MemVault
MemVault is an MCP memory server that gives any MCP-capable agent a shared, persistent long-term memory store — saving, retrieving, and auto-injecting context across agents and sessions.
Save & retrieve memories:
save_memorystores preferences/facts/episodes/skills with priority (MUST/REFERENCE/BACKGROUND), namespace, tags, layer, and auto-embeddings; delta-write skips near-duplicates or merges the residual (force_insertto bypass).Search:
search_memorysupports keyword (BM25), semantic (vector), or hybrid (RRF) modes with top_k, min_score, namespace/type/priority filters, and optional one-hop relation expansion.Session context injection:
session_startreturns agent-filtered MUST/REFERENCE instructions ready to inject, with overflow summaries pointing to search.Memory extraction:
extract_memoriespulls structured memories from text via rule-based or LLM modes (with fallback reporting);import_skillsturns Markdown SOPs into skill memories.Episodic learning:
record_outcomelogs task success/failure/partial results and distills lessons;infer_outcomeclassifies outcomes from host-provided friction/terminal evidence and skips cleanly when nothing is inferred.Review workflow:
review_memoryapproves, rejects, or edits memories;list_inboxlists pending human review items.Lifecycle maintenance:
run_dedupreports near-duplicates,run_decayages/archives stale memories (MUST exempt),run_promoteconsolidates L1→L2→L3 layers.Evidence & provenance:
add_evidencerecords supports/contradicts/sourced_from relations;get_memory_evidencereturns the raw L0 trace chain a memory was distilled from.Deletion:
delete_memorysoft-deletes (restorable via CLI);forget_memoryirreversibly purges by id or criteria with dry_run preview and MUST protection.Compliance & effectiveness:
report_compliancemarks injected memories followed/violated;get_compliance_reportandget_effectiveness_reportreturn follow rates and auto-judged useful/neutral/harmful stats.Access tracking:
confirm_readincrements access_count and last_read_at for memory IDs.
Plugs into a local Ollama instance as the embedding and chat-LLM provider — nomic-embed-text for semantic search vectors and models like qwen2.5 for structured memory extraction, failure reflection, and relation extraction — keeping all memory processing on the user's machine.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@MemVaultremember that I prefer pnpm over npm for all projects"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MemVault
The Shared Memory Layer for Every AI Agent You Run
Not "agent learns to search memory" — memory finds the agent.
MCP Native · Hybrid Retrieval · Auto-Injection · Zero-Config Sync
Open Source · Self-Hosted · Private · MIT Licensed
English · 简体中文
If MemVault solves a real problem for you, a star helps others find it.
curl -fsSL https://raw.githubusercontent.com/dreamor/memvault/master/scripts/install.sh | bashEvery AI agent session starts from scratch. Claude Desktop doesn't know what Cursor just learned. DeepSeek Harness (dsh) doesn't know what you told Claude Code yesterday. Whatever agent you're running — international or domestic, IDE plugin or CLI harness — it forgets your preferences every time you start a new conversation.
You've been manually repeating context — project conventions, personal preferences, past decisions — across agents that should already know. This isn't a limitation of the models. It's a missing infrastructure layer.
MemVault is that layer. A lightweight, self-hosted memory router that sits between your agents and their context. It speaks plain MCP — no MemVault-specific SDK, no per-agent API integration. Any MCP-compatible agent, from any vendor, automatically shares the same persistent memory the moment it connects.
Who it's for:
Anyone running an MCP-capable agent — Claude Code, Claude Desktop, Cursor, Cline, Continue, DeepSeek Harness (dsh), or any other MCP client, domestic or international — who wants preferences, project context, and past decisions to persist across sessions without repeating yourself
Multi-agent power users running several of the above side by side, on different models, from different vendors — all sharing the same memory without configuration
Platform teams deploying AI-assisted workflows where consistency matters across a mixed agent fleet: code review conventions, architecture decisions, project-specific preferences
Anyone tired of telling their AI the same thing twice — MemVault works the way your brain should: you say it once, it's there when you need it, no matter which agent is asking
Quick Start · How It Works · What MemVault Gives You · Why MemVault · MCP Server · CLI Reference · Integrations · Architecture · Project Status · Testing · Documentation · Contributing · License
Quick Start
Don't install MemVault by hand — paste this one prompt into Claude Code, Codex, Cursor, dsh, or any other MCP-capable agent. It points the agent at a machine-readable install guide, so the agent does the whole setup itself:
Install MemVault as your long-term memory and wire it into this agent. Fetch and follow https://raw.githubusercontent.com/dreamor/memvault/master/docs/AGENT-INSTALL.md — install the binaries, register MemVault as an MCP server for this host, and verify recall works. Then keep saving my preferences, project decisions, and lessons from each session so my next agent starts with them instead of from scratch.Or install manually:
# Install (Linux / macOS): official script, auto-verifies SHA-256
curl -fsSL https://raw.githubusercontent.com/dreamor/memvault/master/scripts/install.sh | bash
export PATH="$HOME/.memvault/bin:$PATH"
# Windows (PowerShell):
# powershell -ExecutionPolicy Bypass -File scripts\install.ps1
# Homebrew (Apple Silicon):
# brew install dreamor/tap/memvault
# Or from crates.io:
# cargo install memvault-cli memvault-mcp
# The installers auto-start the local REST backend (host of the Web
# Dashboard). Open it, or start it on demand:
memvault-cli dashboard
# Save a MUST-level preference (injected as instruction, agent must follow)
memvault-cli save --content "User prefers Python" --priority MUST --type preference \
--instruction "Use Python for code, not Java" --tags "coding,python"
# Search across all memory (hybrid: keyword + semantic when embedding is enabled)
memvault-cli search --query "Python"
# See what context gets injected when a specific agent connects
memvault-cli session-start --agent-id claude-desktop --context "Help me write code"
# Extract structured memories from free text
memvault-cli extract --text "I prefer dark mode. Our project uses Rust." --save
# Auto-generate agent instruction files from memory
memvault-cli sync
# All in one: dedup, decay, archive stale memories
memvault-cli dedup && memvault-cli decaySystem requirements:
Prebuilt Linux binaries (install script / GitHub release): glibc ≥ 2.38 + GLIBCXX_3.4.31 (GCC 13-era runtime — Ubuntu 24.04+ / Fedora 39+ / Arch;
memvault-proxyadditionally wants glibc ≥ 2.39). TLS is rustls, so no OpenSSL dependency. Ubuntu 22.04 / RHEL or EL8/EL9 users: use the Docker image (dreamor/memvault) or build from source.Building from source (
cargo install/cargo build): links fastembed's prebuilt ONNX Runtime static library and needs a GCC 13-class toolchain. Older toolchains (e.g. GCC 8, CentOS 7/8-era libstdc++) fail at link time with missing C++20/23 stdlib symbols (std::format,std::to_chars). macOS / Windows (MSVC) / Homebrew / Docker are unaffected.
Verify your install in 5 seconds:
memvault-cli --version
# memvault 0.6.9
# sanity check: list saved memories (verifies DB is healthy)
memvault-cli listLocal Ollama Demo (Zero Cost, Stays on Your Machine)
MemVault is plug-and-play with a local Ollama: unconfigured LLM extraction (full-text understanding / failure reflection / relation extraction) auto-detects a local Ollama; embeddings use the local model with the ollama or auto provider.
# 1. Install and start Ollama
brew install ollama && brew services start ollama # or the official installer
# 2. Pull models
ollama pull nomic-embed-text # embeddings, 768-dim (default for ollama/auto)
ollama pull qwen2.5:3b-instruct # chat: LLM extraction/reflection (default qwen2.5:7b, use 3b on small machines)
# 3. (Optional) Pin the providers explicitly — persist them in ~/.memvault/.env
# (shell exports also work — env vars take precedence over the file — but the file survives reboots)
mkdir -p ~/.memvault
cat >> ~/.memvault/.env <<'EOF'
MEMVAULT_EMBEDDING_PROVIDER=ollama
MEMVAULT_LLM_EXTRACTION_PROVIDER=ollama
MEMVAULT_LLM_EXTRACTION_MODEL=qwen2.5:3b-instruct
EOF
# 4. Verify
memvault-cli status # Embedding provider: configured and reachable
memvault-cli save --content "Build server IP is 10.20.30.40" # output (embedded int8)
memvault-cli outcome --task "Deploy trading service" --status failure --cause "Disk space insufficient" --task-type deploy
# → Lesson (Llm): ... means failure reflection ran through the local LLM (not the rule-based fallback)With no configuration at all (neither env vars nor ~/.memvault/.env), LLM extraction auto-detects a local Ollama and enables itself (default model qwen2.5:7b; pull it in advance with ollama pull qwen2.5:7b, or point MEMVAULT_LLM_EXTRACTION_MODEL at an installed model). Embeddings still default to the in-process native embedder; set MEMVAULT_EMBEDDING_PROVIDER=auto in ~/.memvault/.env to prefer Ollama and fall back to native when it isn't running. The native model's first launch downloads the weights from HuggingFace silently in the background — the server/dashboard come up immediately and hot-swap to semantic search once the download finishes, so a fresh install never blocks on it (set MEMVAULT_EMBEDDING_PROVIDER=none to run pure keyword and skip the download).
