentences, with the primary usage condition front-loaded and the exclusion/alternative stated immediately after. There is zero filler, and every word earns its place. It is a model of conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-by-ID tool with annotations covering safety and no output schema required, the description is complete. It specifies when to use, when not to use, and the alternative. Nothing an agent needs to correctly invoke this tool is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for both parameters (memory_id and agent_instance_id), so the schema already documents their purpose. The description does not add any additional parameter-level semantics beyond what the schema provides. Baseline 3 is appropriate when the schema handles parameter documentation fully.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (reading a memory record) and the specific precondition (exact memory_id already known). It also differentiates from the discovery-oriented sibling memoryguard_memory_search by explicitly naming it as the alternative. This makes the tool's purpose unambiguous and distinct from its siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use guidance ('Use when an exact memory_id is already known') and when-not-to-use guidance ('Do not use for discovery'), and directs the agent to the correct alternative (memoryguard_memory_search). This is textbook usage routing with no ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

memoryguard_memory_statusA
Read-onlyIdempotent

Use when checking shared-memory availability, bound scope, total and active records, lifecycle and kind counts, and evidence-link count. Do not use to search or read individual memory content.

ParametersJSON Schema
NameRequiredDescriptionDefault
agent_instance_idNooptional identity consistency check; trusted MCP environment is authoritative

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is fully covered. The description adds value by enumerating what the status covers (metrics categories), but does not disclose additional behavior such as freshness of counts, failure modes, or return structure. With annotations carrying the safety burden, a 3 is appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero filler. The primary use case is front-loaded, followed immediately by a clear exclusion. Every word contributes.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only status tool with zero required parameters and no output schema, the description conveys the essential return categories (availability, scope, counts) so an agent knows what to expect. Minor gap: no hint about return shape or whether counts are live, but the metric list largely covers the agent's needs.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the single optional parameter agent_instance_id is already documented as an 'optional identity consistency check.' The description adds no parameter detail, but with full schema coverage the baseline of 3 is correct per the rubric.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear purpose: checking shared-memory availability, scope, record counts, lifecycle/kind counts, and evidence-link counts. It differentiates from siblings via 'Do not use to search or read individual memory content,' which maps to memory_read and memory_search, though it doesn't name those alternatives explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use context ('Use when checking shared-memory availability...') and an explicit exclusion ('Do not use to search or read individual memory content'). It stops short of a 5 because it doesn't name the sibling tools to use instead, leaving the routing slightly implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

memoryguard_memory_updateA

Use when owner must correct body, kind, recall policy, or priority of one known memory. Do not use to create a record, change lifecycle status, or modify another owner's memory.

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyNonew body
kindNoreplacement kind; omit to preserve current kind
atom_idNoV2 atom ID; use the source-mapping target when a migrated logical ID is ambiguous
audienceNoreplace mandatory-rule assignments; only allowed for always records
priorityNonew priority
memory_idYesmemory record ID
idempotency_keyNooptional retry key bound to this target and payload
injection_policyNonew injection policy
agent_instance_idNooptional identity consistency check; trusted MCP environment is authoritative

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already signal a write operation (readOnly=false) and non-idempotence, and the description adds ownership and scope constraints beyond those annotations. However, it does not disclose partial-update behavior, return semantics, or identity-check consequences, so behavioral disclosure is only moderate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with no filler: the use condition is front-loaded and each clause carries routing or exclusion information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with nine parameters and no output schema, the description supplies the needed selection criteria and exclusions while the schema covers parameter details. It could specify update result/return semantics, but what is needed to choose the tool correctly is present.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3 and the schema documents all parameters. The description lightly maps 'recall policy' to injection_policy and emphasizes which fields are correctable, but it does not add substantive meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific action: owner correcting body, kind, recall policy, or priority of one known memory. It clearly distinguishes from memory_write by excluding record creation and from memory_status by excluding lifecycle changes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides an explicit when-to-use condition ('Use when owner must correct ... one known memory') and explicit exclusions (not for creating a record, changing lifecycle status, or modifying another owner's memory). This is strong routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

memoryguard_memory_writeA

Use when user explicitly asks to retain a durable fact, preference, project decision, or procedure. Do not use for raw transcripts or temporary task notes. Writes locally and may organize duplicates or conflicts.

