Skip to main content
Glama

MemVault

The Shared Memory Layer for Every AI Agent You Run

Not "agent learns to search memory" — memory finds the agent.

MCP Native · Hybrid Retrieval · Auto-Injection · Zero-Config Sync

Open Source · Self-Hosted · Private · MIT Licensed

Crates.io GitHub Release CI License: MIT Rust MCP Glama Status

English · 简体中文

If MemVault solves a real problem for you, a star helps others find it.

⭐ Star on GitHub · Report Bug

curl -fsSL https://raw.githubusercontent.com/dreamor/memvault/master/scripts/install.sh | bash

Every AI agent session starts from scratch. Claude Desktop doesn't know what Cursor just learned. DeepSeek Harness (dsh) doesn't know what you told Claude Code yesterday. Whatever agent you're running — international or domestic, IDE plugin or CLI harness — it forgets your preferences every time you start a new conversation.

You've been manually repeating context — project conventions, personal preferences, past decisions — across agents that should already know. This isn't a limitation of the models. It's a missing infrastructure layer.

MemVault is that layer. A lightweight, self-hosted memory router that sits between your agents and their context. It speaks plain MCP — no MemVault-specific SDK, no per-agent API integration. Any MCP-compatible agent, from any vendor, automatically shares the same persistent memory the moment it connects.

Who it's for:

  • Anyone running an MCP-capable agent — Claude Code, Claude Desktop, Cursor, Cline, Continue, DeepSeek Harness (dsh), or any other MCP client, domestic or international — who wants preferences, project context, and past decisions to persist across sessions without repeating yourself

  • Multi-agent power users running several of the above side by side, on different models, from different vendors — all sharing the same memory without configuration

  • Platform teams deploying AI-assisted workflows where consistency matters across a mixed agent fleet: code review conventions, architecture decisions, project-specific preferences

  • Anyone tired of telling their AI the same thing twice — MemVault works the way your brain should: you say it once, it's there when you need it, no matter which agent is asking

Quick Start · How It Works · What MemVault Gives You · Why MemVault · MCP Server · CLI Reference · Integrations · Architecture · Project Status · Testing · Documentation · Contributing · License


Quick Start

Don't install MemVault by hand — paste this one prompt into Claude Code, Codex, Cursor, dsh, or any other MCP-capable agent. It points the agent at a machine-readable install guide, so the agent does the whole setup itself:

Install MemVault as your long-term memory and wire it into this agent. Fetch and follow https://raw.githubusercontent.com/dreamor/memvault/master/docs/AGENT-INSTALL.md — install the binaries, register MemVault as an MCP server for this host, and verify recall works. Then keep saving my preferences, project decisions, and lessons from each session so my next agent starts with them instead of from scratch.

Or install manually:

# Install (Linux / macOS): official script, auto-verifies SHA-256
curl -fsSL https://raw.githubusercontent.com/dreamor/memvault/master/scripts/install.sh | bash
export PATH="$HOME/.memvault/bin:$PATH"

# Windows (PowerShell):
#   powershell -ExecutionPolicy Bypass -File scripts\install.ps1

# Homebrew (Apple Silicon):
#   brew install dreamor/tap/memvault

# Or from crates.io:
#   cargo install memvault-cli memvault-mcp

# The installers auto-start the local REST backend (host of the Web
# Dashboard). Open it, or start it on demand:
memvault-cli dashboard

# Save a MUST-level preference (injected as instruction, agent must follow)
memvault-cli save --content "User prefers Python" --priority MUST --type preference \
  --instruction "Use Python for code, not Java" --tags "coding,python"

# Search across all memory (hybrid: keyword + semantic when embedding is enabled)
memvault-cli search --query "Python"

# See what context gets injected when a specific agent connects
memvault-cli session-start --agent-id claude-desktop --context "Help me write code"

# Extract structured memories from free text
memvault-cli extract --text "I prefer dark mode. Our project uses Rust." --save

# Auto-generate agent instruction files from memory
memvault-cli sync

# All in one: dedup, decay, archive stale memories
memvault-cli dedup && memvault-cli decay

System requirements:

  • Prebuilt Linux binaries (install script / GitHub release): glibc ≥ 2.39 + GLIBCXX_3.4.31 (GCC 13-era runtime — Ubuntu 24.04+ / Fedora 40+ / Arch). Release builds are pinned to Ubuntu 24.04 runners, and the release workflow gates the highest glibc/GLIBCXX symbol version every binary may require plus a startup smoke test, so this floor cannot silently drift upward (0.6.9 shipped x86_64 binaries requiring glibc 2.43 that way). TLS is rustls, so no OpenSSL dependency. Ubuntu 22.04 / RHEL or EL8/EL9 users: use the Docker image (dreamor/memvault) or build from source.

  • Building from source (cargo install / cargo build): links fastembed's prebuilt ONNX Runtime static library and needs a GCC 13-class toolchain. Older toolchains (e.g. GCC 8, CentOS 7/8-era libstdc++) fail at link time with missing C++20/23 stdlib symbols (std::format, std::to_chars). macOS / Windows (MSVC) / Homebrew / Docker are unaffected.

Verify your install in 5 seconds:

memvault-cli --version
# memvault 0.6.10

# sanity check: list saved memories (verifies DB is healthy)
memvault-cli list

Local Ollama Demo (Zero Cost, Stays on Your Machine)

MemVault is plug-and-play with a local Ollama: unconfigured LLM extraction (full-text understanding / failure reflection / relation extraction) auto-detects a local Ollama; embeddings use the local model with the ollama or auto provider.

# 1. Install and start Ollama
brew install ollama && brew services start ollama    # or the official installer

# 2. Pull models
ollama pull nomic-embed-text        # embeddings, 768-dim (default for ollama/auto)
ollama pull qwen2.5:3b-instruct     # chat: LLM extraction/reflection (default qwen2.5:7b, use 3b on small machines)

# 3. (Optional) Pin the providers explicitly — persist them in ~/.memvault/.env
#    (shell exports also work — env vars take precedence over the file — but the file survives reboots)
mkdir -p ~/.memvault
cat >> ~/.memvault/.env <<'EOF'
MEMVAULT_EMBEDDING_PROVIDER=ollama
MEMVAULT_LLM_EXTRACTION_PROVIDER=ollama
MEMVAULT_LLM_EXTRACTION_MODEL=qwen2.5:3b-instruct
EOF

# 4. Verify
memvault-cli status     # Embedding provider: configured and reachable
memvault-cli save --content "Build server IP is 10.20.30.40"   # output (embedded int8)
memvault-cli outcome --task "Deploy trading service" --status failure --cause "Disk space insufficient" --task-type deploy
#   → Lesson (Llm): ... means failure reflection ran through the local LLM (not the rule-based fallback)

With no configuration at all (neither env vars nor ~/.memvault/.env), LLM extraction auto-detects a local Ollama and enables itself (default model qwen2.5:7b; pull it in advance with ollama pull qwen2.5:7b, or point MEMVAULT_LLM_EXTRACTION_MODEL at an installed model). Embeddings still default to the in-process native embedder; set MEMVAULT_EMBEDDING_PROVIDER=auto in ~/.memvault/.env to prefer Ollama and fall back to native when it isn't running. The native model's first launch downloads the weights from HuggingFace silently in the background — the server/dashboard come up immediately and hot-swap to semantic search once the download finishes, so a fresh install never blocks on it (set MEMVAULT_EMBEDDING_PROVIDER=none to run pure keyword and skip the download).


Related MCP server: GNB MemoryMCP

How It Works

MemVault is a pipeline, not a single script. Every stage below is a shipping module:

Agent connects (MCP stdio/SSE)
        │
        ▼
┌───────────────────┐
│  Agent Router      │  ← match agent type/tag → filter relevant memory
│  (Agent Registry)  │
└────────┬──────────┘
         │
         ▼
┌───────────────────┐
│  Memory Retrieval  │  ← keyword (BM25) + vector (embedding) + RRF fusion
│  (3 search modes)  │     synonym expansion · scoring · soft filtering
└────────┬──────────┘
         │
         ▼
┌───────────────────┐
│  Auto-Injection    │  ← MUST-level → instruction prompt
│                    │     REFERENCE → context resource
│                    │     NORMAL    → search result
└────────┬──────────┘
         │
         ▼
  Agent receives context ──→ makes better decisions
  • Storage: SQLite with bundled FTS5 (full-text search); embeddings stored int8-quantized (~1/4 the size of f32 at near-identical ranking quality, legacy f32 rows still readable)

  • Retrieval: BM25 keyword search over FTS5 with CJK bigram tokenization (Chinese two-character words match correctly) and tiered match fallback (strict → relaxed unigram → synonym OR; relaxations are reported, never silent), local-first embedding (in-process native by default — switch to local Ollama or any OpenAI-compatible model), RRF fusion with per-result recall provenance (kw#2/vec#5), synonym expansion, relevance scoring, soft intent filtering

  • Pipeline: Automatic entity extraction, delta-write on save (near-duplicates skipped, similar memories absorb only the residual), semantic deduplication, time-based decay, archive of stale memories

  • Sync: Zero-invasion file generation — memvault-cli sync produces CLAUDE.md, AGENTS.md, etc. directly from database contents


What MemVault Gives You

  • Auto-Injected Context: Session start automatically pulls relevant memory by agent identity — MUST-level rules land as instructions, not just chat history