Related MCP server: GNB MemoryMCP
How It Works
MemVault is a pipeline, not a single script. Every stage below is a shipping module:
Agent connects (MCP stdio/SSE)
│
▼
┌───────────────────┐
│ Agent Router │ ← match agent type/tag → filter relevant memory
│ (Agent Registry) │
└────────┬──────────┘
│
▼
┌───────────────────┐
│ Memory Retrieval │ ← keyword (BM25) + vector (embedding) + RRF fusion
│ (3 search modes) │ synonym expansion · scoring · soft filtering
└────────┬──────────┘
│
▼
┌───────────────────┐
│ Auto-Injection │ ← MUST-level → instruction prompt
│ │ REFERENCE → context resource
│ │ NORMAL → search result
└────────┬──────────┘
│
▼
Agent receives context ──→ makes better decisionsStorage: SQLite with bundled FTS5 (full-text search); embeddings stored int8-quantized (~1/4 the size of f32 at near-identical ranking quality, legacy f32 rows still readable)
Retrieval: BM25 keyword search over FTS5 with CJK bigram tokenization (Chinese two-character words match correctly) and tiered match fallback (strict → relaxed unigram → synonym OR; relaxations are reported, never silent), local-first embedding (in-process native by default — switch to local Ollama or any OpenAI-compatible model), RRF fusion with per-result recall provenance (
kw#2/vec#5), synonym expansion, relevance scoring, soft intent filteringPipeline: Automatic entity extraction, delta-write on save (near-duplicates skipped, similar memories absorb only the residual), semantic deduplication, time-based decay, archive of stale memories
Sync: Zero-invasion file generation —
memvault-cli syncproduces CLAUDE.md, AGENTS.md, etc. directly from database contents
What MemVault Gives You
Auto-Injected Context: Session start automatically pulls relevant memory by agent identity — MUST-level rules land as instructions, not just chat history
Hybrid Retrieval: BM25 + vector + RRF fusion with synonym expansion, relevance scoring, and per-result provenance (which path recalled each memory, at what rank) — available via CLI, MCP tool, and REST API
Explainable Injection: every candidate dropped on the way into an agent's context is recorded with a reason (budget, caps, intent/type penalties) — "why didn't the agent get this memory?" always has an answer
MUST Enforcement: MUST-priority memories are never filtered or truncated. Always in context, always obeyed — trust comes from provenance (human-authored/reviewed), with an opt-in fallback for memories independently corroborated by multiple identity-verified agents (
MEMVAULT_CORROBORATION_GATE), so a single spoofed/compromised agent can't unilaterally inject a binding MUSTMulti-Agent Awareness: Agent Registry with type/tag-based soft filtering (score demotion, not hard exclusion)
agent_idIs Provenance, Not a Filter: retrieval never filters byagent_id— the field only records which agent wrote a memory (source_agent). Every agent searches the same shared corpus; per-agent differences apply only at injection time (type/tag soft scoring viaagents.yamlinject_rules)MCP Proxy: Transparent proxy that injects memory into ANY upstream MCP server's responses — zero client changes
Compliance Tracking:
inject_session_idtraces what was injected and measures follow-through rateCross-Platform: CLI + MCP Server (stdio & SSE) + Web Dashboard (browser) + Obsidian Plugin
Zero-Invasion Sync: Generate AGENTS.md / CLAUDE.md from memory — no per-agent config files to edit
Contextual Extraction, Local-First: Rule-based keyword extraction by default; optionally understands a full user+assistant exchange via an LLM, auto-detecting a local Ollama for free before ever touching a remote API
History & Rollback: Every update/delete is snapshotted into
memory_history—memvault-cli checkpoints+memvault-cli restoreroll one memory back without touching the restSelf-Diagnostics:
memvault-cli statusreports exactly which features are degraded when no embedding provider is configured, plus a schema fingerprint (migration version + checksum) for cross-database comparisonEpisodic Memory:
record_outcomerecords task results; failures are distilled into lessons and auto-injected next time (REFERENCE → MUST only with human approval), so the same trap isn't hit twiceProcedural Skill Activation: skills whose
triggermatches intent are injected as structured[SKILL]blocks with success-rate stats (shown after ≥3 runs); failures flag the skill for revision (version++on human edit), repeated successes auto-draft new skills into the review inboxSemantic Knowledge Links: lightweight relation triples, repeated facts consolidated into a linked semantic fact with provenance, and superseded facts archived (never re-injected, still listable & restorable)
Team Shared Pool & SOP Import: memories marked
sharedare injected into every session (capped at 20); Markdown SOPs can be batch-imported as verifiable skillsDelta-Write on Save: every save is checked against its namespace first — near-duplicates are skipped, similar memories absorb only the residual (what's genuinely new) and get their strength refreshed, so the library converges instead of accumulating near-copies;
--force/force_insertbypassesTask-Level Evaluation:
memvault-cli benchsamples your own failure history (episodes that distilled a lesson) and measures lesson retrieval/injection rates — and with--judge, an LLM scores "plan without vs. with memory" against the known failure cause, so you see task-success lift, not just retrieval recallTwo-Phase Injection (never blocks): MUST rules resolve deterministically with zero embedding calls and are served immediately; the semantic pipeline prefetches in the background and lands within a short window (250ms) — if it doesn't, the deterministic baseline is served and the request moves on (two-phase design)
Conversation-N-Gram Retrieval: retrieval keys are conditioned on the recent turn window, weighted by recency so the current focus dominates — not a single flat query
Single Canonical Injection Channel: per-agent
inject_channel(mcp/proxy/syncinagents.yaml) restricts automatic injection to one delivery path, so the same memory is never sent to the same agent twiceData You Own: Single SQLite file. Full export/import. No cloud dependency. Your data, your machine.
Why MemVault
Looking for a self-hosted alternative to Mem0, Zep, or Letta/MemGPT? Those are hosted APIs or Python frameworks tied to one SDK. MemVault ships as a single Rust binary with no hosted service and no vendor lock-in, speaks plain MCP instead of a proprietary SDK, and shares one memory store across every agent you run — Claude Code, Cursor, Claude Desktop, dsh — not just one.
Feature | Plain CLAUDE.md | Vector DB + RAG | MemVault |
Context injection | Manual edits | Query-time only | Auto on session start |
Multi-agent sharing | Copy-paste | Separate indexes | Single shared store |
MUST enforcement | None | None | Instruction-layer injection |
Search modes | File grep | Embedding only | BM25 + Vector + Hybrid |
Synonym expansion | No | No | Built-in |
Deduplication | No | No | Semantic dedup pipeline |
Write-time delta merge | No | No | Near-dupes skip, similar absorb the residual at save |
Task-level evaluation | None | Recall metrics only |
|
Decay / archival | No | No | Time-based + auto archive |
Memory extraction | Manual | N/A | Rule-based by default; optional local-first LLM extraction |
MCP native | No | No | stdio + SSE + Proxy |
Agent differentiation | Global file | Query filter | Type/tag registry |
Compliance tracking | None | None | inject_session_id + rate |
Self-hosted | Yes | Varies | Single binary, no cloud |
MemVault complements your existing agent setup rather than replacing it. Keep your LLM, your IDE, and your workflow exactly as they are. MemVault adds the memory layer underneath.
MCP Server
Tier-1 agents (Claude Code, OpenCode, dsh, Gemini CLI, Codex) have one-command plugin installs — see Installing into your agents first. Everything below is the universal fallback for any other MCP client.
stdio (any standard MCP client)
MemVault speaks plain MCP stdio — the same mcpServers JSON works verbatim in Claude Desktop, Cursor, Cline, Continue, and any other client that reads this format:
{
"mcpServers": {
"memvault": {
"command": "/path/to/memvault-mcp",
"args": ["--db", "~/.memvault/data.db"],
"env": { "OPENAI_API_KEY": "sk-..." }
}
}
}A couple of clients use their own one-liner instead of hand-editing JSON:
# Claude Code
claude mcp add memvault /path/to/memvault-mcp -- --db ~/.memvault/data.dbDeepSeek Harness (dsh) — a domestic (China) agent harness — gets deeper treatment than a generic stdio config: a native Cordis plugin (dsh-plugin/) that auto-injects memory into the system prompt and auto-extracts at turn end, with no per-turn cooperation required from the agent. See docs/INSTALL.md §2.5 for both the zero-code MCP route and the deep-integration plugin.
Other MCP-compatible agents — international or domestic, IDE plugin or CLI harness — should work the same way: any client implementing standard MCP stdio/SSE can connect without MemVault-side changes. The ones above are the ones we've actually verified; if you get MemVault working with another one, a PR to this list is welcome.
