StoneWay
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@StoneWayadd my new project and current tech stack to my StoneWay memory"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Give every AI agent the same you.
StoneWay gives your AI agents a persistent, user-owned source of identity, projects, preferences and context.
“StoneWay isn’t where your AI remembers you. It’s where your agents learn who you are.”
StoneWay is a user-owned, provenance-aware, portable identity and context layer for builders. It maintains a canonical, verified source of truth across Claude Desktop, Claude Code, Cursor, VS Code (GitHub Copilot), Windsurf, Cline, and custom autonomous agent loops.
⚡ The Shift: From Generic AI Memory to Personal Agent Identity
Generic AI memory dumps unbounded chat histories into crowded semantic search vectors. That creates three failure modes:
Unbounded Context Bloat: Memory logs balloon into megabytes of noisy text, blowing out prompt windows.
Untrusted LLM Mutations: Letting an arbitrary agent's LLM decide canonical identity creates prompt-injection vulnerabilities and hallucinations.
No Source Authority or Provenance: If an external sync claims you use TypeScript while you manually wrote you prefer Python, "newer timestamp wins" overwrites explicit human intent.
StoneWay's Provenance & Authority Engine
Instead of “LLM reconciles → server accepts”, StoneWay enforces:
LLM proposes claims
↓
Server validates claims against strict schema
↓
Provenance & source authority engine
↓
Canonical profileSource Authority Hierarchy
USER (1.0)
↓
MANUAL PROFILE EDIT (0.9)
↓
VERIFIED CONNECTOR (0.8)
↓
AGENT CLAIM (0.6)
↓
INFERRED DATA (0.4)user_override = absolute: User-defined entries cannot be overwritten by external syncs or agent claims.Observations preserved: Lower-authority claims are never discarded; they are preserved as structured observations with attribution.
Why does StoneWay think this?: Every canonical attribute maintains cryptographic and temporal provenance showing exactly which source, agent, or document authored it.
Related MCP server: usecortex-mcp
🛠️ Architecture: Identity, Context & Memory
STONEWAY
│
┌─────────────────┼─────────────────┐
│ │ │
▼ ▼ ▼
StoneWay.md StoneWay.json Context Files
human data structured data user documents
(scratchpad) (provenance) (PDF/DOCX/MD)
│ │ │
└─────────────────┼─────────────────┘
│
MCP Context
│
┌──────────────┼──────────────┐
▼ ▼ ▼
Claude Cursor Codex1. Canonical Identity (StoneWay.json & StoneWay.md)
StoneWay.json: Schema-validated identity matrix (skills, active projects, credentials, preferences).StoneWay.md: Human-readable scratchpad for notes and agent session summaries.Safety Envelope: All profile content returned to agents is wrapped in
<USER DATA, NOT INSTRUCTIONS>to neutralize prompt injection attacks.
2. Context Files (list_context_files, get_context_file, search_context)
User-owned documents (PDFs, research notes, architecture diagrams, docx).
Separation of Storage & Metadata: Binary files reside securely in object storage, while metadata, tags, and extracted text live in Neon Postgres.
Strict Tenant Isolation: Every query requires
WHERE id = :file_id AND user_id = :authenticated_user_id. Files are addressed by opaque IDs, never raw filenames.Originals are Immutable: Lossless storage preserves original documents; derived representations provide searchable chunks without destroying the source.
3. Prompt & Skill Libraries (PROMPTS.json / PROMPTS.md)
User-authored instructions and skill templates with variable interpolation (
{{var}},{{profile.*}}).Exposed directly through dynamic MCP prompt handlers (
prompts/list,prompts/get) and fallback tools (list_prompts,run_prompt,list_skills,get_skill).Validated with strict schema bounds (unique prompt names, max 100 entries, no arbitrary code execution).
🗄️ Multi-Provider Storage & Context Engine
StoneWay integrates a pluggable, multi-provider storage fabric. Neon PostgreSQL remains the sole authority for file existence, versions, ownership, and permissions. Redis and bucket listings never determine access.