  • Hybrid Retrieval: BM25 + vector + RRF fusion with synonym expansion, relevance scoring, and per-result provenance (which path recalled each memory, at what rank) — available via CLI, MCP tool, and REST API

  • Explainable Injection: every candidate dropped on the way into an agent's context is recorded with a reason (budget, caps, intent/type penalties) — "why didn't the agent get this memory?" always has an answer

  • MUST Enforcement: MUST-priority memories are never filtered or truncated. Always in context, always obeyed — trust comes from provenance (human-authored/reviewed), with an opt-in fallback for memories independently corroborated by multiple identity-verified agents (MEMVAULT_CORROBORATION_GATE), so a single spoofed/compromised agent can't unilaterally inject a binding MUST

  • Multi-Agent Awareness: Agent Registry with type/tag-based soft filtering (score demotion, not hard exclusion)

  • agent_id Is Provenance, Not a Filter: retrieval never filters by agent_id — the field only records which agent wrote a memory (source_agent). Every agent searches the same shared corpus; per-agent differences apply only at injection time (type/tag soft scoring via agents.yaml inject_rules)

  • MCP Proxy: Transparent proxy that injects memory into ANY upstream MCP server's responses — zero client changes

  • Compliance Tracking: inject_session_id traces what was injected and measures follow-through rate

  • Cross-Platform: CLI + MCP Server (stdio & SSE) + Web Dashboard (browser) + Obsidian Plugin

  • Zero-Invasion Sync: Generate AGENTS.md / CLAUDE.md from memory — no per-agent config files to edit

  • Contextual Extraction, Local-First: Rule-based keyword extraction by default; optionally understands a full user+assistant exchange via an LLM, auto-detecting a local Ollama for free before ever touching a remote API

  • History & Rollback: Every update/delete is snapshotted into memory_history — memvault-cli checkpoints + memvault-cli restore roll one memory back without touching the rest

  • Self-Diagnostics: memvault-cli status reports exactly which features are degraded when no embedding provider is configured, plus a schema fingerprint (migration version + checksum) for cross-database comparison

  • Episodic Memory: record_outcome records task results; failures are distilled into lessons and auto-injected next time (REFERENCE → MUST only with human approval), so the same trap isn't hit twice

  • Procedural Skill Activation: skills whose trigger matches intent are injected as structured [SKILL] blocks with success-rate stats (shown after ≥3 runs); failures flag the skill for revision (version++ on human edit), repeated successes auto-draft new skills into the review inbox

  • Semantic Knowledge Links: lightweight relation triples, repeated facts consolidated into a linked semantic fact with provenance, and superseded facts archived (never re-injected, still listable & restorable)

  • Team Shared Pool & SOP Import: memories marked shared are injected into every session (capped at 20); Markdown SOPs can be batch-imported as verifiable skills

  • Delta-Write on Save: every save is checked against its namespace first — near-duplicates are skipped, similar memories absorb only the residual (what's genuinely new) and get their strength refreshed, so the library converges instead of accumulating near-copies; --force / force_insert bypasses

  • Task-Level Evaluation: memvault-cli bench samples your own failure history (episodes that distilled a lesson) and measures lesson retrieval/injection rates — and with --judge, an LLM scores "plan without vs. with memory" against the known failure cause, so you see task-success lift, not just retrieval recall

  • Two-Phase Injection (never blocks): MUST rules resolve deterministically with zero embedding calls and are served immediately; the semantic pipeline prefetches in the background and lands within a short window (250ms) — if it doesn't, the deterministic baseline is served and the request moves on (two-phase design)

  • Conversation-N-Gram Retrieval: retrieval keys are conditioned on the recent turn window, weighted by recency so the current focus dominates — not a single flat query

  • Single Canonical Injection Channel: per-agent inject_channel (mcp / proxy / sync in agents.yaml) restricts automatic injection to one delivery path, so the same memory is never sent to the same agent twice

  • Data You Own: Single SQLite file. Full export/import. No cloud dependency. Your data, your machine.


Why MemVault

Looking for a self-hosted alternative to Mem0, Zep, or Letta/MemGPT? Those are hosted APIs or Python frameworks tied to one SDK. MemVault ships as a single Rust binary with no hosted service and no vendor lock-in, speaks plain MCP instead of a proprietary SDK, and shares one memory store across every agent you run — Claude Code, Cursor, Claude Desktop, dsh — not just one.

Feature

Plain CLAUDE.md

Vector DB + RAG

MemVault

Context injection

Manual edits

Query-time only

Auto on session start

Multi-agent sharing

Copy-paste

Separate indexes

Single shared store

MUST enforcement

None

None

Instruction-layer injection

Search modes

File grep

Embedding only

BM25 + Vector + Hybrid

Synonym expansion

No

No

Built-in

Deduplication

No

No

Semantic dedup pipeline

Write-time delta merge

No

No

Near-dupes skip, similar absorb the residual at save

Task-level evaluation

None

Recall metrics only

bench: with-vs-without-memory task success delta

Decay / archival

No

No

Time-based + auto archive

Memory extraction

Manual

N/A

Rule-based by default; optional local-first LLM extraction

MCP native

No

No

stdio + SSE + Proxy

Agent differentiation

Global file

Query filter

Type/tag registry

Compliance tracking

None

None

inject_session_id + rate

Self-hosted

Yes

Varies

Single binary, no cloud

MemVault complements your existing agent setup rather than replacing it. Keep your LLM, your IDE, and your workflow exactly as they are. MemVault adds the memory layer underneath.


MCP Server

Tier-1 agents (Claude Code, OpenCode, dsh, Gemini CLI, Codex) have one-command plugin installs — see Installing into your agents first. Everything below is the universal fallback for any other MCP client.

stdio (any standard MCP client)

MemVault speaks plain MCP stdio — the same mcpServers JSON works verbatim in Claude Desktop, Cursor, Cline, Continue, and any other client that reads this format:

{
  "mcpServers": {
    "memvault": {
      "command": "/path/to/memvault-mcp",
      "args": ["--db", "~/.memvault/data.db"],
      "env": { "OPENAI_API_KEY": "sk-..." }
    }
  }
}

A couple of clients use their own one-liner instead of hand-editing JSON:

# Claude Code
claude mcp add memvault /path/to/memvault-mcp -- --db ~/.memvault/data.db

DeepSeek Harness (dsh) — a domestic (China) agent harness — gets deeper treatment than a generic stdio config: a native Cordis plugin (dsh-plugin/) that auto-injects memory into the system prompt and auto-extracts at turn end, with no per-turn cooperation required from the agent. See docs/INSTALL.md §2.5 for both the zero-code MCP route and the deep-integration plugin.

Other MCP-compatible agents — international or domestic, IDE plugin or CLI harness — should work the same way: any client implementing standard MCP stdio/SSE can connect without MemVault-side changes. The ones above are the ones we've actually verified; if you get MemVault working with another one, a PR to this list is welcome.

SSE (multi-client, network-accessible)

memvault-mcp --transport sse --port 3777
# Clients connect at http://127.0.0.1:3777/mcp

SSE features: multi-client simultaneous connections, auto-triggered embedding backfill on initialization, HTTP remote access.

Note: --transport sse only mounts the MCP-over-HTTP endpoint (/mcp) — it does not expose the REST API (/api/*). The Web Dashboard is served by the REST backend (memvault-mcp --transport http --serve-web <dist>), and the Obsidian plugin also uses the REST API and requires --transport http instead. See docs/INSTALL.md §2.6.

20 MCP Tools

Tool

Description

save_memory

Save with auto-embedding; delta-write by default (near-dupes skip, similar merge) — force_insert to bypass

record_outcome

Record a task outcome (episodic memory); failures reflect into lessons

infer_outcome

Classify + record a task outcome from host-provided evidence (friction counts, terminal state) instead of a raw transcript — same rule-floor-plus-optional-LLM-judge logic as the Stop hook's outcome --infer; built for hosts without a Claude-Code-shaped JSONL transcript (e.g. dsh/Cordis). Returns skipped (not an error) when nothing is inferred

import_skills

Import skills from a Markdown SOP (headings → skills, list items → steps)

search_memory

Hybrid (default) / keyword / semantic; semantic modes fall back to keyword when embeddings are unavailable

session_start

Agent-aware context injection; honors the agent's inject_channel (skips with an explanation when another channel is canonical); records compliance injections when enabled

review_memory

Approve / reject / edit; edit also works on already-approved memories, reject only applies to pending ones

delete_memory

Soft delete — removes the live row and cascaded evidence relations, restorable via CLI restore; use forget_memory for irreversible purge

forget_memory

Permanently erase one memory or a criteria-matched bulk set (GDPR-style, irreversible); dry_run defaults to true

extract_memories

Structured extraction from text

run_dedup

Read-only deduplication scan (reports near-duplicates; does not merge/delete)

run_decay

Decay + auto-archive; opt-in permanent auto-forget when MEMVAULT_FORGET_AUTO_ENABLED=1

confirm_read

Mark read (increments access_count; repeated calls increment again)

list_inbox

List memories pending human review; limit only, no pagination

run_promote

Promote pipeline (L1→L2→L3), archive sources to L0

report_compliance

Report follow/violate status for an injected session; bad items are skipped, so check the returned updated/total counts

get_compliance_report

Compliance rates per session or aggregate

add_evidence

Record evidence relations: supports / contradicts / sourced_from; identical relations are rejected rather than duplicated

get_memory_evidence

Get the raw-evidence chain a memory was distilled from (its L0 trace rows) plus its evidence profile — read-only grounding, so an agent can quote the original session text and name its sources

get_effectiveness_report

Automatic effectiveness judgments for injected memories (useful/neutral/harmful/insufficient-context rates, judged from record_outcome) — independent of the manual report_compliance flow

2 MCP Resources

URI

Content

memory://user-profile

MUST-level rules, auto-loaded on connect

memory://project-context

REFERENCE-level project context

Configuration (.env file & environment variables)

Copy .env.example to ~/.memvault/.env and uncomment what you need — it is also the single source of truth documenting every key.