SSE (multi-client, network-accessible)
memvault-mcp --transport sse --port 3777
# Clients connect at http://127.0.0.1:3777/mcpSSE features: multi-client simultaneous connections, auto-triggered embedding backfill on initialization, HTTP remote access.
Note:
--transport sseonly mounts the MCP-over-HTTP endpoint (/mcp) — it does not expose the REST API (/api/*). The Web Dashboard is served by the REST backend (memvault-mcp --transport http --serve-web <dist>), and the Obsidian plugin also uses the REST API and requires--transport httpinstead. See docs/INSTALL.md §2.6.
20 MCP Tools
Tool | Description |
| Save with auto-embedding; delta-write by default (near-dupes skip, similar merge) — |
| Record a task outcome (episodic memory); failures reflect into lessons |
| Classify + record a task outcome from host-provided evidence (friction counts, terminal state) instead of a raw transcript — same rule-floor-plus-optional-LLM-judge logic as the Stop hook's |
| Import skills from a Markdown SOP (headings → skills, list items → steps) |
| Hybrid (default) / keyword / semantic; semantic modes fall back to keyword when embeddings are unavailable |
| Agent-aware context injection; honors the agent's |
| Approve / reject / edit; edit also works on already-approved memories, reject only applies to pending ones |
| Soft delete — removes the live row and cascaded evidence relations, restorable via CLI |
| Permanently erase one memory or a criteria-matched bulk set (GDPR-style, irreversible); |
| Structured extraction from text |
| Read-only deduplication scan (reports near-duplicates; does not merge/delete) |
| Decay + auto-archive; opt-in permanent auto-forget when |
| Mark read (increments |
| List memories pending human review; |
| Promote pipeline (L1→L2→L3), archive sources to L0 |
| Report follow/violate status for an injected session; bad items are skipped, so check the returned updated/total counts |
| Compliance rates per session or aggregate |
| Record evidence relations: supports / contradicts / sourced_from; identical relations are rejected rather than duplicated |
| Get the raw-evidence chain a memory was distilled from (its L0 trace rows) plus its evidence profile — read-only grounding, so an agent can quote the original session text and name its sources |
| Automatic effectiveness judgments for injected memories (useful/neutral/harmful/insufficient-context rates, judged from |
2 MCP Resources
URI | Content |
| MUST-level rules, auto-loaded on connect |
| REFERENCE-level project context |
Configuration (.env file & environment variables)
Copy .env.example to ~/.memvault/.env and uncomment what you need — it is also the single source of truth documenting every key.
Precedence (high → low): CLI flags > process environment > ~/.memvault/.env > built-in defaults. Every binary loads the env file first thing at startup; --env-file <path> or MEMVAULT_ENV_FILE points elsewhere, and a missing file is silently skipped. memvault-cli status prints where each setting came from (env / file / default).
Two groups are intentionally not in the table below: the host installation contract (MEMVAULT_AGENT_ID, MEMVAULT_HOOK_EXTRACT, … — per-agent values authored in each host's plugin/mcpServers config), and the proxy's upstreams topology (structured data, lives in ~/.memvault/proxy.yaml).
Variable | Purpose | Default |
| Provider: |
|
| API key for remote providers (not needed for local Ollama); the default | (not needed — |
| Any OpenAI-compatible base URL (OpenAI / Azure / vLLM / gateway...). For |
|
| Embedding model: |
|
| Vector dimensions |
|
| Optional: enables LLM-based contextual memory extraction (understands a full user+assistant exchange, not just keyword lines). Unset/ | (unset — local-first, rule-based if no local Ollama) |
| Chat-completions endpoint config for LLM extraction | local: |
| Opt-in LLM relation extraction: | (unset / false) |
| Delta-write on save: dedup within the same namespace first — near-duplicates skipped, similar memories absorb the residual. | true |
| How many recent observed turns build the recency-weighted retrieval key used by proxy auto-injection |
|
| Minimum friction score (tool retries, rejected tool calls, mid-session corrections) a Stop-hook-triggered |
|
| Minimum friction score for a Stop-hook |
|
| Minimum LLM-judge confidence to accept its |
|
| Set to | (off) |
| Record whether a | true |
| Opt-in MUST trust path: a MUST memory independently corroborated by enough distinct identity-verified agents (see | false |
| Minimum distinct identity-verified agents required for the corroboration gate above |
|
| Opt-in stricter injection gate: by default an unreviewed MUST memory is still injected, tagged | false |
| SQLite connection pool size |
|
| Comma-separated allowed CORS origins for REST (unset = localhost only) | (localhost only) |
| Seconds |
|
| Path-list ( | — |
| Background auto-forget: permanently purge memories archived longer than the retention window (irreversible, unlike decay's reversible archiving) |
|
| Archived-retention window (days) for the auto-forget sweep |
|
| Protect MUST memories from forget unless the caller explicitly overrides ( |
|
| Exclude shared-visibility memories from the auto sweep (manual/bulk forget can still purge them) |
|
| SQLite database path |
|
| Storage backend: |
|
| markdown-backend data directory (also | — (markdown mode only) |
| Log verbosity |
|
| Base directory: where |
|
| Path to the env file ( |
|
| HuggingFace endpoint override for native model downloads (e.g. | (HuggingFace default) |
| Proxy-path contextual extraction of agent-produced text: on by default but saved downgraded ( | (on — downgraded) |
CLI Reference
save · outcome · search · list · review · delete · session-start · resource · extract · dedup · decay · forget · forget-log · doctor · promote · backup · export · export-skill · import · import-skills · import-agent · ingest · confirm-read · backfill-embeddings · sync · reindex · migrate-to-markdown · checkpoints · restore · supersede · status · bench · eval-history · server start|status|stop · dashboard
memvault-cli <command> --help # detailed usage per commandKey Commands
Command | What It Does |
| Save a memory with priority, type, optional instruction. Delta-write by default: near-duplicates are skipped, similar memories absorb the residual; |
| Record a task result (success/failure/partial); failures are distilled into lessons that auto-inject into similar future tasks |
| Hybrid retrieval with relevance scoring; flags: |
| Simulate what context an agent receives on connect; a multi-line |
| Parse free text, extract structured memories |
| Import skills from a Markdown SOP ( |
| Cold-start import from another agent's native memory files: Claude Code/Desktop ( |
| Incrementally ingest agent session transcripts (Claude Code / Codex / Hermes) into memory: turns with extractable signal are kept as L0 evidence rows, and their extracted candidates carry |
| Generate agent instruction files (AGENTS.md / CLAUDE.md / MEMORY-INDEX.md, …) from memory (with |
| Scan and merge semantically duplicate memories (vector-assisted when an embedding provider is configured) |
| List memory history snapshots (per-memory or global); flags: |
| Revert a memory to the state captured by a checkpoint ( |
| Archive an old fact and point it at its replacement (nothing is deleted; search skips superseded, list keeps them) |
| Show embedding provider readiness (distinguishes not-configured / explicitly-disabled / configured-but-unavailable) and which features degrade without it |
| Ensure the local REST backend is running (spawns |
| Manage that same backend: idempotent start (health-probes first, auto-moves to the next free port when 3777 is taken by a foreign process), status, and stop. Prints the active URL (with |
| Read-only memory hygiene lint: dangling/stale/duplicate/contradicted + machine-readable |
| Task-level memory benchmark: samples your own outcome history, measures lesson retrieval/injection rates; |
| Trend-over-time view of past |
| Archive stale memories based on access recency |
| Create a consistent point-in-time SQLite backup |
| Backup and restore — JSON to a file or a directory (writes |
| Mark memories as read (updates access_count) |
Integrations
Installing into your agents
MemVault ships native adapters for most agents — one shared store, per-host identity via MEMVAULT_AGENT_ID, four tiers (Tier 1/2/3 details below; per-client registration snippets in integrations/mcp-clients/).
Core packages & versions:
Package | Version | Install / Source |
| 0.6.9 | library dependency |
| 0.6.9 |
|
| 0.6.9 | npm registry (dsh Cordis plugin, below) |
Shipped plugins & versions — each bumps on its own schedule:
Plugin | Version | Distributed via |
Claude Code / Codex plugin bundle ( | 0.6.9 |
|
Gemini CLI extension ( | 0.6.9 |
|
Qoder plugin ( | 0.6.9 | in-repo manifest |
Obsidian plugin ( | 0.3.6 |
|
dsh Cordis plugin ( | 0.6.9 |
Tier 1 — one-command native plugins (memory injected by hooks; extraction opt-in where the host exposes lifecycle hooks):
Agent | Install | Recall | Extract |
Claude Code |
| ✅ SessionStart hook | ✅ Stop hook, enable with |
OpenCode | merge | ✅ system transform | ✅ on |
DeepSeek Harness (dsh) | built-in Cordis plugin | ✅ system prompt | ✅ turn-end |
Gemini CLI / Antigravity |
| ⚠️ rule context + tools | ❌ |
Codex CLI |
| ✅ SessionStart hook — approve the bundled hook once in | ✅ Stop hook — approve in |
⚠️ = the host has no injection hooks; recall is rule-driven (the agent calls session_start once) with the bundled canonical rule text.