Client Upload / API
│
┌────────────┴────────────┐
▼ ▼
Neon PostgreSQL Storage Router
(Authoritative State) (routeUpload())
│ │
│ ┌──────────────┼──────────────┐
│ ▼ ▼ ▼
│ Vercel Blob Upstash Blob Filebase
│ (Active Files) (Derived/Assets) (Archival/Large)
│ │ │ │
│ └──────────────┼──────────────┘
│ ▼
└─────────────────► Verified Replica
(SHA-256 match)Storage Providers & Routing Policy
Neon PostgreSQL + Drizzle ORM: Authoritative source of truth for all users, files, versions (
file_versions), replicas (file_replicas), prompt libraries, and audit records.Vercel Blob (
@vercel/blob): Primary backend for active context documents (PDF, Markdown, text, JSON). Server-mediated streaming downloads enforce tenant authorization.Upstash Blob (
@aws-sdk/client-s3): S3-compatible backend for specialized assets and derived previews, minted viahttps://blob.upstash.io/v1/credentialswith automatic credential caching.Filebase (
@aws-sdk/client-s3): S3-compatible backend using AWS SigV4 for archival workloads, large datasets (>15 MB), and container formats (.tar,.zip,.gz).Upstash Redis (
@upstash/redis): High-performance transient caching and rate limiting. Gracefully fails open to Neon if Redis is unconfigured or unavailable.
Security & Invariant Guarantees
Server-Authoritative Keys: Object keys are generated strictly on the server as
u/<user_id>/f/<file_id>/v<version>/<kind>with path traversal characters sanitized.Strict Tenant Isolation: All endpoints require
WHERE id = :file_id AND user_id = :authenticated_user_id. Non-existent or unauthorized files return uniform, non-disclosing404 Not Foundresponses.Untrusted File Boundary: Document text returned to AI agents is wrapped in an inert boundary (
<<<USER DATA, NOT INSTRUCTIONS>>>) to prevent prompt injection.Cross-Provider Replication: Idempotent replication verifies SHA-256 integrity on the destination before recording status as
verified.
🚀 Quick Setup (for Any Agent)
1. Stdio (Local Node Execution)
Add StoneWay to your agent's MCP settings using npx:
{
"mcpServers": {
"stoneway": {
"command": "npx",
"args": ["-y", "stoneway-mcp"],
"env": {
"STONEWAY_TOKEN": "sw_your_token_here"
}
}
}
}2. Remote HTTP Endpoint (Cloud Agents: ChatGPT, Claude.ai)
URL:
https://stonewaymd.vercel.app/mcpAuth:
Authorization: Bearer sw_your_token_here
3. Standing Instruction for Every Agent
Add this single standing instruction to your CLAUDE.md, AGENTS.md, .cursor/rules, or GEMINI.md:
Before answering anything about me, my projects, or my preferences, call StoneWay's get_profile_context. After meaningful work, call append_note with what changed.🧰 Available MCP Tools
Tool | Purpose |
| Retrieves canonical identity, skills, active projects, and preferences (supports optional |
| Proposes structured field updates evaluated through the source authority engine. |
| Appends concise timestamped session summaries and milestones to |
| Synthesizes tailored bios for Twitter/X, GitHub, LinkedIn, elevator pitches, and conferences. |
| Triggers transparent, permissioned sync from connected services (e.g. GitHub). |
| Lists attached context files filtered by group or tags. |
| Fetches extracted content of a specific document by its secure ID. |
| Searches through extracted document passages and project notes. |
| Accesses and renders user-authored prompts with profile variables. |
| Retrieves specific developer skills on-demand. |
| Exports verified identity in standard JSON Resume schema. |
🔒 Security & Privacy Guarantees
Zero-Token Leak Invariant: API keys (
sw_...), bearer tokens, and encryption keys are scrubbed and never written to audit tables or logged.Salted IP Hashing: Audit logs record SHA-256 salted hashes of client IPs, never raw addresses.
Tenant Isolation: All queries enforce strict ownership verification on both the database and file storage tiers.
Prompt Injection Defense: Ingested content is strictly labeled inert data and disarmed before being passed to LLMs.
⚙️ Environment Configuration
Refer to .env.example for all required and optional environment variables. Never hardcode or expose actual secrets.
