Magnemo
OfficialSummary: It's an MCP server for governed agent memory — agents can retrieve approved knowledge, draft memory entries for human review, load a boot pack on wake, and record session handoffs.
retrieve — search canonical (keyholder-approved) memory scoped to a partition (dev/ops/shared), with size budget, and get scored snippets with mn:// pointers.
stage — the only write verb: draft a note with title, body, partition, store, provenance, optional tags/impact/supersedes; it goes to staging, never canon.
bootpack — on wake, read the charter (verbatim), gate map, agent autonomy, canon digest, open threads, review queue, last handoff, and ledger tail; deterministic.
handoff — record a session boundary with usage %, trigger, and what was cut; appends to handoffs ledger and stages a handoff note for the next bootpack.
Can be run alongside an existing Obsidian vault as a governed memory layer, complementing current notes without replacing them.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Magnemostage a note: the API base URL is https://api.example.com"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Magnemo
Tools gave your agent hands. MCP gave it a nervous system. Magnemo gives it a brain.
Governed memory for AI agents. Every entry with a receipt. Your agent writes the draft; nothing is kept until you say yes.
The one paste
Open your AI (Claude Code, Cursor, Windsurf, or anything that speaks MCP) in any of your project folders, and paste this:
Set up Magnemo in this project:
1. Install it: pip install magnemo. It needs Python 3.11 or newer. If pip can't find it, install uv (curl -LsSf https://astral.sh/uv/install.sh | sh) and then run: uv tool install magnemo
2. Initialize the vault: magnemo init
3. Register the MCP server: run magnemo mount — it writes this project's MCP config itself.
4. Verify: run magnemo doctor and confirm everything passes.
5. Stage the first memory: one line on what this project is, using magnemo stage. Show me the note id.
6. Then tell me the exact command to approve it. After I approve, run magnemo bootpack and tell me what you remember — then remind me to restart you, so the memory mounts for every session after this one.
If anything fails, show me what went wrong and fix it if you can.You'll know it worked — your AI will tell you who it is now.
For builders. Magnemo is an MCP server with four tools — retrieve, stage,
bootpack, handoff — and a CLI for your side: review, promote, reject.
It runs on your machine, in plain markdown files you own, with zero network calls
(the doctor line proves it). Every promotion is a person's click, recorded with
who wrote the entry, when, and through which gate — memory with a witness. Trust is
computed from that record, never asserted. It mounts beside any memory you already
run (a folder of notes, Obsidian, a RAG stack). Python 3.11+, zero dependencies,
Apache-2.0.
Fresh vault? THE CHARTER section will say it isn't promoted yet — that is the
governance speaking: Magnemo never fabricates canon. Stage a charter, review it,
promote it, and every boot thereafter serves it back verbatim.
(magnemo not found after install? pip's script folder isn't on PATH —
python3 -m magnemo always works.)
Open beta — read KNOWN_LIMITS.md before trusting it with anything you can't lose. Honest caveats, no fine print.
Related MCP server: Engram
Install in your client
One server, said ten ways. Every block below is the same thing: uvx magnemo-mcp with MAGNEMO_VAULT pointing at
the folder your memory lives in (make one with magnemo init ./vault). Tested on this Mac where it says so;
the rest is from each client's own docs and marked untested — corrections welcome, open an issue.
Claude Code — tested.
claude mcp add magnemo -e MAGNEMO_VAULT=/absolute/path/to/vault -- uvx magnemo-mcp(claude mcp list shows magnemo … ✔ Connected. Add -s project to write it into the repo's .mcp.json for your team.)
Claude Desktop — tested. Download the extension from the latest release — magnemo-0.6.4.post1.mcpb — and open it; Claude Desktop asks for the vault folder and does the rest. (The connectors directory listing follows once it is accepted.)
Cursor — untested here (not installed on this Mac); the link and the block follow Cursor's docs.
Or
~/.cursor/mcp.json (or .cursor/mcp.json in the project):
{
"mcpServers": {
"magnemo": {
"command": "uvx",
"args": ["magnemo-mcp"],
"env": { "MAGNEMO_VAULT": "/absolute/path/to/vault" }
}
}
}VS Code / Copilot — untested here; per VS Code's docs.
