continuum
This is a read-only MCP server for querying an imported conversation-history index; it can list, search, and read sessions but cannot import or modify data.
history_sources: list imported data sources with coverage, revision, and timestamps (no live discovery).history_list: list sessions with optional filters bysource_idandproject, pluslimitandcursorpagination.history_search: literal Unicode substring search across sessions, with optionalsource_id/projectfilters and pagination; returns truncated previews.history_read: read full event text for a givensession_id, in snapshot order, with pagination.All tools are annotated as read-only, idempotent, and non-destructive; no import, delete, or write operations are exposed.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@continuumsearch my history for 'sqlite' and list matching sessions"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Continuum
Your tools change. Your context stays.
Local conversation history for humans and coding agents. Import what you point at. Search it. Read it to the end. Hand a slice to another agent over MCP. Never rewrite a vendor database.
中文 · Architecture · Publishing · Contributing · Security · Releases
Continuum is a local index of conversations you already have on disk. You choose a file. Continuum copies what it can into a derived SQLite database. CLI, MCP, and the GUI all query that same index.
It does not scan your home directory, does not write Cursor/Claude/Codex stores, and does not upload chats. Pre-alpha: the Cursor path is synthetic-fixture green; a live host is not verified. PyPI is not published yet.
Contents
Related MCP server: chist
Try it
Need uv and Python 3.12+.
git clone https://github.com/bosprimigenious/continuum.git
cd continuum
uv sync --locked
uv run continuum --db .continuum/demo.sqlite3 import examples/synthetic.snapshot.json
uv run continuum --db .continuum/demo.sqlite3 search "数据库锁"You should see one hit whose preview contains SQLite 数据库锁. Copy session_id, then:
uv run continuum --db .continuum/demo.sqlite3 read SESSION_ID --limit 2Follow next_cursor until it is null. Import the same file again: "changed": false.
The example file is never modified.
The demo data is hand-written synthetic JSON. There are no private chats in this repository.
Install
Do not pip install continuum. That name is an unrelated PyTorch library.
Channel | Status |
GitHub prerelease wheel | Available |
PyPI project | Not published. OIDC 422 |
Signed desktop installer | Not published |
Windows | CI produced unsigned NSIS ( |
From the GitHub release:
uv pip install \
https://github.com/bosprimigenious/continuum/releases/download/v0.1.0a1/continuum_history-0.1.0a1-py3-none-any.whl
continuum --helpFrom a checkout, use uv run continuum … as in Try it. The console script is
continuum; the distribution name will be continuum-history when it reaches PyPI.
CLI
The index is an explicit --db path or CONTINUUM_DB. Continuum does not scan your home
directory or invent a default vendor path.
uv run continuum --db .continuum/demo.sqlite3 import examples/synthetic.snapshot.json
export CONTINUUM_DB=.continuum/demo.sqlite3
uv run continuum search "数据库锁"
uv run continuum "数据库锁"
uv run continuum --format text search "数据库锁"
uv run continuum read SESSION_ID --limit 2--format auto (default): JSON when piped (GUI/MCP/scripts), text in a terminal.
--format json always JSON. This is not an agent REPL like Grok/Codex; it searches
an index you already imported.
Search is literal Unicode (including short Chinese). Results return a 240-character preview;
read returns full event text. Filters on source/project are exact match, not permissions.
Cursor state.vscdb
One observed IDE shape, not every Cursor store. You pass the file. Continuum does not find it for you. Live Cursor installs are unverified.
uv run continuum --db .continuum/demo.sqlite3 import \
--adapter cursor-state-vscdb --source-id cursor-demo PATH/TO/state.vscdb--source-id is required. The reader copies the main file plus WAL/SHM, then opens the copy
with SQLite mode=ro. A blocked capture (incomplete_source) leaves any existing index
unchanged and does not create a new empty --db.
Do not commit real Cursor databases. Agent-transcripts JSONL and workspace sidebar DBs are
not this adapter. Reusing a source_id replaces that source's derived snapshot; it is
not an archive merge. Keep the original files. Indexes are disposable.
MCP
Same index, four read-only tools. Import is CLI-only.
uv run continuum --db .continuum/demo.sqlite3 serve{
"mcpServers": {
"continuum": {
"command": "uv",
"args": [
"run", "--locked", "--directory", "/absolute/path/to/continuum",
"continuum", "--db", "/absolute/path/to/continuum/.continuum/demo.sqlite3", "serve"
]
}
}
}Replace both paths. Host config file locations differ.