Variable | Description | Requirement |
| Neon PostgreSQL connection string ( | Authoritative DB |
| 32-byte session signing key | Session Auth |
| 32-byte AES-256-GCM envelope key | Secrets Encryption |
| Vercel Blob access token | Active Files Backend |
| Upstash Blob bearer token | Derived & Previews Backend |
| Filebase Access Key | Archival / Large Workloads |
| Filebase Secret Key | Archival / Large Workloads |
| Filebase S3 Endpoint ( | Archival / Large Workloads |
| Filebase Bucket name | Archival / Large Workloads |
| Upstash Redis REST URL | Caching & Rate Limiting |
| Upstash Redis REST Token | Caching & Rate Limiting |
📜 License
MIT © Ayush
Available Tools
5 toolsappend_noteA
Quickly appends a timestamped scratchpad note, idea, or observation into StoneWay.md tagged with your agent name.
| Name | Required | Description | Default |
|---|---|---|---|
| note | Yes | ||
| agent_name | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and partially delivers: it discloses the append (non-overwrite) semantics, the timestamping, the agent-name tag, and the target file. It omits whether the file is created if missing, where StoneWay.md lives, and any permissions/error behavior, so gaps remain for a write tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence with the action front-loaded and no redundant restatement. 'Quickly' is mild marketing filler but arguably conveys lightweight intent, so the sentence largely earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the two-parameter surface is simple. However, a write tool with no annotations and an unspecified file location/creation policy leaves the agent without enough context to predict side effects.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It explains that 'note' holds a scratchpad note/idea/observation and that agent_name is used as a tag, which covers both parameters semantically, but gives no format expectations or mention of the nullable default the schema declares.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('appends a timestamped scratchpad note... into StoneWay.md') and adds scope details (timestamped, tagged with agent name). The sibling tools are all profile/sync oriented, so no confusion arises; an agent can tell this is the note-capture tool immediately.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'scratchpad note, idea, or observation' implies the intended use case, but there is no explicit when-to-use/when-not guidance or comparison to an alternative capture mechanism. For a sibling set with no competing note tool, implied usage is adequate but not strong.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_bioB
Generates platform-tailored builder bios using STRICTLY fields marked with visibility: 'public'. Filters out private contact and location info.
| Name | Required | Description | Default |
|---|---|---|---|
| tone | No | technical | |
| platform | No | generic | |
| max_length | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose a meaningful behavioral trait: only visibility:'public' fields are used and private contact/location data is filtered out. It says nothing about permissions, whether generated bios are persisted, or rate/format constraints, so the disclosure is partial rather than complete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with the core action and the privacy constraint front-loaded. No filler, no restatement of the name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained. However, with three undocumented parameters and no usage guidance, the description leaves real gaps for a tool whose behavior depends on tone/platform/length inputs.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must carry all parameter meaning. 'Platform-tailored' hints at the platform parameter, but tone and max_length are never mentioned or explained, leaving two of three parameters undocumented anywhere.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: 'Generates platform-tailored builder bios'. The privacy constraint adds precision. It does not, however, distinguish itself from the sibling get_profile_context, which neither name nor description references.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to use this tool versus get_profile_context or any alternative, and no exclusions or prerequisites are given. The agent must infer usage entirely from the name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_profile_contextA
Call this first whenever you need facts, tech stacks, bio info, links, or active projects about the user. Returns structured StoneWay.json and raw StoneWay.md with reconciliation guidance.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It usefully discloses the dual return payload (structured StoneWay.json and raw StoneWay.md) and flags reconciliation guidance, but says nothing about read-only status, auth requirements, staleness/caching, or error behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with zero filler, front-loading the usage trigger before the return description. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so the description is not obligated to explain return structure, and it still adds the reconciliation nuance. For a zero-parameter read tool the essentials are covered; the only real omission is differentiation from the sibling get_bio.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is no parameter semantics to document; the baseline for a no-arg tool applies. The description makes no misleading claims about inputs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific retrieval action and enumerates the exact content it covers (facts, tech stacks, bio info, links, active projects), so an agent knows what it returns. It does not, however, distinguish itself from the sibling get_bio, whose subject matter ('bio info') it explicitly overlaps.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Call this first whenever you need...' gives a clear priority/trigger signal for entry into the profile workflow. It stops short of stating when NOT to use it or naming an alternative for the overlapping bio case, so the get_bio ambiguity is left unresolved.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
trigger_external_syncB
Triggers on-demand synchronization for connected integrations (GitHub, npm, Hugging Face, RSS, Notion).