Tier 2 — paste an MCP snippet. Strict-JSON registrations with per-host identities in integrations/mcp-clients/ (target paths in its README): Cursor · Windsurf · Cline/Roo · Continue · Zed · JetBrains AI/Junie · VS Code (Copilot Chat) · Claude Desktop.
Tier 3 — native manifests, verify-on-install. Qoder (.qoder/rules/ + .qoder-plugin/ + a UserPromptSubmit hook template), Grok Build (grok plugin install dreamor/memvault --trust), the Hermes Python plugin (integrations/hermes/, pre_llm_call recall + extraction helper) and the pi extension (pi-extension/, pi install git:github.com/dreamor/memvault) ship in-repo; OpenClaw and Swival consume the generated root skills/ (also exported to .openclaw/skills/); Devin stays a manual recipe in integrations/README.md.
Tier 4 — instruction-only rule copies. Canonical text + scripts/gen-rule-copies.sh (parity-checked in CI) produce AGENTS.md/CLAUDE.md blocks, .cursor/rules/, .clinerules/, .kiro/steering/, Junie guidelines; memvault-cli sync --watch keeps them fresh from the store.
Any other MCP-speaking client (domestic or international, IDE plugin or CLI harness) connects with zero MemVault-side changes via the standard stdio config below — not individually verified; PRs adding a verified entry are welcome.
GUI surfaces are independent of agent installs: Web Dashboard (9 tabs) · Obsidian plugin (α — Vault sync + browse/capture) · MCP Proxy (transparent memory injection for any upstream server).
Architecture
┌────────────────────────────────────────────────┐
│ Clients (any MCP-compatible agent) │
│ ┌────────────┐ ┌────────┐ ┌─────┐ ┌────────┐ │
│ │ Claude Code│ │ Cursor │ │ dsh │ │ Others │ │
│ └────────────┘ └────────┘ └─────┘ └────────┘ │
└──────────────────┬───────────────────────────────┘
│ MCP (stdio / SSE / HTTP)
┌──────────────────▼───────────────────────────────┐
│ memvault-mcp (rmcp 3.1.1) │
│ ┌──────────────┐ ┌────────────────┐ ┌────────┐ │
│ │ 20 tools │ │ 2 Resources │ │ SSE │ │
│ │ + REST API │ │ + Auto-Inject │ │ Server │ │
│ └──────┬───────┘ └──────┬─────────┘ └────────┘ │
│ └────────┬───────┘ │
│ ┌───▼────────┐ │
│ │ Agent │ (Agent Registry │
│ │ Router │ type/tag filter) │
│ └───┬────────┘ │
├──────────────────┼────────────────────────────────┤
│ memvault-core │ │
│ ┌──────────┐ ┌─▼───────┐ ┌────────────┐ ┌───┐ │
│ │ storage │ │retrieval│ │ pipeline │ │sync│ │
│ │ SQLite │ │BM25+Vec │ │extractor │ │ │ │
│ │ │ │RRF+syn │ │dedup/decay │ │ │ │
│ │embed │ │onym │ │export/ │ │ │ │
│ │backfill │ │scoring │ │import │ │ │ │
│ └──────────┘ └─────────┘ └────────────┘ └───┘ │
└────────────────────────────────────────────────┘Project Status
MemVault is in beta. The Rust core (storage / search / injection) is CI-gated and stable; plugin adapters and GUI surfaces evolve faster. All configuration is environment-driven (see .env.example), and every change is recorded in CHANGELOG.md.
Testing
cargo test # ~1300 tests (full workspace)
cargo clippy --all-targets # zero warnings
cargo fmt --all -- --check # format check
cargo llvm-cov --workspace --all-features # CI gate: line ≥92% / region ≥90% / function ≥85%Documentation
Doc | Content |
Product & architecture design | |
Installation guide (all platforms) | |
Agent-facing install guide — the target of the one-prompt Quick Start (install → register as MCP → verify recall) | |
Docker deployment | |
Deployment / health check / rollback runbook | |
Symptom → cause → fix troubleshooting guide | |
Hypothesis-validation experiments (H1–H7, 2026-08-11 → 2026-08-27, all CONFIRMED) + runtime plumbing regression (2026-08-28) | |
Release process — what CI automates (Linux/macOS binaries, Docker image, dashboard archive, Obsidian zip) vs. manual steps (Obsidian submission — no macOS signing needed) | |
Distribution channel map — automated vs. manual channels, required credentials, MCP registries, optional channels | |
Release history | |
Contribution guide | |
Security disclosures | |
Accessibility statement — commitment, supported environments, known limitations, how to report a barrier | |
Configuration template — single source of truth for every config key |
Contributing
🐛 Bugs: Issue Tracker
💡 Ideas: Feature Request
📖 Guide: CONTRIBUTING.md
🔒 Security: SECURITY.md
♿ Accessibility: ACCESSIBILITY.md
License
MemVault is released under the MIT License.
Available Tools
20 toolsadd_evidenceA
Record evidence for a memory. relation="supports"/"contradicts" links evidence_id → memory_id (a memory supporting or contradicting it); relation="sourced_from" records memory_id's external provenance via source (URL/document). Contradictions accelerate the contradicted memory's decay; superseded or archived evidence stops counting.
| Name | Required | Description | Default |
|---|---|---|---|
| source | No | External source: URL, document path, conversation reference (required for sourced_from). | |
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| agent_id | No | ID of the requesting agent | unknown |
| relation | Yes | Evidence relation: "supports" | "contradicts" | "sourced_from". supports/contradicts link two memories (`evidence_id` = the memory providing evidence); sourced_from records an external source text. | |
| memory_id | Yes | The memory this evidence statement is ABOUT, or that the subject memory supports/contradicts — see `relation` for direction. For supports/contradicts: the memory being supported/contradicted. For sourced_from: the memory whose provenance is recorded. | |
| confidence | No | Evidence confidence, 0.0-1.0 (default 0.8). | |
| evidence_id | No | The memory providing evidence (required for supports/contradicts). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral-disclosure burden. It usefully states that contradictions accelerate the contradicted memory's decay and that superseded or archived evidence stops counting, but it omits authentication requirements, idempotency, reversibility of added evidence, and expected response behavior. The decay/counting effects are valuable, but the disclosure is not complete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core action and then efficiently covers relation semantics and behavioral effects. Every sentence adds useful information, with no filler or redundant restatement of the tool name. It is appropriately sized for a multi-relation evidence tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 7-parameter tool with no annotations and no output schema, the description covers the core relation semantics and important decay behavior. It still leaves out authentication handling, agent identity expectations, confidence defaults, and what a successful call returns or changes. It is adequate but not fully complete for the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all seven parameters, including relation direction and source requirements. The description reinforces the relation semantics and clarifies that evidence_id points from evidence to memory, but it largely repeats schema-level information rather than adding substantial new parameter meaning. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Record evidence for a memory.' It also explains the three relation modes, so an agent can understand what the tool does without opening the schema. It does not explicitly differentiate this tool from sibling tools such as get_memory_evidence or review_memory, which keeps it from a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives relation-specific usage: supports/contradicts link two memories, while sourced_from records external provenance via source. However, it does not say when to choose add_evidence over related sibling tools like get_memory_evidence, review_memory, or save_memory. Usage is implied by the relation modes but not fully guided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
confirm_readB
Confirm that one or more memories have been read by the agent. Updates access_count and last_read_at for the specified memory IDs.
| Name | Required | Description | Default |
|---|---|---|---|
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| agent_id | No | ID of the requesting agent | unknown |
| memory_ids | Yes | List of memory IDs to confirm as read |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden; it does usefully disclose the exact side effect (access_count and last_read_at updated). It omits idempotency, behavior for unknown memory IDs, and whether the counters feed ranking, decay, or promotion logic – meaningful gaps for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, both earning their place, with the action front-loaded and the side effect second. No filler, though there is no structure beyond the two sentences.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a no-annotation mutation with no output schema, the definition covers the action and its effects but leaves out return value, error behavior for invalid IDs, and any prerequisite linking to an actual read. Adequate but with clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so all three parameters (including api_key authentication and agent_id) are already documented in the schema; baseline 3 applies. The description only restates that memory_ids accepts one or more values, adding no new semantics such as deduplication or batching limits.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Uses a specific verb+resource ('Confirm that one or more memories have been read') and immediately names the mutated state ('Updates access_count and last_read_at'). It does not differentiate itself from plausible siblings like review_memory or search_memory, which also touch the read/evidence lifecycle.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: an agent can infer it should call this after actually reading memories, but the description never says when to call it, when not to, or whether search_memory / review_memory already implies the same bookkeeping. No alternatives are named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_memoryC
Delete a memory by its ID.
