compound-memory
The compound-memory MCP server gives AI agents a local-first, file-backed shared memory store exposed through exactly 5 tools — write, search, get, link, and feedback — so knowledge compounds across sessions and hosts instead of being relearned.
Write memories (
memory_write): store episodes, facts, insights, skills, or decisions to_sharedor a privateagent-<name>namespace, with optional stablekey, links,projectscope,valid_from/valid_untilvalidity window, andlesson_role(lesson/avoid); content capped at 262144 chars; duplicate keys flagconflict: trueand queue a review entry.Search memories (
memory_search): hybrid lexical (BM25) + optional vector (BGE/sqlite-vec) recall fused via RRF with graceful fallback to lexical; scopes to_sharedplus your own private namespace by default; supportstop_k,ns,project(fail-closed),readerfor private namespaces,explain, andinclude_neighbors(up to 3 trimmed one-hop neighbors per hit); returns{hits, count, retrieval}.Fetch by id (
memory_get): retrieve a specific memory with its one-hop neighbors (no cap, archived neighbors kept, expired ones omitted); private-namespace reads requirereader.Link memories (
memory_link): create bidirectional associations between two memories in the same namespace (association is compounding source #2); private-namespace links require owner identity.Report feedback (
memory_feedback): close the compounding loop by recording how a memory actually performed —success(+0.1, plus +0.15 first cross-host validation),failure(−0.2, floor 0.05),contradiction(freeze + review queue),obsolete(archive now), orunknown(record only); every outcome advancesuses/last_used.Compound value automatically: confirmed usage raises confidence, strong memories resist decay, neglected ones archive but remain revivable, and distillation merges many raw memories into fewer denser ones.
Coordinate multiple agents: a shared
_sharednamespace everyone reads/writes plus per-hostagent-*private namespaces, with process-identity attestation preventing forged cross-host validation.Maintain the store: results include retrieval mode/reason and evidence trails, and the same underlying store supports a CLI for init, search, feedback, decay, revive, distill-plan/apply, dream, doctor, stats, rebuild-index, review-queue, and git history.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@compound-memorysave a memory that this project uses pnpm, not npm"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
compound-memory
English | 简体中文
Local-first shared memory for multiple AI agents — plain Markdown files that compound in value as they are used. Memory lives on your disk as frontmatter-annotated Markdown, gets stronger with every confirmed use, decays into a revivable archive when neglected, and auto-commits to a local git history on every write.
Why
Every agent session starts from zero: preferences get re-asked, project conventions get re-discovered, the same pitfall gets hit twice. compound-memory gives all your agents one shared store:
Local-first — nothing leaves your machine; memories are human-readable Markdown files, not rows in an opaque database.
MCP-native — exactly 5 tools (
memory_write/memory_search/memory_get/memory_link/memory_feedback) as the single read-write boundary; works with any MCP host (Claude Code, ZCode, WorkBuddy, …), plus a full CLI for operations.Compounding — confirmed usage raises confidence, related memories are recalled as neighbors, validation from a different host counts as independent evidence, and distillation merges many raw memories into fewer, denser ones.
Multi-agent by design — a
_sharednamespace everyone reads, plusagent-*private namespaces each host owns; cross-host validation is tracked per host.Optional semantic recall — vector search via sqlite-vec + BGE embeddings, with automatic graceful fallback to pure lexical search when unavailable. Override the model with
COMPOUND_MEMORY_EMBEDDING_MODEL(defaultXenova/bge-small-zh-v1.5) andCOMPOUND_MEMORY_EMBEDDING_DIM(default 512); changing either is an ops action and needs an explicitrebuild-index.
Related MCP server: Link
Quick Start
For AI agents
Paste this one-liner into your coding agent (Claude Code, Cursor, ZCode, …) and let it do the rest:
Set up compound-memory (https://github.com/chinwe/compound-memory) — a local-first multi-agent shared memory (MCP server + CLI) — on this machine. Do not clone the repo for a normal install. Initialize the store with `uvx --from compound-memory compound-memory init` (defaults to ~/.agents/memory). Register its stdio MCP server in this host's MCP config: command `uvx`, args `--from compound-memory compound-memory-server`, env `COMPOUND_MEMORY_ROOT=$HOME/.agents/memory` and `COMPOUND_MEMORY_AGENT_ID=agent-<your-host-id>`. Verify by calling `memory_search` and expecting a `{"hits": [...]}` response; if the host needs a restart to load MCP servers, tell me. Use `uv run --directory <repo>` only when developing against a local checkout. Short English setup and the search → feedback → write loop: docs/agent-integration.en.md. Full per-host configs: docs/agent-integration.md.For humans
1. Install
Python ≥ 3.11. The default does not clone the repo:
# Default: PyPI. Hosts launch the MCP server with
# uvx --from compound-memory compound-memory-server
# Optional CLI on PATH:
uv tool install compound-memory # or: pip install compound-memory
# Developer / local checkout only — not the default host launch
git clone https://github.com/chinwe/compound-memory.git
cd compound-memory && uv sync --extra dev2. Initialize your store
Defaults to ~/.agents/memory; override with the COMPOUND_MEMORY_ROOT env var. A leading ~ or $HOME is expanded; a blank override falls back to the default.