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesmemory content
kindNooptional kind override; omit for native classification
audienceNomandatory-rule assignments; omitted always defaults to the trusted current agent
metadataNooptional metadata from agent
priorityNostable ordering within the mandatory rule package
write_policyNooptional write policy; propose_only creates a low_confidence candidate, while omission uses automatic organization
idempotency_keyNooptional retry key bound to content, metadata, kind and policy
injection_policyNorelevant participates in task recall; always is a mandatory rulerelevant
agent_instance_idNooptional identity consistency check; trusted MCP environment is authoritative

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate a non-read-only, non-idempotent, non-destructive operation. The description adds value by disclosing local write behavior and the potential to organize duplicates or conflicts, which goes beyond the annotation flags. No contradiction found.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with zero filler. The primary use case is front-loaded, and the exclusion and behavioral notes are placed efficiently. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers purpose, usage boundaries, and key behavioral traits. With a high-coverage schema and no output schema, it provides sufficient context for an agent to call the tool correctly. Minor gaps like success return values are acceptable given the lack of an output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so all parameters are documented. The description enriches the meaning of the primary parameter 'body' by providing concrete examples of durable content (facts, preferences, decisions, procedures), which goes beyond the schema's generic 'memory content'.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('retain a durable fact, preference, project decision, or procedure') and the resource (durable memory). It also differentiates from siblings by explicitly excluding raw transcripts and temporary task notes, making its scope unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit triggers ('when user explicitly asks to retain') and exclusions ('do not use for raw transcripts or temporary task notes'). While it doesn't name alternative tools like memory_read or memory_update, the guidance is clear enough for an agent to decide when to invoke this write tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 59 tool updatesv0.7.12
    • Removedmemoryguard_accept_candidates
    • Removedmemoryguard_apply_enrichments
    • Removedmemoryguard_binding_create
    • Removedmemoryguard_binding_list
    • Removedmemoryguard_build_and_enrich
    • Removedmemoryguard_canonical_status
    • Addedmemoryguard_capabilities
    • Removedmemoryguard_codegraph_affected
    • Removedmemoryguard_codegraph_explain
    • Removedmemoryguard_codegraph_path
    • Removedmemoryguard_codegraph_query
    • Removedmemoryguard_codegraph_status
    • Removedmemoryguard_codegraph_update
    • Changedmemoryguard_context_bootstrap2 fields changed
      • addedInput schema / properties / max_chars / description
        Added value: +"maximum characters for optional recalled content; mandatory rules use their separate budget"
      • addedInput schema / properties / max_items / description
        Added value: +"maximum optional memories to include; mandatory rules use their separate budget"
    • Removedmemoryguard_diagnostics_snapshot
    • Removedmemoryguard_enrichment_status
    • Removedmemoryguard_external_mcp_import
    • Removedmemoryguard_external_mcp_list
    • Removedmemoryguard_extract_memories
    • Removedmemoryguard_history_delete
    • Removedmemoryguard_history_export
    • Removedmemoryguard_history_extract_preview
    • Removedmemoryguard_history_list_sessions
    • Removedmemoryguard_history_read
    • Removedmemoryguard_history_search
    • Removedmemoryguard_history_timeline
    • Removedmemoryguard_import_preview
    • Addedmemoryguard_invoke
    • Removedmemoryguard_knowledge_book
    • Removedmemoryguard_knowledge_candidates
    • Removedmemoryguard_knowledge_list
    • Removedmemoryguard_knowledge_read
    • Removedmemoryguard_knowledge_search
    • Removedmemoryguard_list_pending_enrichments
    • Removedmemoryguard_list_sources
    • Changedmemoryguard_memory_delete2 fields changed
      • changedInput schema / properties / idempotency_key / description
        Previous value: -"optional retry key bound to this target"New value: +"required retry key bound to this target; makes repeated deletion safe"
      • changedInput schema / required
        Previous value: -[
        -  "memory_id"
        -]New value: +[
        +  "memory_id",
        +  "idempotency_key"
        +]
    • Removedmemoryguard_memory_merge_safe
    • Removedmemoryguard_memory_merge_safe_preview
    • Changedmemoryguard_memory_search4 fields changed
      • removedInput schema / properties / kind
        Removed value: -{
        -  "description": "filter by kind: preference|fact|project|procedure|episode|correction",
        -  "type": "string"
        -}
      • removedInput schema / properties / semantic
        Removed value: -{
        -  "description": "optional semantic recall mode (default: off)",
        -  "enum": [
        -    "off",
        -    "heuristic",
        -    "model"
        -  ],
        -  "type": "string"
        -}
      • changedInput schema / properties / status / description
        Previous value: -"filter by status: active (default)|low_confidence|shadowed|conflicted|quarantined|deleted"New value: +"lifecycle status filter; defaults to active"
