memocat-mcp
Montycat MCP provides AI agents with a shared, persistent memory layer offering semantic search, real-time change notifications, and full memory lifecycle management across sessions and clients.
Store, update, fetch, list, and delete memory records (individually or in bulk).
Perform semantic (meaning-based) vector search, optionally combined with metadata filters, time-range constraints, similarity score floors, or precomputed embeddings.
Wait in real time for memory changes via live subscriptions (no polling), and resume change streams with sequence cursors.
Set and manage memory scopes: private scopes (user), shared scopes, group scopes, or explicit keyspaces.
Create, list, and delete keyspaces, with governance enforcement for all lifecycle operations.
Enable, disable, or rebuild semantic search for a keyspace, supporting multiple embedding models and external vectors.
Manage scheduled snapshots for in-memory keyspaces (start, stop, clean).
Inspect governance policy, policy history, and whether a proposed action would be allowed.
Install the local Montycat engine on demand (also supports Docker and remote/TLS engines) and connect multiple AI clients (Claude, Cursor, Codex) to the same memory backend.
Enables OpenAI Codex agents to use the same persistent, shared memory layer with semantic search and real-time updates across sessions.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@memocat-mcpremember that I prefer dark mode in my code editor"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Montycat MCP Server — Shared, Persistent Memory for AI Agents
Montycat MCP is a local-first Model Context Protocol (MCP) memory server for Claude, OpenAI Codex, Cursor, and other AI agents. It provides shared, persistent memory across conversations, semantic search for retrieval-augmented generation (RAG), and real-time updates between connected agents.
Montycat MCP is not tied to one model, app, or agent framework. The server uses Montycat as its database and vector-search engine. Run it locally for private, cross-session memory, or connect multiple machines and AI systems to one trusted Montycat engine for multi-agent memory.
Memories are embedded on-device and recalled by meaning, metadata, timestamp, or exact key. Montycat keeps the database, vector search, embeddings, persistent and in-memory storage, live subscriptions, and governance together, so agents do not need separate vector, embedding, messaging, and policy services. No cloud embedding API or per-query bill.
AI memory server features
One persistent memory across conversations, agents, and MCP-compatible systems.
Shared scopes let multiple agents work from the same facts and project context.
Semantic vector search with metadata and time-range filtering for RAG.
Persistent memory, in-memory working spaces, bulk writes, updates, and deletion.
Real-time memory-change subscriptions without database polling.
Private scopes, delegated-owner governance, and policy explanations.
Keyspace lifecycle, semantic-model controls, snapshots, and revocation-safe watch buffers.
One-command
uvx montycat-mcpentry point with native/Docker engine bootstrap.
Related MCP server: Memsolus MCP Server
Why use Montycat MCP for AI agent memory?
AI systems forget between conversations, and separate agents cannot naturally share what they learn. Montycat MCP gives them a common memory: one agent can store a decision, another can recall it by meaning, and a third can receive its update live. Its 23 MCP tools also support exact retrieval, lifecycle management, and governed deployments, but the core product is the shared memory layer—not a model-specific plugin or another standalone vector database.
Install the Montycat MCP server
Claude Desktop
Download the latest
montycat-mcp-<version>.mcpbfrom GitHub Releases.Double-click the downloaded file. You can also drag it into Claude Desktop or select it under Settings > Extensions > Advanced settings > Install Extension.
Review the requested tools and complete the extension setup.
The MCPB runs Montycat MCP locally over stdio and manages its UV-based Python runtime, so Claude Desktop users do not need to install Python separately.
Claude Code and Cowork plugin
Add the MontyGovernance marketplace and install Montycat MCP from inside Claude Code:
/plugin marketplace add MontyGovernance/montycat-mcp
/plugin install montycat-mcp@montygovernanceThe plugin runs the published Python package through uvx. Install
uv first, then use
/mcp after installation to confirm that the montycat server connected. See
the plugin setup guide for engine configuration
and security notes.
Other MCP clients
The fastest option is uvx, which
runs the latest published package in an isolated environment:
uvx montycat-mcpIf uvx is not installed yet:
curl -LsSf https://astral.sh/uv/install.sh | sh
uvx montycat-mcpFor a persistent command-line installation, use pipx:
pipx install montycat-mcp
montycat-mcpYou can also install it into an existing Python environment:
python -m pip install montycat-mcp
montycat-mcpMontycat MCP requires Python 3.10 or newer. The package is published as
montycat-mcp on PyPI.
Upgrading from MemoCat MCP
Montycat MCP 1.0 uses the montycat_mcp Python module, montycat_* MCP tool
names, montycat:// resource URIs, and MONTYCAT_* configuration variables.
The former memocat-mcp command and memocat_mcp import remain compatibility
aliases, and legacy MEMOCAT_* variables and memocat:// subscription URIs
are still accepted. MCP clients that pin tool names must migrate from
memocat_* to montycat_*.
Quick start
Montycat MCP reuses a configured Montycat Semantic engine or attempts the supported native/Docker bootstrap path. For an existing engine:
export MONTYCAT_URI="montycat://memory-agent:password@localhost:21210/memories"
uvx montycat-mcpTools
Tool | What it does |
| Recall by meaning (vector kNN), with text or a supplied query vector. |
| Store a fact/record; embedded automatically or indexed with a supplied vector. |
| Store many memories at once. |
| Fetch by exact key or by field filter. |
| Browse / list stored memories (optionally most-recent first). |
| Revise a memory in place — memory is mutable. |
| Delete a stored record. |
| Discover available memory namespaces. |
| Provision a namespace; superowners also create a missing configured store in the same engine request. |
| Permanently remove an authorized memory namespace with safe watch cleanup. |
| Enable semantic search and backfill one authorized keyspace. |
| Enroll one keyspace for caller-supplied vectors and a named embedding space. |
| Inspect semantic configuration and backfill state. |
| Replace an enrolled text embedding model and backfill the keyspace. |
| Disable semantic search for one authorized keyspace. |
| Start scheduled snapshots for one authorized in-memory keyspace. |
| Stop scheduled snapshots for one authorized in-memory keyspace. |
| Delete snapshot files for one authorized in-memory keyspace. |
| View the configured owner's effective governance policy and constraints. |
| Explain whether a proposed governed action is allowed and why. |
| View governance history visible to the configured owner. |
| Wait for memory to change — returns the moment another agent or session writes. Live subscription, not polling. |
| Install the Montycat engine on this computer and start it. Opens your OS installer and asks for an administrator password, so it only ever runs when you ask for it. |
Montycat MCP truthfully identifies routine writes and configuration changes as non-destructive mutations. Your MCP client decides whether those operations require confirmation according to its permission settings. Delete, rebuild, vector-dropping, and snapshot-cleanup tools are marked destructive. Engine installation is also marked destructive and open-world because it downloads software and opens the operating system installer.
Real-time memory watch
Other memory servers can only be polled: ask again, and again, in case something changed. Montycat has native live subscriptions, so this one pushes.
agent B: montycat_await_memory_change(scope="shared", timeout_sec=60)
⏳ sleeps — no polling, no wasted tokens
agent A: montycat_remember({"text": "the deploy key rotated"}, scope="shared")
agent B: ← returns in milliseconds with the key, the value, and the eventTwo agents, one shared scope, one notices what the other just learned. Pass the
returned next_seq back as since_seq to resume exactly where you left off —
changes that happen between calls are buffered, not lost.
Memory namespaces are also exposed as MCP resources
(montycat://memory/<keyspace>) with resources.subscribe support, so clients
that implement resource subscriptions get notifications/resources/updated
pushed to them as well. Both surfaces share one engine subscription.
Subscriptions open on demand and close when idle
(MONTYCAT_WATCH_IDLE_TIMEOUT), so users who never watch pay nothing.
Montycat Semantic engine requirements
Python 3.10+ when installing Montycat MCP through
uv,pipx, orpip.Access to a Montycat Semantic engine.
uvx montycat-mcpfirst reuses an existing engine, then attempts the supported native/platform installation path, and finally falls back to Docker. Semantic search is enabled by default in the Semantic edition.To start the engine manually with Docker, pick the tag for your CPU—the tag carries the architecture:
Apple Silicon (M1/M2/M3/M4) — use
arm64-semantic:docker run -d --name montycat -p 21210:21210 -p 21211:21211 \ -e MONTYCAT_SUPEROWNER="admin" -e MONTYCAT_PASSWORD="change-me" \ -v montycat_data:/var/lib/.montycat \ montygovernance/montycat:arm64-semanticIntel / AMD (x86_64) — use
semantic:docker run -d --name montycat -p 21210:21210 -p 21211:21211 \ -e MONTYCAT_SUPEROWNER="admin" -e MONTYCAT_PASSWORD="change-me" \ -v montycat_data:/var/lib/.montycat \ montygovernance/montycat:semanticOn Apple Silicon the plain
semantictag is the amd64 image and runs under emulation, where the embedding runtime's warm-up crashes. Usearm64-semantic— a native build, not a workaround. Unsure which you have?uname -mprintsarm64on Apple Silicon andx86_64on Intel.Port
21211is the subscription server and is required formontycat_await_memory_change(real-time watch); without it the other tools still work.