uvx --from compound-memory compound-memory init
# after `uv tool install`: compound-memory init3. Wire it into your MCP host (recommended)
This lets your everyday agents read/write the shared store automatically. No repo path:
{
"mcpServers": {
"compound-memory": {
"type": "stdio",
"command": "uvx",
"args": ["--from", "compound-memory", "compound-memory-server"],
"env": {
"COMPOUND_MEMORY_ROOT": "$HOME/.agents/memory",
"COMPOUND_MEMORY_AGENT_ID": "agent-<your-host-id>"
}
}
}
}uvx takes the package name; the server console script is compound-memory-server, so --from is required. If uvx is not on PATH, set command to the absolute path ~/.local/bin/uvx. COMPOUND_MEMORY_AGENT_ID is required for any multi-agent store: the process identity wins over whatever the model claims, so a forged source cannot write another host's namespace or inflate cross-host validation. Unset or blank is a hard failure for shared _shared use: stats and doctor exit 1 (the diagnosis is still printed). MCP tools keep running, and the server logs the same warning at startup. Without the id, identity is self-reported and can be forged.
A local checkout is the developer path, not a second default: command uv, args ["run", "--directory", "<absolute-repo-path>", "compound-memory-server"] after uv sync --extra dev.
Verify: ask your agent to call memory_search (any keyword) — a {"hits": [...]} response means you're connected. Or run uvx --from compound-memory compound-memory doctor (exit 0 when COMPOUND_MEMORY_AGENT_ID is set and the store is writable; exit 1 when it is unset or blank).
Claude Code plugin
Requires Claude Code and uv (uvx on PATH). This repository hosts a self-hosted marketplace. Submitting the plugin to Anthropic's official Directory is out of scope.
claude plugin marketplace add chinwe/compound-memory
claude plugin install compound-memory@compound-memoryThat installs integrations/claude, which launches uvx --from compound-memory compound-memory-server with COMPOUND_MEMORY_AGENT_ID=agent-claude (override that env var in the host if you need a different id). A SessionStart hook adds a short reminder on new sessions; verify and disable steps are in the plugin README. Those marketplace and plugin files are not in the PyPI sdist or wheel: MANIFEST.in prunes them, and scripts/wheel_smoke.sh checks the built artifacts.
WorkBuddy / CodeBuddy plugin
Requires WorkBuddy or CodeBuddy and uv (uvx on PATH). This repository hosts a self-hosted marketplace at .codebuddy-plugin/marketplace.json.
/plugin marketplace add chinwe/compound-memory
/plugin install compound-memory@compound-memoryThat installs integrations/workbuddy, which launches the same PyPI server with COMPOUND_MEMORY_AGENT_ID=agent-workbuddy. A SessionStart hook prints a short hard-rule reminder on new sessions and does not read the store. The Claude marketplace file is unchanged.
ZCode plugin
Requires the ZCode desktop app and uv (uvx on PATH). ZCode reads this repository's .claude-plugin/marketplace.json as its marketplace catalog, so no separate marketplace file is needed.
Clone the repository, then in ZCode: Plugin Marketplace → Add → Add Plugin Marketplace, paste the clone path (the directory containing .claude-plugin/), and install Compound Memory (ZCode) under Personal → compound-memory. That installs integrations/zcode, which launches the same PyPI server with COMPOUND_MEMORY_AGENT_ID=agent-zcode, plus a SessionStart hard-rule reminder and the short skill. The plugin's MCP server is named compound-memory; if ~/.zcode/cli/config.json already registers a server with that name (the hand-written path, §3 of docs/agent-integration.md), keep only one of the two.
4. Next step
Inject the usage protocol from skills/compound-memory/SKILL.md into your host (the search → feedback → write loop). The short English version is docs/agent-integration.en.md; the full protocol is docs/agent-integration.md §6.