Precedence (high → low): CLI flags > process environment > ~/.memvault/.env > built-in defaults. Every binary loads the env file first thing at startup; --env-file <path> or MEMVAULT_ENV_FILE points elsewhere, and a missing file is silently skipped. memvault-cli status prints where each setting came from (env / file / default).

Two groups are intentionally not in the table below: the host installation contract (MEMVAULT_AGENT_ID, MEMVAULT_HOOK_EXTRACT, … — per-agent values authored in each host's plugin/mcpServers config), and the proxy's upstreams topology (structured data, lives in ~/.memvault/proxy.yaml).

Variable

Purpose

Default

MEMVAULT_EMBEDDING_PROVIDER

Provider: native (in-process, default), auto (Ollama-first, native fallback), ollama/local, openai, openai-compatible (any OpenAI-compatible endpoint), or none (pure keyword, skips the download)

native

MEMVAULT_EMBEDDING_API_KEY (legacy fallback: OPENAI_API_KEY)

API key for remote providers (not needed for local Ollama); the default native provider needs no key

(not needed — native local model)

MEMVAULT_EMBEDDING_API_BASE

Any OpenAI-compatible base URL (OpenAI / Azure / vLLM / gateway...). For ollama/local the embedder uses Ollama's native endpoint http://localhost:11434/api

https://api.openai.com/v1 / http://localhost:11434/api (Ollama)

MEMVAULT_EMBEDDING_MODEL

Embedding model: bge-small-zh (zh, ~95MB) / multilingual/e5-base for native; nomic-embed-text (768-dim) for Ollama; or any model name for API providers

bge-small-zh (native) / nomic-embed-text (Ollama) / text-embedding-3-small (API)

MEMVAULT_EMBEDDING_DIM

Vector dimensions

768 (local/Ollama) / 1536 (API)

MEMVAULT_LLM_EXTRACTION_PROVIDER

Optional: enables LLM-based contextual memory extraction (understands a full user+assistant exchange, not just keyword lines). Unset/auto → local-first: auto-detects a running local Ollama and uses it for free, no config needed; falls back to rule-based if none is running. openai/openai-compatible/custom → explicit remote provider (never auto-enabled just because an API key exists elsewhere — remote calls cost money and carry hallucination risk). off/disabled/none → force pure rule-based, even if local Ollama is running

(unset — local-first, rule-based if no local Ollama)

MEMVAULT_LLM_EXTRACTION_API_KEY (falls back to OPENAI_API_KEY) / MEMVAULT_LLM_EXTRACTION_API_BASE / MEMVAULT_LLM_EXTRACTION_MODEL

Chat-completions endpoint config for LLM extraction

local: http://localhost:11434/v1 / qwen2.5:7b (no key) — remote: https://api.openai.com/v1 / gpt-4o-mini

MEMVAULT_RELATIONS

Opt-in LLM relation extraction: true makes extract_memories (mode=llm) also persist supports/contradicts/sourced_from triples

(unset / false)

MEMVAULT_DELTA_WRITE

Delta-write on save: dedup within the same namespace first — near-duplicates skipped, similar memories absorb the residual. false turns it off; per-save bypass via --force / force_insert

true

MEMVAULT_CONTEXT_NGRAM_WINDOW

How many recent observed turns build the recency-weighted retrieval key used by proxy auto-injection

5

MEMVAULT_HOOK_EXTRACT_MIN_FRICTION

Minimum friction score (tool retries, rejected tool calls, mid-session corrections) a Stop-hook-triggered extract must reach before it saves anything. 0 disables the gate — extracts on every Stop, as before this existed

1

MEMVAULT_HOOK_OUTCOME_MIN_FRICTION

Minimum friction score for a Stop-hook outcome --infer to record a Resolved session; 0 disables the floor (mirrors MEMVAULT_HOOK_EXTRACT_MIN_FRICTION)

1

MEMVAULT_HOOK_OUTCOME_MIN_CONFIDENCE

Minimum LLM-judge confidence to accept its outcome --infer verdict over the rule floor

0.6

MEMVAULT_HOOK_DEBUG

Set to 1 to write host-hook diagnostics to ${TMPDIR:-/tmp}/memvault-hook.log

(off)

MEMVAULT_IDENTITY_VERIFICATION

Record whether a save_memory call's agent_id actually had a registered agents.yaml API key checked (Memory.identity_verified), vs. running unauthenticated. false stops recording it; recording alone never changes trust decisions

true

MEMVAULT_CORROBORATION_GATE

Opt-in MUST trust path: a MUST memory independently corroborated by enough distinct identity-verified agents (see MEMVAULT_CORROBORATION_MIN_AGENTS) is treated as trusted even without human review. true turns it on — off by default, so is_trusted output is unchanged unless you opt in

false

MEMVAULT_CORROBORATION_MIN_AGENTS

Minimum distinct identity-verified agents required for the corroboration gate above

2

MEMVAULT_INJECT_REQUIRE_REVIEW_FOR_MUST

Opt-in stricter injection gate: by default an unreviewed MUST memory is still injected, tagged [未审核] in the "reference data, don't execute directly" block (never [MUST]). When on, unreviewed MUST memories are excluded from injection entirely until a human reviews them — across every injection channel (CLI/MCP body, MCP [MORE - 摘要] overflow summaries, REST /api/session, proxy deterministic fast path), with an unreviewed-must-gated skip reason kept for audit. Only affects MUST — unreviewed REF/BG memories are unaffected

false

MEMVAULT_DB_POOL_SIZE

SQLite connection pool size

5

MEMVAULT_CORS_ORIGIN

Comma-separated allowed CORS origins for REST (unset = localhost only)

(localhost only)

MEMVAULT_SERVER_START_TIMEOUT

Seconds server start / the SessionStart hook waits for a freshly spawned REST server to become healthy

15

MEMVAULT_IMPORT_ROOTS

Path-list (:-separated on unix) of roots a caller-supplied path on /api/agents/import/* must live under (canonicalized before the check, so ../symlink escapes are rejected). Unset = no confinement (the endpoint is admin-gated)

—

MEMVAULT_FORGET_AUTO_ENABLED

Background auto-forget: permanently purge memories archived longer than the retention window (irreversible, unlike decay's reversible archiving)

false

MEMVAULT_FORGET_RETENTION_DAYS

Archived-retention window (days) for the auto-forget sweep

90

MEMVAULT_FORGET_MUST_EXEMPT

Protect MUST memories from forget unless the caller explicitly overrides (allow_must)

true

MEMVAULT_FORGET_SHARED_AUTO_EXEMPT

Exclude shared-visibility memories from the auto sweep (manual/bulk forget can still purge them)

true

MEMVAULT_DB

SQLite database path

$MEMVAULT_HOME/data.db when MEMVAULT_HOME is set, else ~/.memvault/data.db

MEMVAULT_STORAGE_BACKEND

Storage backend: sqlite (default) or markdown (alias md) — markdown makes a directory of {id}.md files authoritative and an internal .memvault-cache.db a rebuildable index (see docs/DESIGN.md §18)

sqlite

MEMVAULT_MARKDOWN_DIR

markdown-backend data directory (also --markdown-dir on cli/mcp/proxy); required when the backend is markdown. backup/checkpoints/restore stay sqlite-only

— (markdown mode only)

RUST_LOG

Log verbosity

info

MEMVAULT_HOME

Base directory: where .env lives, plus the model cache (~/.memvault/models) and agents.yaml. Environment-only — it can't be set inside the .env file itself (a file can't define its own location)

~/.memvault

MEMVAULT_ENV_FILE

Path to the env file (--env-file <path> also works); process-env only — the file can't relocate itself

$MEMVAULT_HOME/.env / ~/.memvault/.env

HF_ENDPOINT

HuggingFace endpoint override for native model downloads (e.g. https://hf-mirror.com on CN networks)

(HuggingFace default)

MEMVAULT_EXTRACT_ASSISTANT

Proxy-path contextual extraction of agent-produced text: on by default but saved downgraded (review:required, lowered confidence — nothing agent-produced is trusted before human review). off/disabled/false/0 disables extracting from agent responses entirely

(on — downgraded)


