MemVault
MemVault is an MCP memory server that gives any agent a shared, persistent long-term memory store — save, retrieve, auto-inject, and govern context across sessions.
save_memory— store preferences/facts/episodes/skills with priority (MUST/REFERENCE/BACKGROUND), instructions, tags, namespace, confidence, layers; delta-write dedup/merge by default (force_insertto bypass)search_memory— hybrid (BM25 + vector via RRF), keyword, or semantic search withtop_k,min_score, namespace/type/priority filters, optional relation expansionsession_start— auto-inject relevant memory on connect, filtered by agent identity, formatted as MUST/REF instructions with overflow summariesextract_memories— pull structured memories out of free text (rule-based or LLM mode), optionally auto-saverecord_outcome/infer_outcome— log task success/failure; failures distill into lessons re-injected into similar future tasksimport_skills— turn Markdown SOPs into trigger-based skills (optionally auto-approved)Evidence graph —
add_evidence(supports/contradicts/sourced_from) andget_memory_evidencefor raw L0 provenance and citationReview workflow —
list_inbox+review_memory(approve/reject/edit) to gate unreviewed memoriesMaintenance —
run_dedup,run_decay(archive stale),run_promote(L1→L2→L3 consolidation, archiving sources to L0)Accountability —
report_compliance,get_compliance_report,get_effectiveness_reportto measure whether injected memories were followed and whether they helpedRead tracking —
confirm_readupdates access counts/recency for one or many memoriesDeletion —
delete_memory(soft, restorable) vsforget_memory(irreversible GDPR purge: dry-run preview, bulk criteria, MUST protection, audit log)Auth/attribution — per-agent
api_keyandagent_idon every call
Plugs into a local Ollama instance as the embedding and chat-LLM provider — nomic-embed-text for semantic search vectors and models like qwen2.5 for structured memory extraction, failure reflection, and relation extraction — keeping all memory processing on the user's machine.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@MemVaultremember that I prefer pnpm over npm for all projects"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MemVault
The Shared Memory Layer for Every AI Agent You Run
Not "agent learns to search memory" — memory finds the agent.
MCP Native · Hybrid Retrieval · Auto-Injection · Zero-Config Sync
Open Source · Self-Hosted · Private · MIT Licensed
English · 简体中文
If MemVault solves a real problem for you, a star helps others find it.
curl -fsSL https://raw.githubusercontent.com/dreamor/memvault/master/scripts/install.sh | bashEvery AI agent session starts from scratch. Claude Desktop doesn't know what Cursor just learned. DeepSeek Harness (dsh) doesn't know what you told Claude Code yesterday. Whatever agent you're running — international or domestic, IDE plugin or CLI harness — it forgets your preferences every time you start a new conversation.
You've been manually repeating context — project conventions, personal preferences, past decisions — across agents that should already know. This isn't a limitation of the models. It's a missing infrastructure layer.
MemVault is that layer. A lightweight, self-hosted memory router that sits between your agents and their context. It speaks plain MCP — no MemVault-specific SDK, no per-agent API integration. Any MCP-compatible agent, from any vendor, automatically shares the same persistent memory the moment it connects.
Who it's for:
Anyone running an MCP-capable agent — Claude Code, Claude Desktop, Cursor, Cline, Continue, DeepSeek Harness (dsh), or any other MCP client, domestic or international — who wants preferences, project context, and past decisions to persist across sessions without repeating yourself
Multi-agent power users running several of the above side by side, on different models, from different vendors — all sharing the same memory without configuration
Platform teams deploying AI-assisted workflows where consistency matters across a mixed agent fleet: code review conventions, architecture decisions, project-specific preferences
Anyone tired of telling their AI the same thing twice — MemVault works the way your brain should: you say it once, it's there when you need it, no matter which agent is asking
Quick Start · How It Works · What MemVault Gives You · Why MemVault · MCP Server · CLI Reference · Integrations · Architecture · Project Status · Testing · Documentation · Contributing · License
Quick Start
Don't install MemVault by hand — paste this one prompt into Claude Code, Codex, Cursor, dsh, or any other MCP-capable agent. It points the agent at a machine-readable install guide, so the agent does the whole setup itself:
Install MemVault as your long-term memory and wire it into this agent. Fetch and follow https://raw.githubusercontent.com/dreamor/memvault/master/docs/AGENT-INSTALL.md — install the binaries, register MemVault as an MCP server for this host, and verify recall works. Then keep saving my preferences, project decisions, and lessons from each session so my next agent starts with them instead of from scratch.Or install manually:
# Install (Linux / macOS): official script, auto-verifies SHA-256
curl -fsSL https://raw.githubusercontent.com/dreamor/memvault/master/scripts/install.sh | bash
export PATH="$HOME/.memvault/bin:$PATH"
# Windows (PowerShell):
# powershell -ExecutionPolicy Bypass -File scripts\install.ps1
# Homebrew (Apple Silicon):
# brew install dreamor/tap/memvault
# Or from crates.io:
# cargo install memvault-cli memvault-mcp
# The installers auto-start the local REST backend (host of the Web
# Dashboard). Open it, or start it on demand:
memvault-cli dashboard
# Save a MUST-level preference (injected as instruction, agent must follow)
memvault-cli save --content "User prefers Python" --priority MUST --type preference \
--instruction "Use Python for code, not Java" --tags "coding,python"
# Search across all memory (hybrid: keyword + semantic when embedding is enabled)
memvault-cli search --query "Python"
# See what context gets injected when a specific agent connects
memvault-cli session-start --agent-id claude-desktop --context "Help me write code"
# Extract structured memories from free text
memvault-cli extract --text "I prefer dark mode. Our project uses Rust." --save
# Auto-generate agent instruction files from memory
memvault-cli sync
# All in one: dedup, decay, archive stale memories
memvault-cli dedup && memvault-cli decaySystem requirements:
Prebuilt Linux binaries (install script / GitHub release): glibc ≥ 2.39 + GLIBCXX_3.4.31 (GCC 13-era runtime — Ubuntu 24.04+ / Fedora 40+ / Arch). Release builds are pinned to Ubuntu 24.04 runners, and the release workflow gates the highest glibc/GLIBCXX symbol version every binary may require plus a startup smoke test, so this floor cannot silently drift upward (0.6.9 shipped x86_64 binaries requiring glibc 2.43 that way). TLS is rustls, so no OpenSSL dependency. Ubuntu 22.04 / RHEL or EL8/EL9 users: use the Docker image (
dreamor/memvault) or build from source.Building from source (
cargo install/cargo build): links fastembed's prebuilt ONNX Runtime static library and needs a GCC 13-class toolchain. Older toolchains (e.g. GCC 8, CentOS 7/8-era libstdc++) fail at link time with missing C++20/23 stdlib symbols (std::format,std::to_chars). macOS / Windows (MSVC) / Homebrew / Docker are unaffected.
Verify your install in 5 seconds:
memvault-cli --version
# memvault 0.6.10
# sanity check: list saved memories (verifies DB is healthy)
memvault-cli listLocal Ollama Demo (Zero Cost, Stays on Your Machine)
MemVault is plug-and-play with a local Ollama: unconfigured LLM extraction (full-text understanding / failure reflection / relation extraction) auto-detects a local Ollama; embeddings use the local model with the ollama or auto provider.
# 1. Install and start Ollama
brew install ollama && brew services start ollama # or the official installer
# 2. Pull models
ollama pull nomic-embed-text # embeddings, 768-dim (default for ollama/auto)
ollama pull qwen2.5:3b-instruct # chat: LLM extraction/reflection (default qwen2.5:7b, use 3b on small machines)
# 3. (Optional) Pin the providers explicitly — persist them in ~/.memvault/.env
# (shell exports also work — env vars take precedence over the file — but the file survives reboots)
mkdir -p ~/.memvault
cat >> ~/.memvault/.env <<'EOF'
MEMVAULT_EMBEDDING_PROVIDER=ollama
MEMVAULT_LLM_EXTRACTION_PROVIDER=ollama
MEMVAULT_LLM_EXTRACTION_MODEL=qwen2.5:3b-instruct
EOF
# 4. Verify
memvault-cli status # Embedding provider: configured and reachable
memvault-cli save --content "Build server IP is 10.20.30.40" # output (embedded int8)
memvault-cli outcome --task "Deploy trading service" --status failure --cause "Disk space insufficient" --task-type deploy
# → Lesson (Llm): ... means failure reflection ran through the local LLM (not the rule-based fallback)With no configuration at all (neither env vars nor ~/.memvault/.env), LLM extraction auto-detects a local Ollama and enables itself (default model qwen2.5:7b; pull it in advance with ollama pull qwen2.5:7b, or point MEMVAULT_LLM_EXTRACTION_MODEL at an installed model). Embeddings still default to the in-process native embedder; set MEMVAULT_EMBEDDING_PROVIDER=auto in ~/.memvault/.env to prefer Ollama and fall back to native when it isn't running. The native model's first launch downloads the weights from HuggingFace silently in the background — the server/dashboard come up immediately and hot-swap to semantic search once the download finishes, so a fresh install never blocks on it (set MEMVAULT_EMBEDDING_PROVIDER=none to run pure keyword and skip the download).