Tool | Does |
| Imported sources, counts, digests, timestamps |
| Sessions, optional source/project filter |
| Literal substring search |
| Full events, pagination, |
There is no import tool, no filesystem path argument, no delete, no “run this in another agent”. stdio against the Python SDK is tested. Cursor / Claude Code / Codex hosts are not.
A connected client can read the entire selected index. Project filters are not ACLs. Use one index per trust boundary. Text an agent reads may still be sent to that agent's model provider. Continuum has no upload service of its own.
Local coding agents should use the continuum-history skill
(~/shared-ai-skills/continuum-history/, symlinked into Grok / Claude / Codex / Cursor
skills/). Follow that SKILL.md (CLI or an already-connected MCP). Do not write a
home-directory scanner. Synthetic check:
bash ~/shared-ai-skills/continuum-history/scripts/continuum_skill_check.shGUI
The UI talks to the same CLI JSON interface. It does not parse vendor files or open SQLite itself. The desktop shell is a four-pane workbench (session list, read, coverage, settings), not an editor and not a second agent.
Vite shell (checkout, not a downloadable app):
cd gui
npm install
npm run devDesktop is experimental. This repo can build an unsigned macOS .app with a
PyInstaller sidecar of the continuum CLI. That artifact is not notarized, not shipped
in git, and not a clean-machine install. Windows NSIS is produced on GitHub windows-latest;
this macOS checkout cannot launch that .exe.
uv run --with pyinstaller python scripts/build_sidecar.py
uv run python scripts/smoke_sidecar.py
cd gui && npm ci && npx tauri buildNeeds Rust (rustup) and Node. Output lands under
gui/src-tauri/target/release/bundle/ (gitignored).
What works / what does not
Pre-alpha. A green foundation gate means the checkout works, not that the product is done.
Works in this repository | Not here yet |
Snapshot v1 import, literal search, pagination, source refs | Claude Code / Codex adapters |
Cursor | Live Cursor host, Cursor JSONL, sidebar DBs |
CLI + four read-only MCP tools on one core | Auto-discovery, background refresh |
GUI session via CLI JSON; Vite dev; unsigned local macOS | Browser e2e, signed installer, Windows start/query acceptance |
GitHub | PyPI |
Rollback, Unicode, WAL sidecar, stdio tests | Semantic search, attachments as full text, cloud sync |
Native adapter status: NOT READY until a named live Cursor/OS/MCP-host combination is recorded. GUI status: NOT READY until a real browser (or desktop) path is exercised end to end.
How it is put together
One Python core. Several shells. Not an IDE.
┌──────────────────────────────────────────────┐
│ Shell: CLI / MCP / Vite / .app / .exe │
└──────────────────┬───────────────────────────┘
│ CLI JSON or MCP stdio
┌──────────────────▼───────────────────────────┐
│ Core: adapters → Snapshot v1 → HistoryStore │
└──────────────────────────────────────────────┘This is the Grok / Codex shipping shape (runtime + shells), not the Cursor shape
(VS Code fork). The desktop .app / .exe wrap the same continuum CLI. Do not
fork an editor to get a GUI.
See docs/architecture.md for contracts, rejected alternatives, and how a failed import is supposed to behave.
Contributing
Read CONTRIBUTING.md and docs/development.md before changing behavior.
uv sync --locked
uv run python scripts/check.pyThat gate is format, lint, strict mypy, tests (coverage floor 85%), a basic publication hygiene scan, wheel/sdist, and an isolated wheel smoke. It may hit the network for build dependencies. It does not read your private agent history.
Please:
Start from synthetic fixtures and a failing behavior test.
Keep vendor databases read-only.
Do not attach real
state.vscdb, logs, or tokens to issues or PRs.Do not skip a red test or lower the coverage floor to go green.
CI runs the same gate on Ubuntu, macOS, and Windows.
Privacy
Indexes are plaintext. There is no automatic secret redaction and no secure-erase guarantee.
Only import what you are willing to expose to every client connected to that --db.
Details: SECURITY.md.
FAQ
Why isn't this pip install continuum?
PyPI already has continuum, a PyTorch continual-learning
library. This project will publish as continuum-history. Until then, use the GitHub wheel
or a checkout.
