Skip to main content
Glama

Magnemo

Tools gave your agent hands. MCP gave it a nervous system. Magnemo gives it a brain.

Governed memory for AI agents. Every entry with a receipt. Your agent writes the draft; nothing is kept until you say yes.

The one paste

Open your AI (Claude Code, Cursor, Windsurf, or anything that speaks MCP) in any of your project folders, and paste this:

Set up Magnemo in this project:
1. Install it: pip install magnemo. It needs Python 3.11 or newer. If pip can't find it, install uv (curl -LsSf https://astral.sh/uv/install.sh | sh) and then run: uv tool install magnemo
2. Initialize the vault: magnemo init
3. Register the MCP server: run magnemo mount — it writes this project's MCP config itself.
4. Verify: run magnemo doctor and confirm everything passes.
5. Stage the first memory: one line on what this project is, using magnemo stage. Show me the note id.
6. Then tell me the exact command to approve it. After I approve, run magnemo bootpack and tell me what you remember — then remind me to restart you, so the memory mounts for every session after this one.
If anything fails, show me what went wrong and fix it if you can.

You'll know it worked — your AI will tell you who it is now.

For builders. Magnemo is an MCP server with four tools — retrieve, stage, bootpack, handoff — and a CLI for your side: review, promote, reject. It runs on your machine, in plain markdown files you own, with zero network calls (the doctor line proves it). Every promotion is a person's click, recorded with who wrote the entry, when, and through which gate — memory with a witness. Trust is computed from that record, never asserted. It mounts beside any memory you already run (a folder of notes, Obsidian, a RAG stack). Python 3.11+, zero dependencies, Apache-2.0.

Fresh vault? THE CHARTER section will say it isn't promoted yet — that is the governance speaking: Magnemo never fabricates canon. Stage a charter, review it, promote it, and every boot thereafter serves it back verbatim. (magnemo not found after install? pip's script folder isn't on PATH — python3 -m magnemo always works.)

Open beta — read KNOWN_LIMITS.md before trusting it with anything you can't lose. Honest caveats, no fine print.

Related MCP server: Engram

Install in your client

One server, said ten ways. Every block below is the same thing: uvx magnemo-mcp with MAGNEMO_VAULT pointing at the folder your memory lives in (make one with magnemo init ./vault). Tested on this Mac where it says so; the rest is from each client's own docs and marked untested — corrections welcome, open an issue.

Claude Code — tested.

claude mcp add magnemo -e MAGNEMO_VAULT=/absolute/path/to/vault -- uvx magnemo-mcp

(claude mcp list shows magnemo … ✔ Connected. Add -s project to write it into the repo's .mcp.json for your team.)

Claude Desktop — tested. Download the extension from the latest release — magnemo-0.6.4.post1.mcpb — and open it; Claude Desktop asks for the vault folder and does the rest. (The connectors directory listing follows once it is accepted.)

Cursor — untested here (not installed on this Mac); the link and the block follow Cursor's docs. Add to Cursor Or ~/.cursor/mcp.json (or .cursor/mcp.json in the project):

{
  "mcpServers": {
    "magnemo": {
      "command": "uvx",
      "args": ["magnemo-mcp"],
      "env": { "MAGNEMO_VAULT": "/absolute/path/to/vault" }
    }
  }
}

VS Code / Copilot — untested here; per VS Code's docs. Install in VS Code Or .vscode/mcp.json in the workspace:

{
  "servers": {
    "magnemo": {
      "type": "stdio",
      "command": "uvx",
      "args": ["magnemo-mcp"],
      "env": { "MAGNEMO_VAULT": "/absolute/path/to/vault" }
    }
  }
}

Windsurf — untested; ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "magnemo": {
      "command": "uvx",
      "args": ["magnemo-mcp"],
      "env": { "MAGNEMO_VAULT": "/absolute/path/to/vault" }
    }
  }
}

Cline — untested; Cline → MCP Servers → Configure → cline_mcp_settings.json:

{
  "mcpServers": {
    "magnemo": {
      "command": "uvx",
      "args": ["magnemo-mcp"],
      "env": { "MAGNEMO_VAULT": "/absolute/path/to/vault" },
      "disabled": false
    }
  }
}