      • addedInput schema / properties / status / enum
        Added value: +[
        +  "active",
        +  "low_confidence",
        +  "shadowed",
        +  "conflicted",
        +  "quarantined",
        +  "deleted"
        +]
    • Changedmemoryguard_memory_update3 fields changed
      • changedInput schema / properties / kind / description
        Previous value: -"new kind"New value: +"replacement kind; omit to preserve current kind"
      • addedInput schema / properties / kind / enum
        Added value: +[
        +  "preference",
        +  "fact",
        +  "project",
        +  "procedure",
        +  "episode",
        +  "correction"
        +]
      • removedInput schema / properties / status
        Removed value: -{
        -  "description": "new status",
        -  "type": "string"
        -}
    • Changedmemoryguard_memory_write3 fields changed
      • changedInput schema / properties / kind / description
        Previous value: -"override kind (default: auto-classify). Valid: preference|fact|project|procedure|episode|correction"New value: +"optional kind override; omit for native classification"
      • addedInput schema / properties / kind / enum
        Added value: +[
        +  "preference",
        +  "fact",
        +  "project",
        +  "procedure",
        +  "episode",
        +  "correction"
        +]
      • changedInput schema / properties / write_policy / description
        Previous value: -"write policy: auto_accept (default) | auto_quarantine_on_risk | propose_only. propose_only creates a low_confidence candidate without modifying existing memories"New value: +"optional write policy; propose_only creates a low_confidence candidate, while omission uses automatic organization"
    • Removedmemoryguard_neuron_graph
    • Removedmemoryguard_projection_status
    • Removedmemoryguard_provider_install
    • Removedmemoryguard_resolve_group
    • Removedmemoryguard_rule_create_auto
    • Removedmemoryguard_rule_decision_read
    • Removedmemoryguard_rule_feedback
    • Removedmemoryguard_rule_merge_acknowledge
    • Removedmemoryguard_rule_merge_approve
    • Removedmemoryguard_rule_merge_capability_issue
    • Removedmemoryguard_rule_merge_cooldown_clear
    • Removedmemoryguard_rule_merge_safe
    • Removedmemoryguard_rule_merge_safe_preview
    • Removedmemoryguard_rule_scope_stats
    • Removedmemoryguard_rule_undo
    • Removedmemoryguard_runtime_processes
    • Removedmemoryguard_scan_summary
    • Removedmemoryguard_semantic_check
  2. 4 tool updatesv0.7.11
    • Addedmemoryguard_memory_merge_safe
    • Addedmemoryguard_memory_merge_safe_preview
    • Addedmemoryguard_rule_merge_safe
    • Addedmemoryguard_rule_merge_safe_preview
  3. 57 tool updatesv0.7.8
    • First observedmemoryguard_accept_candidates
    • First observedmemoryguard_apply_enrichments
    • First observedmemoryguard_audit
    • First observedmemoryguard_binding_create
    • First observedmemoryguard_binding_list
    • First observedmemoryguard_build_and_enrich
    • First observedmemoryguard_canonical_status
    • First observedmemoryguard_codegraph_affected
    • First observedmemoryguard_codegraph_explain
    • First observedmemoryguard_codegraph_path
    • First observedmemoryguard_codegraph_query
    • First observedmemoryguard_codegraph_status
    • First observedmemoryguard_codegraph_update
    • First observedmemoryguard_context_bootstrap
    • First observedmemoryguard_diagnostics_snapshot
    • First observedmemoryguard_enrichment_status
    • First observedmemoryguard_explain
    • First observedmemoryguard_external_mcp_import
    • First observedmemoryguard_external_mcp_list
    • First observedmemoryguard_extract_memories
    • First observedmemoryguard_history_delete
    • First observedmemoryguard_history_export
    • First observedmemoryguard_history_extract_preview
    • First observedmemoryguard_history_list_sessions
    • First observedmemoryguard_history_read
    • First observedmemoryguard_history_search
    • First observedmemoryguard_history_timeline
    • First observedmemoryguard_import_preview
    • First observedmemoryguard_knowledge_book
    • First observedmemoryguard_knowledge_candidates
    • First observedmemoryguard_knowledge_list
    • First observedmemoryguard_knowledge_read
    • First observedmemoryguard_knowledge_search
    • First observedmemoryguard_list_pending_enrichments
    • First observedmemoryguard_list_sources
    • First observedmemoryguard_memory_delete
    • First observedmemoryguard_memory_read
    • First observedmemoryguard_memory_search
    • First observedmemoryguard_memory_status
    • First observedmemoryguard_memory_update
    • First observedmemoryguard_memory_write
    • First observedmemoryguard_neuron_graph
    • First observedmemoryguard_projection_status
    • First observedmemoryguard_provider_install
    • First observedmemoryguard_resolve_group
    • First observedmemoryguard_rule_create_auto
    • First observedmemoryguard_rule_decision_read
    • First observedmemoryguard_rule_feedback
    • First observedmemoryguard_rule_merge_acknowledge
    • First observedmemoryguard_rule_merge_approve
    • First observedmemoryguard_rule_merge_capability_issue
    • First observedmemoryguard_rule_merge_cooldown_clear
    • First observedmemoryguard_rule_scope_stats
    • First observedmemoryguard_rule_undo
    • First observedmemoryguard_runtime_processes
    • First observedmemoryguard_scan_summary
    • First observedmemoryguard_semantic_check