Docker Compose deployment
Use Compose when you want a reproducible local deployment with a persistent Semantic engine and an MCP container on the same private Docker network. Docker is optional when you already manage a reachable Montycat server.
Create a .env file beside compose.yaml:
MONTYCAT_USERNAME=admin
MONTYCAT_PASSWORD=replace-with-a-strong-password
MONTYCAT_STORE=memories
MONTYCAT_VERSION=1.0.0
# Apple Silicon: arm64-semantic. Intel/AMD64: semantic.
MONTYCAT_IMAGE_TAG=semanticStart the engine and build the MCP image:
docker compose up -d montycat
docker compose build mcpTo use the published image instead of building from source:
docker pull montygovernance/montycat-mcp:1.0.0The Compose service uses montygovernance/montycat-mcp:${MONTYCAT_VERSION} and
waits for the Semantic engine health check before launching MCP. The image runs
as an unprivileged montycat user and supports both AMD64 and ARM64.
The image installs the released montycat>=1.2.2,<2 Python client declared in
the package metadata.
The engine data is stored in the named montycat_data volume. Ports 21210
and 21211 are published for debugging and external clients; the MCP container
uses the private montycat:21210 network address. Credentials are passed as
separate environment variables, so passwords with URL-special characters need
no URL encoding. Port 21211 carries live subscription traffic for
montycat_await_memory_change.
MCP uses stdio, so do not run it as a web service. Configure a desktop MCP client to invoke the Compose service on demand:
{
"mcpServers": {
"montycat": {
"command": "docker",
"args": [
"compose",
"-f", "/absolute/path/to/montycat-mcp/compose.yaml",
"run", "--rm", "-T", "mcp"
]
}
}
}For Apple Silicon set MONTYCAT_IMAGE_TAG=arm64-semantic in .env; the plain
semantic image is AMD64. Stop the stack with docker compose down; include
-v only when you intentionally want to erase persisted memories.
Engine auto-start
Montycat MCP starts serving immediately and acquires an engine in the background, so the MCP handshake is never held up by a container pull or an embedding-model download. While that is still in progress, memory tools say so and ask you to try again in a moment rather than hanging.
The engine may be local or remote. Montycat MCP first reuses one already reachable
through MONTYCAT_URI or the host/port settings — including on another machine
over TCP. If that address is not on this computer and nothing answers, Montycat MCP
reports it and stops: starting a local engine for a remote address would create
a second database and write memories where you are not looking.
For a local engine that is not running, it tries, in order:
Step | Route | If it cannot complete |
1 | Launch an already-installed | Docker |
2 | Start the | Report how to install |
Before launching a local engine Montycat MCP asks the montycat CLI that ships
beside it (montycat version, a compile-time constant that answers while the
engine is down). An installation that cannot run — wrong architecture, missing
ONNX libraries, no execute bit — is skipped immediately rather than launched and
waited on, and the reported edition distinguishes a base-edition install from
the Semantic one the memory tools need. Set MONTYCAT_ENGINE_CLI to point at a
CLI in a non-standard location, or MONTYCAT_ENGINE_BINARY for the engine
itself.
Installation is never automatic. Acquiring the engine opens your operating
system's installer and asks for an administrator password (or, on Linux, runs
the APT setup with sudo), which should not happen as a side effect of opening
a chat client. Ask for montycat_install_engine instead, and it runs with your
consent:
Platform | Route |
macOS Apple Silicon | Discover and download the latest verified |
macOS Intel | No Semantic package currently published — use Docker |
Windows x86_64 | Download verified |
Linux AMD64 | Run the official one-command APT setup for |
Other platforms | Use Docker |
Montycat MCP asks the shared Montycat release catalog for the current Semantic
artifact for macOS or Windows. Artifact URLs are treated as opaque, and the
package's adjacent .sha256 is required and verified before Installer opens;
verified packages are cached by filename. If catalog discovery is unavailable,
installation stops instead of silently installing an older package.
Override the URL with MONTYCAT_INSTALLER_URL, pin a release with
MONTYCAT_ENGINE_VERSION, or adjust the Installer completion budget with
MONTYCAT_INSTALLER_TIMEOUT. On Linux, set
MONTYCAT_APT_INSTALL_COMMAND to use an organization-managed mirror or package
command. ARM64 Linux goes directly to Docker because the official APT repository
is AMD64-only. Set MONTYCAT_AUTOSTART=off to disable all start attempts, and
MONTYCAT_READY_TIMEOUT (default 20s) to change how long a tool waits for a
starting engine before reporting progress.
Connect multiple AI systems to one memory
Use the same MONTYCAT_URI in each client to give Claude Desktop, Cursor,
OpenAI Codex, and other MCP-compatible systems access to the same memory. A
default local engine shares memory across sessions and local clients on one
machine; cross-machine sharing requires a trusted network-reachable Montycat
engine.
Claude Desktop
Add Montycat MCP to claude_desktop_config.json, then restart Claude Desktop:
{
"mcpServers": {
"montycat": {
"command": "uvx",
"args": ["montycat-mcp"],
"env": {
"MONTYCAT_URI": "montycat://memory-agent:agent-password@localhost:21210/mystore"
}
}
}
}Cursor
Add the same server definition to your Cursor MCP configuration:
{
"mcpServers": {
"montycat": {
"command": "uvx",
"args": ["montycat-mcp"],
"env": {
"MONTYCAT_URI": "montycat://memory-agent:agent-password@localhost:21210/mystore"
}
}
}
}OpenAI Codex
Codex can register the local stdio server directly from a terminal:
codex mcp add montycat \
--env MONTYCAT_URI="montycat://memory-agent:agent-password@localhost:21210/mystore" \
-- uvx montycat-mcpConfirm the registration with codex mcp list, then start a new Codex session.
ChatGPT integration
Montycat MCP currently runs as a local stdio MCP server. It works directly with clients that can launch local MCP commands, including Claude Desktop, Cursor, and Codex. A ChatGPT connector requires a remotely reachable MCP transport and cannot connect directly to this stdio command. Remote HTTP transport is not included in the current package; do not expose the engine's database port as an MCP endpoint.
Connect to a remote TLS engine
Keep the normal montycat:// connection URI and enable TLS separately:
export MONTYCAT_URI="montycat://memory-agent:agent-password@db.example.com:21210/mystore"
export MONTYCAT_TLS=true
uvx montycat-mcpFor a desktop client, add "MONTYCAT_TLS": "true" beside MONTYCAT_URI in
the server's env object. The remote engine must present a certificate trusted
by the machine running Montycat MCP. Setting MONTYCAT_URI disables local engine
auto-install and auto-start because it explicitly selects a managed engine.
Security and delegated-owner setup
Use a delegated Montycat owner such as memory-agent for the MCP process.
Grant that owner only the keyspace read/write and provisioning capabilities its
agent needs. Keep the superowner credential in a separate bootstrap or
governance-administration workflow.
The read-only montycat_policy_view, montycat_policy_explain, and
montycat_policy_history tools expose policy information for the authenticated
owner. They do not accept an owner override and cannot grant, revoke, deny, or
otherwise mutate policy. When automatic keyspace provisioning fails, Montycat MCP
also requests a read-only policy explanation and appends it to the original
engine error when available.
montycat_remove_keyspace is destructive and remains engine-authorized. A
delegated owner may remove a keyspace through creator authority or an explicit
remove-keyspace grant unless policy contains an overriding denial. Montycat MCP
closes active watches and releases resource subscriptions before requesting
removal.
Semantic management is always keyspace-scoped. The MCP server does not expose
database-wide semantic controls; Montycat checks manage-semantic, creator
authority, denials, and model allow-lists for every enable or disable request.
Snapshot tools are likewise keyspace-scoped and work only with in-memory
keyspaces. Montycat MCP does not expose the global snapshot-rate setting. A
Snapshot rate is not set response means scheduling has not been configured
on the engine; it is distinct from a governance denial.
Active watches use short authorization leases because the current engine checks read authority when a subscription opens but does not terminate that connection after a later revocation. Montycat MCP revalidates against the engine's filtered structure view, closes the subscription on access loss, removes MCP resource ownership, wakes pending callers with an error, and permanently purges buffered changes so they cannot be replayed after access is restored.