Related MCP server: GNB MemoryMCP
How It Works
MemVault is a pipeline, not a single script. Every stage below is a shipping module:
Agent connects (MCP stdio/SSE)
│
▼
┌───────────────────┐
│ Agent Router │ ← match agent type/tag → filter relevant memory
│ (Agent Registry) │
└────────┬──────────┘
│
▼
┌───────────────────┐
│ Memory Retrieval │ ← keyword (BM25) + vector (embedding) + RRF fusion
│ (3 search modes) │ synonym expansion · scoring · soft filtering
└────────┬──────────┘
│
▼
┌───────────────────┐
│ Auto-Injection │ ← MUST-level → instruction prompt
│ │ REFERENCE → context resource
│ │ NORMAL → search result
└────────┬──────────┘
│
▼
Agent receives context ──→ makes better decisionsStorage: SQLite with bundled FTS5 (full-text search); embeddings stored int8-quantized (~1/4 the size of f32 at near-identical ranking quality, legacy f32 rows still readable)
Retrieval: BM25 keyword search over FTS5 with CJK bigram tokenization (Chinese two-character words match correctly) and tiered match fallback (strict → relaxed unigram → synonym OR; relaxations are reported, never silent), local-first embedding (in-process native by default — switch to local Ollama or any OpenAI-compatible model), RRF fusion with per-result recall provenance (
kw#2/vec#5), synonym expansion, relevance scoring, soft intent filteringPipeline: Automatic entity extraction, delta-write on save (near-duplicates skipped, similar memories absorb only the residual), semantic deduplication, time-based decay, archive of stale memories
Sync: Zero-invasion file generation —
memvault-cli syncproduces CLAUDE.md, AGENTS.md, etc. directly from database contents
What MemVault Gives You
Auto-Injected Context: Session start automatically pulls relevant memory by agent identity — MUST-level rules land as instructions, not just chat history
Hybrid Retrieval: BM25 + vector + RRF fusion with synonym expansion, relevance scoring, and per-result provenance (which path recalled each memory, at what rank) — available via CLI, MCP tool, and REST API
Explainable Injection: every candidate dropped on the way into an agent's context is recorded with a reason (budget, caps, intent/type penalties) — "why didn't the agent get this memory?" always has an answer
MUST Enforcement: MUST-priority memories are never filtered or truncated. Always in context, always obeyed — trust comes from provenance (human-authored/reviewed), with an opt-in fallback for memories independently corroborated by multiple identity-verified agents (
MEMVAULT_CORROBORATION_GATE), so a single spoofed/compromised agent can't unilaterally inject a binding MUSTMulti-Agent Awareness: Agent Registry with type/tag-based soft filtering (score demotion, not hard exclusion)
agent_idIs Provenance, Not a Filter: retrieval never filters byagent_id— the field only records which agent wrote a memory (source_agent). Every agent searches the same shared corpus; per-agent differences apply only at injection time (type/tag soft scoring viaagents.yamlinject_rules)MCP Proxy: Transparent proxy that injects memory into ANY upstream MCP server's responses — zero client changes
Compliance Tracking:
inject_session_idtraces what was injected and measures follow-through rateCross-Platform: CLI + MCP Server (stdio & SSE) + Web Dashboard (browser) + Obsidian Plugin
Zero-Invasion Sync: Generate AGENTS.md / CLAUDE.md from memory — no per-agent config files to edit
Contextual Extraction, Local-First: Rule-based keyword extraction by default; optionally understands a full user+assistant exchange via an LLM, auto-detecting a local Ollama for free before ever touching a remote API
History & Rollback: Every update/delete is snapshotted into
memory_history—memvault-cli checkpoints+memvault-cli restoreroll one memory back without touching the restSelf-Diagnostics:
memvault-cli statusreports exactly which features are degraded when no embedding provider is configured, plus a schema fingerprint (migration version + checksum) for cross-database comparisonEpisodic Memory:
record_outcomerecords task results; failures are distilled into lessons and auto-injected next time (REFERENCE → MUST only with human approval), so the same trap isn't hit twiceProcedural Skill Activation: skills whose
triggermatches intent are injected as structured[SKILL]blocks with success-rate stats (shown after ≥3 runs); failures flag the skill for revision (version++on human edit), repeated successes auto-draft new skills into the review inboxSemantic Knowledge Links: lightweight relation triples, repeated facts consolidated into a linked semantic fact with provenance, and superseded facts archived (never re-injected, still listable & restorable)
Team Shared Pool & SOP Import: memories marked
sharedare injected into every session (capped at 20); Markdown SOPs can be batch-imported as verifiable skillsDelta-Write on Save: every save is checked against its namespace first — near-duplicates are skipped, similar memories absorb only the residual (what's genuinely new) and get their strength refreshed, so the library converges instead of accumulating near-copies;
--force/force_insertbypassesTask-Level Evaluation:
memvault-cli benchsamples your own failure history (episodes that distilled a lesson) and measures lesson retrieval/injection rates — and with--judge, an LLM scores "plan without vs. with memory" against the known failure cause, so you see task-success lift, not just retrieval recallTwo-Phase Injection (never blocks): MUST rules resolve deterministically with zero embedding calls and are served immediately; the semantic pipeline prefetches in the background and lands within a short window (250ms) — if it doesn't, the deterministic baseline is served and the request moves on (two-phase design)
Conversation-N-Gram Retrieval: retrieval keys are conditioned on the recent turn window, weighted by recency so the current focus dominates — not a single flat query
Single Canonical Injection Channel: per-agent
inject_channel(mcp/proxy/syncinagents.yaml) restricts automatic injection to one delivery path, so the same memory is never sent to the same agent twiceData You Own: Single SQLite file. Full export/import. No cloud dependency. Your data, your machine.
Why MemVault
Looking for a self-hosted alternative to Mem0, Zep, or Letta/MemGPT? Those are hosted APIs or Python frameworks tied to one SDK. MemVault ships as a single Rust binary with no hosted service and no vendor lock-in, speaks plain MCP instead of a proprietary SDK, and shares one memory store across every agent you run — Claude Code, Cursor, Claude Desktop, dsh — not just one.
Feature | Plain CLAUDE.md | Vector DB + RAG | MemVault |
Context injection | Manual edits | Query-time only | Auto on session start |
Multi-agent sharing | Copy-paste | Separate indexes | Single shared store |
MUST enforcement | None | None | Instruction-layer injection |
Search modes | File grep | Embedding only | BM25 + Vector + Hybrid |
Synonym expansion | No | No | Built-in |
Deduplication | No | No | Semantic dedup pipeline |
Write-time delta merge | No | No | Near-dupes skip, similar absorb the residual at save |
Task-level evaluation | None | Recall metrics only |
|
Decay / archival | No | No | Time-based + auto archive |
Memory extraction | Manual | N/A | Rule-based by default; optional local-first LLM extraction |
MCP native | No | No | stdio + SSE + Proxy |
Agent differentiation | Global file | Query filter | Type/tag registry |
Compliance tracking | None | None | inject_session_id + rate |
Self-hosted | Yes | Varies | Single binary, no cloud |
MemVault complements your existing agent setup rather than replacing it. Keep your LLM, your IDE, and your workflow exactly as they are. MemVault adds the memory layer underneath.
MCP Server
Tier-1 agents (Claude Code, OpenCode, dsh, Gemini CLI, Codex) have one-command plugin installs — see Installing into your agents first. Everything below is the universal fallback for any other MCP client.
stdio (any standard MCP client)
MemVault speaks plain MCP stdio — the same mcpServers JSON works verbatim in Claude Desktop, Cursor, Cline, Continue, and any other client that reads this format:
{
"mcpServers": {
"memvault": {
"command": "/path/to/memvault-mcp",
"args": ["--db", "~/.memvault/data.db"],
"env": { "OPENAI_API_KEY": "sk-..." }
}
}
}A couple of clients use their own one-liner instead of hand-editing JSON:
# Claude Code
claude mcp add memvault /path/to/memvault-mcp -- --db ~/.memvault/data.dbDeepSeek Harness (dsh) — a domestic (China) agent harness — gets deeper treatment than a generic stdio config: a native Cordis plugin (dsh-plugin/) that auto-injects memory into the system prompt and auto-extracts at turn end, with no per-turn cooperation required from the agent. See docs/INSTALL.md §2.5 for both the zero-code MCP route and the deep-integration plugin.
Other MCP-compatible agents — international or domestic, IDE plugin or CLI harness — should work the same way: any client implementing standard MCP stdio/SSE can connect without MemVault-side changes. The ones above are the ones we've actually verified; if you get MemVault working with another one, a PR to this list is welcome.
SSE (multi-client, network-accessible)
memvault-mcp --transport sse --port 3777
# Clients connect at http://127.0.0.1:3777/mcpSSE features: multi-client simultaneous connections, auto-triggered embedding backfill on initialization, HTTP remote access.
Note:
--transport sseonly mounts the MCP-over-HTTP endpoint (/mcp) — it does not expose the REST API (/api/*). The Web Dashboard is served by the REST backend (memvault-mcp --transport http --serve-web <dist>), and the Obsidian plugin also uses the REST API and requires--transport httpinstead. See docs/INSTALL.md §2.6.