Or
.vscode/mcp.json in the workspace:
{
"servers": {
"magnemo": {
"type": "stdio",
"command": "uvx",
"args": ["magnemo-mcp"],
"env": { "MAGNEMO_VAULT": "/absolute/path/to/vault" }
}
}
}Windsurf — untested; ~/.codeium/windsurf/mcp_config.json:
{
"mcpServers": {
"magnemo": {
"command": "uvx",
"args": ["magnemo-mcp"],
"env": { "MAGNEMO_VAULT": "/absolute/path/to/vault" }
}
}
}Cline — untested; Cline → MCP Servers → Configure → cline_mcp_settings.json:
{
"mcpServers": {
"magnemo": {
"command": "uvx",
"args": ["magnemo-mcp"],
"env": { "MAGNEMO_VAULT": "/absolute/path/to/vault" },
"disabled": false
}
}
}Continue — untested; ~/.continue/config.yaml (or a file in .continue/mcpServers/):
mcpServers:
- name: magnemo
command: uvx
args: ["magnemo-mcp"]
env:
MAGNEMO_VAULT: /absolute/path/to/vaultGemini CLI — untested; ~/.gemini/settings.json:
{
"mcpServers": {
"magnemo": {
"command": "uvx",
"args": ["magnemo-mcp"],
"env": { "MAGNEMO_VAULT": "/absolute/path/to/vault" }
}
}
}Codex CLI — untested; ~/.codex/config.toml:
[mcp_servers.magnemo]
command = "uvx"
args = ["magnemo-mcp"]
env = { MAGNEMO_VAULT = "/absolute/path/to/vault" }Zed — untested; settings.json → context_servers:
{
"context_servers": {
"magnemo": {
"source": "custom",
"command": "uvx",
"args": ["magnemo-mcp"],
"env": { "MAGNEMO_VAULT": "/absolute/path/to/vault" }
}
}
}After the install, the loop is the same everywhere: your agent writes to staging, you review.
magnemo yes # promote the top of the queue (yes <id-fragment> · yes --all)
magnemo no <id> --reason "…" # reject one — the reason is required; rejections teach
magnemo review # the interactive queue, when you want to read first
magnemo doctor # python, vault, config, ledger, and the mount — proves the zero-network line tooAnything that speaks MCP over stdio mounts the same way. The remote door (ChatGPT and hosted clients) is on its way in 0.7.0.
Agents draft, people keep — the one rule
Agents get four MCP tools. Promotion is not one of them.
Actor | Door | Can do |
Agents | MCP server (stdio) |
|
You | CLI + git (any editor) | review the queue · promote / reject · edit anything · own everything |
The vault
vault/
dev/ knowledge/ playbooks/ decisions/ debt/ ← example: a dev team's partition
ops/ knowledge/ playbooks/ clients/ decisions/ style/ ← example: an ops team's partition
shared/ tickets/ changelog/ ← interop bus (gated)
_staging/ agent writes await review here
_index/ machine-managed
_ledger/ trust_ledger.jsonl — append-only, never forgetsEvery note is markdown with provenance frontmatter (author, written, source, status, reviewed_by, supersedes, strength). Provenance is the file format.
Privacy
Magnemo runs on your machine and nowhere else. The vault is a folder of plain markdown
files you own and can read in any editor. The engine makes zero network calls — magnemo doctor proves it on every run — so nothing you or your agent writes leaves the computer.
There is no telemetry, no account, no phone-home; the only copies of your memory are the
ones you make yourself (magnemo chest), to places you own. The full page:
https://magnemo.ai/privacy
Guarantees (Phase 1 — Governed Recall)
Agent writes NEVER reach canonical stores directly — staging only, always.
Search returns canonical (keyholder-approved) notes only. Staged claims are invisible.
Partition walls enforced per agent (
MAGNEMO_PARTITIONS); cross-partition = DENIED.Supersession is explicit: old notes archive with a forward link. Nothing deletes.
Rejections are kept and recorded — rejections teach.
Every promote/reject lands in the append-only Trust Ledger with actor + reason.
Tests
python -m unittest discover -s tests -v # incl. full MCP round-trips (legacy + four-verb)
# or: pip install -e ".[test]" && pytestEverything that shipped
Release by release, with the design notes that used to live here: CHANGELOG.md.
— Silver Valley Technologies Inc. · Phase 1 of 3 · The memory that learns is the memory that is governed.