Why did the PyPI upload fail?
GitHub OIDC reached PyPI (run 35454466719) and got 422 invalid-publisher.
The token is valid; pypi.org has no pending publisher for continuum-history /
bosprimigenious/continuum / publish.yml / environment pypi.
That is an account setting, not a version bump. Steps: docs/publishing.md.
Does Continuum phone home?
No runtime telemetry, hosted sync, or model API. uv / npm / cargo still talk to package
registries when you install or build.
Will connecting MCP leak my whole library? The tools can read everything in that index. Split indexes if you need split trust. Whatever the host does with the text is outside Continuum.
Can I point --db at Cursor's own database?
No. --db is Continuum's derived index. Pass the vendor file to import.
Is the macOS .app a release?
No. It is a local packaging spike: unsigned, not notarized, not installed from GitHub Releases.
License
MIT. Copyright (c) 2026 Continuum contributors.
Independent project. Not affiliated with Cursor, Anthropic, OpenAI, or any other vendor. The name does not claim exclusive trademark rights.
Available Tools
4 toolshistory_listARead-onlyIdempotent
List sessions; filters are exact matches, not authorization boundaries.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| cursor | No | ||
| project | No | ||
| source_id | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds a non-obvious behavioral nuance: filters are exact matches, not authorization boundaries, which clarifies that results are not permission-scoped. This goes beyond the annotation hints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with two clauses, front-loading the action and adding a critical caveat. It contains no filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has an output schema, so return format is covered elsewhere. It has four optional parameters, and the description provides a key nuance about filters but does not explain limit/cursor pagination or the meaning of project/source_id beyond their names. Given the low complexity and the presence of an output schema, the description is adequate but not complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries full responsibility for explaining parameters. It only states that filters are exact matches, which applies to project and source_id but not to limit and cursor. The parameter names are somewhat self-explanatory, but pagination semantics and data types are not clarified.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'List sessions', a clear verb and resource, and adds a clarifying note about filter semantics. It doesn't explicitly differentiate from sibling tools like history_search or history_read, but the core purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage: use this to list sessions with exact-match filters. The warning that filters are not authorization boundaries hints at when not to rely on it for security scoping, but no alternatives are named and no explicit when-to-use/when-not-to-use guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
history_readARead-onlyIdempotent
Read complete events by opaque session ID, in snapshot order, with pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| cursor | No | ||
| session_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, openWorldHint, and destructiveHint, so the safety profile is covered. The description adds meaningful behavior beyond annotations: events are returned complete, in snapshot order, and with pagination. It does not discuss errors or rate limits, but the added context is sufficient for this simple read operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One compact sentence with no filler. It front-loads the verb and resource, then efficiently packs completeness, ordering, and pagination. Every phrase earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only paginated fetch with an output schema and comprehensive annotations, nothing critical is missing: session ID, record completeness, ordering, and pagination are all explicitly present. The tool's complexity is low, and the definition covers the full call contract.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It covers session_id ('opaque session ID') and pagination (limit/cursor), giving high-level semantics for the parameters. However, it leaves details unstated, such as whether the cursor itself is opaque or how limit interacts with pagination. The schema's defaults and titles fill in some meaning, so the description is adequate but not exhaustive.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Read'), a clear resource ('complete events'), and the key differentiator ('by opaque session ID'), plus ordering and pagination. This distinguishes it from siblings like history_list and history_search, which imply broader listing or searching rather than a direct session-based read.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use the tool: when you have a session ID and need the full event sequence in snapshot order. It does not explicitly name alternatives or exclusions, but the intended use case is evident from the wording and sibling names.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
history_searchBRead-onlyIdempotent
Find literal Unicode text. Previews may truncate; history_read returns full text.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| query | Yes | ||
| cursor | No | ||
| project | No | ||