20 MCP Tools
Tool | Description |
| Save with auto-embedding; delta-write by default (near-dupes skip, similar merge) — |
| Record a task outcome (episodic memory); failures reflect into lessons |
| Classify + record a task outcome from host-provided evidence (friction counts, terminal state) instead of a raw transcript — same rule-floor-plus-optional-LLM-judge logic as the Stop hook's |
| Import skills from a Markdown SOP (headings → skills, list items → steps) |
| Hybrid (default) / keyword / semantic; semantic modes fall back to keyword when embeddings are unavailable |
| Agent-aware context injection; honors the agent's |
| Approve / reject / edit; edit also works on already-approved memories, reject only applies to pending ones |
| Soft delete — removes the live row and cascaded evidence relations, restorable via CLI |
| Permanently erase one memory or a criteria-matched bulk set (GDPR-style, irreversible); |
| Structured extraction from text |
| Read-only deduplication scan (reports near-duplicates; does not merge/delete) |
| Decay + auto-archive; opt-in permanent auto-forget when |
| Mark read (increments |
| List memories pending human review; |
| Promote pipeline (L1→L2→L3), archive sources to L0 |
| Report follow/violate status for an injected session; bad items are skipped, so check the returned updated/total counts |
| Compliance rates per session or aggregate |
| Record evidence relations: supports / contradicts / sourced_from; identical relations are rejected rather than duplicated |
| Get the raw-evidence chain a memory was distilled from (its L0 trace rows) plus its evidence profile — read-only grounding, so an agent can quote the original session text and name its sources |
| Automatic effectiveness judgments for injected memories (useful/neutral/harmful/insufficient-context rates, judged from |
2 MCP Resources
URI | Content |
| MUST-level rules, auto-loaded on connect |
| REFERENCE-level project context |
Configuration (.env file & environment variables)
Copy .env.example to ~/.memvault/.env and uncomment what you need — it is also the single source of truth documenting every key.
Precedence (high → low): CLI flags > process environment > ~/.memvault/.env > built-in defaults. Every binary loads the env file first thing at startup; --env-file <path> or MEMVAULT_ENV_FILE points elsewhere, and a missing file is silently skipped. memvault-cli status prints where each setting came from (env / file / default).
Two groups are intentionally not in the table below: the host installation contract (MEMVAULT_AGENT_ID, MEMVAULT_HOOK_EXTRACT, … — per-agent values authored in each host's plugin/mcpServers config), and the proxy's upstreams topology (structured data, lives in ~/.memvault/proxy.yaml).
Variable | Purpose | Default |
| Provider: |
|
| API key for remote providers (not needed for local Ollama); the default | (not needed — |
| Any OpenAI-compatible base URL (OpenAI / Azure / vLLM / gateway...). For |
|
| Embedding model: |
|
| Vector dimensions |
|
| Optional: enables LLM-based contextual memory extraction (understands a full user+assistant exchange, not just keyword lines). Unset/ | (unset — local-first, rule-based if no local Ollama) |
| Chat-completions endpoint config for LLM extraction | local: |
| Opt-in LLM relation extraction: | (unset / false) |
| Delta-write on save: dedup within the same namespace first — near-duplicates skipped, similar memories absorb the residual. | true |
| How many recent observed turns build the recency-weighted retrieval key used by proxy auto-injection |
|
| Minimum friction score (tool retries, rejected tool calls, mid-session corrections) a Stop-hook-triggered |
|
| Minimum friction score for a Stop-hook |
|
| Minimum LLM-judge confidence to accept its |
|
| Set to | (off) |
| Record whether a | true |
| Opt-in MUST trust path: a MUST memory independently corroborated by enough distinct identity-verified agents (see | false |
| Minimum distinct identity-verified agents required for the corroboration gate above |
|
| Opt-in stricter injection gate: by default an unreviewed MUST memory is still injected, tagged | false |
| SQLite connection pool size |
|
| Comma-separated allowed CORS origins for REST (unset = localhost only) | (localhost only) |
| Seconds |
|
| Path-list ( | — |
| Background auto-forget: permanently purge memories archived longer than the retention window (irreversible, unlike decay's reversible archiving) |
|
| Archived-retention window (days) for the auto-forget sweep |
|
| Protect MUST memories from forget unless the caller explicitly overrides ( |
|
| Exclude shared-visibility memories from the auto sweep (manual/bulk forget can still purge them) |
|
| SQLite database path |
|
| Storage backend: |
|
| markdown-backend data directory (also | — (markdown mode only) |
| Log verbosity |
|
| Base directory: where |
|
| Path to the env file ( |
|
| HuggingFace endpoint override for native model downloads (e.g. | (HuggingFace default) |
| Proxy-path contextual extraction of agent-produced text: on by default but saved downgraded ( | (on — downgraded) |
CLI Reference
save · outcome · search · list · review · delete · session-start · resource · extract · dedup · decay · forget · forget-log · doctor · promote · backup · export · export-skill · import · import-skills · import-agent · ingest · confirm-read · backfill-embeddings · sync · reindex · migrate-to-markdown · checkpoints · restore · supersede · status · bench · eval-history · server start|status|stop · dashboard
memvault-cli <command> --help # detailed usage per commandKey Commands
Command | What It Does |
| Save a memory with priority, type, optional instruction. Delta-write by default: near-duplicates are skipped, similar memories absorb the residual; |
| Record a task result (success/failure/partial); failures are distilled into lessons that auto-inject into similar future tasks |
| Hybrid retrieval with relevance scoring; flags: |
| Simulate what context an agent receives on connect; a multi-line |
| Parse free text, extract structured memories |
| Import skills from a Markdown SOP ( |
| Cold-start import from another agent's native memory files: Claude Code/Desktop ( |
| Incrementally ingest agent session transcripts (Claude Code / Codex / Hermes) into memory: turns with extractable signal are kept as L0 evidence rows, and their extracted candidates carry |
| Generate agent instruction files (AGENTS.md / CLAUDE.md / MEMORY-INDEX.md, …) from memory (with |
| Scan and merge semantically duplicate memories (vector-assisted when an embedding provider is configured) |
| List memory history snapshots (per-memory or global); flags: |
| Revert a memory to the state captured by a checkpoint ( |
| Archive an old fact and point it at its replacement (nothing is deleted; search skips superseded, list keeps them) |
| Show embedding provider readiness (distinguishes not-configured / explicitly-disabled / configured-but-unavailable) and which features degrade without it |
| Ensure the local REST backend is running (spawns |
| Manage that same backend: idempotent start (health-probes first, auto-moves to the next free port when 3777 is taken by a foreign process), status, and stop. Prints the active URL (with |
| Read-only memory hygiene lint: dangling/stale/duplicate/contradicted + machine-readable |
| Task-level memory benchmark: samples your own outcome history, measures lesson retrieval/injection rates; |
| Trend-over-time view of past |
| Archive stale memories based on access recency |
| Create a consistent point-in-time SQLite backup |
| Backup and restore — JSON to a file or a directory (writes |
| Mark memories as read (updates access_count) |
Integrations
Installing into your agents
MemVault ships native adapters for most agents — one shared store, per-host identity via MEMVAULT_AGENT_ID, four tiers (Tier 1/2/3 details below; per-client registration snippets in integrations/mcp-clients/).
Core packages & versions:
Package | Version | Install / Source |
| 0.6.10 | library dependency |
| 0.6.10 |
|
| 0.6.10 | npm registry (dsh Cordis plugin, below) |
Shipped plugins & versions — each bumps on its own schedule:
Plugin | Version | Distributed via |
Claude Code / Codex plugin bundle ( | 0.6.10 |
|
Gemini CLI extension ( | 0.6.10 |
|
Qoder plugin ( | 0.6.10 | in-repo manifest |
Obsidian plugin ( | 0.3.6 |
|
dsh Cordis plugin ( | 0.6.10 |
Tier 1 — one-command native plugins (memory injected by hooks; extraction opt-in where the host exposes lifecycle hooks):
Agent | Install | Recall | Extract |
Claude Code |
| ✅ SessionStart hook | ✅ Stop hook, enable with |
OpenCode | merge | ✅ system transform | ✅ on |
DeepSeek Harness (dsh) | built-in Cordis plugin | ✅ system prompt | ✅ turn-end |
Gemini CLI / Antigravity |
| ⚠️ rule context + tools | ❌ |
Codex CLI |
| ✅ SessionStart hook — approve the bundled hook once in | ✅ Stop hook — approve in |
⚠️ = the host has no injection hooks; recall is rule-driven (the agent calls session_start once) with the bundled canonical rule text.
Tier 2 — paste an MCP snippet. Strict-JSON registrations with per-host identities in integrations/mcp-clients/ (target paths in its README): Cursor · Windsurf · Cline/Roo · Continue · Zed · JetBrains AI/Junie · VS Code (Copilot Chat) · Claude Desktop.
Tier 3 — native manifests, verify-on-install. Qoder (.qoder/rules/ + .qoder-plugin/ + a UserPromptSubmit hook template), Grok Build (grok plugin install dreamor/memvault --trust), the Hermes Python plugin (integrations/hermes/, pre_llm_call recall + extraction helper) and the pi extension (pi-extension/, pi install git:github.com/dreamor/memvault) ship in-repo; OpenClaw and Swival consume the generated root skills/ (also exported to .openclaw/skills/); Devin stays a manual recipe in integrations/README.md.
Tier 4 — instruction-only rule copies. Canonical text + scripts/gen-rule-copies.sh (parity-checked in CI) produce AGENTS.md/CLAUDE.md blocks, .cursor/rules/, .clinerules/, .kiro/steering/, Junie guidelines; memvault-cli sync --watch keeps them fresh from the store.
Any other MCP-speaking client (domestic or international, IDE plugin or CLI harness) connects with zero MemVault-side changes via the standard stdio config below — not individually verified; PRs adding a verified entry are welcome.
GUI surfaces are independent of agent installs: Web Dashboard (9 tabs) · Obsidian plugin (α — Vault sync + browse/capture) · MCP Proxy (transparent memory injection for any upstream server).