Available Tools
4 toolsbootpackRead what this agent wakes up knowingARead-onlyIdempotent
The boot pack: Charter first (verbatim, never fabricated), then the Gate Map, YOUR AUTONOMY (this agent's own trust levels), canon digest, open threads, salience-ranked review queue, last handoff, ledger tail. Read it FIRST on every wake. Deterministic: same vault state, same bytes.
| Name | Required | Description | Default |
|---|---|---|---|
| class | No | worker = lean; partner = adds the relationship layer when a codex exists | worker |
| scope | No | partition to orient on (must be inside MAGNEMO_SCOPE) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark it read-only, idempotent, and non-destructive, so the bar is lower. The description goes further by disclosing the deterministic output property ('same vault state, same bytes'), the strict ordering requirement, and the anti-fabrication rule ('Charter first, verbatim, never fabricated'). This adds meaningful behavioral context beyond the structured annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two dense sentences with no filler. It front-loads the core object and rule, lists contents in a natural reading order, and closes with a deterministic guarantee. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only boot tool with no required parameters and no output schema, this is complete. It tells the agent what will be read, in what order, when to call it, and what property to expect. Nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with both parameters (class and scope) having enums and descriptions. The tool description adds no parameter-specific details, but it doesn't need to because the schema fully documents them. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the resource ('boot pack'), specifies the action (read it FIRST), and enumerates the exact ordered contents. It also adds the deterministic property ('same vault state, same bytes'), which makes the tool's purpose unambiguous and distinct from generic retrieval.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly prescribes when to use the tool: 'Read it FIRST on every wake.' This is clear contextual guidance. It doesn't explicitly contrast with siblings like retrieve or handoff, but the every-wake-first instruction is strong enough that an agent can infer this is the mandatory entry point.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
handoffRecord where this session stoppedA
Record a session boundary: appends telemetry (usage %, trigger, what was cut) to the append-only handoffs ledger AND stages a provenance-complete handoff note. The next bootpack inherits it. Doctrine: hand off at ~88-90%, do not ride to the wall.
| Name | Required | Description | Default |
|---|---|---|---|
| cut | No | what was cut / deferred at the boundary | |
| usage | Yes | context usage percent at the boundary | |
| trigger | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only signal that this is not read-only, not idempotent, and not destructive. The description adds valuable behavioral context: it appends to an append-only ledger, stages a note, and has a downstream effect (next bootpack inherits it). It does not fully detail all side effects or return behavior, but it goes beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core action, then side effects, then policy. Every clause earns its place and the doctrine is memorable guidance rather than filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a three-parameter tool with no output schema, the description is nearly complete: it covers what happens, the downstream effect, and the recommended usage threshold. The only notable gaps are naming sibling tools for disambiguation and explaining the trigger enum values, neither of which is critical.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With only 67% schema description coverage and trigger lacking a description, the description compensates by mapping telemetry to usage %, trigger, and what was cut. usage and cut are already documented in the schema, and the description adds the unifying telemetry framing, though it adds little detail to the trigger enum.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource ('Record a session boundary') and details exactly what the tool does: appends telemetry to the append-only handoffs ledger and stages a handoff note that the next bootpack inherits. This clearly separates it from siblings like retrieve and bootpack by focusing on the boundary-recording action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The doctrine line gives concrete when-to-use guidance: hand off at ~88-90% and do not ride to the wall, so an agent knows the intended invocation point. It does not name alternative tools or explicitly say when not to use it, so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
retrieveLook something up in memoryARead-onlyIdempotent
Retrieve canonical (keyholder-approved) memory relevant to a query. Returns a scored, BUDGETED payload: mn:// pointers plus snippet renditions, never raw dumps. Scope is partition-walled; payload size is logged to the Foresight counters. Cite the returned rid when the action resolves.