Continue — untested; ~/.continue/config.yaml (or a file in .continue/mcpServers/):

mcpServers:
  - name: magnemo
    command: uvx
    args: ["magnemo-mcp"]
    env:
      MAGNEMO_VAULT: /absolute/path/to/vault

Gemini CLI — untested; ~/.gemini/settings.json:

{
  "mcpServers": {
    "magnemo": {
      "command": "uvx",
      "args": ["magnemo-mcp"],
      "env": { "MAGNEMO_VAULT": "/absolute/path/to/vault" }
    }
  }
}

Codex CLI — untested; ~/.codex/config.toml:

[mcp_servers.magnemo]
command = "uvx"
args = ["magnemo-mcp"]
env = { MAGNEMO_VAULT = "/absolute/path/to/vault" }

Zed — untested; settings.json → context_servers:

{
  "context_servers": {
    "magnemo": {
      "source": "custom",
      "command": "uvx",
      "args": ["magnemo-mcp"],
      "env": { "MAGNEMO_VAULT": "/absolute/path/to/vault" }
    }
  }
}

After the install, the loop is the same everywhere: your agent writes to staging, you review.

magnemo yes             # promote the top of the queue (yes <id-fragment> · yes --all)
magnemo no <id> --reason "…"   # reject one — the reason is required; rejections teach
magnemo review          # the interactive queue, when you want to read first
magnemo doctor          # python, vault, config, ledger, and the mount — proves the zero-network line too

Anything that speaks MCP over stdio mounts the same way. The remote door (ChatGPT and hosted clients) is on its way in 0.7.0.

Agents draft, people keep — the one rule

Agents get four MCP tools. Promotion is not one of them.

Actor

Door

Can do

Agents

MCP server (stdio)

retrieve canonical memory · stage → staging only, the one write tool · bootpack on wake · handoff at the boundary

You

CLI + git (any editor)

review the queue · promote / reject · edit anything · own everything

The vault

vault/
  dev/      knowledge/ playbooks/ decisions/ debt/        ← example: a dev team's partition
  ops/      knowledge/ playbooks/ clients/ decisions/ style/  ← example: an ops team's partition
  shared/   tickets/ changelog/                            ← interop bus (gated)
  _staging/   agent writes await review here
  _index/     machine-managed
  _ledger/    trust_ledger.jsonl — append-only, never forgets

Every note is markdown with provenance frontmatter (author, written, source, status, reviewed_by, supersedes, strength). Provenance is the file format.

Privacy

Magnemo runs on your machine and nowhere else. The vault is a folder of plain markdown files you own and can read in any editor. The engine makes zero network calls — magnemo doctor proves it on every run — so nothing you or your agent writes leaves the computer. There is no telemetry, no account, no phone-home; the only copies of your memory are the ones you make yourself (magnemo chest), to places you own. The full page: https://magnemo.ai/privacy

Guarantees (Phase 1 — Governed Recall)

  • Agent writes NEVER reach canonical stores directly — staging only, always.

  • Search returns canonical (keyholder-approved) notes only. Staged claims are invisible.

  • Partition walls enforced per agent (MAGNEMO_PARTITIONS); cross-partition = DENIED.

  • Supersession is explicit: old notes archive with a forward link. Nothing deletes.

  • Rejections are kept and recorded — rejections teach.

  • Every promote/reject lands in the append-only Trust Ledger with actor + reason.

Tests

python -m unittest discover -s tests -v     # incl. full MCP round-trips (legacy + four-verb)
# or: pip install -e ".[test]" && pytest

Everything that shipped

Release by release, with the design notes that used to live here: CHANGELOG.md.

— Silver Valley Technologies Inc. · Phase 1 of 3 · The memory that learns is the memory that is governed.


mcp-name: ai.magnemo/magnemo · Source · Security · Privacy

Available Tools

4 tools
bootpackRead what this agent wakes up knowingA
Read-onlyIdempotent

The boot pack: Charter first (verbatim, never fabricated), then the Gate Map, YOUR AUTONOMY (this agent's own trust levels), canon digest, open threads, salience-ranked review queue, last handoff, ledger tail. Read it FIRST on every wake. Deterministic: same vault state, same bytes.