Configuration
Variable | Default | Purpose |
| — |
|
|
| Engine host |
|
| Engine port |
| — | Credentials |
| — | Store name |
|
| Connect over TLS |
|
| Keyspace used when a tool omits scope/keyspace |
|
| Storage type for newly created keyspaces (durable vs in-memory). Existing keyspaces are auto-detected — the server binds the correct type regardless of this setting. |
| — | Default owner/scope, applied when a tool omits |
|
| Prefix for per-owner keyspaces ( |
|
| The common/shared keyspace name |
|
| Auto-create a scope's keyspace on first use. Requires |
|
| Stamp each memory with an indexed |
| main + 1 | Engine subscription server port (21211 by default; enabled by default) |
|
| Changes retained per watched keyspace, so changes between calls aren't lost |
|
| Seconds before an unused subscription is closed |
|
| Seconds between read-authority checks for active watches. Access loss closes the subscription and purges buffered changes. |
|
| Maximum seconds allowed for one watch authorization check. A failed check closes the watch safely. |
montycat_create_keyspace works with delegated-owner credentials when policy
grants provision-keyspace for the requested store, storage type, and semantic
model. The store must already exist for delegated owners. With superowner
credentials, creating the first keyspace also creates a missing configured
store in the same engine request. montycat_forget deletes one record and
requires write authority for its keyspace. The engine makes every final
authorization decision.
Memory scoping (multi-tenant)
Pass scope (an owner/user id) to any memory tool to isolate that owner's
memory. Because Montycat's semantic search runs per keyspace, each scope gets its
own keyspace mem_<scope> — so semantic recall for one owner never sees another
owner's memories:
remember(value={"fact": "..."}, scope="alice") # -> keyspace mem_alice
semantic_search(query="...", scope="alice") # searches only mem_alice
remember(value={"fact": "..."}, scope="shared") # -> the shared keyspacePer-owner private memory —
scope="<owner>"→mem_<owner>, auto-created on first use when the configured owner has provisioning authority.Shared/common memory —
scope="shared"→ theMONTYCAT_SHARED_KEYSPACE.Group memory — use a group id as the scope (e.g.
scope="team_eng").Single-tenant — set
MONTYCAT_SCOPEonce and omitscopeper call.
This maps onto Montycat's keyspace governance. In production, run one server instance per agent or service with delegated-owner credentials and grant only the provisioning and data authority it needs.
Isolation note: scope is routing convenience, not authenticated identity.
With one server instance sharing one connection, scopes provide logical
keyspace organization. For credential-enforced isolation, run one server
instance per owner with that owner's delegated credentials; the engine then
denies cross-owner access. Reserve superowner credentials for bootstrap and
governance administration.
Claude Desktop extension configuration
Montycat MCP's .mcpb package runs the stdio MCP server on the user's computer. It
is not a hosted MCP service and does not expose the Montycat database ports as
MCP endpoints. See the Claude Desktop installation steps or
download the package from the latest GitHub
release.
Extension settings
Setting | Purpose |
Existing Montycat URI | Optional sensitive |
Use TLS for existing engine | Enables TLS certificate verification for a configured remote engine. |
Default memory keyspace | Namespace used when Claude does not specify a scope or keyspace. Defaults to |
Local engine startup mode |
|
For a remote engine, use a least-privilege delegated owner and enable TLS. Do not put a superowner credential into a shared desktop configuration.
Update and uninstall
To update Montycat MCP, download the newer .mcpb from GitHub
Releases and
open it in Claude Desktop. When a matching .sha256 asset is provided, it can
be used to verify the download. Removing the extension stops and removes its
MCP process, but deliberately does not erase memory data.
To remove data as well:
delete individual records or keyspaces before uninstalling when selective deletion is desired;
remove the local Montycat MCP state directory at
~/.montycatonly when all locally managed Montycat MCP configuration and cached installer state should be removed;if the engine was started through Docker, remove the
montycat_datavolume separately (for example, inspect it first withdocker volume lsand remove that exact volume only when its stored memories are no longer needed);for a user-configured remote engine, remove its data using that engine operator's process—the desktop extension cannot delete an external deployment merely by being uninstalled.
Data deletion is irreversible. Back up required memories before removing a keyspace, engine data directory, snapshot set, or Docker volume.
MCPB troubleshooting
Open the extension details in Claude Desktop Settings and inspect its logs.
If startup reports that no engine is reachable, start the configured engine, correct the URI, or change startup mode from
offtoauto.If automatic setup cannot install a native engine, install Docker and retry, or install Montycat manually and configure its URI.
On Apple Silicon, use the native
arm64-semanticengine image; the plainsemantictag is AMD64.For remote TLS failures, verify the hostname and that the certificate is trusted by the user's machine. Do not disable TLS merely to bypass a certificate error.
Report reproducible problems at https://github.com/MontyGovernance/montycat-mcp/issues or use https://montygovernance.com/contact-us.
Privacy Policy
Montycat MCP processes memory values, search queries, vectors, and configuration only as needed to perform MCP calls. By default, the MCP process and Montycat engine run locally, embeddings are generated on-device, and Montycat MCP includes no product analytics or telemetry that sends memory contents to MontyGovernance. A user-configured remote engine receives the MCP data sent to that engine and is governed by its operator's retention and privacy practices.
Persistent memories, snapshots, native engine data, and Docker volumes remain until the user deletes them; uninstalling the MCPB alone does not erase them. The complete policy—including collection, storage, sharing, retention, deletion, third-party distribution services, and contact information—is in PRIVACY.md and is published at https://github.com/MontyGovernance/montycat-mcp/blob/master/PRIVACY.md.
Links
License
MIT.
Available Tools
23 toolsmontycat_await_memory_changeWait for Memory ChangeARead-onlyIdempotent
Wait until memory CHANGES — returns the moment another agent or session writes, updates, or deletes something in this memory.
This is a live subscription to the database, not a poll: it sleeps until a change actually happens and then returns immediately. Use it to coordinate with other agents sharing a scope ("tell me when someone adds to our shared memory"), or to confirm a write from another session landed. Do NOT call it in a tight loop as a substitute for searching — to find things, use montycat_semantic_search.
Returns {changes: [...], next_seq, oldest_seq, cursor_expired, timed_out}.
Each change is
{seq, key, event, value} where event is "inserted" (covers create and
update) or "removed". Pass the returned next_seq back as since_seq on
the next call to resume exactly where you left off. If the bounded buffer
has discarded part of that history, cursor_expired is true and
oldest_seq identifies the earliest retained record.
Args:
scope: Owner/user id whose memory to watch (keyspace mem_).
Use "shared" for the common keyspace — the usual choice when
coordinating between agents.
keyspace: Explicit keyspace override (advanced; bypasses scope).
timeout_sec: How long to wait before giving up (default 30). On timeout
the result is empty with timed_out: true — that is a
normal outcome, not an error.
since_seq: Resume cursor from a previous call. Omit on the first call to
watch only for changes from now on.
| Name | Required | Description | Default |
|---|---|---|---|
| scope | No | ||
| keyspace | No | ||
| since_seq | No | ||
| timeout_sec | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
It discloses the live-subscription behavior, explains that timeout is a normal outcome rather than an error, describes cursor resumption via since_seq/next_seq, and covers buffer expiry with cursor_expired and oldest_seq. This adds substantial behavioral context well beyond what the annotations already state.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Although the description is longer than average, every section earns its place: behavior, usage, return contract, and parameter details are separated cleanly. The length is justified by four parameters and a non-obvious return/cursor contract.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is complete for this tool's complexity: no output schema exists, yet it documents the return shape, event semantics, timeout behavior, cursor continuation, and both scope and keyspace modes. An agent has everything it needs to call this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description fully compensates: it documents all four parameters, including scope's shared keyspace, keyspace as an advanced override, timeout_sec's default and normal timeout behavior, and since_seq's cursor semantics. This is exactly the compensation needed when the schema provides no descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: it waits until memory is written, updated, or deleted, and returns at the moment of change. It also distinguishes itself from montycat_semantic_search, so an agent can tell this subscription-style tool apart from its siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states when to use the tool: coordinating with other agents sharing a scope and confirming that a write from another session landed. It also gives a clear exclusion: do not use it in a tight loop as a substitute for searching, and directs agents to montycat_semantic_search instead.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
montycat_clean_snapshotsDelete Memory SnapshotsADestructive
Delete snapshot files for one existing in-memory keyspace.
This is destructive to the keyspace's snapshot history but does not delete its currently loaded in-memory records. Montycat performs the final authorization check.