CLI Reference

save · outcome · search · list · review · delete · session-start · resource · extract · dedup · decay · forget · forget-log · doctor · promote · backup · export · export-skill · import · import-skills · import-agent · ingest · confirm-read · backfill-embeddings · sync · reindex · migrate-to-markdown · checkpoints · restore · supersede · status · bench · eval-history · server start|status|stop · dashboard

memvault-cli <command> --help   # detailed usage per command

Key Commands

Command

What It Does

save

Save a memory with priority, type, optional instruction. Delta-write by default: near-duplicates are skipped, similar memories absorb the residual; --force to bypass

outcome

Record a task result (success/failure/partial); failures are distilled into lessons that auto-inject into similar future tasks

search

Hybrid retrieval with relevance scoring; flags: --query, --top-k, --namespace

session-start

Simulate what context an agent receives on connect; a multi-line --context is treated as a turn sequence and weighted by recency

extract

Parse free text, extract structured memories

import-skills

Import skills from a Markdown SOP (# / ## headings → skills, list items → steps); enters the review inbox unless --approve

import-agent

Cold-start import from another agent's native memory files: Claude Code/Desktop (CLAUDE.md/auto-memory), Codex CLI (AGENTS.md), Hermes Agent (USER.md/MEMORY.md/skills), Qoder (.qoder/rules), OpenClaw (experimental); --scan to detect-only, --path to override, --paste/stdin as a generic fallback for any other agent, enters the review inbox unless --approve

ingest

Incrementally ingest agent session transcripts (Claude Code / Codex / Hermes) into memory: turns with extractable signal are kept as L0 evidence rows, and their extracted candidates carry source_trace_ids back to that evidence; a per-session watermark means each turn is processed once. --dry-run to preview, --approve to skip the review inbox, --agent/--home/--max-sessions to scope

sync

Generate agent instruction files (AGENTS.md / CLAUDE.md / MEMORY-INDEX.md, …) from memory (with --watch)

dedup

Scan and merge semantically duplicate memories (vector-assisted when an embedding provider is configured)

checkpoints

List memory history snapshots (per-memory or global); flags: --memory-id, --limit

restore

Revert a memory to the state captured by a checkpoint (--history-id)

supersede

Archive an old fact and point it at its replacement (nothing is deleted; search skips superseded, list keeps them)

status

Show embedding provider readiness (distinguishes not-configured / explicitly-disabled / configured-but-unavailable) and which features degrade without it

dashboard

Ensure the local REST backend is running (spawns memvault-mcp --transport http detached if needed) and open the Web Dashboard in your browser

server start / server status / server stop

Manage that same backend: idempotent start (health-probes first, auto-moves to the next free port when 3777 is taken by a foreign process), status, and stop. Prints the active URL (with --quiet, the URL alone)

doctor

Read-only memory hygiene lint: dangling/stale/duplicate/contradicted + machine-readable --json

bench

Task-level memory benchmark: samples your own outcome history, measures lesson retrieval/injection rates; --judge adds an LLM-scored "plan without vs. with memory" success delta; each run persists itself for eval-history

eval-history

Trend-over-time view of past bench/doctor runs — every run persists itself automatically, this just lists what accumulated

decay

Archive stale memories based on access recency

backup

Create a consistent point-in-time SQLite backup

export / import

Backup and restore — JSON to a file or a directory (writes export.json inside); Markdown to/from a directory or a single .md file; import is idempotent (ids already present are skipped, never overwritten)

confirm-read

Mark memories as read (updates access_count)


Integrations

Installing into your agents

MemVault ships native adapters for most agents — one shared store, per-host identity via MEMVAULT_AGENT_ID, four tiers (Tier 1/2/3 details below; per-client registration snippets in integrations/mcp-clients/).

Core packages & versions:

Package

Version

Install / Source

memvault-core (crates.io)

0.6.10

library dependency

memvault-cli · memvault-mcp · memvault-proxy (crates.io)

0.6.10

cargo install memvault-cli memvault-mcp memvault-proxy

@dreamor/dsh-memvault (npm)

0.6.10

npm registry (dsh Cordis plugin, below)

Shipped plugins & versions — each bumps on its own schedule:

Plugin

Version

Distributed via

Claude Code / Codex plugin bundle (plugins/memvault/)

0.6.10

dreamor/memvault marketplace

Gemini CLI extension (gemini-extension.json)

0.6.10

gemini extensions install

Qoder plugin (.qoder-plugin/)

0.6.10

in-repo manifest

Obsidian plugin (obsidian-plugin/)

0.3.6

dreamor/memvault-obsidian (BRAT / community dir)

dsh Cordis plugin (dsh-plugin/)

0.6.10

npm @dreamor/dsh-memvault

Tier 1 — one-command native plugins (memory injected by hooks; extraction opt-in where the host exposes lifecycle hooks):

Agent

Install

Recall

Extract

Claude Code

/plugin marketplace add dreamor/memvault, then /plugin install memvault@memvault (two separate prompts) — bundles the MCP server, 4 skills, 4 slash commands

✅ SessionStart hook

✅ Stop hook, enable with MEMVAULT_HOOK_EXTRACT=1

OpenCode

merge integrations/opencode/opencode.json into your project

✅ system transform

✅ on session.idle

DeepSeek Harness (dsh)

built-in Cordis plugin dsh-plugin/ — see docs/INSTALL.md §2.5

✅ system prompt

✅ turn-end

Gemini CLI / Antigravity

gemini extensions install https://github.com/dreamor/memvault

⚠️ rule context + tools

❌

Codex CLI

codex plugin marketplace add dreamor/memvault, then install memvault@memvault from the plugin browser — the same plugins/memvault/ bundle; manual fallback in integrations/codex/

✅ SessionStart hook — approve the bundled hook once in /hooks

✅ Stop hook — approve in /hooks; opt-in via MEMVAULT_HOOK_EXTRACT=1 / MEMVAULT_HOOK_OUTCOME=1

⚠️ = the host has no injection hooks; recall is rule-driven (the agent calls session_start once) with the bundled canonical rule text.

Tier 2 — paste an MCP snippet. Strict-JSON registrations with per-host identities in integrations/mcp-clients/ (target paths in its README): Cursor · Windsurf · Cline/Roo · Continue · Zed · JetBrains AI/Junie · VS Code (Copilot Chat) · Claude Desktop.

Tier 3 — native manifests, verify-on-install. Qoder (.qoder/rules/ + .qoder-plugin/ + a UserPromptSubmit hook template), Grok Build (grok plugin install dreamor/memvault --trust), the Hermes Python plugin (integrations/hermes/, pre_llm_call recall + extraction helper) and the pi extension (pi-extension/, pi install git:github.com/dreamor/memvault) ship in-repo; OpenClaw and Swival consume the generated root skills/ (also exported to .openclaw/skills/); Devin stays a manual recipe in integrations/README.md.

Tier 4 — instruction-only rule copies. Canonical text + scripts/gen-rule-copies.sh (parity-checked in CI) produce AGENTS.md/CLAUDE.md blocks, .cursor/rules/, .clinerules/, .kiro/steering/, Junie guidelines; memvault-cli sync --watch keeps them fresh from the store.

Any other MCP-speaking client (domestic or international, IDE plugin or CLI harness) connects with zero MemVault-side changes via the standard stdio config below — not individually verified; PRs adding a verified entry are welcome.

GUI surfaces are independent of agent installs: Web Dashboard (9 tabs) · Obsidian plugin (α — Vault sync + browse/capture) · MCP Proxy (transparent memory injection for any upstream server).


Architecture

┌────────────────────────────────────────────────┐
│  Clients (any MCP-compatible agent)             │
│  ┌────────────┐ ┌────────┐ ┌─────┐ ┌────────┐  │
│  │ Claude Code│ │ Cursor │ │ dsh │ │ Others │  │
│  └────────────┘ └────────┘ └─────┘ └────────┘  │
└──────────────────┬───────────────────────────────┘
                   │ MCP (stdio / SSE / HTTP)
┌──────────────────▼───────────────────────────────┐
│  memvault-mcp     (rmcp 3.1.1)                    │
│  ┌──────────────┐ ┌────────────────┐ ┌────────┐  │
│  │  20 tools    │ │  2 Resources   │ │ SSE    │  │
│  │   + REST API │ │  + Auto-Inject │ │ Server │  │
│  └──────┬───────┘ └──────┬─────────┘ └────────┘  │
│         └────────┬───────┘                        │
│              ┌───▼────────┐                       │
│              │ Agent       │ (Agent Registry      │
│              │ Router      │  type/tag filter)     │
│              └───┬────────┘                       │
├──────────────────┼────────────────────────────────┤
│  memvault-core    │                               │
│  ┌──────────┐  ┌─▼───────┐ ┌────────────┐ ┌───┐ │
│  │ storage  │  │retrieval│ │ pipeline   │ │sync│ │
│  │ SQLite   │  │BM25+Vec │ │extractor   │ │   │ │
│  │          │  │RRF+syn  │ │dedup/decay │ │   │ │
│  │embed     │  │onym     │ │export/     │ │   │ │
│  │backfill  │  │scoring  │ │import      │ │   │ │
│  └──────────┘  └─────────┘ └────────────┘ └───┘ │
└────────────────────────────────────────────────┘

Project Status

MemVault is in beta. The Rust core (storage / search / injection) is CI-gated and stable; plugin adapters and GUI surfaces evolve faster. All configuration is environment-driven (see .env.example), and every change is recorded in CHANGELOG.md.