ParametersJSON Schema
NameRequiredDescriptionDefault
classNoworker = lean; partner = adds the relationship layer when a codex existsworker
scopeNopartition to orient on (must be inside MAGNEMO_SCOPE)

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark it read-only, idempotent, and non-destructive, so the bar is lower. The description goes further by disclosing the deterministic output property ('same vault state, same bytes'), the strict ordering requirement, and the anti-fabrication rule ('Charter first, verbatim, never fabricated'). This adds meaningful behavioral context beyond the structured annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two dense sentences with no filler. It front-loads the core object and rule, lists contents in a natural reading order, and closes with a deterministic guarantee. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only boot tool with no required parameters and no output schema, this is complete. It tells the agent what will be read, in what order, when to call it, and what property to expect. Nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with both parameters (class and scope) having enums and descriptions. The tool description adds no parameter-specific details, but it doesn't need to because the schema fully documents them. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the resource ('boot pack'), specifies the action (read it FIRST), and enumerates the exact ordered contents. It also adds the deterministic property ('same vault state, same bytes'), which makes the tool's purpose unambiguous and distinct from generic retrieval.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly prescribes when to use the tool: 'Read it FIRST on every wake.' This is clear contextual guidance. It doesn't explicitly contrast with siblings like retrieve or handoff, but the every-wake-first instruction is strong enough that an agent can infer this is the mandatory entry point.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

handoffRecord where this session stoppedA

Record a session boundary: appends telemetry (usage %, trigger, what was cut) to the append-only handoffs ledger AND stages a provenance-complete handoff note. The next bootpack inherits it. Doctrine: hand off at ~88-90%, do not ride to the wall.

ParametersJSON Schema
NameRequiredDescriptionDefault
cutNowhat was cut / deferred at the boundary
usageYescontext usage percent at the boundary
triggerYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only signal that this is not read-only, not idempotent, and not destructive. The description adds valuable behavioral context: it appends to an append-only ledger, stages a note, and has a downstream effect (next bootpack inherits it). It does not fully detail all side effects or return behavior, but it goes beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core action, then side effects, then policy. Every clause earns its place and the doctrine is memorable guidance rather than filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a three-parameter tool with no output schema, the description is nearly complete: it covers what happens, the downstream effect, and the recommended usage threshold. The only notable gaps are naming sibling tools for disambiguation and explaining the trigger enum values, neither of which is critical.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With only 67% schema description coverage and trigger lacking a description, the description compensates by mapping telemetry to usage %, trigger, and what was cut. usage and cut are already documented in the schema, and the description adds the unifying telemetry framing, though it adds little detail to the trigger enum.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource ('Record a session boundary') and details exactly what the tool does: appends telemetry to the append-only handoffs ledger and stages a handoff note that the next bootpack inherits. This clearly separates it from siblings like retrieve and bootpack by focusing on the boundary-recording action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The doctrine line gives concrete when-to-use guidance: hand off at ~88-90% and do not ride to the wall, so an agent knows the intended invocation point. It does not name alternative tools or explicitly say when not to use it, so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

retrieveLook something up in memoryA
Read-onlyIdempotent

Retrieve canonical (keyholder-approved) memory relevant to a query. Returns a scored, BUDGETED payload: mn:// pointers plus snippet renditions, never raw dumps. Scope is partition-walled; payload size is logged to the Foresight counters. Cite the returned rid when the action resolves.

ParametersJSON Schema
NameRequiredDescriptionDefault
kNo
queryYeswhat you need to remember
scopeNopartition to search (must be inside this agent's MAGNEMO_SCOPE)
budgetNomax payload bytes; results are truncated/downgraded to fit and the truncation is logged