Architecture
┌────────────────────────────────────────────────┐
│ Clients (any MCP-compatible agent) │
│ ┌────────────┐ ┌────────┐ ┌─────┐ ┌────────┐ │
│ │ Claude Code│ │ Cursor │ │ dsh │ │ Others │ │
│ └────────────┘ └────────┘ └─────┘ └────────┘ │
└──────────────────┬───────────────────────────────┘
│ MCP (stdio / SSE / HTTP)
┌──────────────────▼───────────────────────────────┐
│ memvault-mcp (rmcp 3.1.1) │
│ ┌──────────────┐ ┌────────────────┐ ┌────────┐ │
│ │ 20 tools │ │ 2 Resources │ │ SSE │ │
│ │ + REST API │ │ + Auto-Inject │ │ Server │ │
│ └──────┬───────┘ └──────┬─────────┘ └────────┘ │
│ └────────┬───────┘ │
│ ┌───▼────────┐ │
│ │ Agent │ (Agent Registry │
│ │ Router │ type/tag filter) │
│ └───┬────────┘ │
├──────────────────┼────────────────────────────────┤
│ memvault-core │ │
│ ┌──────────┐ ┌─▼───────┐ ┌────────────┐ ┌───┐ │
│ │ storage │ │retrieval│ │ pipeline │ │sync│ │
│ │ SQLite │ │BM25+Vec │ │extractor │ │ │ │
│ │ │ │RRF+syn │ │dedup/decay │ │ │ │
│ │embed │ │onym │ │export/ │ │ │ │
│ │backfill │ │scoring │ │import │ │ │ │
│ └──────────┘ └─────────┘ └────────────┘ └───┘ │
└────────────────────────────────────────────────┘Project Status
MemVault is in beta. The Rust core (storage / search / injection) is CI-gated and stable; plugin adapters and GUI surfaces evolve faster. All configuration is environment-driven (see .env.example), and every change is recorded in CHANGELOG.md.
Testing
cargo test # ~1300 tests (full workspace)
cargo clippy --all-targets # zero warnings
cargo fmt --all -- --check # format check
cargo llvm-cov --workspace --all-features # CI gate: line ≥92% / region ≥90% / function ≥85%Documentation
Doc | Content |
Product & architecture design | |
Installation guide (all platforms) | |
Agent-facing install guide — the target of the one-prompt Quick Start (install → register as MCP → verify recall) | |
Docker deployment | |
Deployment / health check / rollback runbook | |
Symptom → cause → fix troubleshooting guide | |
Hypothesis-validation experiments (H1–H7, 2026-08-11 → 2026-08-27, all CONFIRMED) + runtime plumbing regression (2026-08-28) | |
Release process — what CI automates (Linux/macOS binaries, Docker image, dashboard archive, Obsidian zip) vs. manual steps (Obsidian submission — no macOS signing needed) | |
Distribution channel map — automated vs. manual channels, required credentials, MCP registries, optional channels | |
Release history | |
Contribution guide | |
Security disclosures | |
Accessibility statement — commitment, supported environments, known limitations, how to report a barrier | |
Configuration template — single source of truth for every config key |
Contributing
🐛 Bugs: Issue Tracker
💡 Ideas: Feature Request
📖 Guide: CONTRIBUTING.md
🔒 Security: SECURITY.md
♿ Accessibility: ACCESSIBILITY.md
License
MemVault is released under the MIT License.
Available Tools
20 toolsadd_evidenceAIdempotent
Record evidence for a memory. relation="supports"/"contradicts" links evidence_id → memory_id (a memory supporting or contradicting it); relation="sourced_from" records memory_id's external provenance via source (URL/document). Writes one relation and returns its relation_id; an identical relation is rejected rather than duplicated. Contradictions accelerate the contradicted memory's decay; superseded or archived evidence stops counting. Requires agent auth when the agent has a registered key.
| Name | Required | Description | Default |
|---|---|---|---|
| source | No | External source: URL, document path, conversation reference (required for sourced_from). | |
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| agent_id | No | ID of the requesting agent | unknown |
| relation | Yes | Evidence relation: "supports" | "contradicts" | "sourced_from". supports/contradicts link two memories (`evidence_id` = the memory providing evidence); sourced_from records an external source text. | |
| memory_id | Yes | The memory this evidence statement is ABOUT, or that the subject memory supports/contradicts — see `relation` for direction. For supports/contradicts: the memory being supported/contradicted. For sourced_from: the memory whose provenance is recorded. | |
| confidence | No | Evidence confidence, 0.0-1.0 (default 0.8). | |
| evidence_id | No | The memory providing evidence (required for supports/contradicts). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations: discloses that duplicates are rejected rather than created (concretizing idempotentHint), that contradictions accelerate the contradicted memory's decay, that superseded or archived evidence stops counting, and that a relation_id is returned. Auth requirement is also stated. These are real side effects and constraints an agent could not infer from the structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core purpose, then mode semantics, then side effects and auth — a sensible order. Dense but every clause carries information; only the parenthetical re-explanation of supports/contradicts is mildly redundant with the relation schema description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 7-parameter write tool with no output schema, the description covers return value (relation_id), failure mode (duplicate rejection), downstream consequences (decay acceleration, superseded evidence), and auth. Nothing essential for a correct call is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% so baseline is 3, but the description adds genuine meaning: it clarifies the direction of the evidence_id → memory_id arrow and what `source` does for sourced_from. It does not explain `confidence` or `agent_id`, leaving those entirely to the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Record evidence for a memory") and spells out the two modes of the operation (memory→memory relations vs memory→external source provenance). An agent can see this is a write of a single relation, unlike the read-oriented get_memory_evidence sibling, but no sibling is named explicitly, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Clear conditional guidance per mode: relation="supports"/"contradicts" link evidence_id → memory_id, relation="sourced_from" requires `source`. Prerequisites (agent key auth, source required) are stated. It does not, however, say when an agent should prefer this over save_memory or get_memory_evidence, or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
confirm_readA
Confirm that one or more memories have been read by the agent. Increments access_count and sets last_read_at for the specified memory IDs; unknown IDs are skipped and the response reports how many rows were confirmed. Repeated calls increment the counters again (not idempotent). Requires agent auth when the agent has a registered key.
| Name | Required | Description | Default |
|---|---|---|---|
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| agent_id | No | ID of the requesting agent | unknown |
| memory_ids | Yes | List of memory IDs to confirm as read |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses behavior beyond the annotations: unknown IDs are silently skipped, the response reports the confirmed row count, and repeated calls double-increment. The non-idempotency note largely mirrors idempotentHint=false, but the unknown-ID handling, return-count behavior, and auth requirement are genuine additions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three dense sentences, front-loaded with the action and effect, then side effects, then auth. No filler and every clause carries information an agent needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description still tells the agent what comes back (a count of confirmed rows) and covers the auth requirement and skip behavior. Nothing material is missing for a 3-parameter write tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description reinforces batch semantics ('one or more memories') and the auth requirement for api_key, but adds nothing about agent_id and no format details for IDs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('confirm that one or more memories have been read') plus the exact effect (increments access_count, sets last_read_at). It is clearly distinguishable from siblings like search_memory, get_memory_evidence, or record_outcome, which do not confirm reads.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear context for when to call it (marking memories as read after the agent consumes them) and the auth precondition when a registered key exists. It does not name an alternative tool or state a when-not-to-use case, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_memoryADestructiveIdempotent
Soft-delete one memory by its ID: removes its live row, FTS entry, and cascaded evidence relations so it is no longer searchable or injected. A full snapshot is written to memory_history first; restore is available through the CLI (memvault restore), not through this MCP tool. Use forget_memory for an irreversible GDPR-style purge. Requires agent auth when the agent has a registered key; a second delete of the same ID returns NotFound.