Demo

One full loop: write → search → feedback (with cross-host first-validation bonus) → store health. Real output from v0.4.0, long payloads trimmed:
uv run compound-memory init{ "ok": true, "root": "~/.agents/memory" }Two different hosts each write one stable fact (new memories start at confidence 0.5, uses 0):
uv run compound-memory write \
"Deploy serverless functions on this platform times out at 10s — keep handlers under that budget" \
fact agent-claude --key vercel-timeout{
"id": "20261007_86adf1",
"ns": "_shared",
"type": "fact",
"source": "agent-claude",
"content": "Deploy serverless functions on this platform times out at 10s — keep handlers under that budget",
"confidence": 0.5,
"uses": 0,
"key": "vercel-timeout",
"validated_by": []
...
}uv run compound-memory write \
"User prefers concise replies with tables and code examples" \
fact agent-zcode --key user-styleSearch ranks by score (--explain attaches per-hit ranking components for debugging):
uv run compound-memory search "serverless timeout"[
{
"id": "20261007_86adf1", "score": 1.0292, "similarity": 1.0,
"type": "fact", "source": "agent-claude",
"content": "Deploy serverless functions on this platform times out at 10s — keep handlers under that budget",
"neighbors": []
},
{
"id": "20261007_6a0c0c", "score": 0.5211, "similarity": 0.4919,
"type": "fact", "source": "agent-zcode",
"content": "User prefers concise replies with tables and code examples",
"neighbors": []
}
]A different host used this memory and reported it back with the default success outcome — uses +1, conf +0.1; and since the reporter agent-workbuddy ≠ source agent-claude, the first cross-host validation adds another +0.15:
uv run compound-memory feedback 20261007_86adf1 agent-workbuddy{
"id": "20261007_86adf1",
"confidence": 0.75,
"uses": 1,
"last_used": "2026-10-07",
"validated_by": ["agent-workbuddy"],
"evidence": {
"success_count": 1, "failure_count": 0, "contradiction_count": 0,
"last_verified": "2026-10-07",
"recent": [{ "date": "2026-10-07", "agent": "agent-workbuddy", "outcome": "success" }]
}
...
}Store health at a glance (fixed-bucket histograms, liveness, distillation yield):
uv run compound-memory stats{
"total": 2, "archived": 0, "active": 2,
"avg_confidence": 0.625,
"by_type": { "fact": 2 },
"by_ns": { "_shared": 2 },
"review_queue_entries": 0,
"uses_histogram": { "0": 1, "1-2": 1, "3-5": 0, "6-9": 0, "10+": 0 },
"confidence_histogram": { "<0.3": 0, "0.3-0.6": 1, "0.6-0.8": 1, "0.8-1.0": 0 },
"recent_feedback_7d": 1, "cross_validated": 0,
"distilled_total": 0, "distilled_recent_7d": 0
}Current stats also includes retrieval (mode: vector or lexical, plus reason when the vector channel is off), attestation (attested, plus a warning when COMPOUND_MEMORY_AGENT_ID is unset), and expired_active (active-area memories whose valid_until has passed; 0 in this snapshot). cross_validated counts memories whose validated_by lists at least two distinct agents — the single cross-host validation above correctly leaves it at 0. memory_search carries the same retrieval object. CLI search stays a bare array. CLI stats exits 1 when COMPOUND_MEMORY_AGENT_ID is unset or blank; doctor is the one-page check (attestation, retrieval, write lock, git) and uses the same rule, plus root / lock / git failures. MCP tools do not stop for a missing agent id.
Three things to notice:
New memories start at
confidence0.5 and move on evidence — feedback carries an outcome:successraises it,failurelowers it (floor 0.05),contradictionfreezes it into the review queue,obsoletearchives immediately.First validation from a different host earns an independent bonus (once per host per memory), with
validated_by/evidencetrails — confidence is evidence of correctness, not popularity.Hits embed one-hop neighbors automatically (empty here — no links yet;
memory_linkcreates bidirectional links that get recalled for free).
How compounding works
Interest source | Mechanism |
① Usage reinforcement | Every |
② Link value |
|
③ Distillation |
|
④ Cross-agent validation | On |
Scoring (weights are the W_* constants in src/compound_memory/scoring.py): 0.70·similarity + 0.15·confidence + 0.10·recency(0.5+0.5·e^(−Δt/τ)) + 0.05·type weight. With the vector channel enabled, ranking switches to RRF fusion with an ε=0.04 prior tie-break (see the spec, "index as cache").
The 5 MCP tools
Tool | Purpose | Key points |
| Write a memory |
|
| Retrieve | Returns |
| Fetch by id | Always contains a |
| Link two memories | Bidirectional; both sides must be in the same ns; private-ns links require owner identity |
| Report how a memory actually behaved | Every outcome advances |
Tool descriptions embed the protocol rules themselves, so agents keep the loop intact even without host-side rules injected. Short English loop: docs/agent-integration.en.md. Full parameter reference: docs/agent-integration.md.