Args: keyspace: Explicit in-memory keyspace whose snapshots are cleaned.
| Name | Required | Description | Default |
|---|---|---|---|
| keyspace | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark the tool as destructive, and the description adds valuable context: it destroys snapshot history but preserves loaded in-memory records, and notes that Montycat performs the final authorization check. This goes beyond the annotation and helps set accurate expectations for a mutation operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and well-organized: a one-sentence action statement, a two-sentence caveat about destructive scope and authorization, then a focused Args section. Every sentence earns its place, and the most important information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter destructive tool with annotations already covering safety hints, the description is complete. It states what the tool does, what it affects, what it does not affect, the authorization step, and the meaning of the one required argument. No critical context is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for the parameter's meaning. It does so by explaining that keyspace is the 'Explicit in-memory keyspace whose snapshots are cleaned.' This adds key semantic detail beyond the bare property name and type in the input schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Delete snapshot files for one existing in-memory keyspace.' It also clarifies that it does not delete currently loaded in-memory records, which distinguishes it from siblings like montycat_remove_keyspace. This leaves no ambiguity about the tool's core function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is used to clean snapshot history for a keyspace, and it clarifies the destructive scope, but it does not explicitly state when to prefer this tool over alternatives or mention any exclusions. No sibling tools are referenced for routing decisions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
montycat_create_keyspaceCreate Memory KeyspaceA
Create a new memory namespace using the configured owner's authority.
A delegated owner can create a keyspace when its governance policy grants
provision-keyspace for the requested store, storage type, and semantic
model, but its store must already exist. With superowner credentials, the
engine creates a missing configured store and this first keyspace together
in the same provisioning request. The engine remains the final
authorization boundary.
Args: keyspace: Name of the keyspace to create. storage: Preferred storage type: "persistent" or "inmemory". Defaults to "persistent". semantic: Enable semantic search for this keyspace after creation. semantic_model: Optional embedding model: "minilm", "bge-small", "bge-base", or "e5-small". Supplying a model implies semantic=True. persistent: Deprecated compatibility option. True maps to storage="persistent"; False maps to storage="inmemory". cache: Optional cache size in MB (persistent only; min/default 10). compression: Enable compression (persistent only).
| Name | Required | Description | Default |
|---|---|---|---|
| cache | No | ||
| storage | No | ||
| keyspace | Yes | ||
| semantic | No | ||
| persistent | No | ||
| compression | No | ||
| semantic_model | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations provide only generic false hints, so the description carries the behavioral burden. It discloses authorization delegation, the engine as final authorization boundary, the store-creation side effect for superowners, default storage behavior, and that supplying semantic_model implies semantic=True. It does not cover the effects of cache or compression, but the description adds substantial behavioral context beyond the structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The first sentence delivers the core purpose, and the governance/provisioning context is relevant rather than filler. The Args block is compact and useful. It is longer than strictly necessary but every section earns its place; no wasted wording.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a provisioning tool with no output schema and only generic annotations, the description covers the important preconditions, authorization paths, defaults, and side effects. The main gaps are the undocumented cache and compression parameters and lack of explicit failure/return behavior, but the description is still strong enough for an agent to call the tool correctly in most cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Given 0% schema description coverage, the description must compensate. It does explain keyspace, storage, semantic, semantic_model, and persistent, including meaningful inference like semantic_model implying semantic=True. However, it is completely silent on the 'cache' and 'compression' parameters, leaving two of seven parameters underdocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action and resource: 'Create a new memory namespace' / keyspace. It clearly distinguishes this provisioning tool from sibling tools like list_keyspaces, remove_keyspace, and enable_semantic by establishing it as the creation entry point.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives concrete conditions for use: a delegated owner can create a keyspace only when governance grants 'provision-keyspace' and the store already exists, while superowner credentials can create the store and first keyspace together. This is clear context, though it doesn't explicitly compare against sibling tools or state when not to use it beyond the store precondition.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
montycat_disable_semanticDisable Semantic SearchADestructive
Disable semantic search for one explicit keyspace.
Stored vectors are retained by default so re-enabling can resume without a
full rebuild. Set drop_vectors only when intentionally clearing vectors,
such as before changing embedding models. The engine enforces all
governance authority and explicit denials.
Args: keyspace: Explicit keyspace to unenroll. store: Target store. Defaults to the configured store. drop_vectors: Also delete stored vectors for this keyspace.
| Name | Required | Description | Default |
|---|---|---|---|
| store | No | ||
| keyspace | Yes | ||
| drop_vectors | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (destructiveHint=true), the description explains the nuanced destructive behavior: vectors are retained unless drop_vectors is set, and dropping is recommended only in specific scenarios like changing embedding models. It also mentions governance enforcement, adding meaningful behavioral context not available from annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured: a one-line purpose, two sentences of important behavioral context, and a tight parameter list. Every sentence earns its place, with no filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's destructive nature, three parameters, and absence of an output schema, the description covers what the tool does, its default non-destructive behavior, when to opt into destruction, and each parameter's meaning. Nothing essential for invoking it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description fully compensates with an Args section covering all three parameters: keyspace ('Explicit keyspace to unenroll'), store ('Defaults to the configured store'), and drop_vectors ('Also delete stored vectors for this keyspace'). This adds meaning well beyond the bare schema titles.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Disable'), a clear resource ('semantic search'), and a scope ('one explicit keyspace'). This distinguishes it from siblings like montycat_enable_semantic and montycat_reembed_semantic without needing to open their schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: stored vectors are retained by default so re-enabling can resume without a full rebuild, and explicitly says to set drop_vectors only when intentionally clearing vectors. It does not explicitly name alternative tools, but the situational guidance is strong enough to guide correct use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
montycat_enable_external_vectorsEnable External VectorsB
Enroll a keyspace for caller-supplied embeddings instead of text embedding.
| Name | Required | Description | Default |
|---|---|---|---|
| store | No | ||
| keyspace | Yes | ||
| dimensions | Yes | ||
| embedding_space | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description notes a key behavioral trait—replacing text embedding with external vectors—but says nothing about side effects on existing data, whether the operation invalidates previously stored text embeddings, or what happens on repeated calls. Annotations are generic and do not fill this gap; no contradiction is present.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one sentence with no wasted words, front-loads the main action, and places the differentiator at the end. It is easily parseable and appropriately sized for an overview, though it trades off depth.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With four parameters, no parameter descriptions, and no output schema, an agent still lacks prerequisites, expected outcomes, error behavior, and relationships to setup tools like montycat_create_keyspace or montycat_install_engine. This is not enough to invoke the tool confidently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for parameter meaning. It only clarifies the role of 'keyspace'; 'dimensions' and 'embedding_space' are unexplained, and the optional 'store' parameter is entirely opaque.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a concrete verb ('Enroll'), names the affected resource ('keyspace'), and clarifies the intent ('caller-supplied embeddings instead of text embedding'). This clearly distinguishes the tool from a text-embedding flow and from related sibling tools like montycat_enable_semantic.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it: when callers will supply embeddings rather than relying on text embedding. It does not explicitly state when not to use it, nor does it name alternatives such as montycat_enable_semantic or montycat_install_engine, leaving some selection reasoning to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
montycat_enable_semanticEnable Semantic SearchA
Enable semantic search for one explicit keyspace.
The engine enforces manage-semantic, creator authority, explicit denials,
and allowed-model constraints. Existing records are backfilled by the
engine. This tool never enables semantic search database-wide.
Args: keyspace: Explicit keyspace to enroll and backfill. store: Target store. Defaults to the configured store. semantic_model: Optional model: "minilm", "bge-small", "bge-base", or "e5-small". Omit to use the engine/policy default. field: Optional JSON field to embed instead of the whole stored value.
| Name | Required | Description | Default |
|---|---|---|---|
| field | No | ||
| store | No | ||
| keyspace | Yes | ||
| semantic_model | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations only provide generic false hints, so the description carries the burden of explaining behavior. It discloses meaningful side effects and constraints: the engine enforces manage-semantic and creator authority, existing records are backfilled, allowed-model constraints apply, and the operation is scoped to one keyspace. This goes well beyond what annotations alone tell an agent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is focused and efficiently structured: a one-line purpose, a short paragraph of behavioral constraints, and a clear Args list. Every sentence adds necessary information without fluff or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the action, scope, permissions, side effects, and all parameter semantics, which is largely complete for invoking the tool. It does not mention return behavior, async behavior, or failure modes, and it does not cite sibling alternatives, so a small gap remains for fully autonomous decision-making.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, so the tool description must compensate. It does: every parameter is explained, including defaults for store and semantic_model, the meaning of field, and the explicit allowed model names. This is strong, complete parameter guidance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action and resource: "Enable semantic search for one explicit keyspace." It further differentiates itself with "This tool never enables semantic search database-wide," making the scope unmistakable. The title and body align clearly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly implies when to use it: when enrolling a single keyspace for semantic search. It also gives an explicit exclusion: it never enables database-wide semantic search. However, it does not name sibling alternatives explicitly, such as montycat_enable_external_vectors or montycat_disable_semantic, so it lacks full alternative routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
montycat_forgetDelete MemoryADestructive
Delete a stored record from memory by key or custom key.