| source_id | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, which cover the safety profile. The description adds meaningful behavioral context beyond annotations: 'Previews may truncate' discloses output truncation, and 'history_read returns full text' points to a workaround. This is valuable non-obvious information that aids agent decision-making.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, with no fluff. The primary purpose is front-loaded in the first sentence, and the behavioral caveat and alternative are in the second. Every word serves a function, making it highly efficient and easily parseable by an agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that the tool has 5 parameters with 0% schema coverage and no parameter descriptions from the tool definition, the description is severely incomplete for correct invocation. It does not explain how to structure a query, handle pagination via cursor, or use project/source_id filters. The output schema exists, so return format isn't a concern, but the input semantics are under-documented. An agent would likely need to guess or rely on external knowledge to use this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% – the input schema has no descriptions for any of the five parameters. The description fails to compensate: it does not explain the meaning or usage of query, limit, cursor, project, or source_id. While parameter names like 'query' and 'limit' are somewhat self-explanatory, the description adds zero value in clarifying parameter semantics, and the cursor/project/source_id fields remain ambiguous.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Find') and a specific resource ('literal Unicode text'), which clearly indicates a text search operation. This distinguishes it from the sibling tools history_sources (list sources), history_list (list history), and history_read (read full content). However, it does not explicitly name the target as 'history entries', though the tool name and sibling context imply that.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides an implicit usage context: use this tool to find literal text, and use history_read to get full text when previews truncate. It explicitly mentions a condition to switch to an alternative, but it does not contrast against history_sources or history_list, nor does it state when not to use this tool. The guidance is partially useful but not comprehensive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
history_sourcesARead-onlyIdempotent
List imported source coverage, revision and timestamps; not live discovery.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, covering safety. The description adds that it lists coverage, revision, and timestamps, and clarifies it is not live discovery, which provides additional behavioral context beyond the annotations. This is useful and consistent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, compact sentence that front-loads the core action and resource. Every word earns its place, and the clarifying 'not live discovery' adds meaningful distinction without waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter tool with a clear output schema (not shown but noted), the description is complete. It states what the tool does, what it covers, and explicitly rules out live discovery. The distinction from siblings is clear, and an agent can correctly invoke it without additional information.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, so schema description coverage is trivially 100%. With no parameters, the description carries no burden to explain them, and the baseline of 4 applies. No additional param info is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List') and resource ('imported source coverage, revision and timestamps'), and explicitly adds 'not live discovery' to distinguish it from live discovery tools. This differentiates it from siblings like history_list, history_search, and history_read, which are about different operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'not live discovery' clarifies that this tool is for imported/historical data, not real-time discovery. While it doesn't explicitly name alternatives, the context of the siblings (list, search, read) implies when this tool is appropriate. It gives clear context but no explicit exclusions beyond the live discovery caveat.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
4 tool updates
v0.1.0- First observed
history_list - First observed
history_read - First observed
history_search - First observed
history_sources
TDQS
Scored across 4 tools
Each tool has a clearly distinct purpose: listing sources, listing sessions, searching text, and reading full events. The overlap between search and read is well-defined, with search for discovery and read for retrieval.
All tools follow a consistent history_ verb_noun pattern (sources, list, search, read). The naming is predictable and immediately conveys the action and resource.
With only 4 tools, the server is well-scoped for a read-only history/event domain. Each tool earns its place, covering the essential operations without unnecessary bloat.
The surface covers listing, searching, and reading, which are the core operations for a history server. Minor gaps exist, such as no rich filtering for sessions, but agents can work around these limitations.
Maintenance
Related MCP Connectors
Read-only MCP access to authorized Vocci sessions, notes, files, and memory search.
Search your AI chat history (ChatGPT, Claude, Codex) from any MCP client. Remote, private, read-only
Search and retrieve published Alkemata articles, pages, and guidance through a read-only MCP server.
Read-only MCP tools for AI agent discovery, structured resources, and NIULAI information.
Related MCP Servers
- AlicenseAqualityCmaintenanceLocal-first, read-only Codex session aggregator that indexes multiple CODEX_HOME directories into a SQLite database and provides MCP tools for cross-project, archival, and sub-agent history queries.53MIT
- AlicenseNot gradedqualityBmaintenanceMCP server for unified full-text search across chat histories from Claude Code, Codex, Cursor CLI, and Antigravity CLI, using SQLite FTS5. Provides read-only tools to search sessions, list conversations, and retrieve session details.MIT
- AlicenseAqualityCmaintenanceRead-only MCP server for searching your local Retrace screen-history database, with tools for full-text search, segment listing, frame details, app usage, and tags.6MIT
- AlicenseAqualityAmaintenanceProvides MCP tools to search, browse, and retrieve unified read-only history from CLI agents like Codex, Claude Code, and OpenCode, with connector discovery and project-folder grouping.61MIT