SleepSweet — memory hygiene and audit for AI agents

Agents have a brain — we give it sleep.

SleepSweet is an open-source memory hygiene and audit layer for AI agents: an offline engine plus local CLI and MCP server that deduplicates, resolves conflicts, flags stale facts, finds broken links and dead paths, and quarantines suspicious entries in the memory your agent already keeps — CLAUDE.md, AGENTS.md, ~/.claude auto-memory, Cursor rules, and GitHub Copilot instructions. It is not a memory store and it does not do retrieval.

Cleanup is non-destructive: history is marked, never deleted. Every decision is journaled and versioned, which yields a complete audit trail of your agent's knowledge over time — what the agent knew at date X, and who changed it, when, and why.

Quick start

pip install sleepsweet     # or zero-install: uvx sleepsweet run
sleepsweet run

No configuration. run scans (read-only), prints the summary below, then asks once — Apply them? [y/N] — and on y applies the fixes with a live log of every change. Nothing changes without your y:

SleepSweet — memory audit — 89 files, 206 records
Scope: all agent memory on this machine (scanned from ~/projects/myapp)
Read-only scan: nothing was changed.

  20 findings: 16 warnings, 4 notices

     10  broken links     [[links]] pointing at memories that do not exist
      6  dead file paths  memory refers to files that no longer exist
      3  unclear entries  too short or context-dependent to stand on their own
      1  duplicates       the same rule or fact written more than once
      0  conflicts        needs a judge — run via MCP, or set SLEEPSWEET_LLM

The whole CLI:

sleepsweet run             # scan + report + one confirmation + fixes
sleepsweet report          # the latest report (--details for every finding)
sleepsweet diff            # what changed in memory since the previous run
sleepsweet undo            # revert applied fixes (--to DATE rolls back to a date)
sleepsweet asof 2026-08-01 # what the agent knew at that date

Related MCP server: agentburn

Why

Agent memory degrades measurably, and the research is unambiguous:

• Memory systems fail at conflict resolution. On the MAB FactConsolidation benchmark, popular memory stores resolve conflicting facts 7–28% of the time (best system: 54%). The recipe that reaches 78–94.8% is the one SleepSweet implements: an LLM extracts candidates verbatim, deterministic code makes the decision (arXiv 2606.01435).

• 97.7% of memory errors are born at write time — confident fabrications stored as fact (MemGuard, arXiv 2605.28009). Auditing what was written is the highest-leverage intervention.

• Bad context files actively hurt: degraded CLAUDE.md-style files reduce agent task success (arXiv 2602.11988). That is why every SleepSweet fix is a diff you approve, never an automatic rewrite.

What it checks

* The judge is either the calling agent itself (via MCP — no setup at all) or any LLM you already have via one string: SLEEPSWEET_LLM=claude (or claude:<model>), ollama:qwen3:8b, command:llm -m gpt-4o-mini, or https://host/v1#model (+ SLEEPSWEET_API_KEY if the endpoint needs one).

Run it from your agent (MCP)

claude mcp add sleepsweet -- sleepsweet mcp

The agent gets tools to scan, read the structured report, dismiss false positives, and — through get_judge_batches / submit_judged_facts — act as the conflict judge itself. No API key, no model configuration: the model that calls the tool is the model that judges. The JSON report schema is stable and documented in docs/report-schema.md.

Audit superpowers

• sleepsweet diff — what changed in your memory since the previous run? Byte-level diffs of every change, with the ones SleepSweet did not make labeled as such.

• sleepsweet asof 2026-08-01 — what did the agent know on that date? The event-sourced journal replays to any moment, and every verdict records which analyzer, ruleset, judge, and prompt produced it.

Safety

• Local-first: no telemetry, no network calls; your memory never leaves the machine (the only exception is an LLM judge you explicitly configure).

• Nothing changes without your y: scanning is read-only, fixes wait for one explicit confirmation — or an explicit --yes for hooks and automation — and are logged as they are applied (agents triage the same way through MCP).

• Secrets are redacted before anything is stored or sent anywhere — API keys, tokens, and private keys never reach the journal or a judge.

• Everything is reversible: append-only journal, sleepsweet undo (down to a date with --to), and history is marked, never deleted.

Details: docs/safety.md · docs/how-it-works.md · docs/cli.md · docs/mcp.md · docs/faq.md

Verified against a stratified golden set

Beyond unit tests, evals/ holds a hand-labelled, stratified golden set: 18 kinds of memory defect (duplicates, conflicts, moved paths, stale facts, broken links, retracted parents, trust lows, external edits, …) covering every analyzer stage A1–A14, each with several planted corpora and negative controls. python evals/run.py executes real scans over them and reports objective precision/coverage per stratum and per stage; gated strata must score clean or the run fails, while the hard strata (vector-close lookalikes, hidden paraphrases, indirect conflicts) honestly map the current frontier. Judge-only defects count as misses in a judgeless run, so the tier-0 and --llm numbers are directly comparable.

Project family

• sleepsweet — engine + CLI + MCP server (this repository)

• auditable-memory-record — open specification for auditable agent memory records

• memory-hygiene-bench — open benchmark measuring the cost of dirty agent memory

License

Apache-2.0