CLI
Checkout commands below (uv run inside a clone). Hosts that did not clone the repo use uvx --from compound-memory compound-memory … instead.
uv sync --extra dev # first clone: build .venv (later `uv run` reuses it)
uv run compound-memory init # initialize an empty store
uv run compound-memory write "Vercel Serverless has a 10s timeout" episode agent-workbuddy
uv run compound-memory search "Vercel timeout" # default top_k=5; hits embed one-hop neighbors (limit 3, --no-neighbors to disable)
uv run compound-memory feedback <id> agent-claude
uv run compound-memory decay # run from cron
uv run compound-memory revive <id> # revive an archived memory
uv run compound-memory distill-plan # distillation candidates: suggested_action is merge / promote / review; also report-only negative_salience and contradiction_pairs
uv run compound-memory dream --ns _shared # read-only report: distill-plan section (including the negative sections) + decay_signals + equal stats snapshots (no writes, no LLM)
uv run compound-memory maintain # one ops pass: read-only dream → optional decay → health-snapshot. Decay is off unless --with-decay or RUN_DECAY=1 (DECAY=1). No --propose, no dream-apply
uv run compound-memory dream --ns _shared --propose # system proposes: qualifying clusters go to <root>/distill/dream-proposals.json; a human runs dream-apply. Default off; empty pack is []
uv run compound-memory dream-apply --proposals apply.json --source agent-workbuddy --dry-run # gated apply preview; drop --dry-run to run distill-apply on admitted rows
uv run compound-memory distill-apply "the merged insight" insight agent-workbuddy --sources <id1>,<id2> # atomic: product (links, origin=distillation) + source archival, one commit
uv run compound-memory doctor # one-page health check; exit 1 if AGENT_ID is unset, root is missing, the lock is broken, or git is unusable
uv run compound-memory stats # health: uses/confidence buckets + liveness + distillation yield; exit 1 if AGENT_ID is unset
uv run compound-memory rebuild-index # rebuild the search cache anytime
uv run compound-memory review-queue # conflict queue (CLI-only entry)
uv run compound-memory git-log # audit trailMore operations: explain <id> (confidence composition + evidence detail for one memory), forget <id> --agent <id> (terminal removal, ADR-0009), review-resolve (adjudicate conflicts), extract <transcript|dir> (deterministic session-transcript mining).
Architecture
Agent (MCP client / CLI)
└─ memory_write | memory_search | memory_get | memory_link | memory_feedback
└─ MemoryStore (~/.agents/memory)
├─ namespaces/_shared/{episode,fact,insight,skill,decision}/*.md shared area
├─ namespaces/agent-*/... private areas
├─ archive/... decayed archive (revivable)
├─ index/tokens.json rebuildable lexical cache
├─ index/vectors.db rebuildable vector cache (optional)
├─ review-queue.md fact/insight/decision conflict queue
└─ .git/ auto-commit on every writeScheduled distillation prep (launchd / cron / systemd)
Per ADR 0001, the deterministic prep runs on a schedule while judgment (summarizing / merging) stays with the calling agent. Every day at 09:00 dream writes a read-only report to <root>/distill/last-plan.json (the distill object is the candidate list; nothing is archived or forgotten). Schedulers keep calling dream; dream-apply is the explicit, caller-supplied apply and is not part of the timer. Pick one scheduler — launchd (macOS standard, catches up after sleep), systemd user timer (Persistent=true, same catch-up), or cron (most portable, no catch-up) — all three drive the same platform-neutral scripts/distill-prepare.sh. Ready-made templates: scripts/com.compound-memory.distill-prepare.plist.tmpl (launchd), scripts/compound-memory-distill-prepare.{service,timer}.example (systemd), and scripts/compound-memory-distill-prepare.cron.example (cron). The filled launchd / systemd / cron commands are in the Chinese README. The script runs set -eu: any failure exits non-zero (visible via launchctl list / systemctl --user list-timers / cron mail, log at distill/prepare.log). distill/ is a runtime artifact directory (auto-gitignored) — no commit noise; only distill-apply after agent judgment lands one atomic commit.