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, openWorldHint=false, idempotentHint=true, and destructiveHint=false Score. The description goes beyond annotations by disclosing that the payload is budgeted and truncated/downgraded to fit, that scope is partition-walled, that payload size is logged to Foresight counters, and that results are never raw dumps. This materially enriches the agent's understanding of side effects and constraints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two dense sentences that front-load the core purpose and then add essential behavioral details. Every clause adds value, and there is no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of an output schema, the description reasonably explains the return shape: mn:// pointers plus snippet renditions, never raw dumps. It also covers budget truncation, scope constraints, and logging. It stops short of explaining edge cases like empty results or what rid means, but for a retrieval tool with rich annotations and schema, it is largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 75%, so the schema documents most parameters. The description adds meaning by explaining that budget controls payload truncation/downgrade and that scope is partition-walled. It also clarifies that results are scored and budgeted, which relates to the budget parameter. The k parameter is not explicitly addressed, but the schema provides range and default context.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: retrieve canonical, keyholder-approved memory relevant to a query. It also distinguishes the tool's behavior from a general memory lookup by specifying scored, budgeted payloads with mn:// pointers and snippet renditions. This clearly separates it from the unrelated sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when to use this tool: when canonical memory relevant to a query is needed segments. It also provides a usage instruction ('Cite the returned rid when the action resolves'). However, it does not explicitly state when not to use it or name alternatives, missing the top tier of guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

stageDraft an entry for a person to reviewA

Stage a memory candidate for KEYHOLDER review. This is the only write verb: the note lands in _staging/ with mandatory provenance and never touches canon. Returns the staged id, its salience, and a duplicate flag. Malformed or paperless (no provenance) notes are refused.

ParametersJSON Schema
NameRequiredDescriptionDefault
noteYes
provenanceYes

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds substantial behavioral detail beyond the annotations: the note lands in _staging/, never touches canon, requires provenance, returns the staged id/salience/duplicate flag, and refuses malformed or paperless notes. This is consistent with readOnlyHint=false and no contradiction exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three tight sentences with no filler. The core purpose is front-loaded, followed by location/side-effect constraints and return/refusal behavior. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given there is no output schema, the description usefully lists the return values and refusal conditions. The nested input schema carries the parameter detail. It could more fully explain what a duplicate flag or salience means, but the agent has enough to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, but it only repeats that provenance is required and that paperless notes are refused—both already implied by the schema. It adds no meaningful guidance about the note object, required fields, partitions, or staged-output semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Stage a memory candidate for KEYHOLDER review.' It also clarifies scope by stating this is 'the only write verb' and that the note 'lands in _staging/' and 'never touches canon,' clearly distinguishing it from its read-related siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context: use this when you need to stage a memory candidate for review, and it is the only write verb among the siblings. It does not explicitly name alternatives or state when not to use it, but the 'only write verb' framing gives strong routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 4 tool updatesv0.6.4
    • First observedbootpack
    • First observedhandoff
    • First observedretrieve
    • First observedstage

TDQS

A4.6/5.0

Scored across 4 tools

Disambiguation5/5

Each tool maps to a distinct lifecycle action: querying approved memory, proposing new memory, loading the boot context, and closing a session. There is no real overlap, since bootpack is a deterministic startup read while retrieve is on-demand canonical lookup.

Naming Consistency5/5

All four names are lowercase single-word commands, forming a consistent imperative style. They do not follow a verb_noun scheme, but the naming convention is uniform and predictable across the set.

Tool Count5/5

Four tools is tight but appropriate for the server's narrow, well-defined purpose. Each tool has a distinct role and none feels redundant or extraneous.

Completeness5/5

The toolset covers the full agent-facing memory lifecycle: wake with bootpack, read with retrieve, propose with stage, and close with handoff. Keyholder review appears intentionally external, and the deterministic bootpack plus append-only handoff ledger leaves no obvious dead end.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    B
    maintenance
    A local-first MCP server that gives AI assistants long-term memory by storing, searching, and recalling notes as Markdown files on your machine.
    8 npm
    MIT
  • A
    license
    A
    quality
    A
    maintenance
    A self-hosted MCP server that gives AI agents shared, long-term memory over a git-backed folder of markdown, enabling persistent knowledge search, read, and write without a database.
    16
    14 npm
    11
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    An MCP server that gives AI agents durable, temporal memory over local markdown vaults, with tools for searching, asserting facts, querying point-in-time state, and reinforcing useful knowledge.
    181 npm
    MIT