Args: keyspace: Memory namespace (defaults to the configured one). key: Montycat-generated key to delete. custom_key: Custom key to delete. wait_for_index: For persistent keyspaces, wait for secondary indexes before returning. Defaults to the engine setting.
| Name | Required | Description | Default |
|---|---|---|---|
| key | No | ||
| scope | No | ||
| keyspace | No | ||
| custom_key | No | ||
| wait_for_index | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already flag destructive behavior with destructiveHint=true, and the description matches that. It adds useful behavioral context beyond the annotations by explaining that wait_for_index controls whether deletion waits for secondary indexes before returning and that keyspace defaults to the configured namespace.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with a one-line purpose followed by a compact Args list. Every clause adds information, and there is no filler or restating of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, zero schema descriptions, and a destructive operation, the description should define the full input contract. It covers the delete operation and wait_for_index behavior, but leaves scope unexplained and does not clarify the deletion target precondition. DestructiveHint covers the danger, so this is not a complete failure, but it is incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It meaningfully explains keyspace, key, custom_key, and wait_for_index, but it omits the scope parameter entirely and does not clarify whether key/custom_key are alternatives or if at least one is required.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence 'Delete a stored record from memory by key or custom key' names a specific verb, resource, and selection method. It clearly distinguishes this from sibling tools like montycat_remember, montycat_recall, and montycat_remove_keyspace.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives, no prerequisites, and no exclusions. The description implies deletion of memories, but the agent is left to infer that it should be chosen over related memory tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
montycat_install_engineInstall Montycat EngineADestructiveIdempotent
Install the Montycat engine on THIS computer, then start it.
Call this only when memory tools report that no engine is running and the
user has agreed to install one. Tell them what it does first: it downloads
the Montycat Semantic package (~18 MB) and opens your operating system's
installer, which asks for an administrator password. On Linux it runs the
documented APT installation with sudo.
Refuses when MONTYCAT_URI is set or the configured host is not this machine — Montycat MCP is pointed at an engine elsewhere, and installing a local one would create a second database and write memories where nobody is looking. Does nothing if an engine is already reachable.
Not needed when Docker is available: engine startup falls back to a container automatically, with no prompt.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations, the description discloses concrete side effects: downloading an ~18 MB package, opening the OS installer, requesting an administrator password, and using sudo APT on Linux. It also warns about creating a second database and 'write memories where nobody is looking,' giving the agent real behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the primary action and each subsequent sentence adds necessary condition or effect information. It covers consent, behavior, refusal, no-op conditions, and Docker fallback without any filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, mutating install tool with no output schema, the description fully covers prerequisites, user consent, exact side effects, refusal conditions, and automatic Docker fallback. An agent has enough information to decide when to call it and what will happen.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, so there are no parameter semantics to document. The description confirms there are no configurable inputs and instead explains what the tool autonomously handles, which is appropriate for a zero-parameter tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence states a specific action—'Install the Montycat engine on THIS computer, then start it'—with the resource and scope clearly named. This cleanly distinguishes it from the sibling read, memory, and update tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives an explicit trigger condition: 'Call this only when memory tools report that no engine is running and the user has agreed to install one.' It also names exclusions and alternatives, including refusing when MONTYCAT_URI points elsewhere, doing nothing if an engine is reachable, and not being needed when Docker is available because startup falls back automatically.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
montycat_list_keyspacesList Memory KeyspacesARead-onlyIdempotent
List the available memory stores and keyspaces on this Montycat engine.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, covering the safety profile. The description adds minimal behavioral context with the word 'available' but does not mention output shape, possible empty results, or engine-state dependencies.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, concise sentence that front-loads the action and resource without any wasted words or repetition of the title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, zero-parameter, read-only listing tool, the description adequately identifies the resource and scope. The lack of an output schema is not a major gap here, though a brief note on what the returned list contains would make it complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With zero parameters, the input schema imposes no burden and the baseline is naturally high. The description implies that no inputs are required, which is consistent with the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and resource ('available memory stores and keyspaces') scoped to 'this Montycat engine.' It clearly distinguishes itself from the sibling montycat_list_memories, which would list memory contents rather than keyspace names.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance is given about when to use this tool instead of siblings like montycat_create_keyspace or montycat_remove_keyspace. The intended use is only implied by the verb 'list', with no when-to-use conditions or exclusions stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
montycat_list_memoriesList MemoriesARead-onlyIdempotent
Browse stored memories — enumerate what is remembered, not search by meaning.
Returns up to limit records with their keys. Use this to review or list
memory; for meaning-based recall use montycat_semantic_search, and for exact
lookups use montycat_recall.
Args: keyspace: Memory namespace (defaults to the configured one). limit: Max records to return (default 25). recent: Bias toward the most recently written records (default True). Ordering is approximate (by storage volume), not a strict timestamp sort. Falls back to a full scan when the latest volume is empty. Pass False to scan the whole keyspace from the start.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| scope | No | ||
| recent | No | ||
| keyspace | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare read-only, idempotent, and non-destructive behavior. The description adds meaningful behavioral context beyond those: ordering is approximate by storage volume, not a strict timestamp sort; it falls back to a full scan when the latest volume is empty; and recent=False scans the entire keyspace. This is exactly the kind of non-obvious behavior an agent needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The purpose is front-loaded in the first line, alternative tools are named immediately, and the Args section is compact and scannable. Every sentence carries useful information with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only listing tool, this is largely complete: it explains behavior, defaults, return contents ('up to limit records with their keys'), and edge cases like fallback scanning. It falls just short of full completeness because the scope parameter is omitted and there is no output schema to fill in return-structure details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description richly documents keyspace, limit, and recent with defaults and behavioral nuances. However, the input schema has a fourth parameter, scope, with 0% schema description coverage, and the description never mentions it at all. Since the schema provides no descriptions, this missing parameter is a concrete gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Browse stored memories — enumerate what is remembered, not search by meaning.' It also explicitly contrasts itself with montycat_semantic_search and montycat_recall, making its distinct purpose unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says when to use this tool ('Use this to review or list memory') and names the alternatives for other use cases: montycat_semantic_search for meaning-based recall and montycat_recall for exact lookups. This is ideal routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
montycat_policy_explainExplain Policy DecisionARead-onlyIdempotent
Explain whether the configured owner may perform a proposed action.
This is a read-only policy check for planning and diagnostics; executing the action still requires a separate tool call and fresh engine authorization. The explanation identifies applicable grants, denials, creator authority, and storage/model constraints.
Args: capability: One of "provision-keyspace", "remove-keyspace", "manage-snapshots", "manage-semantic", "manage-schema", or "manage-access". store: Target store. Defaults to the configured store. keyspace: Optional target keyspace. storage: Optional keyspace type: "persistent", "inmemory", or "distributed". semantic_model: Optional model constraint: "minilm", "bge-small", "bge-base", or "e5-small".
| Name | Required | Description | Default |
|---|---|---|---|
| store | No | ||
| storage | No | ||
| keyspace | No | ||
| capability | Yes | ||
| semantic_model | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark the tool as read-only and idempotent, and the description reinforces this by labeling it a read-only check. It adds valuable detail by stating that the tool 'identifies applicable grants, denials, creator authority, and storage/model constraints' and by clarifying that it does not execute the action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core behavior is front-loaded in the first sentence, followed by essential context about read-only planning use and a compact, well-organized Args block. Every sentence adds value, especially given the otherwise bare schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with five parameters and no output schema, the description covers purpose, usage context, behavioral boundaries, and all parameter semantics. It does not specify the exact return format, but it offers enough for correct selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage and provides only parameter names and defaults, so the description must carry the full semantic burden. The Args block compensates thoroughly by enumerating allowed capability values, storage types, semantic model options, and default behavior for the store parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Explain whether the configured owner may perform a proposed action,' and it lists the kinds of constraints the explanation covers. This clearly identifies the tool's function, though it does not explicitly differentiate it from siblings like montycat_policy_view or montycat_policy_history.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says this is a 'read-only policy check for planning and diagnostics' and that 'executing the action still requires a separate tool call and fresh engine authorization.' This gives clear when-to-use and when-not-to-use context, but it does not name alternative sibling tools for comparison.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
montycat_policy_historyView Policy HistoryARead-onlyIdempotent
View governance history visible to the configured owner.