Daily maintenance (one timer)
compound-memory maintain is the single daily job: read-only dream (writes <root>/distill/last-plan.json, same report as dream, never --propose) → optional decay → health-snapshot. The snapshot runs after decay, so it records the post-decay store when decay ran. Default is dream + health-snapshot. Decay stays off unless you pass --with-decay or set RUN_DECAY=1 (DECAY=1 is an alias). Any failing step exits non-zero and names that step on stderr; later steps do not run.
scripts/distill-prepare.sh stays the dream-only prep path. Do not point a timer at dream --propose, dream-apply, or distill-apply (ADR-0001 / #72 / #97): proposals and merges stay an explicit human/agent step. scripts/daily-maintain.sh is a thin launchd/cron wrapper (resolves uv on PATH, then execs compound-memory maintain). It does not orchestrate the steps.
From a checkout, one cron line is enough (decay off):
0 9 * * * COMPOUND_MEMORY_ROOT=$HOME/.agents/memory $HOME/.local/bin/uv run --project <repo> compound-memory maintain >> $HOME/.agents/memory/distill/daily-maintain.log 2>&1Same job with decay: prefix RUN_DECAY=1. A launchd ProgramArguments array can be the same uv, run, --project, <repo>, compound-memory, maintain (set COMPOUND_MEMORY_ROOT and, only if you want decay, RUN_DECAY under EnvironmentVariables). The thin wrapper is the PATH-proof alternative: /bin/sh <repo>/scripts/daily-maintain.sh with UV_BIN set. Keep using distill-prepare.sh when the timer should only refresh the dream report.
Documentation
CHANGELOG.md— release notes (0.5.x Windows support and later)docs/specs/0001-compound-memory-spec.md— design specdocs/agent-integration.en.md— short English setup (uvx, required agent id, 5 tools, search → feedback → write)docs/agent-integration.md— per-host MCP configs + the unified usage protocol (Chinese; full guide)docs/eval/README.md— how to record "can run" versus "did the same task change with memory". A checklist and a small fixed prompt set, not a measured effectiveness claimdocs/adr/— architecture decision recordsCONTEXT.md— glossary (Chinese)skills/compound-memory/SKILL.md— usage rules for hosts (Chinese)
Development
uv run pytest tests/ -q # full suite (MCP tool boundary + distillation + lifecycle/index/CLI + input defense)
uv run mypy src/compound_memory/ # whole package, non-strict except the modules belowstorage.validation, storage.paths, and server are checked with the per-module strict flags in pyproject.toml (the same mypy invocation CI runs on Ubuntu / Python 3.13). Other modules stay on the looser global config. Do not set strict = true inside a [[tool.mypy.overrides]] block: mypy applies that key to the global options and would strict-check the whole package.
Test seams: the MCP tool boundary via in-process mcp.Client(server) (no subprocess) plus unit tests for core modules (scoring / index / store ops). CI runs tests, type checks, and a pure-wheel install smoke on Linux and Windows across Python 3.11/3.12/3.13.
Platform support
Python ≥ 3.11 on macOS, Linux, and Windows.
macOS / Linux | Windows | |
Install |
| Same. CI installs the pure wheel and runs |
Write lock |
|
|
Lock file cannot be created | Warning, write proceeds unlocked | Same. This is a broken filesystem, not lock contention |
File permissions | POSIX mode bits preserved on atomic replace | No POSIX permissions; the permission-align step is skipped |
Vector recall | Optional | Same code path. Windows CI does not install the |
Scheduled distill prep | launchd, systemd user timer, or cron ( | No first-party Task Scheduler template; point cron or Task Scheduler at |
Daily maintain | one cron/launchd job: | Same command. Decay only with |
Git history |
| Same |
Release
PyPI versions are immutable and the tag must match pyproject.toml's version (the release workflow verifies this and fails loudly). Releases go through GitHub Actions + PyPI Trusted Publisher (OIDC, no token): push a tag like v0.1.0 and release.yml builds and publishes automatically.
MCP Registry name: mcp-name: io.github.chinwe/compound-memory
server.json records the PyPI package compound-memory (stdio). It does not name a repo path. Host configs still use uvx --from compound-memory compound-memory-server, because the package name and the server console script differ.
Available Tools
5 toolsmemory_feedbackA
Report feedback on a memory with an outcome (closes the compounding loop — call after actually adopting a memory). Every outcome advances uses and last_used. outcome: 'success' (default, the memory worked), 'failure' (it misled you — confidence drops 0.2, floor 0.05), 'contradiction' (you dispute it — confidence frozen and a review entry is queued pending adjudication), 'obsolete' (it is superseded — archived immediately), 'unknown' (records the event only: confidence does not move). Anything else is rejected. Success raises confidence (+0.1; extra +0.15 when a different agent validates for the first time). agent must be your own source agent id. Memories in a private 'agent-' namespace accept feedback only from the owner (agent = 'agent-' or ''). Archiving is reversed on feedback (except outcome=obsolete, which archives instead).