Testing

cargo test                      # ~1300 tests (full workspace)
cargo clippy --all-targets      # zero warnings
cargo fmt --all -- --check      # format check
cargo llvm-cov --workspace --all-features   # CI gate: line ≥92% / region ≥90% / function ≥85%

Documentation

Doc

Content

docs/DESIGN.md

Product & architecture design

docs/INSTALL.md

Installation guide (all platforms)

docs/AGENT-INSTALL.md

Agent-facing install guide — the target of the one-prompt Quick Start (install → register as MCP → verify recall)

docs/DOCKER.md

Docker deployment

docs/RUNBOOK.md

Deployment / health check / rollback runbook

docs/TROUBLESHOOTING.md

Symptom → cause → fix troubleshooting guide

docs/experiments/

Hypothesis-validation experiments (H1–H7, 2026-08-11 → 2026-08-27, all CONFIRMED) + runtime plumbing regression (2026-08-28)

docs/RELEASING.md

Release process — what CI automates (Linux/macOS binaries, Docker image, dashboard archive, Obsidian zip) vs. manual steps (Obsidian submission — no macOS signing needed)

docs/DISTRIBUTION.md

Distribution channel map — automated vs. manual channels, required credentials, MCP registries, optional channels

CHANGELOG.md

Release history

CONTRIBUTING.md

Contribution guide

SECURITY.md

Security disclosures

ACCESSIBILITY.md

Accessibility statement — commitment, supported environments, known limitations, how to report a barrier

.env.example

Configuration template — single source of truth for every config key


Contributing


License

MemVault is released under the MIT License.

Available Tools

20 tools
add_evidenceA
Idempotent

Record evidence for a memory. relation="supports"/"contradicts" links evidence_id → memory_id (a memory supporting or contradicting it); relation="sourced_from" records memory_id's external provenance via source (URL/document). Writes one relation and returns its relation_id; an identical relation is rejected rather than duplicated. Contradictions accelerate the contradicted memory's decay; superseded or archived evidence stops counting. Requires agent auth when the agent has a registered key.

NameRequiredDescriptionDefault
sourceNoExternal source: URL, document path, conversation reference (required for sourced_from).
api_keyNoAPI key for agent authentication (required if agent has a registered key)
agent_idNoID of the requesting agentunknown
relationYesEvidence relation: "supports" | "contradicts" | "sourced_from". supports/contradicts link two memories (`evidence_id` = the memory providing evidence); sourced_from records an external source text.
memory_idYesThe memory this evidence statement is ABOUT, or that the subject memory supports/contradicts — see `relation` for direction. For supports/contradicts: the memory being supported/contradicted. For sourced_from: the memory whose provenance is recorded.
confidenceNoEvidence confidence, 0.0-1.0 (default 0.8).
evidence_idNoThe memory providing evidence (required for supports/contradicts).

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations: discloses that duplicates are rejected rather than created (concretizing idempotentHint), that contradictions accelerate the contradicted memory's decay, that superseded or archived evidence stops counting, and that a relation_id is returned. Auth requirement is also stated. These are real side effects and constraints an agent could not infer from the structured fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the core purpose, then mode semantics, then side effects and auth — a sensible order. Dense but every clause carries information; only the parenthetical re-explanation of supports/contradicts is mildly redundant with the relation schema description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter write tool with no output schema, the description covers return value (relation_id), failure mode (duplicate rejection), downstream consequences (decay acceleration, superseded evidence), and auth. Nothing essential for a correct call is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% so baseline is 3, but the description adds genuine meaning: it clarifies the direction of the evidence_id → memory_id arrow and what `source` does for sourced_from. It does not explain `confidence` or `agent_id`, leaving those entirely to the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Record evidence for a memory") and spells out the two modes of the operation (memory→memory relations vs memory→external source provenance). An agent can see this is a write of a single relation, unlike the read-oriented get_memory_evidence sibling, but no sibling is named explicitly, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Clear conditional guidance per mode: relation="supports"/"contradicts" link evidence_id → memory_id, relation="sourced_from" requires `source`. Prerequisites (agent key auth, source required) are stated. It does not, however, say when an agent should prefer this over save_memory or get_memory_evidence, or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

confirm_readA

Confirm that one or more memories have been read by the agent. Increments access_count and sets last_read_at for the specified memory IDs; unknown IDs are skipped and the response reports how many rows were confirmed. Repeated calls increment the counters again (not idempotent). Requires agent auth when the agent has a registered key.

NameRequiredDescriptionDefault
api_keyNoAPI key for agent authentication (required if agent has a registered key)
agent_idNoID of the requesting agentunknown
memory_idsYesList of memory IDs to confirm as read

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses behavior beyond the annotations: unknown IDs are silently skipped, the response reports the confirmed row count, and repeated calls double-increment. The non-idempotency note largely mirrors idempotentHint=false, but the unknown-ID handling, return-count behavior, and auth requirement are genuine additions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences, front-loaded with the action and effect, then side effects, then auth. No filler and every clause carries information an agent needs.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description still tells the agent what comes back (a count of confirmed rows) and covers the auth requirement and skip behavior. Nothing material is missing for a 3-parameter write tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description reinforces batch semantics ('one or more memories') and the auth requirement for api_key, but adds nothing about agent_id and no format details for IDs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('confirm that one or more memories have been read') plus the exact effect (increments access_count, sets last_read_at). It is clearly distinguishable from siblings like search_memory, get_memory_evidence, or record_outcome, which do not confirm reads.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear context for when to call it (marking memories as read after the agent consumes them) and the auth precondition when a registered key exists. It does not name an alternative tool or state a when-not-to-use case, so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delete_memoryA
DestructiveIdempotent

Soft-delete one memory by its ID: removes its live row, FTS entry, and cascaded evidence relations so it is no longer searchable or injected. A full snapshot is written to memory_history first; restore is available through the CLI (memvault restore), not through this MCP tool. Use forget_memory for an irreversible GDPR-style purge. Requires agent auth when the agent has a registered key; a second delete of the same ID returns NotFound.

NameRequiredDescriptionDefault
api_keyNoAPI key for agent authentication (required if agent has a registered key)
agent_idNoID of the requesting agentunknown
memory_idYesID of the memory to delete

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Although annotations already declare destructive and idempotent behavior, the description adds substantial operational context: what is removed, that search and injection stop working, that a snapshot is written first, that restore is outside this tool, auth requirements, and NotFound behavior on repeat deletion. No annotation is contradicted.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but well front-loaded, starting with the core action and consequences. Every sentence contributes useful behavioral or routing information without repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive mutation tool with no output schema, the description covers the important missing context: side effects, recoverability, auth behavior, repeat-call behavior, and the correct alternative for permanent deletion. An agent has enough information to invoke it correctly and avoid mistakes.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so parameter meanings are already documented in the input schema. The description reinforces memory_id and auth requirements but does not add syntax or format details beyond the schema, making the baseline 3 appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource: soft-delete one memory by ID. It precisely states the scope and consequences, including removal of the live row, FTS entry, and evidence relations, and explicitly distinguishes this from forget_memory.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly names the alternative tool for irreversible GDPR-style purges, forget_memory, and explains that restoration is available only through the CLI rather than this MCP tool. This gives clear when-to-use and when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

extract_memoriesA

Extract structured memories from conversation text. mode="rule" (default) detects preferences, facts, and skills via keyword pattern matching. mode="llm" instead understands the full context (optionally pairing assistant_text) semantically — uses the configured LLM extraction provider, and degrades to rule-based extraction (reported via fallback_used/fallback_reason) when no provider is configured or the LLM call fails. Returns extracted items; with auto_save=true it also writes them and requires agent auth when the agent has a registered key. Invalid occurred_at is an error, never a silent drop.

NameRequiredDescriptionDefault
modeNoExtraction mode: "rule" (default, keyword pattern matching) or "llm" (semantic extraction over the full context; uses the configured LLM extraction provider, falling back to rule-based when none is configured or the LLM call fails — see fallback_used in the result).
textYesText to extract memories from (conversation content, e.g. the user's turn)
api_keyNoAPI key for agent authentication (required if agent has a registered key)
agent_idNoAgent ID to attribute saved memories tounknown
auto_saveNoWhether to auto-save extracted memories
occurred_atNoWhen the extracted facts actually happened in the source conversation (RFC 3339), stored as `occurred_at` on saved memories — distinct from `created_at` (ingestion time). Invalid input is an error, never a silent drop.
assistant_textNoOptional paired assistant/response text for mode="llm" — passing both sides of the exchange lets the model resolve references and implicit preferences a single text can't.

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations by disclosing the fallback path (degrades to rule-based, surfaced via fallback_used/fallback_reason), the auth requirement when an agent key is registered, and that invalid occurred_at errors rather than silently dropping. It does not address non-idempotency (idempotentHint=false) — nothing warns that repeated calls with auto_save=true may produce duplicate memories.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Dense but front-loaded: purpose first, then the mode distinction, then the write/auth caveat, then the occurred_at rule. Each sentence carries information, though the mode explanation partially duplicates the schema and could be trimmed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter, non-idempotent tool with no output schema, the description covers the decisions that matter: mode selection, fallback reporting, auth on write, and error semantics. The only meaningful omission is duplicate/retry behavior after a save.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents mode, assistant_text, api_key, and occurred_at semantics; the description largely restates these rather than adding syntax or constraints. The one genuinely additive note is the auth precondition tied to auto_save, which lifts it just to baseline rather than above.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb + resource ("Extract structured memories from conversation text") and immediately qualifies the two operating modes, so the agent knows exactly what the tool produces. It does not name or contrast any sibling (save_memory, add_evidence), so an agent still has to infer why to extract rather than save directly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear conditions for the key branch: rule mode for keyword matching, llm mode for semantic understanding over full context with optional assistant_text, and notes auto_save triggers a write. It stops short of saying when to pick this tool over save_memory or when extraction is unnecessary.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

forget_memoryA
DestructiveIdempotent

Permanently erase (GDPR-style) one memory by id or a bulk set matched by criteria (namespace/namespace_prefix/source_agent_id/tag/memory_type/before_days). Unlike delete_memory, this also purges memory_history snapshots and any orphaned compliance rows, leaving only a content-hash audit entry in the forgotten-log — irreversible. dry_run defaults to true: call once to preview, then again with dry_run=false to execute. Priority::Must memories are excluded unless allow_must=true. Gated by the same per-agent API-key auth as delete_memory — there is no separate admin tier at the MCP layer.