| Name | Required | Description | Default |
|---|---|---|---|
| k | No | ||
| query | Yes | what you need to remember | |
| scope | No | partition to search (must be inside this agent's MAGNEMO_SCOPE) | |
| budget | No | max payload bytes; results are truncated/downgraded to fit and the truncation is logged |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, openWorldHint=false, idempotentHint=true, and destructiveHint=false Score. The description goes beyond annotations by disclosing that the payload is budgeted and truncated/downgraded to fit, that scope is partition-walled, that payload size is logged to Foresight counters, and that results are never raw dumps. This materially enriches the agent's understanding of side effects and constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two dense sentences that front-load the core purpose and then add essential behavioral details. Every clause adds value, and there is no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the absence of an output schema, the description reasonably explains the return shape: mn:// pointers plus snippet renditions, never raw dumps. It also covers budget truncation, scope constraints, and logging. It stops short of explaining edge cases like empty results or what rid means, but for a retrieval tool with rich annotations and schema, it is largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 75%, so the schema documents most parameters. The description adds meaning by explaining that budget controls payload truncation/downgrade and that scope is partition-walled. It also clarifies that results are scored and budgeted, which relates to the budget parameter. The k parameter is not explicitly addressed, but the schema provides range and default context.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: retrieve canonical, keyholder-approved memory relevant to a query. It also distinguishes the tool's behavior from a general memory lookup by specifying scored, budgeted payloads with mn:// pointers and snippet renditions. This clearly separates it from the unrelated sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use this tool: when canonical memory relevant to a query is needed segments. It also provides a usage instruction ('Cite the returned rid when the action resolves'). However, it does not explicitly state when not to use it or name alternatives, missing the top tier of guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
stageDraft an entry for a person to reviewA
Stage a memory candidate for KEYHOLDER review. This is the only write verb: the note lands in _staging/ with mandatory provenance and never touches canon. Returns the staged id, its salience, and a duplicate flag. Malformed or paperless (no provenance) notes are refused.
| Name | Required | Description | Default |
|---|---|---|---|
| note | Yes | ||
| provenance | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds substantial behavioral detail beyond the annotations: the note lands in _staging/, never touches canon, requires provenance, returns the staged id/salience/duplicate flag, and refuses malformed or paperless notes. This is consistent with readOnlyHint=false and no contradiction exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three tight sentences with no filler. The core purpose is front-loaded, followed by location/side-effect constraints and return/refusal behavior. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given there is no output schema, the description usefully lists the return values and refusal conditions. The nested input schema carries the parameter detail. It could more fully explain what a duplicate flag or salience means, but the agent has enough to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, but it only repeats that provenance is required and that paperless notes are refused—both already implied by the schema. It adds no meaningful guidance about the note object, required fields, partitions, or staged-output semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Stage a memory candidate for KEYHOLDER review.' It also clarifies scope by stating this is 'the only write verb' and that the note 'lands in _staging/' and 'never touches canon,' clearly distinguishing it from its read-related siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context: use this when you need to stage a memory candidate for review, and it is the only write verb among the siblings. It does not explicitly name alternatives or state when not to use it, but the 'only write verb' framing gives strong routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
4 tool updates
v0.6.4- First observed
bootpack - First observed
handoff - First observed
retrieve - First observed
stage
TDQS
Scored across 4 tools
Each tool maps to a distinct lifecycle action: querying approved memory, proposing new memory, loading the boot context, and closing a session. There is no real overlap, since bootpack is a deterministic startup read while retrieve is on-demand canonical lookup.
All four names are lowercase single-word commands, forming a consistent imperative style. They do not follow a verb_noun scheme, but the naming convention is uniform and predictable across the set.
Four tools is tight but appropriate for the server's narrow, well-defined purpose. Each tool has a distinct role and none feels redundant or extraneous.
The toolset covers the full agent-facing memory lifecycle: wake with bootpack, read with retrieve, propose with stage, and close with handoff. Keyholder review appears intentionally external, and the deterministic bootpack plus append-only handoff ledger leaves no obvious dead end.
Maintenance
Related MCP Connectors
One memory, every AI. A shared, user-owned markdown memory your AI clients read and write over MCP.
An MCP memory server. One memory your agents share — across models, devices and apps.
Markdown-based note-taking with a hosted MCP server. Your notes serve you and your AI.
Cloud-hosted MCP server for durable AI memory
Related MCP Servers
- AlicenseNot gradedqualityBmaintenanceA local-first MCP server that gives AI assistants long-term memory by storing, searching, and recalling notes as Markdown files on your machine.8 npmMIT
- AlicenseAqualityAmaintenanceA self-hosted MCP server that gives AI agents shared, long-term memory over a git-backed folder of markdown, enabling persistent knowledge search, read, and write without a database.1614 npm11MIT
- AlicenseAqualityCmaintenanceA local-first MCP server that provides a shared Markdown-based memory for AI coding agents, enabling cross-agent context persistence via tools like memory_search and memory_capture.101MIT
- AlicenseNot gradedqualityAmaintenanceAn MCP server that gives AI agents durable, temporal memory over local markdown vaults, with tools for searching, asserting facts, querying point-in-time state, and reinforcing useful knowledge.181 npmMIT