| Name | Required | Description | Default |
|---|---|---|---|
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| agent_id | No | ID of the requesting agent | unknown |
| memory_id | Yes | ID of the memory to delete |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Although annotations already declare destructive and idempotent behavior, the description adds substantial operational context: what is removed, that search and injection stop working, that a snapshot is written first, that restore is outside this tool, auth requirements, and NotFound behavior on repeat deletion. No annotation is contradicted.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but well front-loaded, starting with the core action and consequences. Every sentence contributes useful behavioral or routing information without repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive mutation tool with no output schema, the description covers the important missing context: side effects, recoverability, auth behavior, repeat-call behavior, and the correct alternative for permanent deletion. An agent has enough information to invoke it correctly and avoid mistakes.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so parameter meanings are already documented in the input schema. The description reinforces memory_id and auth requirements but does not add syntax or format details beyond the schema, making the baseline 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource: soft-delete one memory by ID. It precisely states the scope and consequences, including removal of the live row, FTS entry, and evidence relations, and explicitly distinguishes this from forget_memory.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly names the alternative tool for irreversible GDPR-style purges, forget_memory, and explains that restoration is available only through the CLI rather than this MCP tool. This gives clear when-to-use and when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
extract_memoriesA
Extract structured memories from conversation text. mode="rule" (default) detects preferences, facts, and skills via keyword pattern matching. mode="llm" instead understands the full context (optionally pairing assistant_text) semantically — uses the configured LLM extraction provider, and degrades to rule-based extraction (reported via fallback_used/fallback_reason) when no provider is configured or the LLM call fails. Returns extracted items; with auto_save=true it also writes them and requires agent auth when the agent has a registered key. Invalid occurred_at is an error, never a silent drop.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | Extraction mode: "rule" (default, keyword pattern matching) or "llm" (semantic extraction over the full context; uses the configured LLM extraction provider, falling back to rule-based when none is configured or the LLM call fails — see fallback_used in the result). | |
| text | Yes | Text to extract memories from (conversation content, e.g. the user's turn) | |
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| agent_id | No | Agent ID to attribute saved memories to | unknown |
| auto_save | No | Whether to auto-save extracted memories | |
| occurred_at | No | When the extracted facts actually happened in the source conversation (RFC 3339), stored as `occurred_at` on saved memories — distinct from `created_at` (ingestion time). Invalid input is an error, never a silent drop. | |
| assistant_text | No | Optional paired assistant/response text for mode="llm" — passing both sides of the exchange lets the model resolve references and implicit preferences a single text can't. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations by disclosing the fallback path (degrades to rule-based, surfaced via fallback_used/fallback_reason), the auth requirement when an agent key is registered, and that invalid occurred_at errors rather than silently dropping. It does not address non-idempotency (idempotentHint=false) — nothing warns that repeated calls with auto_save=true may produce duplicate memories.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Dense but front-loaded: purpose first, then the mode distinction, then the write/auth caveat, then the occurred_at rule. Each sentence carries information, though the mode explanation partially duplicates the schema and could be trimmed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 7-parameter, non-idempotent tool with no output schema, the description covers the decisions that matter: mode selection, fallback reporting, auth on write, and error semantics. The only meaningful omission is duplicate/retry behavior after a save.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents mode, assistant_text, api_key, and occurred_at semantics; the description largely restates these rather than adding syntax or constraints. The one genuinely additive note is the auth precondition tied to auto_save, which lifts it just to baseline rather than above.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb + resource ("Extract structured memories from conversation text") and immediately qualifies the two operating modes, so the agent knows exactly what the tool produces. It does not name or contrast any sibling (save_memory, add_evidence), so an agent still has to infer why to extract rather than save directly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear conditions for the key branch: rule mode for keyword matching, llm mode for semantic understanding over full context with optional assistant_text, and notes auto_save triggers a write. It stops short of saying when to pick this tool over save_memory or when extraction is unnecessary.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
forget_memoryADestructiveIdempotent
Permanently erase (GDPR-style) one memory by id or a bulk set matched by criteria (namespace/namespace_prefix/source_agent_id/tag/memory_type/before_days). Unlike delete_memory, this also purges memory_history snapshots and any orphaned compliance rows, leaving only a content-hash audit entry in the forgotten-log — irreversible. dry_run defaults to true: call once to preview, then again with dry_run=false to execute. Priority::Must memories are excluded unless allow_must=true. Gated by the same per-agent API-key auth as delete_memory — there is no separate admin tier at the MCP layer.
| Name | Required | Description | Default |
|---|---|---|---|
| tag | No | Bulk: memories carrying this tag | |
| reason | No | Audit-trail reason recorded in the forgotten-log | |
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| dry_run | No | Preview matches without purging anything (default: true — forgetting is irreversible, so a caller must explicitly set this to false to execute) | |
| agent_id | No | ID of the requesting agent | unknown |
| memory_id | No | ID of a single memory to permanently erase. Mutually exclusive with the criteria fields below — when set, every criteria field is ignored. | |
| namespace | No | Bulk: exact namespace match | |
| allow_must | No | Explicit override to include Priority::Must memories (otherwise excluded by default) | |
| before_days | No | Bulk: not updated in this many days | |
| memory_type | No | Bulk: memory type (preference, fact, episode, entity, skill) | |
| source_agent_id | No | Bulk: source agent id | |
| namespace_prefix | No | Bulk: namespace starts with this (e.g. "archived:") |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond annotations: discloses that history snapshots and orphaned compliance rows are purged, that only a content-hash audit entry remains, that the operation is irreversible, that Must-priority memories are excluded unless allow_must=true, and that auth is per-agent API key with no admin tier at the MCP layer.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Dense but front-loaded: scope, sibling contrast, destructive effects, workflow, and auth in a tight block. Slightly long with some redundancy against schema descriptions (dry_run default, allow_must) but every sentence carries operational weight.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers the critical concerns for a destructive, 12-param, irreversible tool with no output schema: what gets destroyed, irreversibility, preview workflow, exclusion of Must memories, and auth. Return-value shape is not explained, but for a preview/execute purge tool the key facts are present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% so the baseline is 3; the description adds value by grouping bulk criteria (namespace/namespace_prefix/source_agent_id/tag/memory_type/before_days), flagging memory_id as mutually exclusive with the criteria, and explaining the dry_run default and allow_must override. Marginal gain over schema because these details are largely restated.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (permanently erase / purge), the resource (one memory by id or a bulk set), and explicitly contrasts with the sibling delete_memory. An agent can distinguish it from delete_memory without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit selection criteria (single id vs bulk criteria fields), names the alternative (delete_memory) and how this differs, and prescribes a two-step workflow (preview with dry_run, then execute). No inference required.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_compliance_reportARead-onlyIdempotent
Get a compliance report for injection sessions. Shows follow/violation rates for MUST memories. Provide inject_session_id for one session, or omit it for an aggregate summary filtered by optional agent_id and limit (default 10). Read-only; returns JSON and does not change compliance records.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| agent_id | No | Filter aggregate summary by agent | |
| inject_session_id | No | Get report for a specific injection session |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true and openWorldHint=false, so 'Read-only; ... does not change compliance records' largely restates them. The genuinely additive part is the aggregate-vs-single-session behavior and the default limit; 'returns JSON' is generic and, with no output schema, gives no insight into report shape.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three compact sentences with the resource and payload front-loaded, followed by the routing rule for the optional parameter. No filler, though the trailing read-only clause is partly redundant with the annotations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-required-parameter read-only report tool with annotations covering safety and no output schema, the description covers what the report contains, both invocation modes, the default limit, and the absence of side effects. A little more on report structure would make it fully self-sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 67% and the undocumented parameter is limit; the description compensates by stating the default of 10 and its role in the aggregate filter. The two documented parameters (agent_id, inject_session_id) are also explained in behavioral terms (single vs aggregate), adding context beyond the terse schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Get a compliance report for injection sessions') and clarifies the payload ('follow/violation rates for MUST memories'). It is discernible from get_effectiveness_report, but nothing in the text distinguishes it from the sibling report_compliance, so sibling differentiation is only partial.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit invocation guidance: pass inject_session_id for a single session, or omit it for an aggregate filtered by agent_id and limit (default 10). What's missing is any exclusion, e.g. when to prefer report_compliance or get_effectiveness_report instead.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_effectiveness_reportARead-onlyIdempotent
Get automatic effectiveness judgments for injected memories: useful/neutral/harmful/insufficient_context rates, judged automatically from record_outcome — independent of manual report_compliance. Optional agent_id filters the summary and limit defaults to 10. Read-only; returns JSON and does not change records.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| agent_id | No | Filter by agent |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and openWorldHint, so the safety profile is covered. The description adds useful context beyond annotations: judgments are automatic, sourced from record_outcome, independent of manual compliance reporting, and returned as JSON without changing records.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded, starting with the core purpose and then adding the automatic/manual distinction, parameter defaults, and read-only behavior. Every clause contributes useful selection or invocation context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description still enumerates the rate categories and states that the response is JSON. It could be slightly more complete about the reporting window or whether rates are counts versus percentages, but it provides enough for correct selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 50%, so the description must compensate for the undocumented parameters. It explains that agent_id optionally filters the summary and that limit defaults to 10, adding meaning beyond the schema for both parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: get automatic effectiveness judgments for injected memories. It names the exact metrics (useful/neutral/harmful/insufficient_context rates) and distinguishes the tool from manual compliance reporting by saying it is independent of report_compliance.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clearly positions the tool as the automatic effectiveness counterpart to manual report_compliance, which helps an agent choose between the two. It does not explicitly state when not to use it, but the alternative and context are clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_memory_evidenceARead-onlyIdempotent
Get the raw-evidence chain a memory was distilled from (its L0 trace rows), plus its evidence profile. Read-only grounding: lets an agent quote the original session text and name its sources. Missing or pruned evidence yields an empty chain rather than a write; requires agent auth when the agent has a registered key.
| Name | Required | Description | Default |
|---|---|---|---|
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| agent_id | No | ID of the requesting agent | unknown |
| memory_id | Yes | The memory whose raw-evidence chain (L0 trace rows) to expand |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint/idempotentHint annotations, the description discloses two things annotations cannot: missing or pruned evidence returns an empty chain rather than erroring, and agent auth is required when a registered key exists. It stops short of describing pagination or chain size limits, but the behavioral payoff is substantial.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three compact sentences, front-loaded with the core action and followed by the use case and edge-case behavior. Slightly dense phrasing ('Read-only grounding: lets an agent...'), but no wasted text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description usefully sketches the return shape (L0 trace rows plus evidence profile, empty chain when evidence is missing) and covers the auth precondition. An agent has enough to invoke this correctly; only deeper return-format detail is absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so memory_id, agent_id, and api_key are already documented in the schema. The description reinforces the auth condition but adds no new syntax or semantics for memory_id beyond what the schema states. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: retrieves the raw-evidence chain (L0 trace rows) plus evidence profile for a memory. This is clearly distinguishable from siblings like add_evidence (writes evidence) and search_memory (searches), since it is about expanding provenance for a known memory_id.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides a concrete usage context: 'read-only grounding: lets an agent quote the original session text and name its sources,' which tells the agent when this tool is the right pick. It does not explicitly name an alternative tool or state exclusions, so guidance is clear but not fully comparative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
import_skillsA
Import skills from a Markdown SOP document. Each #/## heading becomes a skill (trigger:/verification: metadata lines + list-item steps). Sections without steps are skipped. Imported skills enter the review inbox unless approve=true. Writes new skill memories; repeating the same import can create duplicates. Requires agent auth when the agent has a registered key.