NameRequiredDescriptionDefault
tagNoBulk: memories carrying this tag
reasonNoAudit-trail reason recorded in the forgotten-log
api_keyNoAPI key for agent authentication (required if agent has a registered key)
dry_runNoPreview matches without purging anything (default: true — forgetting is irreversible, so a caller must explicitly set this to false to execute)
agent_idNoID of the requesting agentunknown
memory_idNoID of a single memory to permanently erase. Mutually exclusive with the criteria fields below — when set, every criteria field is ignored.
namespaceNoBulk: exact namespace match
allow_mustNoExplicit override to include Priority::Must memories (otherwise excluded by default)
before_daysNoBulk: not updated in this many days
memory_typeNoBulk: memory type (preference, fact, episode, entity, skill)
source_agent_idNoBulk: source agent id
namespace_prefixNoBulk: namespace starts with this (e.g. "archived:")

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond annotations: discloses that history snapshots and orphaned compliance rows are purged, that only a content-hash audit entry remains, that the operation is irreversible, that Must-priority memories are excluded unless allow_must=true, and that auth is per-agent API key with no admin tier at the MCP layer.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Dense but front-loaded: scope, sibling contrast, destructive effects, workflow, and auth in a tight block. Slightly long with some redundancy against schema descriptions (dry_run default, allow_must) but every sentence carries operational weight.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers the critical concerns for a destructive, 12-param, irreversible tool with no output schema: what gets destroyed, irreversibility, preview workflow, exclusion of Must memories, and auth. Return-value shape is not explained, but for a preview/execute purge tool the key facts are present.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% so the baseline is 3; the description adds value by grouping bulk criteria (namespace/namespace_prefix/source_agent_id/tag/memory_type/before_days), flagging memory_id as mutually exclusive with the criteria, and explaining the dry_run default and allow_must override. Marginal gain over schema because these details are largely restated.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (permanently erase / purge), the resource (one memory by id or a bulk set), and explicitly contrasts with the sibling delete_memory. An agent can distinguish it from delete_memory without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit selection criteria (single id vs bulk criteria fields), names the alternative (delete_memory) and how this differs, and prescribes a two-step workflow (preview with dry_run, then execute). No inference required.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_compliance_reportA
Read-onlyIdempotent

Get a compliance report for injection sessions. Shows follow/violation rates for MUST memories. Provide inject_session_id for one session, or omit it for an aggregate summary filtered by optional agent_id and limit (default 10). Read-only; returns JSON and does not change compliance records.

NameRequiredDescriptionDefault
limitNo
agent_idNoFilter aggregate summary by agent
inject_session_idNoGet report for a specific injection session

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true and openWorldHint=false, so 'Read-only; ... does not change compliance records' largely restates them. The genuinely additive part is the aggregate-vs-single-session behavior and the default limit; 'returns JSON' is generic and, with no output schema, gives no insight into report shape.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three compact sentences with the resource and payload front-loaded, followed by the routing rule for the optional parameter. No filler, though the trailing read-only clause is partly redundant with the annotations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-required-parameter read-only report tool with annotations covering safety and no output schema, the description covers what the report contains, both invocation modes, the default limit, and the absence of side effects. A little more on report structure would make it fully self-sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 67% and the undocumented parameter is limit; the description compensates by stating the default of 10 and its role in the aggregate filter. The two documented parameters (agent_id, inject_session_id) are also explained in behavioral terms (single vs aggregate), adding context beyond the terse schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Get a compliance report for injection sessions') and clarifies the payload ('follow/violation rates for MUST memories'). It is discernible from get_effectiveness_report, but nothing in the text distinguishes it from the sibling report_compliance, so sibling differentiation is only partial.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit invocation guidance: pass inject_session_id for a single session, or omit it for an aggregate filtered by agent_id and limit (default 10). What's missing is any exclusion, e.g. when to prefer report_compliance or get_effectiveness_report instead.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_effectiveness_reportA
Read-onlyIdempotent

Get automatic effectiveness judgments for injected memories: useful/neutral/harmful/insufficient_context rates, judged automatically from record_outcome — independent of manual report_compliance. Optional agent_id filters the summary and limit defaults to 10. Read-only; returns JSON and does not change records.

NameRequiredDescriptionDefault
limitNo
agent_idNoFilter by agent

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and openWorldHint, so the safety profile is covered. The description adds useful context beyond annotations: judgments are automatic, sourced from record_outcome, independent of manual compliance reporting, and returned as JSON without changing records.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded, starting with the core purpose and then adding the automatic/manual distinction, parameter defaults, and read-only behavior. Every clause contributes useful selection or invocation context.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description still enumerates the rate categories and states that the response is JSON. It could be slightly more complete about the reporting window or whether rates are counts versus percentages, but it provides enough for correct selection and invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 50%, so the description must compensate for the undocumented parameters. It explains that agent_id optionally filters the summary and that limit defaults to 10, adding meaning beyond the schema for both parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: get automatic effectiveness judgments for injected memories. It names the exact metrics (useful/neutral/harmful/insufficient_context rates) and distinguishes the tool from manual compliance reporting by saying it is independent of report_compliance.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly positions the tool as the automatic effectiveness counterpart to manual report_compliance, which helps an agent choose between the two. It does not explicitly state when not to use it, but the alternative and context are clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_memory_evidenceA
Read-onlyIdempotent

Get the raw-evidence chain a memory was distilled from (its L0 trace rows), plus its evidence profile. Read-only grounding: lets an agent quote the original session text and name its sources. Missing or pruned evidence yields an empty chain rather than a write; requires agent auth when the agent has a registered key.

NameRequiredDescriptionDefault
api_keyNoAPI key for agent authentication (required if agent has a registered key)
agent_idNoID of the requesting agentunknown
memory_idYesThe memory whose raw-evidence chain (L0 trace rows) to expand

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint/idempotentHint annotations, the description discloses two things annotations cannot: missing or pruned evidence returns an empty chain rather than erroring, and agent auth is required when a registered key exists. It stops short of describing pagination or chain size limits, but the behavioral payoff is substantial.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three compact sentences, front-loaded with the core action and followed by the use case and edge-case behavior. Slightly dense phrasing ('Read-only grounding: lets an agent...'), but no wasted text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description usefully sketches the return shape (L0 trace rows plus evidence profile, empty chain when evidence is missing) and covers the auth precondition. An agent has enough to invoke this correctly; only deeper return-format detail is absent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so memory_id, agent_id, and api_key are already documented in the schema. The description reinforces the auth condition but adds no new syntax or semantics for memory_id beyond what the schema states. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: retrieves the raw-evidence chain (L0 trace rows) plus evidence profile for a memory. This is clearly distinguishable from siblings like add_evidence (writes evidence) and search_memory (searches), since it is about expanding provenance for a known memory_id.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides a concrete usage context: 'read-only grounding: lets an agent quote the original session text and name its sources,' which tells the agent when this tool is the right pick. It does not explicitly name an alternative tool or state exclusions, so guidance is clear but not fully comparative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

import_skillsA

Import skills from a Markdown SOP document. Each #/## heading becomes a skill (trigger:/verification: metadata lines + list-item steps). Sections without steps are skipped. Imported skills enter the review inbox unless approve=true. Writes new skill memories; repeating the same import can create duplicates. Requires agent auth when the agent has a registered key.

NameRequiredDescriptionDefault
api_keyNoAPI key for agent authentication (required if agent has a registered key)
approveNoMark imported skills as human-reviewed (skip the inbox). Default false.
agent_idNoID of the requesting agentunknown
markdownYesMarkdown SOP text. Each #/## heading becomes a skill; `trigger:` / `verification:` lines and list items become the skill metadata.
namespaceNoNamespace for the imported skills.global
fallback_titleNoFallback skill title when the document has no headings.imported-sop

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations: says imported skills enter the review inbox unless approve=true, that repeating the same import creates duplicates (the concrete consequence behind idempotentHint=false), and that agent auth is required when the agent has a registered key. The auth and inbox-routing details can't be inferred from the annotation flags.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four tight sentences, front-loaded with the action and parsing rule, then side effects, then auth. Every sentence carries operational information; nothing is redundant filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 6-parameter write tool with no output schema, the description covers creation behavior, skip rules, duplicate risk, inbox routing, and auth. It omits what the call returns (counts, per-skill errors) and how namespace scoping affects results, which leaves a modest gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds parsing semantics not in the schema: sections without steps are skipped, and headings define skill boundaries. It covers markdown/approve/auth but says nothing about namespace, fallback_title, or agent_id, which keeps it from a 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb + resource ('Import skills from a Markdown SOP document') with the parsing model spelled out (headings become skills, trigger:/verification: metadata, list-item steps). This clearly separates it from siblings like save_memory or extract_memories, which create skills from other sources.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

States the applicable input form (Markdown SOP document) and discloses the routing decision point (review inbox unless approve=true) plus a duplicate-import caveat. It stops short of naming an explicit alternative such as extract_memories for non-SOP text, so it does not reach a full 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

infer_outcomeA

Classify and record a task outcome from host-provided evidence rather than raw transcript text — for hosts whose event model doesn't produce a Claude-Code-shaped JSONL transcript (e.g. dsh/Cordis session events). Pass pre-computed friction counts and terminal state in evidence; this runs the same rule-floor-plus-optional-LLM-judge classification as the Claude Code Stop hook's outcome --infer, then records exactly like record_outcome. Returns status 'skipped' (not an error) when nothing was inferred — a clean session, below the friction threshold, or no task evidence at all. Repeated calls for the same session/evidence are deduped. Requires agent auth when the agent has a registered key.