| Name | Required | Description | Default |
|---|---|---|---|
| agent | Yes | ||
| mem_id | Yes | ||
| outcome | No | success |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so richly: it details per-outcome confidence deltas (+0.1, +0.15, -0.2 with floor 0.05), archiving, review queuing, and freezing behavior, plus auth constraints for private namespaces and reversal semantics. This is exactly the behavioral context an agent needs before a state-mutating call.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose and usage timing, then structured by outcome. Dense but every clause carries information; there is minor redundancy in the trailing sentence about archiving being reversed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a side-effecting tool with no annotations and no output schema, it covers the material behavior an agent needs. It does not describe the response shape or whether feedback can be resubmitted/edited, a small remaining gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the schema declares no enum, yet the description fully enumerates all five valid outcome values with their effects and states that anything else is rejected. It also explains 'agent' semantics (must be your own source agent id, owner rules for private namespaces), compensating for the total schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource (report feedback on a memory) and names the conceptual function (closes the compounding loop). It is clearly distinct from siblings like memory_write/search/get/link, which are CRUD/query operations rather than outcome reporting.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear timing guidance — 'call after actually adopting a memory' — which tells the agent the precondition for invocation. It does not explicitly name when-not to use it or route to alternatives, so it falls just short of the top band.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
memory_getA
Fetch a memory by id; one-hop link neighbors are included by default. reader: your own source agent id — required when the memory lives in a private 'agent-' namespace (readable only by its owner host). project: your workspace project slug — get-by-id itself is always readable regardless of project, but embedded neighbors are filtered to global ones plus your project's. After adopting it, call memory_feedback (agent = your source id).
| Name | Required | Description | Default |
|---|---|---|---|
| mem_id | Yes | ||
| reader | No | ||
| project | No | ||
| include_neighbors | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does substantial work: it discloses that neighbors are returned by default, that private-namespace reads require the owner's reader id, and that embedded neighbors are filtered to global plus the caller's project. It does not describe return shape, error modes, or whether missing ids fail loudly, leaving some behavioral gaps for a 4-parameter read tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core action and default behavior are front-loaded in the first clause, and the parameter notes follow in order. The longer em-dash sentences and the trailing memory_feedback instruction add real information but make the block denser than it needs to be.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description supplies the permission model, the default neighbor behavior, and the project-scoping rule — enough for an agent to call it correctly in the common case. It stops short of describing the response payload or failure behavior, which a 0%-coverage schema leaves entirely undocumented.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate and largely does: reader gets meaning plus a required-when condition, project gets meaning plus its filtering effect on neighbors, and include_neighbors is implied by 'included by default'. Only mem_id is left undefined, which is self-evident from the purpose sentence.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Fetch a memory by id', and immediately narrows scope by noting that one-hop link neighbors are included by default. It never explicitly contrasts with memory_search or memory_link, so an agent gets the gist but must infer the boundary between this and the search sibling on its own.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states a real conditional rule ('reader: required when the memory lives in a private agent-<name> namespace') and a follow-up workflow ('After adopting it, call memory_feedback'). What is missing is a negative case — there is no statement of when to prefer memory_search or memory_link instead.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
memory_linkA
Create a bidirectional link between two memories (compounding source #2: association). Both memories must live in the same namespace; cross-namespace links are rejected. Memories in a private 'agent-' namespace accept links only from the owner (agent = your own source agent id).