TDQS

A4.2/5.0

Scored across 11 tools

Disambiguation5/5

Every tool has a clearly distinct role, and descriptions actively prevent misselection (e.g., memory_read vs memory_search, audit vs explain, capabilities vs invoke). The lifecycle operations also explicitly state what they should not be used for.

Naming Consistency4/5

All tools share the memoryguard_ prefix and use readable snake_case, with memory operations following a consistent memory_<action> pattern. However, audit, explain, capabilities, invoke, and context_bootstrap deviate from a uniform verb_noun convention, creating minor inconsistency.

Tool Count5/5

Eleven tools is well-scoped for a governed-memory server: CRUD/search/status, audit/explain, context bootstrap, and a capability-discovery/invocation pair. Each tool has a meaningful place and the count feels neither bloated nor thin.

Completeness4/5

The surface covers memory creation, reading, searching, updating, soft-deletion, status inspection, audit, explanation, and task context bootstrapping. Minor gaps remain around explicit lifecycle transitions (e.g., restore/archive) and applying audit repairs, though the generic invoke tool provides a partial extension path.

Maintenance

ActivityActive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    C
    maintenance
    An MCP-native, local-first memory server that gives AI agents persistent, structured memory across sessions and tools, enabling them to maintain identity and context without reconfiguration.
    3
    MIT
  • F
    license
    Not graded
    quality
    C
    maintenance
    A local-first MCP server that manages developer memory for coding agents, enabling shared project context, permissions, and audit trails across different agents.
    1
    -
  • F
    license
    Not graded
    quality
    D
    maintenance
    Shared memory and orchestration for coding agents, enabling persistent knowledge, multi-agent coordination, and a canonical workflow across MCP-compatible AI clients.
    59 npm
    110
    -