| Name | Required | Description | Default |
|---|---|---|---|
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| agent_id | No | ID of the requesting agent | unknown |
| memory_id | Yes | ID of the memory to delete |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does not meet it: it never says whether deletion is permanent, irreversible, or soft, whether related evidence is cascaded, or whether agent-level permissions are checked. 'Delete' signals mutation, but an agent gets no confirmation of consequences before an irreversible call.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero wasted words. It is efficient, though the terseness edges toward under-specification rather than genuine clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, unannotated tool with no output schema, the description should disclose return behavior and irreversibility. It supplies neither, so an agent cannot judge risk or expected result from the definition alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so memory_id, agent_id, and api_key are already documented in the schema. The description only restates the memory_id requirement and adds no semantics about authentication behavior or what an auto-filled agent_id implies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
A specific verb (delete) and resource (memory) with the key identifier named, so the agent knows exactly what the tool acts on. However, it does nothing to distinguish itself from the semantically overlapping sibling forget_memory, leaving the agent to guess which one performs the deletion.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No statement of when to use this versus forget_memory, run_decay, or run_dedup, all of which remove or alter memories. There are also no stated preconditions such as required confirmation via confirm_read.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
extract_memoriesA
Extract structured memories from conversation text. mode="rule" (default) detects preferences, facts, and skills via keyword pattern matching. mode="llm" instead understands the full context (optionally pairing assistant_text) semantically — uses the configured LLM extraction provider, and degrades to rule-based extraction (reported via fallback_used/fallback_reason) when no provider is configured or the LLM call fails. Returns extracted items; optionally saves them.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | Extraction mode: "rule" (default, keyword pattern matching) or "llm" (semantic extraction over the full context; uses the configured LLM extraction provider, falling back to rule-based when none is configured or the LLM call fails — see fallback_used in the result). | |
| text | Yes | Text to extract memories from (conversation content, e.g. the user's turn) | |
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| agent_id | No | Agent ID to attribute saved memories to | unknown |
| auto_save | No | Whether to auto-save extracted memories | |
| occurred_at | No | When the extracted facts actually happened in the source conversation (RFC 3339), stored as `occurred_at` on saved memories — distinct from `created_at` (ingestion time). Invalid input is an error, never a silent drop. | |
| assistant_text | No | Optional paired assistant/response text for mode="llm" — passing both sides of the exchange lets the model resolve references and implicit preferences a single text can't. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries disclosure itself and does well: it explains the LLM-to-rule fallback and that it surfaces via fallback_used/fallback_reason, notes that saving is optional, and flags invalid occurred_at as a hard error. It still omits auth expectations and the response shape beyond 'extracted items.'
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action, then mode behavior, then return/save semantics. Dense but every clause carries information, though the long parenthetical in the second sentence is somewhat heavy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a seven-parameter tool with no output schema, the description covers the key decision (which mode), the failure path, and whether memories are persisted. Auth requirements are left thinly covered relative to the surrounding complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so all seven parameters are already documented in the schema, including the mode semantics the description repeats. The description adds little meaning beyond that, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Extract structured memories from conversation text,' which separates it from sibling persistence tools like save_memory and search_memory. It doesn't explicitly name those siblings as alternatives, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear selection guidance between the two modes: 'rule' is the default keyword-based path, while 'llm' is for semantic understanding of full context. It also explains when assistant_text helps. It stops short of saying when not to use the tool versus siblings such as save_memory or search_memory.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
forget_memoryA
Permanently erase (GDPR-style) one memory by id or a bulk set matched by criteria (namespace/namespace_prefix/source_agent_id/tag/memory_type/before_days). Unlike delete_memory, this also purges memory_history snapshots and any orphaned compliance rows, leaving only a content-hash audit entry in the forgotten-log — irreversible. dry_run defaults to true: call once to preview, then again with dry_run=false to execute. Priority::Must memories are excluded unless allow_must=true. Gated by the same per-agent API-key auth as delete_memory — there is no separate admin tier at the MCP layer.
| Name | Required | Description | Default |
|---|---|---|---|
| tag | No | Bulk: memories carrying this tag | |
| reason | No | Audit-trail reason recorded in the forgotten-log | |
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| dry_run | No | Preview matches without purging anything (default: true — forgetting is irreversible, so a caller must explicitly set this to false to execute) | |
| agent_id | No | ID of the requesting agent | unknown |
| memory_id | No | ID of a single memory to permanently erase. Mutually exclusive with the criteria fields below — when set, every criteria field is ignored. | |
| namespace | No | Bulk: exact namespace match | |
| allow_must | No | Explicit override to include Priority::Must memories (otherwise excluded by default) | |
| before_days | No | Bulk: not updated in this many days | |
| memory_type | No | Bulk: memory type (preference, fact, episode, entity, skill) | |
| source_agent_id | No | Bulk: source agent id | |
| namespace_prefix | No | Bulk: namespace starts with this (e.g. "archived:") |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full burden and does: irreversible, purges memory_history snapshots and orphaned compliance rows, leaves only a content-hash audit entry, gated by per-agent API-key auth with no separate admin tier. It also warns that Priority::Must rows are silently excluded unless overridden — exactly the destructive semantics an agent must know before calling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single dense paragraph that front-loads the destructive action, then scope, then the dry_run safety workflow, then the auth and exclusion caveats. Every sentence conveys a constraint an agent would otherwise have to guess; nothing is repeated from the schema verbatim.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 12-parameter destructive tool with no annotations and no output schema, the description covers irreversibility, retention behavior, auth, defaults, and exclusion rules — everything needed to invoke it safely. Return-value detail is unnecessary given the tool's audit-log framing and the dry_run preview path.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds operational meaning beyond the field docs: the preview-then-execute pattern for dry_run, the memory_id-vs-criteria precedence, and the allow_must gate. Only the reason/agent_id/api_key parameters get no narrative treatment, keeping it short of a 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Permanently erase ... one memory by id or a bulk set matched by criteria') and enumerates the criteria dimensions inline, so the scope is unambiguous. It explicitly contrasts with the sibling delete_memory, letting an agent distinguish the two without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use rules: single id vs bulk criteria, the two-call dry_run workflow ('call once to preview, then again with dry_run=false'), and the Priority::Must exclusion plus the allow_must override. It also names the alternative (delete_memory) and the condition that would select it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_compliance_reportB
Get compliance report for injection sessions. Shows follow/violation rates for MUST memories. Provide inject_session_id for a specific session, or omit for an aggregate summary.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| agent_id | No | Filter aggregate summary by agent | |
| inject_session_id | No | Get report for a specific injection session |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full burden. It does disclose the return content (follow/violation rates for MUST memories) and implies a read-only operation, but says nothing about permissions, pagination behavior from the limit parameter, or how the aggregate differs in shape from a session report.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with purpose before the mode-selection rule, with no filler. It could be slightly tighter by folding the return-content clause into the first sentence, but nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations and no output schema, the description should ideally explain the read-only nature, the shape of the two report modes, and the role of limit. It covers purpose and mode selection adequately but leaves the pagination parameter and the aggregate-vs-session output distinction unexplained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 67%; agent_id and inject_session_id are documented in the schema, while limit has no description anywhere. The description reinforces the inject_session_id semantics but adds nothing for limit or for how agent_id interacts with the aggregate mode, so it does not compensate for the gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb+resource (get compliance report) and scopes it to injection sessions, adding that it shows follow/violation rates for MUST memories. That is clear enough to act on, but it never distinguishes itself from the sibling 'report_compliance' or 'get_effectiveness_report', which an agent could easily confuse with this tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The second sentence gives a genuine decision rule between the two modes: supply inject_session_id for a single session, omit it for an aggregate. However, there is no guidance on when to reach for this tool versus report_compliance or get_effectiveness_report, so sibling selection is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_effectiveness_reportA
Get automatic effectiveness judgments for injected memories: useful/neutral/harmful/insufficient_context rates, judged automatically from record_outcome — independent of manual report_compliance.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| agent_id | No | Filter by agent |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It usefully discloses that judgments are computed automatically from record_outcome and are separate from manual compliance, but it omits read-only confirmation, permissions, pagination/ordering, time range, and response structure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One front-loaded sentence gives the verb, resource, rate categories, source, and contrast. Every clause adds selection-relevant information and there is no padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The core computation and rate categories are covered, which is the key need for this report. However, with no annotations and no output schema, the description leaves gaps around read-only behavior, parameter effects, time scope, and response shape.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 50%: agent_id is described in the schema, but limit is not. The description mentions neither parameter and does not compensate for the undocumented limit or clarify filtering behavior, so parameter meaning relies almost entirely on the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Get automatic effectiveness judgments for injected memories', and enumerates the four rate categories. It explicitly contrasts with manual report_compliance, so an agent can distinguish it from siblings like get_compliance_report and report_compliance.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description establishes clear usage context: automatic effectiveness derived from record_outcome, independent of manual report_compliance. It does not spell out explicit when-not conditions or directly route the agent to get_compliance_report for manual checks, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_memory_evidenceA
Get the raw-evidence chain a memory was distilled from (its L0 trace rows), plus its evidence profile. Read-only grounding: lets an agent quote the original session text and name its sources.