| Name | Required | Description | Default |
|---|---|---|---|
| id_a | Yes | ||
| id_b | Yes | ||
| agent | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose the mutating effect (bidirectional link), the namespace constraint, and the ownership/permission rule. However, it is silent on idempotency, what happens if the link already exists, whether links can be removed, and failure behavior beyond rejection.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action, then constraints in descending order of importance. The '(compounding source #2: association)' aside is internal jargon that interrupts the flow slightly, but the paragraph is otherwise tight and waste-free.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an unannotated mutation tool with no output schema, the description covers the key operational constraints (namespace, ownership) an agent needs before calling. Missing details on return/error behavior are minor since no output schema exists to lean on.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It clarifies the agent parameter ('your own source agent id') and ties it to the ownership rule, but id_a and id_b get no explanation beyond their names, leaving two required params essentially undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: 'Create a bidirectional link between two memories'. The bidirectionality and the association framing are precise. It does not name a sibling such as memory_feedback to disambiguate, but the purpose is otherwise unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear conditions and exclusions: both memories must share a namespace, cross-namespace links are rejected, and private 'agent-<name>' namespaces accept links only from the owner. It stops short of comparing against siblings like memory_feedback or memory_write, so it is strong context without explicit alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
memory_searchA
Search memories. Fuses lexical (BM25) and, when the vec extra + model are installed, vector (BGE) recall via RRF; otherwise falls back to lexical only. The response always includes retrieval {mode, reason}: mode is vector or lexical, and reason is set when the vector channel is off or the last recall failed (embedder-unavailable, engine-unavailable, or degraded) so a lexical-only fallback is visible without a separate tool. Each hit's 'similarity' field carries the normalized RRF fusion score (fused/rrf_max) in dual-channel mode, or the normalized BM25 score in lexical-only (linear) mode; per-hit rank components and the evidence summary come via explain=true. Confidence/recency/type act only as a small tie-break. Default scope is _shared PLUS your own private 'agent-' namespace (when your identity is known via attested process id or explicit reader) — private hits surface automatically, no extra query needed. Pass ns explicitly ('_shared' or 'agent-') to search a single namespace. project: your workspace project slug — results span global memories plus that project's; omit it and ONLY global (untagged) memories are returned (fail-closed: project memories never leak into general sessions). Each hit embeds up to 3 trimmed one-hop neighbors (active only, project-filtered) unless include_neighbors=False. explain: optional debugging carrier — pass true to attach a per-hit 'explain' object (lexical/vector rank, RRF score, prior term breakdown, retrieval channel) plus an 'evidence' summary line (outcome counts, last_verified, origin); omitted by default so the default hit shape stays unchanged. reader: your own source agent id — REQUIRED when ns is 'agent-' (private namespace, readable only by its owner host). Returns {'hits': [...], 'count', 'retrieval'} sorted by score. Compounding rule: after actually adopting a hit, call memory_feedback (agent = your source id) — skipped feedbacks leave the store static.
| Name | Required | Description | Default |
|---|---|---|---|
| ns | No | ||
| query | Yes | ||
| top_k | No | ||
| reader | No | ||
| explain | No | ||
| project | No | ||
| include_neighbors | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so thoroughly: it discloses the dual-channel vs lexical fallback, the retrieval {mode, reason} reporting, the fail-closed project scoping rule, the auth requirement (reader) for private namespaces, and that neighbors are attached by default. Nothing about destructive/auth/fallback behavior is left implicit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core purpose is front-loaded, but the middle collapses into a dense run of parenthetical clauses (score normalization, namespace resolution, neighbor trimming) that is hard to parse in one pass. Most sentences carry real payload, yet the wall-of-text packaging costs readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, and the description supplies the return shape {'hits', 'count', 'retrieval'} plus per-hit field semantics (similarity, explain, neighbors). For a read tool with seven parameters and no structured docs, this is sufficient to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, and it does for six of seven parameters: ns scope/defaults, reader's auth role, project's fail-closed semantics, explain's default-off payload, include_neighbors' one-hop trimming, and the similarity field's meaning. Only top_k goes unexplained, which is minor against the otherwise rich coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Search memories" states a specific verb and resource, and the body makes the retrieval semantics (hybrid lexical/vector with RRF fusion) concrete. It never contrasts itself with the sibling memory_get, so an agent must infer search-vs-fetch-by-id on its own.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear conditional guidance: pass ns explicitly to target a single namespace, omit project and only global memories return, reader is required for 'agent-<name>', and attach explain=true only for debugging. It also names memory_feedback as the required follow-up after adopting a hit. What is missing is an explicit statement of when to prefer this over memory_get.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
memory_writeA
Write a memory. type: episode|fact|insight|skill|decision; source: writing agent id; ns: '_shared' or 'agent-'. key: stable id for fact/insight/decision (enables conflict review). Write only stable facts (preferences, conventions, environment constraints, pitfalls), not session-temporary details; volatile status notes (in-progress work, remaining todos) either carry valid_until or stay out — a stale status memory is worse than none; prefer reusing an existing key over a new entry. valid_from/valid_until: optional ISO dates (YYYY-MM-DD) marking the fact's validity window — once valid_until has passed, the memory is excluded from search results but still readable via memory_get. project: optional lowercase-slug scope tag (lowercase alphanumeric segments joined by dashes) for workspace-specific memories — tagged memories are hidden from searches that do not pass the same project, while untagged (global) memories stay visible everywhere; declare your workspace project per the host usage rules and pass it on every write/search in that workspace. lesson_role: optional 'lesson' or 'avoid' (omit for an ordinary memory) — write a lesson as insight (or a steady decision) and an avoid as decision plus this field; do not invent a memory type or encode the role in the key. links may start with avoid:, fixes:, or contradicts: plus a target id or key; other link strings stay free-form. content is capped at 262144 characters — longer payloads are rejected and nothing is written. Returns the stored memory; conflict: true means a different version with the same key exists and a review entry was queued.