This is read-only and owner-scoped by the authenticated Montycat credential. It can show when authority was delegated, denied, revoked, or transferred without allowing the MCP caller to select another owner.
Args: store: Optional store filter. Defaults to the configured store. keyspace: Optional keyspace filter.
| Name | Required | Description | Default |
|---|---|---|---|
| store | No | ||
| keyspace | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds meaningful behavioral context beyond those: owner-scoping by the authenticated Montycat credential, inability to select another owner, and the specific kinds of events visible (delegated, denied, revoked, transferred). No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is tight and well-structured: purpose first, then scoping/behavioral notes, then an Args section. Every sentence earns its place, with no redundant phrasing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with two optional parameters and no output schema, the description covers purpose, scope, event types, and parameter defaults. It stops short of explaining ordering, pagination, or the exact return shape, but those are minor for a filtered history-view tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, so the description must compensate. It explains that store is an optional filter defaulting to the configured store, and keyspace is an optional filter. This adds real meaning beyond the bare property names, though it could go slightly deeper on how the filters narrow the history results.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb+resource: 'View governance history visible to the configured owner.' It further specifies the types of events included (delegated, denied, revoked, transferred), clearly distinguishing this history tool from siblings like montycat_policy_view or montycat_policy_explain.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly states the tool is read-only and owner-scoped, and explains it surfaces governance events without allowing the caller to select another owner. It gives clear context for when to use it, though it does not explicitly name alternative tools or say 'use this instead of policy_view when you need historical events rather than current policy.'
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
montycat_policy_viewView Memory PolicyARead-onlyIdempotent
View the configured owner's effective Montycat governance policy.
This is read-only. It reports the authenticated owner's effective grants, denials, accessible and owned keyspaces, automatic creator capabilities, provisioning constraints, and policy health. The engine filters the result and remains the authorization boundary.
Args: store: Optional store to inspect. Defaults to the store configured by MONTYCAT_URI or MONTYCAT_STORE.
| Name | Required | Description | Default |
|---|---|---|---|
| store | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint and idempotentHint annotations, the description discloses the specific contents of the policy report: effective grants, denials, accessible and owned keyspaces, creator capabilities, provisioning constraints, and policy health. It also explains that the engine filters the result and remains the authorization boundary, adding useful behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact, front-loaded with the core purpose, and every subsequent sentence contributes useful detail or parameter semantics. There is no redundant filler beyond the natural restatement of the tool's purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-required-parameter read-only query with no output schema, the description is sufficient: it explains the optional input, defaults, result contents, and safety posture. An agent can invoke the tool correctly without needing additional undocumented context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the burden for the single store parameter. It adds meaning by explaining that store is optional, what it selects for inspection, and that it defaults to MONTYCAT_URI or MONTYCAT_STORE. This adequately compensates for the sparse schema, though it does not mention accepted store formats.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb (view) and resource (the effective Montycat governance policy for the configured owner), and it expands on what the report contains. It does not explicitly contrast this tool with montycat_policy_history or montycat_policy_explain, so sibling differentiation is only implicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided about when to use this tool versus related policy or keyspace tools. The only usage-related context is the optional store parameter and its environment-variable default, which describes invocation rather than tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
montycat_recallRecall MemoriesARead-onlyIdempotent
Recall memory by exact key or by field filter (not by meaning).
Provide key/custom_key to fetch a single record, or filters (a map of
field -> value) to look up all records matching those fields. For meaning-based
recall use montycat_semantic_search instead.
Args: keyspace: Memory namespace (defaults to the configured one). key: Montycat-generated key to fetch. custom_key: Custom key to fetch. filters: Field equality filters, e.g. {"user": "alice", "topic": "billing"}. limit: Max results for a filter lookup (default 25).
| Name | Required | Description | Default |
|---|---|---|---|
| key | No | ||
| limit | No | ||
| scope | No | ||
| filters | No | ||
| keyspace | No | ||
| custom_key | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and non-destructive behavior. The description adds useful behavioral detail: recall is exact-match only, not semantic; filters use field equality; keyspace defaults to the configured one; and filter results default to a limit of 25. No contradiction with annotations exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-organized and front-loaded with the core distinction, followed by usage details and an explicit alternative. The Args block is slightly repetitive with the opening sentence but remains compact and scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With six optional parameters, no output schema, and 0% schema descriptions, the description carries heavy responsibility. It covers most operational behavior, but the undocumented `scope` parameter is a real gap, and the description does not state what the tool returns (single record vs. list) beyond implying it. It is adequate for basic use but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does document `key`, `custom_key`, `filters`, `limit`, and `keyspace` with meaningful explanations and examples. However, it omits the `scope` parameter entirely, leaving the agent with only the unhelpful title 'Scope' from the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a precise statement: 'Recall memory by exact key or by field filter (not by meaning).' It names the resource (memories), the operation (recall), and the two lookup modes. It also explicitly names the semantic-search sibling, which distinguishes it clearly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit usage guidance: use `key`/`custom_key` for a single record, use `filters` for field-equality lookups, and 'For meaning-based recall use montycat_semantic_search instead.' This is a clear when-to-use and when-not-to-use statement with an alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
montycat_reembed_semanticRebuild Semantic VectorsADestructive
Replace an enrolled keyspace's text embedding model and backfill it.
This clears its current vectors, then has the engine rebuild them. Use
montycat_semantic_status to observe the resulting configuration.
| Name | Required | Description | Default |
|---|---|---|---|
| field | No | ||
| store | No | ||
| keyspace | Yes | ||
| semantic_model | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description explicitly discloses that the operation clears the current vectors before rebuilding them, which is essential behavioral context beyond the destructiveHint annotation. It also directs the agent to verify the result via montycat_semantic_status, making the side effects and follow-up clear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences and front-loads the action. It contains no filler, clearly states the destructive effect, and adds a useful follow-up command. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive tool with no output schema and sparse parameter names, the description explains the main behavior, the side effect on existing vectors, and how to observe the outcome. It is sufficient for a basic call but leaves optional parameters and possible error conditions undocumented, so it is not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The prose gives semantic meaning to the two required parameters: keyspace identifies the enrolled keyspace and semantic_model is the replacement embedding model. However, with 0% schema description coverage, the optional field and store parameters are left completely unexplained, so the description only partially compensates for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the action: replace an enrolled keyspace's text embedding model and backfill it. It also explains the consequence (clears and rebuilds vectors), which distinguishes it from sibling tools like enabling semantic search or creating a keyspace.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The context is clear: this is used when you want to swap the embedding model for an already-enrolled keyspace. It also points the agent to montycat_semantic_status for observing the resulting configuration, though it does not explicitly state when NOT to use this tool or name alternatives for similar operations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
montycat_rememberStore MemoryA
Store a fact or record in memory; it is embedded and indexed automatically.
Later recall it by meaning with montycat_semantic_search, or by key with
montycat_recall. Returns the generated key in payload.
Every record is auto-stamped with an indexed _created_at (UTC ISO-8601)
unless the value already carries one — this powers time-range recall
(since/until on montycat_semantic_search). Top-level fields are
indexed, so they can be used as filters in hybrid search (e.g. store
{"project": "x", ...}, later filter on it).