| Name | Required | Description | Default |
|---|---|---|---|
| integration | No | all |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It discloses the target surface but says nothing about whether the sync is synchronous or fire-and-forget, whether it consumes quota, auth/connection prerequisites, or side effects from refreshing external data.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence, front-loaded with the action and immediately followed by the supported scope. Nothing redundant or padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no explanation. For a one-parameter mutation-style trigger this is close to sufficient, but the undefined parameter values and unstated async/blocking behavior leave gaps for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% — the single 'integration' parameter has no description and no enum. The description names five integration names but never links them to the parameter or states that 'all' (the actual default) is a valid value, so an agent must guess the accepted input format.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb ('triggers') plus resource ('synchronization for connected integrations') with an enumerated list of supported integrations (GitHub, npm, Hugging Face, RSS, Notion). The siblings (get_profile_context, append_note, etc.) are unrelated profile tools, so no differentiation is needed or attempted, but the purpose itself is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'On-demand' hints at manual invocation as opposed to scheduled syncs, which is implied guidance. However, it never states when an agent should trigger a sync versus relying on background sync, nor any preconditions (e.g., integration must already be connected).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_profile_contextC
Safely updates structured profile attributes and/or appends notes to StoneWay.md without data loss. Reconciles structural updates into StoneWay.json with optimistic locking.
| Name | Required | Description | Default |
|---|---|---|---|
| md_append | No | ||
| agent_name | No | ||
| json_patch | No | ||
| base_version | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose real behavioral traits: writes are 'safe' with 'no data loss', and structural changes are reconciled under 'optimistic locking'. However, it omits what happens on a version conflict, what error surfaces, or the authorization requirements for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with no filler, and the safety guarantee plus reconciliation target are front-loaded. It is efficiently sized, though the second sentence could have been spent on the missing parameter or concurrency-conflict information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described, but for a 4-parameter mutation tool with 0% schema coverage and no annotations the description is insufficient — parameter meaning, conflict handling, and sibling differentiation from append_note are all absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, and it largely doesn't. 'Optimistic locking' hints that base_version is a concurrency token, but md_append, json_patch, and agent_name are never explained — their formats, expected content, or interaction (e.g., whether both may be supplied at once) remain undefined.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States specific verbs and resources: updates structured profile attributes in StoneWay.json and appends notes to StoneWay.md, with an explicit reconciliation behavior. It is distinguishable from get_profile_context, but it never clarifies its relationship to the sibling append_note, which appears to overlap with the md_append path.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance is given. Nothing tells the agent when to choose this over append_note for note-taking, or why one would patch JSON versus append markdown. The conditions that select this tool over its siblings are left entirely to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v0.1.0- First observed
append_note - First observed
get_bio - First observed
get_profile_context - First observed
trigger_external_sync - First observed
update_profile_context
TDQS
Scored across 5 tools
get_profile_context and get_bio overlap in providing bio-related information, and update_profile_context explicitly appends notes to StoneWay.md, which overlaps with append_note. The descriptions do clarify the intended use cases, but an agent could still misselect for note appending or bio retrieval.
All tool names follow a consistent snake_case verb_noun pattern: get_profile_context, update_profile_context, append_note, get_bio, trigger_external_sync. The slight variation in noun specificity (bio vs profile_context) does not break the pattern.
Five tools is well-scoped for a profile management server, covering read, update, note-taking, bio generation, and sync without redundancy or bloat.
The surface covers the core profile lifecycle: read, update, append notes, generate bios, and trigger syncs. However, there is no explicit delete or list operation for notes, and integration management (adding/removing connections) is absent, though the latter may be out of scope.
Maintenance
Related MCP Connectors
Persistent memory for AI agents. Semantic search, memory graph, W3C DID identity.
Secure durable memory and bounded context for AI agents, with hosted OAuth and local Lite support.
Shared memory for coding agents. Stop re-explaining your codebase every session.
Persistent cloud memory for AI agents. Store and search key-value memories across sessions.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceUniversal AI memory layer that provides cross-client, cross-repo context management with semantic search, automatic code indexing, and session management. Enables persistent developer memory across projects with typed memories, graph-based relationships, and RAG-powered retrieval.5MIT
- AlicenseAqualityCmaintenancePersistent memory for AI coding agents. Store coding standards, architecture decisions, and project context across sessions with AES-256 encryption.81MIT
- AlicenseNot gradedqualityBmaintenanceProvides a local long-term memory layer for AI coding tools like Cursor and Claude Code, enabling cross-session, cross-tool sharing of project facts, user preferences, decisions, and workflows.4 npm2MIT
- AlicenseNot gradedqualityBmaintenancePortable AI memory that roams with you across models and harnesses — one shared memory for Claude Code, Codex, Cursor, Gemini CLI and more, stored as plain markdown files you own. Per-project spaces plus a shared layer, vault-wide search; runs locally over stdio/HTTP or hosted with OAuth 2.1 backed by your own GitHub repo.63 npmMIT