| Name | Required | Description | Default |
|---|---|---|---|
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| approve | No | Mark imported skills as human-reviewed (skip the inbox). Default false. | |
| agent_id | No | ID of the requesting agent | unknown |
| markdown | Yes | Markdown SOP text. Each #/## heading becomes a skill; `trigger:` / `verification:` lines and list items become the skill metadata. | |
| namespace | No | Namespace for the imported skills. | global |
| fallback_title | No | Fallback skill title when the document has no headings. | imported-sop |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations: says imported skills enter the review inbox unless approve=true, that repeating the same import creates duplicates (the concrete consequence behind idempotentHint=false), and that agent auth is required when the agent has a registered key. The auth and inbox-routing details can't be inferred from the annotation flags.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four tight sentences, front-loaded with the action and parsing rule, then side effects, then auth. Every sentence carries operational information; nothing is redundant filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 6-parameter write tool with no output schema, the description covers creation behavior, skip rules, duplicate risk, inbox routing, and auth. It omits what the call returns (counts, per-skill errors) and how namespace scoping affects results, which leaves a modest gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds parsing semantics not in the schema: sections without steps are skipped, and headings define skill boundaries. It covers markdown/approve/auth but says nothing about namespace, fallback_title, or agent_id, which keeps it from a 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb + resource ('Import skills from a Markdown SOP document') with the parsing model spelled out (headings become skills, trigger:/verification: metadata, list-item steps). This clearly separates it from siblings like save_memory or extract_memories, which create skills from other sources.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
States the applicable input form (Markdown SOP document) and discloses the routing decision point (review inbox unless approve=true) plus a duplicate-import caveat. It stops short of naming an explicit alternative such as extract_memories for non-SOP text, so it does not reach a full 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
infer_outcomeA
Classify and record a task outcome from host-provided evidence rather than raw transcript text — for hosts whose event model doesn't produce a Claude-Code-shaped JSONL transcript (e.g. dsh/Cordis session events). Pass pre-computed friction counts and terminal state in evidence; this runs the same rule-floor-plus-optional-LLM-judge classification as the Claude Code Stop hook's outcome --infer, then records exactly like record_outcome. Returns status 'skipped' (not an error) when nothing was inferred — a clean session, below the friction threshold, or no task evidence at all. Repeated calls for the same session/evidence are deduped. Requires agent auth when the agent has a registered key.
| Name | Required | Description | Default |
|---|---|---|---|
| tags | No | Tags for categorization — "auto-inferred" and "inferred:rule"/"inferred:llm" are added automatically | |
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| agent_id | No | ID of the agent reporting this outcome | unknown |
| evidence | Yes | Structural evidence computed by the caller from its own event stream | |
| namespace | No | Namespace for the episode memory (default: global) | global |
| agent_type | No | Type of the agent (e.g., coding-assistant) | general-assistant |
| session_id | No | Session the task ran in, for traceability | |
| judge_context | No | Conversation excerpt handed to the LLM judge, if one is configured (DATA to analyze, not instructions). Optional — when empty, only the rule-based floor runs. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Richly goes beyond the annotations: discloses that a no-op returns status 'skipped' rather than an error (clean session, below friction threshold, no evidence), that repeat calls for the same session/evidence are deduped, that agent auth is required when a key is registered, and that the classification is rule-floor plus optional LLM judge with recording identical to record_outcome. The only mild tension is 'deduped' versus idempotentHint=false, but that is a storage-level dedup of the record rather than a claim the call is a pure read-replay, so it does not rise to contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One dense but well-ordered paragraph: purpose, then the evidence-passing contract, then the skipped/dedup/auth caveats. Every clause carries a distinct fact, though the run-on middle sentence about the rule-floor-plus-LLM-judge pipeline could be broken out for faster scanning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 8-parameter, non-read-only, auth-bearing tool with no output schema, the description covers the essentials: what gets recorded, the skipped-not-error return, dedup, and auth. Only the successful return payload (beyond the 'skipped' case) is left implicit, which is a small gap given no output schema exists.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter is already documented, including the per-field evidence semantics and judge_context's "data not instructions" note. The description reinforces that `evidence` must be caller-precomputed and that the judge is optional, but adds no format or constraint detail beyond the schema. Baseline 3 applies when the schema carries this much weight.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb+resource ("Classify and record a task outcome") plus an explicit scope constraint ("from host-provided evidence rather than raw transcript text"). It names the sibling it mirrors (record_outcome) and the pipeline it reuses (the Claude Code Stop hook's `outcome --infer`), so an agent can place it precisely among 19 siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states the selecting condition: use this for hosts whose event model doesn't emit a Claude-Code-shaped JSONL transcript (e.g. dsh/Cordis). It also tells the caller what to supply (pre-computed friction counts, terminal state). It stops short of a clean routing sentence such as "if you already have a classified outcome, call record_outcome instead," leaving that inference to the reader.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_inboxARead-onlyIdempotent
List memories pending human review, sorted by created_at ascending (oldest first). Read-only. Supports an optional namespace and limit (default 20); there is no offset/pagination, so a full page silently truncates older pending memories. Requires agent auth when the agent has a registered key.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results to return | |
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| agent_id | No | ID of the requesting agent | unknown |
| namespace | No | Filter by namespace |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover safety (readOnlyHint, idempotentHint, openWorldHint=false), yet the description still adds real value: oldest-first ordering, the absence of pagination with silent truncation of older items, and the agent-auth requirement. Those are the exact behavioral traits an agent cannot get from the annotations or schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences, front-loaded with the resource and ordering, then the safety profile, then the truncation caveat. Zero filler and nothing repeated from the annotations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a four-parameter read tool with full schema coverage, the description covers ordering, filtering, default page size, the truncation hazard, and auth. No output schema exists, and the return concept (pending review items) is stated clearly enough not to need one.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds meaning beyond the schema by noting the default limit of 20 and clarifying that there is no offset parameter at all. It also restates the conditional auth requirement for api_key in context.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("List memories pending human review") plus the sort order, which is enough to separate it from search_memory or review_memory at a glance. It never explicitly names a sibling, so the differentiation is inferred rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear operating context: read-only, optional namespace/limit, and a warning that there is no offset so a full page silently drops older pending items. That warning effectively tells the agent when this tool is unsafe to trust naively, though it never says which alternative to use instead.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
record_outcomeA
Record the outcome of a task you just executed (episodic memory). Call this after finishing a task so past successes and failures can inform future sessions. Status must be 'success', 'failure', or 'partial'. Failures with a cause are reflected into lessons that get injected into similar future tasks. Repeated calls for the same session/outcome are deduped rather than creating a second episode. Requires agent auth when the agent has a registered key.
| Name | Required | Description | Default |
|---|---|---|---|
| tags | No | Tags for categorization | |
| task | Yes | What task was executed (kept verbatim for retrieval) | |
| cause | No | Attribution of the outcome, when known | |
| status | Yes | Outcome status: success, failure, or partial | |
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| agent_id | No | ID of the agent reporting this outcome | unknown |
| skill_id | No | ID of the skill memory the agent followed, if any — attributes this outcome to the skill's success/failure statistics | |
| namespace | No | Namespace for the episode memory (default: global) | global |
| task_type | No | Coarse task category for lesson matching (e.g. deploy, debug, refactor) | |
| agent_type | No | Type of the agent (e.g., coding-assistant) | general-assistant |
| session_id | No | Session the task ran in, for traceability |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations by disclosing dedup semantics ('repeated calls for the same session/outcome are deduped'), the downstream effect on future tasks via lessons, and the conditional auth requirement for agents with registered keys. The dedup note sits slightly in tension with idempotentHint=false, but the scope is narrower (same session AND same outcome) so it reads as refinement rather than contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Five sentences, front-loaded with the core action and trigger, then escalating to consequences, dedup, and auth. Every sentence carries distinct information, though the auth sentence could arguably be folded into a prerequisite note rather than trailing the description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 11 parameters, no output schema, and permissive annotations, the description does the important work: it explains the write's downstream consequences, the dedup behavior, and the conditional auth requirement. It leaves return-value shape unexplained, but for a fire-and-record tool that is a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 11 parameters are already documented, which sets the baseline at 3. The description adds real semantics for status enumeration and for how cause feeds lesson generation, but it says nothing about task_type, skill_id, namespace, or agent_id beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Record the outcome of a task you just executed') plus the memory subsystem (episodic memory), which separates it from add_evidence and infer_outcome. It does not explicitly name a sibling to contrast with, so the differentiation is implicit rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Call this after finishing a task so past successes and failures can inform future sessions' gives a clear trigger point in the workflow. It stops short of saying when NOT to use it or naming infer_outcome/add_evidence as alternatives for related cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
report_complianceAIdempotent
Report compliance for a previous injection session returned by session_start. Call this to mark which injected memories were followed or violated, with optional evidence. Reports are processed item by item: a bad item is logged and skipped while the call still succeeds, so the response's updated/total counts must be checked rather than assuming all reports were stored. Requires a compliance-enabled server; no agent API key is required by this tool.