Args:
value: The record to store (a JSON object).
scope: Owner/user id to store under (that owner's private memory,
keyspace mem_). Use "shared" for the common keyspace.
keyspace: Explicit keyspace override (advanced; bypasses scope).
custom_key: Optional stable key to store under (for later exact recall/update).
timestamp: Index a _created_at for time-range recall. Defaults to
MONTYCAT_AUTO_TIMESTAMP (on). Pass False to skip the
server-side timestamp parse when this memory will never be
recalled by time.
wait_for_index: For persistent keyspaces, wait until secondary indexes
have caught up before returning. Defaults to the engine
setting; use True when an immediate filtered/semantic
recall must see this write.
vector: Optional precomputed embedding for this record. It must match
the keyspace's enrolled embedding profile.
| Name | Required | Description | Default |
|---|---|---|---|
| scope | No | ||
| value | Yes | ||
| vector | No | ||
| keyspace | No | ||
| timestamp | No | ||
| custom_key | No | ||
| wait_for_index | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes well beyond the sparse annotations by disclosing automatic embedding and indexing, auto-stamping of _created_at, indexing of top-level fields for filters, wait_for_index catch-up semantics, and the return behavior. It adds substantial behavioral context that an agent needs to understand side effects and timing, with no contradiction of annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized for the tool's complexity. It front-loads the primary purpose, then systematically covers return value, timestamp behavior, filtering implications, and a clear Args block. Every sentence adds value; no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity, 7 parameters, no output schema, and minimal annotations, the description covers everything needed: purpose, key return field, timestamp semantics, filtering via indexed top-level fields, per-parameter guidance, and advanced keyspace behavior. It is complete enough for an agent to call correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the full burden. It provides detailed, meaningful explanations for all 7 parameters, including defaults, advanced usage, requirements (vector must match profile), and behavioral implications (wait_for_index). It fully compensates for the missing schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Store a fact or record in memory'. It immediately clarifies the core behavior (embedding and automatic indexing) and distinguishes itself from recall tools by naming them as follow-ups (montycat_semantic_search, montycat_recall). It is clearly differentiated from the sibling 'remember_bulk' by implication of a single record.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives context about when storage matters ('Later recall it by meaning...'), but does not explicitly state when to choose this tool over alternatives like montycat_remember_bulk or montycat_update. No exclusions or explicit routing guidance are provided, so usage is mostly implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
montycat_remember_bulkStore Multiple MemoriesA
Store many memories at once; all are embedded and indexed automatically.
Args:
values: A list of records (JSON objects) to store.
keyspace: Memory namespace (defaults to the configured one).
timestamp: Index a _created_at on each record for time-range recall.
Defaults to MONTYCAT_AUTO_TIMESTAMP (on). Pass False for
large imports that will never be recalled by time — it skips
a server-side timestamp parse per record.
wait_for_index: For persistent keyspaces, wait for secondary indexes
before returning. Defaults to the engine setting.
| Name | Required | Description | Default |
|---|---|---|---|
| scope | No | ||
| values | Yes | ||
| vectors | No | ||
| keyspace | No | ||
| timestamp | No | ||
| wait_for_index | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes well beyond the minimal annotations by explaining that all records are embedded and indexed automatically, how timestamp affects indexing, what wait_for_index does, and the performance rationale for disabling timestamp. This is rich behavioral context for a write operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with an opening summary followed by a clear Args list. It is appropriately sized, and each parameter explanation is concise and relevant, though the two undocumented parameters add slight imbalance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 6-parameter tool with no output schema, the description covers the core parameters and side effects but omits 'scope' and 'vectors', and doesn't mention return values or failure behavior. It is usable for basic invocation but not complete for advanced use cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It clearly explains 'values', 'keyspace', 'timestamp', and 'wait_for_index', but leaves the 'scope' and 'vectors' parameters completely undocumented, which is a notable gap for an agent trying to use them correctly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Store many memories at once') and resource ('memories'), making the bulk variant clear. The name and title reinforce the bulk aspect, but it doesn't explicitly differentiate from the sibling montycat_remember, relying on the word 'bulk'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Store many memories at once' implies the use case for storing multiple records, but it doesn't explicitly say when to choose this over montycat_remember or montycat_forget. No alternatives or exclusions are provided, leaving the routing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
montycat_remove_keyspaceDelete Memory KeyspaceADestructive
Permanently remove a memory namespace using the owner's authority.
This is a destructive lifecycle operation. Before removal Montycat MCP closes
the keyspace's live watch and releases MCP resource-subscription ownership
so the engine cannot deadlock on a lingering subscriber. The engine then
enforces remove-keyspace, creator authority, and explicit denials.
Args: scope: Owner/user scope to remove (maps to keyspace mem_). Use "shared" for the configured shared keyspace. keyspace: Explicit keyspace override (advanced; bypasses scope).
| Name | Required | Description | Default |
|---|---|---|---|
| scope | No | ||
| keyspace | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and idempotentHint=false, but the description adds substantial non-obvious behavior: it closes the keyspace's live watch, releases MCP resource-subscription ownership to prevent deadlock, and enforces policy/authority checks. This is precisely the kind of behavioral context an agent needs beyond the structured hints, and it does not contradict the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and front-loaded with the destructive action and warning, followed by a labelled Args section. The technical sentence about closing watches and releasing subscriptions is somewhat niche but earns its place by explaining a real safety mechanism; 'explicit denials' is the only slightly vague phrase.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive operation, the description covers purpose, parameter semantics, and important safety side effects well. However, because both parameters are optional in the schema, the missing guidance on what happens if scope/keyspace are absent, or how they interact, is a meaningful completeness gap. With no output schema, a brief note on expected confirmation or error behavior would also strengthen the definition.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must carry parameter meaning, and it does well: scope is explained as mapping to keyspace mem_<scope> with the special value 'shared', and keyspace is described as an explicit override that bypasses scope. The main gap is that both parameters are optional in the schema but the description never clarifies what happens if both are omitted or whether they are mutually exclusive.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Permanently remove a memory namespace using the owner's authority.' This clearly identifies the operation and distinguishes it from sibling tools like create_keyspace, list_keyspaces, remember, or forget without requiring schema inspection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies lifecycle use and states authority prerequisites ('using the owner's authority', 'enforces remove-keyspace, creator authority, and explicit denials'). However, it never explicitly contrasts this tool with alternatives such as montycat_forget for deleting individual memories or says when not to use it, leaving the routing mostly implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
montycat_semantic_searchSearch MemoriesARead-onlyIdempotent
Search stored memory by MEANING (vector / semantic search), not keywords.
Use this to recall relevant facts, documents, or past context for RAG and agent memory. Returns the top matches ranked by similarity, each with its key, a cosine-similarity score, and the stored value.
Hybrid mode: filters, since, and until restrict WHICH memories are
ranked — a hard AND constraint over indexed fields; ranking stays pure
similarity. Combine them freely: "what did we decide about the index"
sinceyesterday +filters={"project": "montycat"}is one call. A filter matching nothing returns []. Requires a Montycat Semantic engine with hybrid support (>= 1.2.3); older engines ignore the filter.
Args:
query: Natural-language description of what to recall. May be empty
when vector supplies a precomputed query embedding.
vector: Optional precomputed query embedding. It must match the
keyspace's enrolled embedding space and dimensions; when set,
the engine does not embed query.
scope: Owner/user id to scope recall to (searches only that owner's memory,
keyspace mem_). Use "shared" for the common keyspace.
keyspace: Explicit keyspace override (advanced; bypasses scope).
limit: Max number of results (default 5).
min_score: Optional similarity floor in [-1, 1]; drops weak matches.
filters: Optional metadata constraints, e.g. {"project": "x"} — only
memories whose indexed fields equal these values are ranked.
since: Only memories created at/after this time (ISO-8601, UTC —
matches the auto-stamped _created_at).
until: Only memories created before this time (ISO-8601, UTC).
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| query | No | ||
| scope | No | ||
| since | No | ||
| until | No | ||
| vector | No | ||
| filters | No | ||
| keyspace | No | ||
| min_score | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnly and idempotent annotations, the description discloses the return shape (key, cosine-similarity score, stored value), filter semantics as hard AND constraints, the empty-result behavior, and a critical engine version requirement. These behaviors are not visible from annotations alone.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but justified by the tool's complexity: it front-loads the core purpose, then adds hybrid-mode behavior, engine caveat, and per-parameter guidance. Each sentence adds operational value; there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 9-parameter tool with no output schema, the description covers invocation semantics, result format, filter behavior, engine requirements, and edge cases like empty filter matches. An agent has enough information to select and call the tool correctly without further inference.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, yet the description documents all 9 parameters in detail: query/vector mutual exclusivity, embedding space constraints, scope-to-keyspace mapping, limit default, min_score floor, filters format, and ISO-8601 semantics for since/until. This fully compensates for the schema's lack of descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with a specific verb and resource: 'Search stored memory by MEANING (vector / semantic search), not keywords.' This clearly differentiates the tool from keyword-based siblings like montycat_recall and states its role in RAG and agent memory recall.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives clear context for use ('Use this to recall relevant facts, documents, or past context') and explicitly contrasts with keyword search. However, it does not name sibling tools as alternatives or provide explicit when-not-to-use conditions beyond 'not keywords.'
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
montycat_semantic_statusView Semantic Search StatusARead-onlyIdempotent
Read the engine's actual semantic configuration and backfill state.