| Name | Required | Description | Default |
|---|---|---|---|
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| agent_id | No | ID of the requesting agent | unknown |
| memory_id | Yes | The memory whose raw-evidence chain (L0 trace rows) to expand |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description still discloses the key behavioral fact that this is a read-only grounding operation returning raw trace rows plus an evidence profile. It does not cover what happens when evidence has been pruned or is absent, ordering/limits of the returned chain, or that authentication may be required.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with what is returned, followed by why it matters. No filler, no repetition of the tool name or schema details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
It names the returned artifacts (L0 trace rows, evidence profile), which compensates for the missing output schema. However, for a read tool with zero annotation coverage, gaps around emptiness/pruning behavior and result size remain unexplored.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so memory_id and its meaning are already documented; the description restates the L0 trace expansion but adds no format, ID-shape, or error semantics. Baseline 3 applies when the schema carries the parameter burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: retrieving the raw-evidence chain (L0 trace rows) and evidence profile for a given memory. The 'distilled from' framing makes the retrieval direction clear, so it is distinguishable from write-side siblings like add_evidence, though no sibling is named explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Read-only grounding: lets an agent quote the original session text and name its sources' implies the use case (citation/provenance checks), but there is no explicit when-not guidance and no alternative tool named for related needs such as review_memory or add_evidence.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
import_skillsA
Import skills from a Markdown SOP document. Each #/## heading becomes a skill (trigger:/verification: metadata lines + list-item steps). Sections without steps are skipped. Imported skills enter the review inbox unless approve=true.
| Name | Required | Description | Default |
|---|---|---|---|
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| approve | No | Mark imported skills as human-reviewed (skip the inbox). Default false. | |
| agent_id | No | ID of the requesting agent | unknown |
| markdown | Yes | Markdown SOP text. Each #/## heading becomes a skill; `trigger:` / `verification:` lines and list items become the skill metadata. | |
| namespace | No | Namespace for the imported skills. | global |
| fallback_title | No | Fallback skill title when the document has no headings. | imported-sop |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does substantial work: it discloses the heading-to-skill mapping, that sections without steps are skipped, and that imports default into the review inbox unless approve=true. It omits auth requirements, idempotency/dedup behavior, and what is returned, which prevents a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four tight sentences: purpose first, then parsing rules, then the default review-inbox behavior. Every sentence carries information and nothing is padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations and no output schema, the description covers the core mechanics (what is created, what is skipped, default review state) adequately. It leaves gaps around authentication expectations and duplicate handling, but the schema covers parameter-level detail.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all six parameters are already documented in the schema; the description mostly restates the markdown and approve semantics. It adds a little framing about heading structure but no syntax detail beyond what the schema provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Import') and resource ('skills from a Markdown SOP document') plus the parsing rule, so an agent can tell this apart from single-item tools like save_memory. It does not explicitly name a sibling or alternative, which keeps it from a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied by 'from a Markdown SOP document' — there is no explicit when-to-use/when-not guidance and no mention of alternatives such as save_memory or extract_memories. The approve=true note is behavioral, not a usage condition.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
infer_outcomeA
Classify and record a task outcome from host-provided evidence rather than raw transcript text — for hosts whose event model doesn't produce a Claude-Code-shaped JSONL transcript (e.g. dsh/Cordis session events). Pass pre-computed friction counts and terminal state in evidence; this runs the same rule-floor-plus-optional-LLM-judge classification as the Claude Code Stop hook's outcome --infer, then records exactly like record_outcome. Returns status 'skipped' (not an error) when nothing was inferred — a clean session, below the friction threshold, or no task evidence at all.
| Name | Required | Description | Default |
|---|---|---|---|
| tags | No | Tags for categorization — "auto-inferred" and "inferred:rule"/"inferred:llm" are added automatically | |
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| agent_id | No | ID of the agent reporting this outcome | unknown |
| evidence | Yes | Structural evidence computed by the caller from its own event stream | |
| namespace | No | Namespace for the episode memory (default: global) | global |
| agent_type | No | Type of the agent (e.g., coding-assistant) | general-assistant |
| session_id | No | Session the task ran in, for traceability | |
| judge_context | No | Conversation excerpt handed to the LLM judge, if one is configured (DATA to analyze, not instructions). Optional — when empty, only the rule-based floor runs. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden and does well: it discloses the two-stage classification (rule floor plus optional LLM judge), the write side effect (records an episode like record_outcome), and the non-error 'skipped' outcome with three concrete skip conditions. It omits permission/auth requirements (an api_key parameter exists) and any duplicate/idempotency behavior, which keeps it short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The differentiator (evidence instead of transcript) is front-loaded in the first clause, and the skip semantics land at the end where they matter. It is dense and slightly overloaded with the 'rule-floor-plus-optional-LLM-judge ... as the Claude Code Stop hook's outcome --infer' clause, but no sentence is filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 8-parameter, no-annotation, no-output-schema tool, the description covers what an agent needs: when to choose it, how evidence is constructed, what classification runs, that recording happens, and that 'skipped' is not a failure. Return-shape detail is unnecessary since the key return value (status 'skipped') is stated inline.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description still adds value by telling the caller what to put in `evidence` (pre-computed friction counts and terminal state) and by naming `judge_context`-style judge behavior, clarifying that the judge is optional and only the rule floor runs when no context is supplied.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb pair (classify and record) on a specific resource (task outcome) and immediately scopes the input source: host-provided evidence rather than raw transcript text. It explicitly positions itself against record_outcome ('records exactly like record_outcome') and against the Claude Code Stop hook path, so an agent can distinguish it from siblings without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a clear selection condition — use this for hosts whose event model doesn't produce a Claude-Code-shaped JSONL transcript (e.g. dsh/Cordis session events). It references the alternative paths (transcript-based Stop hook, record_outcome) but never states the inverse rule explicitly, e.g. 'if you do have a transcript, use record_outcome instead.' Clear context, no formal exclusion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_inboxB
List memories pending human review. Shows memories that have not been reviewed yet, sorted by created_at ascending (oldest first).
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results to return | |
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| agent_id | No | ID of the requesting agent | unknown |
| namespace | No | Filter by namespace |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose one genuinely useful behavioral trait: the results are sorted by created_at ascending (oldest first). However, it says nothing about permissions/authentication (the api_key param implies auth is needed), pagination behavior, whether limit truncates silently, or whether this is purely read-only.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core purpose, with the sort-order detail appended where it is most useful. No filler or restatement of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no annotations and no output schema, the description covers what is listed and in what order but omits the review workflow that gives the tool meaning, plus filtering/paging semantics. It is adequate to call the tool, but a thin basis for using it correctly in a multi-step flow.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so limit, api_key, agent_id, and namespace are all documented in the schema itself. The description adds no parameter-level meaning (e.g., that namespace narrows the inbox or how limit interacts with sort order), so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description pairs a specific verb (list) with a precisely scoped resource (memories pending human review) and further clarifies 'not been reviewed yet', making the operation unambiguous. It does not explicitly contrast itself with siblings like search_memory or review_memory, which is the only thing separating it from a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to call this versus search_memory (which also returns memories) or when to follow up with review_memory. The sentence 'Shows memories that have not been reviewed yet' defines the contents rather than prescribing usage, so the agent must infer the review-workflow context itself.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
record_outcomeA
Record the outcome of a task you just executed (episodic memory). Call this after finishing a task so past successes and failures can inform future sessions. Status must be 'success', 'failure', or 'partial'. Failures with a cause are reflected into lessons that get injected into similar future tasks.
| Name | Required | Description | Default |
|---|---|---|---|
| tags | No | Tags for categorization | |
| task | Yes | What task was executed (kept verbatim for retrieval) | |
| cause | No | Attribution of the outcome, when known | |
| status | Yes | Outcome status: success, failure, or partial | |
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| agent_id | No | ID of the agent reporting this outcome | unknown |
| skill_id | No | ID of the skill memory the agent followed, if any — attributes this outcome to the skill's success/failure statistics | |
| namespace | No | Namespace for the episode memory (default: global) | global |
| task_type | No | Coarse task category for lesson matching (e.g. deploy, debug, refactor) | |
| agent_type | No | Type of the agent (e.g., coding-assistant) | general-assistant |
| session_id | No | Session the task ran in, for traceability |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose a non-obvious downstream effect: failures with a cause are 'reflected into lessons that get injected into similar future tasks.' It also enumerates the allowed status values. It omits auth expectations, idempotency/duplicate behavior, and what a call returns, leaving real gaps for an 11-parameter write tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences, front-loaded with the action and followed by the trigger and the consequence. Every sentence carries information; there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Purpose and the key side effect are covered, and the schema fully documents all 11 parameters. However, with no output schema and no annotations, the description should say what a successful call returns and whether there are authentication or de-duplication considerations — especially since api_key and session_id parameters imply behavioral constraints that go unmentioned.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents all parameters in detail. The description adds a little meaning by implying that the 'cause' field is what triggers lesson reflection and that status is constrained to three values, but this largely restates the schema descriptions. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Record the outcome of a task') and names the memory type (episodic memory). It is distinguishable in practice from siblings like save_memory or infer_outcome, but it never explicitly contrasts itself with them, so it falls short of the top mark.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a clear trigger: 'Call this after finishing a task.' It explains the payoff (past successes and failures inform future sessions) but offers no when-not guidance or explicit alternative (e.g., infer_outcome), so it is clear context without exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
report_complianceB
Report compliance for a previous injection session. Call this to indicate which injected memories you followed or violated.