| Name | Required | Description | Default |
|---|---|---|---|
| reports | Yes | List of compliance reports, one per memory | |
| inject_session_id | Yes | The inject_session_id from a previous session_start call |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well past the annotations: discloses item-by-item processing where a bad item is logged and skipped while the call still succeeds, warns that updated/total counts in the response must be checked, and notes the compliance-enabled-server and no-API-key requirements. Annotations only say non-readOnly, idempotent and non-destructive; the partial-success semantics are the genuinely useful addition.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose and the session_start linkage are front-loaded, and each subsequent sentence adds distinct information (what to report, partial-failure behavior, prerequisites). It is dense but slightly overloaded, packing prerequisites and response-checking into a single block rather than separating them.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description compensates by telling the agent what the response contains (updated/total counts) and that it must be inspected. Prerequisites, auth expectations, and partial-failure behavior are all covered, so nothing needed to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and both parameter descriptions already explain inject_session_id and the reports list, so the schema carries the load. The description restates these ('a previous injection session returned by session_start', 'optional evidence') rather than adding new syntax, batching limits, or constraints, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Report compliance') and anchors it to a concrete source of input ('a previous injection session returned by session_start'), then clarifies the action as marking injected memories followed or violated. That distinguishes it from the read-side sibling get_compliance_report without the agent needing to open either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a clear trigger ('Call this to mark which injected memories were followed or violated') and the prerequisite that the session id comes from a prior session_start. It does not explicitly name get_compliance_report as the read-only alternative or state when not to call it, so it stops short of full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
review_memoryADestructive
Review or edit a memory. action='approve' marks it human-reviewed; action='edit' updates content/instruction and re-embeds or clears the stale vector (this also works on already-approved memories); action='reject' soft-deletes a pending memory and is rejected for already-approved memories (use delete_memory instead). Approved memories rank higher in future injections. Writes immediately; requires agent auth when the agent has a registered key.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action: approve, reject, or edit | |
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| agent_id | No | ID of the requesting agent | unknown |
| memory_id | Yes | ID of the memory to review | |
| edited_content | No | New content if action is edit | |
| edited_instruction | No | New instruction if action is edit |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations declaring destructive/non-idempotent behavior, it adds that writes happen immediately, that edit re-embeds or clears stale vectors, that approve affects future ranking, and that auth is required when the agent has a registered key. These are meaningful operational details not expressible through the annotations alone.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: it names the tool, then enumerates the actions and their constraints in one dense but readable passage. Every clause carries operational information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a multi-action mutation tool with full schema descriptions and annotations, the description covers action semantics, authorization, side effects, and the key reject/delete boundary. No output schema exists, so return-value detail is not required.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3, but the description adds real meaning by explaining what each action value does and when edit applies to already-approved memories. It does not add much for api_key or agent_id beyond the schema, so it is not a full 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Review or edit a memory') and then distinguishes the three actions with precise effects. It clearly differentiates reject from delete_memory, so an agent can select it correctly against siblings like forget_memory, delete_memory, and save_memory.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit per-action guidance: approve for human-review marking, edit for content/instruction updates, reject only for pending memories with a direct pointer to delete_memory for approved ones. This names both when to use the tool and when to use an alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_decayADestructive
Run a memory decay cycle: reduces decay_score for old memories and archives memories that fall below the threshold. MUST memories are exempt from decay. This is not purely reversible: if MEMVAULT_FORGET_AUTO_ENABLED=1, the same run also permanently forgets archived memories older than MEMVAULT_FORGET_RETENTION_DAYS (default 90); otherwise auto-forget is off. Requires agent auth when the agent has a registered key. Returns updated/archived/contradicted/harmful_flagged/auto_forgotten counts.
| Name | Required | Description | Default |
|---|---|---|---|
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| agent_id | No | ID of the requesting agent | unknown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the destructiveHint/not-idempotent annotations: it discloses that MUST memories are exempt, that the operation is not purely reversible, and exactly when it becomes permanently destructive (MEMVAULT_FORGET_AUTO_ENABLED=1 with the default 90-day retention). The auth requirement and the enumerated return counts are also stated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action and mechanism, then the risk caveat, then auth, then return shape — a sensible order. All four sentences carry information; the parenthetical env-var detail is dense but load-bearing rather than filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive tool with no output schema, the description covers the mutation semantics, exemption rules, conditional irreversibility, auth prerequisites, and the shape of the return counts. An agent has everything needed to decide and call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so api_key and agent_id are already documented; baseline is 3. The description adds value by explaining when api_key is actually required ('when the agent has a registered key'), giving an agent a decision rule the schema only hints at.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Run a memory decay cycle') and immediately explains the mechanism: lowering decay_score for old memories and archiving those below threshold. This is distinguishable from siblings like run_dedup, run_promote, or forget_memory because the decay/archive semantics are unique to it.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The conditions that select this tool are clear from the description of the cycle, and the exemption rule for MUST memories is spelled out. It does not explicitly say 'use forget_memory instead when...' or name alternatives, so it stops short of full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_dedupARead-onlyIdempotent
Scan for duplicate memories and report findings. Uses lexical text similarity (Jaccard) to detect near-duplicates in one namespace or all namespaces. Read-only: reports existing_id/new_content/similarity/action but does not merge or delete anything. Returns at most 20 duplicate findings.
| Name | Required | Description | Default |
|---|---|---|---|
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| agent_id | No | ID of the requesting agent | unknown |
| namespace | No | Namespace to scan (null for all) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint and idempotentHint annotations, the description discloses the similarity method (Jaccard), the namespace scope, the exact result fields (existing_id/new_content/similarity/action), the cap of 20 findings, and explicitly states that no merge or delete occurs. That is substantive behavioral context an agent cannot infer from annotations alone.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is four sentences, front-loaded with the core action and scope. Each sentence adds useful information: detection method, read-only behavior, returned fields, and result cap. There is no repetitive or wasted text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, but the description compensates by listing the returned fields and stating the maximum number of findings. Combined with the 100% parameter schema coverage and read-only annotations, an agent has everything needed to invoke the tool correctly and understand what it will return.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents api_key, agent_id, and namespace. The description mentions scanning 'one namespace or all namespaces,' which mirrors the schema's 'null for all' note without adding new syntax or format guidance. Baseline 3 is appropriate when the schema carries parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence states a specific verb and resource: 'Scan for duplicate memories and report findings.' It further distinguishes the tool by naming its detection method (lexical Jaccard similarity) and its read-only scope, making it clearly different from mutating siblings like delete_memory or forget_memory.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes the use case clear: scan for near-duplicates in one namespace or all namespaces and report findings without changing data. It does not explicitly name alternatives such as delete_memory or confirm_read, but the read-only constraint and returned 'action' field give an agent enough context to know this is a detection step rather than a cleanup step.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_promoteADestructive
Run the promote pipeline: consolidates atomic L1 memories into L2 scenario summaries, and promotes stable L2 memories into L3 core persona rules. Source memories are archived to L0 after promotion (not deleted). Mutates the store, is not idempotent, and requires agent auth when the agent has a registered key. Returns promoted/consolidated/merged/source counts.
| Name | Required | Description | Default |
|---|---|---|---|
| min_l1 | No | Minimum L1 memories to consolidate into L2 (default: 3) | |
| min_l2 | No | Minimum L2 memories to promote to L3 (default: 2) | |
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| agent_id | No | ID of the requesting agent | unknown |
| namespace | No | Namespace to scan (currently the promote pipeline scans all namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructive/not-idempotent/not-readOnly, and the description adds genuine context beyond them: source memories are archived to L0 rather than deleted (mitigating the destructive hint), and agent auth is required when a registered key exists. It also discloses the return payload shape. Missing only cost/latency or rollback details, which keeps it at 4 rather than 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three compact sentences, with the pipeline semantics front-loaded, then safety behavior, then return value. Every sentence adds distinct information and none repeats the name or annotations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, but the description states what the return contains (promoted/consolidated/merged/source counts), which covers the main gap. Slightly incomplete on preconditions and failure modes for a mutating pipeline, but well beyond adequate overall.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the defaults for min_l1 (3) and min_l2 (2) and the api_key requirement are already documented in the schema. The description adds nothing parameter-specific beyond echoing the auth requirement, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (run) and resource (promote pipeline) and spells out the two-stage transformation: L1 atomics → L2 scenario summaries, stable L2 → L3 persona rules, with sources archived to L0. This is specific enough that an agent can distinguish it from run_dedup or run_decay without inspecting schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage context is implied by the description of what the pipeline does, but there is no explicit when-to-use/when-not guidance and no named alternatives or prerequisites (e.g., that L1 must exist first, or that run_dedup should precede it). The agent must infer timing and ordering.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
save_memoryA
Save a new memory. Memories are persistent user preferences, facts, episodes, or skills that should be recalled in future conversations. Embeddings are generated automatically for semantic search. Delta-write is on by default: near-duplicate saves are skipped and similar existing memories absorb the new content instead of a new row being created (status in the response: saved | merged | skipped). Pass force_insert=true to bypass. Writes persist immediately; requires agent auth when the agent has a registered key.