Pass both store and keyspace for one keyspace. Omitting both asks for
the database-wide view, which may require superowner authority.
| Name | Required | Description | Default |
|---|---|---|---|
| store | No | ||
| keyspace | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and idempotentHint, so the safety profile is covered. The description adds valuable behavioral context by explaining the two invocation scopes and the superowner authority requirement for the database-wide view, going beyond what the annotations alone convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: the first sentence states the tool's purpose, and the second provides the essential parameter guidance. There is no redundant or filler content; every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only status tool with two optional parameters, the description covers purpose, scoping rules, and an authorization caveat. It does not explicitly state what happens if only one parameter is provided, and there is no output schema, but the stated purpose already hints at the returned content.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the burden of explaining the parameters. It explains that both store and keyspace are needed together for a single keyspace view, and that omitting both selects the database-wide view, which meaningfully compensates for the schema's lack of descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reads the engine's actual semantic configuration and backfill state, which is a specific verb and resource. It does not explicitly differentiate from sibling tools by name, but the read-status purpose is evident and distinct from search, memory, and policy tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear usage context: pass both store and keyspace for a specific keyspace, or omit both for a database-wide view requiring superowner authority. It does not name alternative tools or explicitly state when not to use this tool, but the parameter-mode guidance is concrete and actionable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
montycat_start_snapshotsStart Memory SnapshotsA
Start scheduled snapshots for one existing in-memory keyspace.
Montycat enforces manage-snapshots, creator authority, and explicit
denials. If the response says "Snapshot rate is not set", snapshot
scheduling is not configured on the engine; that is an environmental
configuration error, not an authorization denial. This tool cannot alter
the global snapshot rate.
Args: keyspace: Explicit in-memory keyspace to snapshot.
| Name | Required | Description | Default |
|---|---|---|---|
| keyspace | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate the tool is not read-only and not idempotent, but the description adds meaningful behavioral context: enforcement of 'manage-snapshots' and creator authority, how to distinguish an environmental configuration error from an authorization denial, and the limitation on altering the global snapshot rate. This goes beyond the structured annotations without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and well-structured. It opens with the core action, then provides short, useful notes on permissions, error interpretation, and a boundary on what the tool cannot do, followed by the argument definition. Every sentence earns its place and there is no padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool with no output schema, this description is largely complete: it states the action, the target resource, the required parameter, authorization expectations, and a common error condition. It does not describe the success response format or what happens if snapshots are already running, but those are minor gaps given the tool's low complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema only says 'keyspace' is a required string, and schema description coverage is 0%. The description compensates by defining the parameter as 'Explicit in-memory keyspace to snapshot' and by stating earlier that it must be an existing keyspace. This adds real semantic meaning beyond the schema, though it could be even more specific about naming conventions or how to discover valid keyspaces.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Start scheduled snapshots' and names the exact resource: 'one existing in-memory keyspace.' This clearly distinguishes the tool from the sibling stop_snapshots and clean_snapshots tools, so an agent can tell what this tool does without opening other definitions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context about when this tool is applicable: it starts scheduled snapshots for an existing in-memory keyspace. It also provides an important exclusion ('cannot alter the global snapshot rate') and explains how to interpret a 'Snapshot rate is not set' response. However, it does not explicitly name alternatives or state when to prefer a sibling tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
montycat_stop_snapshotsStop Memory SnapshotsA
Stop scheduled snapshots for one existing in-memory keyspace.
Existing snapshot files are retained. Montycat performs the final authorization check.
Args: keyspace: Explicit in-memory keyspace whose snapshot schedule stops.
| Name | Required | Description | Default |
|---|---|---|---|
| keyspace | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations only declare readOnlyHint, destructiveHint, and idempotentHint as false, so they provide little safety context. The description adds meaningful behavioral detail: existing snapshot files are retained, the final authorization check is performed by Montycat, and the action applies to exactly one existing in-memory keyspace. This clarifies non-destructiveness and preconditions beyond what annotations alone convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and well ordered. The first sentence states the core purpose, the second paragraph provides two important side-effect/context facts, and the Args section clearly ties the parameter to its role. No sentence is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one simple parameter and no output schema, the description covers the main action, the key side-effect, and an important precondition. It does not mention error cases or explicitly reference how to resume snapshots, but the core operation is adequately specified for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the schema only names the required parameter as 'Keyspace'. The description compensates by explaining that keyspace must be an explicit, existing in-memory keyspace whose snapshot schedule stops. This adds real semantic meaning and reduces ambiguity about what value to provide.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Stop scheduled snapshots' for an explicit in-memory keyspace. It clearly distinguishes the operation from siblings like montycat_start_snapshots and montycat_clean_snapshots by focusing on stopping a schedule rather than creating, cleaning, or managing snapshot content.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit guidance about when to use this tool versus its siblings. It does not mention montycat_start_snapshots as the counterpart for resuming snapshots, nor does it state any conditions or exclusions. The only implicit signal is the word 'existing', which weakly implies a prerequisite.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
montycat_updateUpdate MemoryA
Revise an existing memory in place (memory is mutable).
Use this when a stored fact changes — a corrected value, an updated
preference — instead of storing a duplicate. Only the fields you pass are
changed. Identify the record by key or custom_key.
Args: updates: Fields to change, e.g. {"status": "resolved"} or {"name": "Alice"}. keyspace: Memory namespace (defaults to the configured one). key: Montycat-generated key of the record to update. custom_key: Custom key of the record to update. wait_for_index: For persistent keyspaces, wait for secondary indexes before returning. Defaults to the engine setting.
| Name | Required | Description | Default |
|---|---|---|---|
| key | No | ||
| scope | No | ||
| vector | No | ||
| updates | Yes | ||
| keyspace | No | ||
| custom_key | No | ||
| wait_for_index | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only signal a non-read operation; the description adds meaningful behavior: partial in-place mutation, mutability of memories, and wait_for_index behavior. It does not discuss side effects or old-value handling, but it goes beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose and usage guidance are front-loaded before the parameter list. Every sentence carries useful information, and the Args block is compact, readable, and free of filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 7-parameter mutation tool with no output schema and sparse annotations, the description covers the main flow well but omits scope and vector, and does not specify behavior when both or neither key and custom_key are provided. Adequate but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has no documentation, so the description compensates by explaining updates with concrete examples, defining key and custom_key as record identifiers, and clarifying wait_for_index defaults. However, the scope and vector parameters are not explained at all.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific action: 'Revise an existing memory in place' and immediately clarifies memory is mutable. It also distinguishes itself from storing a duplicate, which separates it from montycat_remember and montycat_forget without ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states when to use the tool: when a stored fact changes, such as a corrected value or updated preference, rather than storing a duplicate. It also clarifies that only passed fields are changed, preventing accidental overwrites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Most tools target clearly distinct actions: remember/recall/update/forget cover CRUD, semantic_search/list_memories/recall are explicitly differentiated by meaning vs. key vs. browse, and each policy/snapshot/semantic management tool has a specific role. Minor overlap exists between recall-by-filter and list_memories, but the descriptions strongly reduce misselection risk.
All tools share the memocat_ prefix and snake_case style, and many follow a verb_noun pattern like create_keyspace, remove_keyspace, start_snapshots. A few names deviate with noun-first or noun-only forms such as semantic_search, policy_view, and semantic_status, but the pattern is still predictable and readable.
With 23 tools, this is on the heavy side, though the broad scope—memory CRUD, semantic search, keyspace lifecycle, policy governance, snapshots, and live subscriptions—means each tool has a plausible purpose. The count is defensible but feels close to the upper limit of what an agent should comfortably navigate.
The tool surface covers the full memory lifecycle: create, read, update, delete, bulk write, list, semantic search, and change notification, plus keyspace provisioning/removal and semantic enable/disable/reembed operations. Policy inspection and snapshot management round out the domain with no obvious dead ends or missing core operations.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Persistent memory for AI agents. Semantic search, memory graph, W3C DID identity.
Hosted persistent memory with semantic search, importance and TTL for AI agents.
Persistent memory for AI agents. Search and store durable facts, preferences and decisions.
Persistent cloud memory for AI agents. Store and search key-value memories across sessions.
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceProvides AI agents with persistent, searchable memory that survives across conversations using semantic search, temporal versioning, and smart organization. Enables long-term context retention and cross-session continuity for AI assistants.14

Memsolus MCP Serverofficial
AlicenseAqualityDmaintenanceProvides persistent long-term memory for AI agents through semantic search and automated knowledge graph extraction. It enables agents to store, recall, and reason over facts, preferences, and relationships across multiple conversations and sessions.1419MIT- AlicenseAqualityAmaintenanceProvides persistent, searchable memory for AI agents, enabling them to retain, recall, and reflect on information across conversations.191MIT
- AlicenseNot gradedqualityBmaintenanceLocal-first, multi-user shared memory for AI agents with semantic search, offline support, and team synchronization.MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/MontyGovernance/montycat-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server