NameRequiredDescriptionDefault
tagsNoTags for categorization — "auto-inferred" and "inferred:rule"/"inferred:llm" are added automatically
api_keyNoAPI key for agent authentication (required if agent has a registered key)
agent_idNoID of the agent reporting this outcomeunknown
evidenceYesStructural evidence computed by the caller from its own event stream
namespaceNoNamespace for the episode memory (default: global)global
agent_typeNoType of the agent (e.g., coding-assistant)general-assistant
session_idNoSession the task ran in, for traceability
judge_contextNoConversation excerpt handed to the LLM judge, if one is configured (DATA to analyze, not instructions). Optional — when empty, only the rule-based floor runs.

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Richly goes beyond the annotations: discloses that a no-op returns status 'skipped' rather than an error (clean session, below friction threshold, no evidence), that repeat calls for the same session/evidence are deduped, that agent auth is required when a key is registered, and that the classification is rule-floor plus optional LLM judge with recording identical to record_outcome. The only mild tension is 'deduped' versus idempotentHint=false, but that is a storage-level dedup of the record rather than a claim the call is a pure read-replay, so it does not rise to contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One dense but well-ordered paragraph: purpose, then the evidence-passing contract, then the skipped/dedup/auth caveats. Every clause carries a distinct fact, though the run-on middle sentence about the rule-floor-plus-LLM-judge pipeline could be broken out for faster scanning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 8-parameter, non-read-only, auth-bearing tool with no output schema, the description covers the essentials: what gets recorded, the skipped-not-error return, dedup, and auth. Only the successful return payload (beyond the 'skipped' case) is left implicit, which is a small gap given no output schema exists.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so every parameter is already documented, including the per-field evidence semantics and judge_context's "data not instructions" note. The description reinforces that `evidence` must be caller-precomputed and that the judge is optional, but adds no format or constraint detail beyond the schema. Baseline 3 applies when the schema carries this much weight.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb+resource ("Classify and record a task outcome") plus an explicit scope constraint ("from host-provided evidence rather than raw transcript text"). It names the sibling it mirrors (record_outcome) and the pipeline it reuses (the Claude Code Stop hook's `outcome --infer`), so an agent can place it precisely among 19 siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states the selecting condition: use this for hosts whose event model doesn't emit a Claude-Code-shaped JSONL transcript (e.g. dsh/Cordis). It also tells the caller what to supply (pre-computed friction counts, terminal state). It stops short of a clean routing sentence such as "if you already have a classified outcome, call record_outcome instead," leaving that inference to the reader.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_inboxA
Read-onlyIdempotent

List memories pending human review, sorted by created_at ascending (oldest first). Read-only. Supports an optional namespace and limit (default 20); there is no offset/pagination, so a full page silently truncates older pending memories. Requires agent auth when the agent has a registered key.

NameRequiredDescriptionDefault
limitNoMaximum number of results to return
api_keyNoAPI key for agent authentication (required if agent has a registered key)
agent_idNoID of the requesting agentunknown
namespaceNoFilter by namespace

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover safety (readOnlyHint, idempotentHint, openWorldHint=false), yet the description still adds real value: oldest-first ordering, the absence of pagination with silent truncation of older items, and the agent-auth requirement. Those are the exact behavioral traits an agent cannot get from the annotations or schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences, front-loaded with the resource and ordering, then the safety profile, then the truncation caveat. Zero filler and nothing repeated from the annotations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a four-parameter read tool with full schema coverage, the description covers ordering, filtering, default page size, the truncation hazard, and auth. No output schema exists, and the return concept (pending review items) is stated clearly enough not to need one.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds meaning beyond the schema by noting the default limit of 20 and clarifying that there is no offset parameter at all. It also restates the conditional auth requirement for api_key in context.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("List memories pending human review") plus the sort order, which is enough to separate it from search_memory or review_memory at a glance. It never explicitly names a sibling, so the differentiation is inferred rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear operating context: read-only, optional namespace/limit, and a warning that there is no offset so a full page silently drops older pending items. That warning effectively tells the agent when this tool is unsafe to trust naively, though it never says which alternative to use instead.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

record_outcomeA

Record the outcome of a task you just executed (episodic memory). Call this after finishing a task so past successes and failures can inform future sessions. Status must be 'success', 'failure', or 'partial'. Failures with a cause are reflected into lessons that get injected into similar future tasks. Repeated calls for the same session/outcome are deduped rather than creating a second episode. Requires agent auth when the agent has a registered key.

NameRequiredDescriptionDefault
tagsNoTags for categorization
taskYesWhat task was executed (kept verbatim for retrieval)
causeNoAttribution of the outcome, when known
statusYesOutcome status: success, failure, or partial
api_keyNoAPI key for agent authentication (required if agent has a registered key)
agent_idNoID of the agent reporting this outcomeunknown
skill_idNoID of the skill memory the agent followed, if any — attributes this outcome to the skill's success/failure statistics
namespaceNoNamespace for the episode memory (default: global)global
task_typeNoCoarse task category for lesson matching (e.g. deploy, debug, refactor)
agent_typeNoType of the agent (e.g., coding-assistant)general-assistant
session_idNoSession the task ran in, for traceability

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations by disclosing dedup semantics ('repeated calls for the same session/outcome are deduped'), the downstream effect on future tasks via lessons, and the conditional auth requirement for agents with registered keys. The dedup note sits slightly in tension with idempotentHint=false, but the scope is narrower (same session AND same outcome) so it reads as refinement rather than contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Five sentences, front-loaded with the core action and trigger, then escalating to consequences, dedup, and auth. Every sentence carries distinct information, though the auth sentence could arguably be folded into a prerequisite note rather than trailing the description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 11 parameters, no output schema, and permissive annotations, the description does the important work: it explains the write's downstream consequences, the dedup behavior, and the conditional auth requirement. It leaves return-value shape unexplained, but for a fire-and-record tool that is a minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all 11 parameters are already documented, which sets the baseline at 3. The description adds real semantics for status enumeration and for how cause feeds lesson generation, but it says nothing about task_type, skill_id, namespace, or agent_id beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Record the outcome of a task you just executed') plus the memory subsystem (episodic memory), which separates it from add_evidence and infer_outcome. It does not explicitly name a sibling to contrast with, so the differentiation is implicit rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Call this after finishing a task so past successes and failures can inform future sessions' gives a clear trigger point in the workflow. It stops short of saying when NOT to use it or naming infer_outcome/add_evidence as alternatives for related cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

report_complianceA
Idempotent

Report compliance for a previous injection session returned by session_start. Call this to mark which injected memories were followed or violated, with optional evidence. Reports are processed item by item: a bad item is logged and skipped while the call still succeeds, so the response's updated/total counts must be checked rather than assuming all reports were stored. Requires a compliance-enabled server; no agent API key is required by this tool.

NameRequiredDescriptionDefault
reportsYesList of compliance reports, one per memory
inject_session_idYesThe inject_session_id from a previous session_start call

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well past the annotations: discloses item-by-item processing where a bad item is logged and skipped while the call still succeeds, warns that updated/total counts in the response must be checked, and notes the compliance-enabled-server and no-API-key requirements. Annotations only say non-readOnly, idempotent and non-destructive; the partial-success semantics are the genuinely useful addition.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and the session_start linkage are front-loaded, and each subsequent sentence adds distinct information (what to report, partial-failure behavior, prerequisites). It is dense but slightly overloaded, packing prerequisites and response-checking into a single block rather than separating them.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description compensates by telling the agent what the response contains (updated/total counts) and that it must be inspected. Prerequisites, auth expectations, and partial-failure behavior are all covered, so nothing needed to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and both parameter descriptions already explain inject_session_id and the reports list, so the schema carries the load. The description restates these ('a previous injection session returned by session_start', 'optional evidence') rather than adding new syntax, batching limits, or constraints, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Report compliance') and anchors it to a concrete source of input ('a previous injection session returned by session_start'), then clarifies the action as marking injected memories followed or violated. That distinguishes it from the read-side sibling get_compliance_report without the agent needing to open either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear trigger ('Call this to mark which injected memories were followed or violated') and the prerequisite that the session id comes from a prior session_start. It does not explicitly name get_compliance_report as the read-only alternative or state when not to call it, so it stops short of full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

review_memoryA
Destructive

Review or edit a memory. action='approve' marks it human-reviewed; action='edit' updates content/instruction and re-embeds or clears the stale vector (this also works on already-approved memories); action='reject' soft-deletes a pending memory and is rejected for already-approved memories (use delete_memory instead). Approved memories rank higher in future injections. Writes immediately; requires agent auth when the agent has a registered key.