| Name | Required | Description | Default |
|---|---|---|---|
| tags | No | Tags for categorization | |
| type | No | Memory type: preference, fact, episode, entity, or skill | fact |
| layer | No | Memory layer: L0 (raw), L1 (atom), L2 (scenario), L3 (persona). Auto-assigned if omitted. | |
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| content | Yes | The content of the memory to save | |
| agent_id | No | ID of the agent saving this memory | unknown |
| priority | No | Priority level: MUST, REFERENCE, or BACKGROUND | REFERENCE |
| namespace | No | Namespace for the memory (default: global) | global |
| agent_type | No | Type of the agent (e.g., coding-assistant) | general-assistant |
| confidence | No | Confidence score (0.0 to 1.0) | |
| visibility | No | Sharing scope: "scoped" (default, namespace rules) or "shared" (team pool). | |
| instruction | No | Optional instruction format for the memory | |
| skill_steps | No | Skill execution steps (only for type=skill) | |
| force_insert | No | Force insert, skipping delta-write dedup/merge. By default a save is checked against similar memories in the same namespace: near-duplicates are skipped, similar memories absorb the new content's residual (docs/DESIGN.md §17.1). | |
| skill_trigger | No | Skill trigger pattern (only for type=skill) | |
| skill_verification | No | Skill verification criteria (only for type=skill) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations establish that this is a non-read-only, non-idempotent write, and the description adds substantial context beyond that: automatic embedding generation, near-duplicate skipping, merge-absorption semantics, the saved/merged/skipped response states, immediate persistence, and the registered-key auth requirement. This is exactly the behavioral detail an agent needs before calling a mutating tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose and then layers in the important default behavior and exceptions without wasted sentences. The delta-write explanation is dense but each sentence contributes actionable information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 16-parameter mutation tool with no output schema, the description covers the highest-risk behavioral details: dedup/merge behavior, force_insert bypass, immediate persistence, auth, and response status values. It does not describe the response shape beyond status, but given full schema coverage for parameters, it is largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 16 parameters are already documented in the input schema, which sets the baseline at 3. The description mentions force_insert and auth in prose, but those meanings are also present in the schema, so it adds little parameter-level detail beyond the structured fields.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb+resource ("Save a new memory") and immediately defines what a memory is (preferences, facts, episodes, skills), which clearly separates it from siblings like search_memory, delete_memory, and add_evidence. An agent can identify the tool's role without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clearly explains the default delta-write behavior and the exact condition for using force_insert=true, which is strong intra-tool guidance. It stops short of explicitly routing the agent between save_memory and related siblings such as add_evidence or extract_memories, so it is clear but not fully comparative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_memoryARead-onlyIdempotent
Search stored memories. mode defaults to 'hybrid' (keyword + vector via RRF); 'keyword' is text-only and 'semantic' is vector-only. Semantic/hybrid need an embedding provider — when embeddings are unavailable the query falls back to keyword and each result reports search_mode='keyword'. Supports namespace, type_filter, priority_filter, top_k (default 10), min_score, and optional expand_relations for one-hop relation context. Read-only; does not mutate memories.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | Search mode: "hybrid" (default; keyword + vector via RRF), "keyword" (text-only), or "semantic" (vector-only). Semantic/hybrid fall back to keyword when embeddings are unavailable. | hybrid |
| query | Yes | Search query string | |
| top_k | No | Maximum number of results to return | |
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| agent_id | No | ID of the requesting agent | |
| min_score | No | Drop results whose final (post-rerank) relevance score is below this threshold. Unset = return the full top_k regardless of score, the pre-existing behavior. Lets callers distinguish "no confident match" (empty result) from "weak matches padded to top_k". | |
| namespace | No | Filter by namespace | |
| type_filter | No | Filter by memory type | |
| priority_filter | No | Filter by priority | |
| expand_relations | No | Attach each result's one-hop relation neighborhood (semantic graph expansion, C5). Default off. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and idempotentHint=true, but the description adds meaningful behavior beyond them: hybrid/keyword/semantic fallback, search_mode reporting, min_score filtering semantics, and one-hop relation expansion. It also explicitly confirms the tool does not mutate memories.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the purpose, then explains mode behavior, fallback, supported filters, and safety in a compact sequence. It is dense but every clause is relevant for a 10-parameter search tool, with no wasted framing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a search tool with no output schema, the description covers the important invocation context: retrieval modes, fallback behavior, filtering options, score thresholding, relation expansion, and read-only safety. It also notes that results report search_mode, which is enough for correct use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters and a baseline of 3 would be appropriate. The description adds useful context for mode defaults, embedding fallback, top_k default, min_score purpose, and expand_relations, though it does not mention api_key/agent_id because the schema covers them.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Search stored memories") and outlines the available modes, so the core purpose is clear. It does not explicitly distinguish this from sibling retrieval tools such as list_inbox or review_memory, but an agent can still infer that this is the query-based memory lookup tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explains the mode choices and the important fallback behavior when embeddings are unavailable, including that results report search_mode='keyword'. It does not explicitly say when to prefer this tool over alternatives like list_inbox or review_memory, but the retrieval context is otherwise clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
session_startA
Start an agent session. Returns relevant memories filtered by agent identity, formatted as MUST/REF instructions ready for injection into the conversation context; overflow memories are summarized with a hint to use search_memory for details. If this agent's canonical inject channel is not MCP, returns a skip explanation instead of injecting. When compliance tracking is enabled, records the injected memories and returns inject_session_id in structured_content for a later report_compliance call. Not read-only; requires agent auth when the agent has a registered key.
| Name | Required | Description | Default |
|---|---|---|---|
| api_key | No | API key for agent authentication (required if agent has a registered key) | |
| project | No | Current project name | |
| agent_id | No | ID of the agent starting the session | unknown |
| agent_type | No | Type of the agent | general-assistant |
| context_hint | No | Hint about the current conversation context |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations, the description discloses the return format (MUST/REF instructions), the overflow-summarization behavior, the non-MCP skip path, side effects of compliance tracking (recording and returning inject_session_id), and the authentication requirement. These are substantive behavioral details that an agent would not know from the annotations alone.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but front-loaded: the core purpose and return behavior come first, followed by special cases and side effects. Four sentences are appropriate for the complexity, though a slightly tighter wording could have preserved the same information with less reading overhead.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the full burden and does so completely: it explains the return format, the overflow fallback, the non-MCP skip path, compliance tracking side effects, and authentication requirements. An agent has everything needed to invoke and interpret the result correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents each parameter's meaning. The description adds marginal context by noting that memories are filtered by agent identity and that api_key is for authentication, but it does not meaningfully enrich the semantics of project, agent_type, or context_hint beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource ('Start an agent session') and immediately explains what it returns: relevant memories filtered by agent identity, formatted as MUST/REF instructions. It clearly distinguishes this session-initialization role from retrieval siblings like search_memory, which is named as the fallback for overflow details.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes the usage context explicit: it is the session-start step that primes the conversation with injected memories, and it names search_memory for overflow details and report_compliance for later compliance reporting. It does not state explicit exclusions (e.g., when not to call it), but the context is clear enough for an agent to select it correctly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
v0.6.10- Changed
search_memory1 field changed- changed
Input schema / properties / mode / descriptionPrevious value: -"Search mode: \"keyword\" (default), \"semantic\" (vector), or \"hybrid\" (both)"New value: +"Search mode: \"hybrid\" (default; keyword + vector via RRF), \"keyword\"\n(text-only), or \"semantic\" (vector-only). Semantic/hybrid fall back to\nkeyword when embeddings are unavailable."
20 tool updates
v0.1.0- First observed
add_evidence - First observed
confirm_read - First observed
delete_memory - First observed
extract_memories - First observed
forget_memory - First observed
get_compliance_report - First observed
get_effectiveness_report - First observed
get_memory_evidence - First observed
import_skills - First observed
infer_outcome - First observed
list_inbox - First observed
record_outcome - First observed
report_compliance - First observed
review_memory - First observed
run_decay - First observed
run_dedup - First observed
run_promote - First observed
save_memory - First observed
search_memory - First observed
session_start
TDQS
Scored across 20 tools
Most tools target distinct resource+action pairs, and the descriptions carefully delineate the trickiest pairs (delete_memory vs forget_memory, record_outcome vs infer_outcome, review_memory vs save_memory). A few boundaries remain soft — save_memory vs extract_memories with auto_save, and review_memory's edit action vs a dedicated update — but an agent can reason through them from the text.
The set follows a strong verb_noun convention (confirm_read, add_evidence, delete_memory, save_memory, search_memory, get_compliance_report) with a consistent run_* prefix for batch pipeline operations. The only notable deviation is session_start (noun_verb), which breaks the pattern but is unambiguous.
At 20 tools this sits slightly above the comfortable range, but the domain genuinely spans memory CRUD, decay, dedup, promotion, evidence chains, session injection, and compliance reporting, so nearly every tool earns its place. It could be trimmed (e.g. collapsing the report getters) but is not bloated.
Lifecycle coverage is broad: create, search, review/edit, soft-delete, hard-forget, decay, dedup, promote, import, extract, evidence, plus session and outcome/compliance loops. Minor gaps exist — restore is CLI-only, there is no get_memory-by-id or general list/pagination outside the inbox, and update is only reachable via review_memory's edit action.
Maintenance
Related MCP Connectors
An MCP memory server. One memory your agents share — across models, devices and apps.
One memory, every AI. A shared, user-owned markdown memory your AI clients read and write over MCP.
Persistent memory, knowledge graph, task management and more for AI agents via MCP.
- memnodeOAuthdev.memnode
Persistent, inspectable memory for AI agents with lineage, correction, and a hosted MCP endpoint.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceMCP server that enables persistent, hybrid, local memory for LLM agents, with vector + BM25 search, knowledge graph, and policy-driven retention, providing token-budgeted context injection for AI assistants.MIT
- AlicenseNot gradedqualityAmaintenanceA vendor-independent memory layer MCP server that enables multiple LLMs and AI agents to share and persist personal memories, knowledge, and context across sessions, with support for full-text search and tagging.ISC
- AlicenseNot gradedqualityBmaintenanceProvides a self-hosted shared memory service that lets AI agents capture and recall durable facts, decisions, and context across multiple tools and MCP-capable clients.3MIT
- AlicenseNot gradedqualityAmaintenanceA self-hosted memory server that gives AI agents a shared, persistent second brain, enabling verbatim storage, hybrid semantic/keyword retrieval, and a synthesized wiki layer through MCP tools.MIT