| Name | Required | Description | Default |
|---|---|---|---|
| reports | Yes | List of compliance reports, one per memory | |
| inject_session_id | Yes | The inject_session_id from a previous session_start call |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full disclosure burden, yet it says nothing about side effects, whether reports can be amended or resubmitted, whether partial reporting (a subset of injected memories) is allowed, or what the call returns. The only behavioral clue is the implicit prerequisite of a prior session_start, mostly conveyed by the schema rather than the description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, purpose front-loaded, zero filler. Nothing to trim and nothing buried.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 2-parameter, 100%-covered schema the description is minimally sufficient, but with no output schema and no annotations it leaves open what the report produces and whether/how the session's compliance state changes as a result. An agent knows what to send but not what to expect back or whether a repeat call is safe.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%: inject_session_id's origin and the status values (followed/violated/unknown) are fully documented in the schema. The description adds only a gloss ('one per memory' is implied by 'which injected memories'), so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: report compliance for a previous injection session, and clarifies the payload is 'which injected memories you followed or violated'. An agent can distinguish it from the read-side sibling get_compliance_report by the verb alone, but the description never names that sibling or otherwise explicitly contrasts the two.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Call this to indicate which injected memories you followed or violated' implies the trigger condition (after memories have been injected), and the schema notes inject_session_id comes from a prior session_start call. However, it gives no explicit when-not guidance, no mention of how often to report, and does not name get_compliance_report as the read alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
review_memoryB
Review a pending memory: approve it, reject it, or edit its content. Approved memories get higher priority in future injections.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action: approve, reject, or edit | |
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| agent_id | No | ID of the requesting agent | unknown |
| memory_id | Yes | ID of the memory to review | |
| edited_content | No | New content if action is edit | |
| edited_instruction | No | New instruction if action is edit |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral disclosure burden. It usefully states that approved memories get higher priority in future injections, but it omits important traits such as permissions/auth requirements, whether reject deletes or just excludes the memory, and what edit requires.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences with no wasted words. The core purpose and available actions are front-loaded, followed by a useful behavioral consequence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The schema covers all parameters and there is no output schema to explain. Still, for a review/mutation tool with no annotations, the description is a bit thin: it does not clarify the effects of reject or edit, or authentication expectations beyond what the schema says.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all six parameters. The description aligns with the action values and mentions editing content, but adds little beyond the schema, especially about conditional fields like edited_content and edited_instruction when action is edit.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Review a pending memory') and enumerates the three supported actions. It is clear on its own, but it does not explicitly distinguish this tool from nearby siblings such as list_inbox, delete_memory, or save_memory.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'pending memory' implies the usage context, and the actions approve/reject/edit clarify the review workflow. However, it gives no explicit guidance on when to choose this over alternatives or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_decayB
Run memory decay cycle. Reduces decay_score for old memories, archives memories below threshold. MUST memories are exempt.
| Name | Required | Description | Default |
|---|---|---|---|
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| agent_id | No | ID of the requesting agent | unknown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations at all, the description carries the full behavioral burden, and it does disclose the key trait: this tool archives (i.e. removes from active use) memories below a threshold, which is destructive-adjacent. It also discloses the MUST exemption. However, it omits whether the operation is reversible, whether it is global or scoped to the calling agent, and what happens to the api_key-only authentication path.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the action and followed by the effects and the exception. Zero filler and nothing buried.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a maintenance mutation with no annotations and no output schema, the description should say more about scope and results. The threshold is referenced but never defined or made configurable, and it is unclear whether the response reports how many memories were decayed or archived. The core effect and the MUST carve-out are covered, but an agent cannot predict the blast radius.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters already document themselves in the schema. The description adds nothing about api_key or agent_id, nor whether the cycle is scoped by the requesting agent. Baseline 3 is appropriate when the schema does all the work.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb+resource ("Run memory decay cycle") immediately followed by the concrete effects: decay_score reduction, archival below threshold, and a durable exemption for MUST memories. An agent can distinguish this from delete_memory or forget_memory because the effect is scoring-based and selective rather than direct deletion. It stops short of naming those siblings explicitly, so it is clear but not fully differentiated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description says what happens but never when to invoke it — no cadence, no prerequisites, and no statement of when to prefer run_dedup, run_promote, or forget_memory instead. The agent is left to infer that this is periodic maintenance. The absence of any exclusion is notable given that three maintenance-cycle siblings exist.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_dedupB
Scan for duplicate memories and report findings. Uses text similarity (Jaccard) to detect near-duplicates.
| Name | Required | Description | Default |
|---|---|---|---|
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| agent_id | No | ID of the requesting agent | unknown |
| namespace | No | Namespace to scan (null for all) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It usefully implies a read-only scan that only reports (no mutation) and discloses the Jaccard text-similarity basis, which signals that only lexical near-duplicates are caught. However, it never explicitly states that nothing is merged or deleted, nor how results are shaped or how expensive a full-namespace scan is.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the action and trailed by the detection method; every clause carries information and there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description should say more about what 'findings' contain (duplicate pairs, scores, memory IDs) and whether remediation is a separate step. As written it is adequate to invoke the tool but leaves the result shape and follow-up workflow unspecified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so api_key, agent_id, and namespace are all documented in the schema. The description adds no extra meaning about scope (e.g., what a null namespace means for scan cost) or about authentication expectations, so it sits at the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('scan for duplicate memories') plus the output act ('report findings'), and names the detection method (Jaccard text similarity). It is distinguishable from siblings like search_memory or delete_memory, though it never explicitly contrasts itself with them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance: nothing says whether this should run before delete_memory/forget_memory cleanup, how often to run it, or that it is a prerequisite step rather than a cleanup action. The agent must infer the workflow role entirely.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_promoteA
Run the promote pipeline: consolidates atomic L1 memories into L2 scenario summaries, and promotes stable L2 memories into L3 core persona rules. Source memories are archived to L0 after promotion.
| Name | Required | Description | Default |
|---|---|---|---|
| min_l1 | No | Minimum L1 memories to consolidate into L2 (default: 3) | |
| min_l2 | No | Minimum L2 memories to promote to L3 (default: 2) | |
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| agent_id | No | ID of the requesting agent | unknown |
| namespace | No | Namespace to scan (currently the promote pipeline scans all namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose one genuinely important side effect: source memories are archived to L0 after promotion. It does not say whether that archival is reversible, what permissions or API key scope are required for a mutating batch job, how long it takes, or whether it is idempotent — all relevant for a pipeline that rewrites memory tiers.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler: the first states the pipeline and its two stages, the second states the consequential side effect. The most important information (what it does, what it archives) is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a five-parameter, no-output-schema, no-annotation tool, the description covers the pipeline mechanics and the archival behavior. But it omits the return value (e.g., counts consolidated/promoted), any preconditions such as needing sufficient memory volume, and whether namespace is currently ignored despite being a parameter — gaps an agent would want closed before invoking a mutation pipeline.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so each of the five parameters (min_l1, min_l2, api_key, agent_id, namespace) is already documented with defaults. The description adds tier context (L1/L2/L3) that helps interpret min_l1 and min_l2 but does not explain the namespace caveat or auth behavior beyond what the schema says. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb ('Run') plus a named pipeline and then decomposes it into two concrete transformations (L1→L2 consolidation, L2→L3 promotion). This makes it clearly distinct from siblings like run_decay or run_dedup in effect, though it never explicitly names those siblings as alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the accumulation thresholds ('consolidates atomic L1 memories', default min_l1=3), so an agent can infer it should be run after memories have built up. However, there is no explicit when-to-use / when-not-to-use statement and no guidance relative to run_dedup or extract_memories, which also operate on the memory tiers.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
save_memoryA
Save a new memory. Memories are persistent user preferences, facts, episodes, or skills that should be recalled in future conversations. Embeddings are generated automatically for semantic search. Delta-write is on by default: near-duplicate saves are skipped and similar existing memories absorb the new content instead of a new row being created (status in the response: saved | merged | skipped). Pass force_insert=true to bypass.