| Name | Required | Description | Default |
|---|---|---|---|
| ns | No | _shared | |
| key | No | ||
| type | Yes | ||
| links | No | ||
| source | Yes | ||
| content | Yes | ||
| project | No | ||
| valid_from | No | ||
| lesson_role | No | ||
| valid_until | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and does so: content is capped at 262144 characters and longer payloads are rejected with nothing written; expired valid_until memories drop out of search but remain readable via memory_get; project-tagged memories are hidden from searches that don't pass the same project while untagged ones stay global; conflict: true signals a duplicate key and a queued review entry. These are exactly the non-obvious consequences an agent needs before writing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core action and the three critical parameters, and every clause carries real information — nothing is filler. The cost is a single dense run-on paragraph with heavy semicolon chaining that is harder to scan than a short structured list would be, but no sentence is expendable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite 10 parameters, zero schema description coverage, no annotations, and no output schema, the description covers the return value (stored memory plus conflict flag), the write-time rejection behavior, the visibility model for namespaces and projects, and validity-window semantics. Nothing material is left for the agent to guess.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 10 parameters, so the description must compensate and it does: it defines ns values ('_shared' or 'agent-<name>'), the meaning of key (stable id for fact/insight/decision, enables conflict review), project's slug grammar and visibility semantics, valid_from/valid_until as ISO YYYY-MM-DD validity windows with their search-exclusion effect, lesson_role's only legal values ('lesson' or 'avoid') plus the mapping of lesson→insight and avoid→decision, and the avoid:/fixes:/contradicts: link prefixes versus free-form strings.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb+resource ("Write a memory") and immediately enumerates the type vocabulary (episode|fact|insight|skill|decision), so an agent knows exactly what operation this is. It does not explicitly contrast itself with memory_search/memory_link/memory_get, so sibling differentiation is left to inference rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives substantive when-to-use guidance: write only stable facts (preferences, conventions, environment constraints, pitfalls), not session-temporary details; volatile status notes must carry valid_until or stay out; prefer reusing an existing key over a new entry. It also tells the agent to declare its workspace project per host usage rules and pass it on every write/search. No explicit sibling routing (e.g. use memory_link for relations), which keeps it at 4.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
v0.5.8- Changed
memory_write1 field changed- added
Input schema / properties / lesson_roleAdded value: +{ + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "title": "Lesson Role" +}
5 tool updates
v0.4.3- First observed
memory_feedback - First observed
memory_get - First observed
memory_link - First observed
memory_search - First observed
memory_write
TDQS
Scored across 5 tools
Each tool maps to a distinct operation: memory_write (create), memory_search (query), memory_get (fetch by id), memory_feedback (report outcome), and memory_link (associate). Despite all operating on 'memories', their verbs and roles are unambiguous, so an agent can select correctly without confusion.
All five tools follow a strict snake_case 'memory_<verb>' pattern (memory_write, memory_search, memory_feedback, memory_get, memory_link). The prefix and verb style are uniform, making the set highly predictable.
Five tools is well-scoped for a compound-memory store, covering the essential write/read/search/feedback/link lifecycle. Each tool earns its place with no redundant or filler entries.
Core memory lifecycle is covered: write, search, get, associative linking, and feedback-driven confidence/archival (obsolete auto-archives). Minor gaps exist—no explicit delete/update or list/enumerate operation, though overwrite-by-key and archiving approximate these, so agents can work around them.
Maintenance
Related MCP Connectors
Persistent memory for AI agents. Search and store durable facts, preferences and decisions.
Shared persistent memory for AI agents to read, verify, continue, and connect knowledge.
Persistent memory for AI agents. Semantic search, memory graph, W3C DID identity.
One memory, every AI. A shared, user-owned markdown memory your AI clients read and write over MCP.
Related MCP Servers
- AlicenseNot gradedqualityBmaintenanceLocal-first, multi-user shared memory for AI agents with semantic search, offline support, and team synchronization.MIT
- AlicenseNot gradedqualityAmaintenanceEnables AI agents to capture, structure, remember, and retrieve source-backed memory as local Markdown files, with reviewable writes and no cloud dependency.216MIT
- FlicenseNot gradedqualityCmaintenanceProvides AI agents with persistent, local cross-session shared memory by combining vector semantic retrieval with knowledge graph relationships, and supports short/long-term memory management and local backups.-
- AlicenseNot gradedqualityBmaintenanceEnables AI agents like Codex, Grok Build, and Antigravity to share persistent local memory, preferences, project context, tasks, and handoffs using Markdown and SQLite.1MIT