| Name | Required | Description | Default |
|---|---|---|---|
| tags | No | Tags for categorization | |
| type | No | Memory type: preference, fact, episode, entity, or skill | fact |
| layer | No | Memory layer: L0 (raw), L1 (atom), L2 (scenario), L3 (persona). Auto-assigned if omitted. | |
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| content | Yes | The content of the memory to save | |
| agent_id | No | ID of the agent saving this memory | unknown |
| priority | No | Priority level: MUST, REFERENCE, or BACKGROUND | REFERENCE |
| namespace | No | Namespace for the memory (default: global) | global |
| agent_type | No | Type of the agent (e.g., coding-assistant) | general-assistant |
| confidence | No | Confidence score (0.0 to 1.0) | |
| visibility | No | Sharing scope: "scoped" (default, namespace rules) or "shared" (team pool). | |
| instruction | No | Optional instruction format for the memory | |
| skill_steps | No | Skill execution steps (only for type=skill) | |
| force_insert | No | Force insert, skipping delta-write dedup/merge. By default a save is checked against similar memories in the same namespace: near-duplicates are skipped, similar memories absorb the new content's residual (docs/DESIGN.md §17.1). | |
| skill_trigger | No | Skill trigger pattern (only for type=skill) | |
| skill_verification | No | Skill verification criteria (only for type=skill) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses that saves are persistent, that embeddings are generated automatically, that near-duplicates cause a merge or skip rather than an insert, and it names the three possible statuses in the response. It stops short of saying what happens to the existing memory's prior content on a merge (append vs. overwrite) and says nothing about auth or limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the action, then definition, then the non-obvious delta-write behavior, which is the right order. The definitional sentence about what memories are is slightly padded, but every sentence carries real information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 16-parameter mutation tool with no annotations and no output schema, the description covers the highest-risk behavior (silent dedup/merge instead of insert) and even documents the response status values an agent would otherwise not know. Remaining gaps, such as interaction between namespace/visibility and the merge scope, are noted but minor given full schema coverage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 16 parameters including force_insert. The description only restates the force_insert bypass and the embedding behavior, adding little syntactic or semantic detail beyond what the schema fields already say.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Save a new memory') and immediately defines what a memory is (preference, fact, episode, skill), which disambiguates it from generic storage. It never names a sibling, so there's no explicit contrast with extract_memories or review_memory, leaving the agent to infer the boundary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear guidance on the force_insert escape hatch and explains that dedup is on by default, which is genuinely useful for deciding how to call it. It gives no guidance on when to save via this tool versus extracting memories in bulk or reviewing them, so sibling routing is only implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_memoryB
Search user memories. Supports three modes: 'keyword' (text match), 'semantic' (vector similarity), or 'hybrid' (both combined with RRF). Default is 'hybrid' when embeddings are available.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | Search mode: "keyword" (default), "semantic" (vector), or "hybrid" (both) | hybrid |
| query | Yes | Search query string | |
| top_k | No | Maximum number of results to return | |
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| agent_id | No | ID of the requesting agent | |
| min_score | No | Drop results whose final (post-rerank) relevance score is below this threshold. Unset = return the full top_k regardless of score, the pre-existing behavior. Lets callers distinguish "no confident match" (empty result) from "weak matches padded to top_k". | |
| namespace | No | Filter by namespace | |
| type_filter | No | Filter by memory type | |
| priority_filter | No | Filter by priority | |
| expand_relations | No | Attach each result's one-hop relation neighborhood (semantic graph expansion, C5). Default off. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It usefully discloses the default mode and the embeddings dependency ('hybrid' when embeddings are available), but omits auth requirements, result ordering, and what happens when embeddings are unavailable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two compact, front-loaded sentences with no filler. Slight ambiguity: the mode property text says 'keyword' (default) while the top-level default and description say hybrid.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a 10-parameter search tool with no output schema and no annotations, the description covers the core mode behavior but leaves auth requirements and result-shaping options (min_score, expand_relations, filters) entirely to the schema. Adequate but minimal.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 10 parameters, including mode, top_k, min_score, filters, and expand_relations. The description reinforces mode semantics with implementation detail (RRF) but adds no parameter information beyond the schema; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Search user memories') and enumerates the three search modes with their mechanics (text match, vector similarity, RRF combination). An agent can tell this is a retrieval tool, though it doesn't explicitly contrast itself with siblings like get_memory_evidence or review_memory.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The mode semantics imply when each mode is useful, and the default behavior is stated, but there is no explicit when-to-use guidance relative to alternatives or when a caller should switch modes. Usage is inferable rather than directed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
session_startA
Start a new session. Returns relevant memories filtered by agent identity, formatted as MUST/REF instructions ready for injection into the conversation context. Overflow memories are shown as summaries with a hint to use search_memory for details.
| Name | Required | Description | Default |
|---|---|---|---|
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| project | No | Current project name | |
| agent_id | No | ID of the agent starting the session | unknown |
| agent_type | No | Type of the agent | general-assistant |
| context_hint | No | Hint about the current conversation context |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose useful behavior: identity-scoped filtering, the MUST/REF output format, and overflow summarization. It omits whether starting a session persists server-side state, whether it is idempotent, and what happens if a session already exists — meaningful gaps for a state-initializing tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences: purpose first, return shape second, overflow/fallback behavior third. Nothing is redundant and the most decision-relevant information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema and no annotations, and the description compensates well by explaining the return format and overflow handling for a 5-parameter tool. It falls short only on side effects and authentication/session-state behavior, which an agent would still want before invoking.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all five parameters are already documented in the schema, setting the baseline at 3. The description adds only the notion that results are filtered by agent identity, which loosely maps to agent_id/agent_type but gives no additional semantics for project, context_hint, or api_key.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Start a new session') and immediately clarifies what it returns: memories filtered by agent identity, rendered as MUST/REF instructions. It also distinguishes itself from the sibling search_memory tool by explaining that overflow items only appear as summaries with a pointer to that tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied — you call this at the beginning of a conversation — and the overflow sentence routes the agent to search_memory for details, which is a partial alternative hint. But there is no explicit statement of when to call it versus alternatives, no prerequisites (e.g., api_key need), and no exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
20 tool updates
v0.1.0- First observed
add_evidence - First observed
confirm_read - First observed
delete_memory - First observed
extract_memories - First observed
forget_memory - First observed
get_compliance_report - First observed
get_effectiveness_report - First observed
get_memory_evidence - First observed
import_skills - First observed
infer_outcome - First observed
list_inbox - First observed
record_outcome - First observed
report_compliance - First observed
review_memory - First observed
run_decay - First observed
run_dedup - First observed
run_promote - First observed
save_memory - First observed
search_memory - First observed
session_start
TDQS
Scored across 20 tools
Most tools map to distinct resources/actions, but there are several confusable clusters: delete_memory vs forget_memory, record_outcome vs infer_outcome, and the trio report_compliance / get_compliance_report / get_effectiveness_report. The descriptions draw careful boundaries (soft delete vs GDPR purge, transcript vs host-evidence classification, manual vs automatic judgment), which keeps it workable, but an agent must read closely to choose correctly.
Nearly every tool follows a clean verb_noun snake_case pattern (save_memory, search_memory, run_decay, get_memory_evidence, review_memory). The only real deviation is session_start, which inverts the order, and report_compliance reads slightly oddly compared to get_*_report siblings. Minor and readable overall.
Twenty tools is at the upper end but each covers a genuinely separate operational area: CRUD, extraction, review, evidence chains, decay/dedup/promotion, outcomes, and compliance. Nothing looks like a redundant duplicate, though the outcome/compliance family could plausibly be consolidated into fewer entry points.
The lifecycle is well covered: save/search/delete/forget, review, evidence and provenance, decay, dedup, promotion, plus session injection and compliance reporting. The notable gaps are an explicit get_memory-by-ID and a general update/edit path for already-approved memories (review_memory's edit only applies to pending items), forcing agents to route through search plus re-save.
Maintenance
Related MCP Connectors
An MCP memory server. One memory your agents share — across models, devices and apps.
One memory, every AI. A shared, user-owned markdown memory your AI clients read and write over MCP.
Persistent memory, knowledge graph, task management and more for AI agents via MCP.
- memnodeOAuthdev.memnode
Persistent, inspectable memory for AI agents with lineage, correction, and a hosted MCP endpoint.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceMCP server that enables persistent, hybrid, local memory for LLM agents, with vector + BM25 search, knowledge graph, and policy-driven retention, providing token-budgeted context injection for AI assistants.MIT
- AlicenseNot gradedqualityAmaintenanceA vendor-independent memory layer MCP server that enables multiple LLMs and AI agents to share and persist personal memories, knowledge, and context across sessions, with support for full-text search and tagging.ISC
- AlicenseNot gradedqualityBmaintenanceProvides a self-hosted shared memory service that lets AI agents capture and recall durable facts, decisions, and context across multiple tools and MCP-capable clients.3MIT
- AlicenseNot gradedqualityAmaintenanceA self-hosted memory server that gives AI agents a shared, persistent second brain, enabling verbatim storage, hybrid semantic/keyword retrieval, and a synthesized wiki layer through MCP tools.MIT