NameRequiredDescriptionDefault
actionYesAction: approve, reject, or edit
api_keyNoAPI key for agent authentication (required if agent has a registered key)
agent_idNoID of the requesting agentunknown
memory_idYesID of the memory to review
edited_contentNoNew content if action is edit
edited_instructionNoNew instruction if action is edit

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations declaring destructive/non-idempotent behavior, it adds that writes happen immediately, that edit re-embeds or clears stale vectors, that approve affects future ranking, and that auth is required when the agent has a registered key. These are meaningful operational details not expressible through the annotations alone.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: it names the tool, then enumerates the actions and their constraints in one dense but readable passage. Every clause carries operational information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a multi-action mutation tool with full schema descriptions and annotations, the description covers action semantics, authorization, side effects, and the key reject/delete boundary. No output schema exists, so return-value detail is not required.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3, but the description adds real meaning by explaining what each action value does and when edit applies to already-approved memories. It does not add much for api_key or agent_id beyond the schema, so it is not a full 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ('Review or edit a memory') and then distinguishes the three actions with precise effects. It clearly differentiates reject from delete_memory, so an agent can select it correctly against siblings like forget_memory, delete_memory, and save_memory.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit per-action guidance: approve for human-review marking, edit for content/instruction updates, reject only for pending memories with a direct pointer to delete_memory for approved ones. This names both when to use the tool and when to use an alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_decayA
Destructive

Run a memory decay cycle: reduces decay_score for old memories and archives memories that fall below the threshold. MUST memories are exempt from decay. This is not purely reversible: if MEMVAULT_FORGET_AUTO_ENABLED=1, the same run also permanently forgets archived memories older than MEMVAULT_FORGET_RETENTION_DAYS (default 90); otherwise auto-forget is off. Requires agent auth when the agent has a registered key. Returns updated/archived/contradicted/harmful_flagged/auto_forgotten counts.

NameRequiredDescriptionDefault
api_keyNoAPI key for agent authentication (required if agent has a registered key)
agent_idNoID of the requesting agentunknown

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the destructiveHint/not-idempotent annotations: it discloses that MUST memories are exempt, that the operation is not purely reversible, and exactly when it becomes permanently destructive (MEMVAULT_FORGET_AUTO_ENABLED=1 with the default 90-day retention). The auth requirement and the enumerated return counts are also stated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action and mechanism, then the risk caveat, then auth, then return shape — a sensible order. All four sentences carry information; the parenthetical env-var detail is dense but load-bearing rather than filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive tool with no output schema, the description covers the mutation semantics, exemption rules, conditional irreversibility, auth prerequisites, and the shape of the return counts. An agent has everything needed to decide and call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so api_key and agent_id are already documented; baseline is 3. The description adds value by explaining when api_key is actually required ('when the agent has a registered key'), giving an agent a decision rule the schema only hints at.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Run a memory decay cycle') and immediately explains the mechanism: lowering decay_score for old memories and archiving those below threshold. This is distinguishable from siblings like run_dedup, run_promote, or forget_memory because the decay/archive semantics are unique to it.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The conditions that select this tool are clear from the description of the cycle, and the exemption rule for MUST memories is spelled out. It does not explicitly say 'use forget_memory instead when...' or name alternatives, so it stops short of full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_dedupA
Read-onlyIdempotent

Scan for duplicate memories and report findings. Uses lexical text similarity (Jaccard) to detect near-duplicates in one namespace or all namespaces. Read-only: reports existing_id/new_content/similarity/action but does not merge or delete anything. Returns at most 20 duplicate findings.

NameRequiredDescriptionDefault
api_keyNoAPI key for agent authentication (required if agent has a registered key)
agent_idNoID of the requesting agentunknown
namespaceNoNamespace to scan (null for all)

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint and idempotentHint annotations, the description discloses the similarity method (Jaccard), the namespace scope, the exact result fields (existing_id/new_content/similarity/action), the cap of 20 findings, and explicitly states that no merge or delete occurs. That is substantive behavioral context an agent cannot infer from annotations alone.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is four sentences, front-loaded with the core action and scope. Each sentence adds useful information: detection method, read-only behavior, returned fields, and result cap. There is no repetitive or wasted text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, but the description compensates by listing the returned fields and stating the maximum number of findings. Combined with the 100% parameter schema coverage and read-only annotations, an agent has everything needed to invoke the tool correctly and understand what it will return.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents api_key, agent_id, and namespace. The description mentions scanning 'one namespace or all namespaces,' which mirrors the schema's 'null for all' note without adding new syntax or format guidance. Baseline 3 is appropriate when the schema carries parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence states a specific verb and resource: 'Scan for duplicate memories and report findings.' It further distinguishes the tool by naming its detection method (lexical Jaccard similarity) and its read-only scope, making it clearly different from mutating siblings like delete_memory or forget_memory.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes the use case clear: scan for near-duplicates in one namespace or all namespaces and report findings without changing data. It does not explicitly name alternatives such as delete_memory or confirm_read, but the read-only constraint and returned 'action' field give an agent enough context to know this is a detection step rather than a cleanup step.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_promoteA
Destructive

Run the promote pipeline: consolidates atomic L1 memories into L2 scenario summaries, and promotes stable L2 memories into L3 core persona rules. Source memories are archived to L0 after promotion (not deleted). Mutates the store, is not idempotent, and requires agent auth when the agent has a registered key. Returns promoted/consolidated/merged/source counts.

NameRequiredDescriptionDefault
min_l1NoMinimum L1 memories to consolidate into L2 (default: 3)
min_l2NoMinimum L2 memories to promote to L3 (default: 2)
api_keyNoAPI key for agent authentication (required if agent has a registered key)
agent_idNoID of the requesting agentunknown
namespaceNoNamespace to scan (currently the promote pipeline scans all namespaces)

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructive/not-idempotent/not-readOnly, and the description adds genuine context beyond them: source memories are archived to L0 rather than deleted (mitigating the destructive hint), and agent auth is required when a registered key exists. It also discloses the return payload shape. Missing only cost/latency or rollback details, which keeps it at 4 rather than 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three compact sentences, with the pipeline semantics front-loaded, then safety behavior, then return value. Every sentence adds distinct information and none repeats the name or annotations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, but the description states what the return contains (promoted/consolidated/merged/source counts), which covers the main gap. Slightly incomplete on preconditions and failure modes for a mutating pipeline, but well beyond adequate overall.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the defaults for min_l1 (3) and min_l2 (2) and the api_key requirement are already documented in the schema. The description adds nothing parameter-specific beyond echoing the auth requirement, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (run) and resource (promote pipeline) and spells out the two-stage transformation: L1 atomics → L2 scenario summaries, stable L2 → L3 persona rules, with sources archived to L0. This is specific enough that an agent can distinguish it from run_dedup or run_decay without inspecting schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage context is implied by the description of what the pipeline does, but there is no explicit when-to-use/when-not guidance and no named alternatives or prerequisites (e.g., that L1 must exist first, or that run_dedup should precede it). The agent must infer timing and ordering.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

save_memoryA

Save a new memory. Memories are persistent user preferences, facts, episodes, or skills that should be recalled in future conversations. Embeddings are generated automatically for semantic search. Delta-write is on by default: near-duplicate saves are skipped and similar existing memories absorb the new content instead of a new row being created (status in the response: saved | merged | skipped). Pass force_insert=true to bypass. Writes persist immediately; requires agent auth when the agent has a registered key.

NameRequiredDescriptionDefault
tagsNoTags for categorization
typeNoMemory type: preference, fact, episode, entity, or skillfact
layerNoMemory layer: L0 (raw), L1 (atom), L2 (scenario), L3 (persona). Auto-assigned if omitted.
api_keyNoAPI key for agent authentication (required if agent has a registered key)
contentYesThe content of the memory to save
agent_idNoID of the agent saving this memoryunknown
priorityNoPriority level: MUST, REFERENCE, or BACKGROUNDREFERENCE
namespaceNoNamespace for the memory (default: global)global
agent_typeNoType of the agent (e.g., coding-assistant)general-assistant
confidenceNoConfidence score (0.0 to 1.0)
visibilityNoSharing scope: "scoped" (default, namespace rules) or "shared" (team pool).
instructionNoOptional instruction format for the memory
skill_stepsNoSkill execution steps (only for type=skill)
force_insertNoForce insert, skipping delta-write dedup/merge. By default a save is checked against similar memories in the same namespace: near-duplicates are skipped, similar memories absorb the new content's residual (docs/DESIGN.md §17.1).
skill_triggerNoSkill trigger pattern (only for type=skill)
skill_verificationNoSkill verification criteria (only for type=skill)

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations establish that this is a non-read-only, non-idempotent write, and the description adds substantial context beyond that: automatic embedding generation, near-duplicate skipping, merge-absorption semantics, the saved/merged/skipped response states, immediate persistence, and the registered-key auth requirement. This is exactly the behavioral detail an agent needs before calling a mutating tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose and then layers in the important default behavior and exceptions without wasted sentences. The delta-write explanation is dense but each sentence contributes actionable information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 16-parameter mutation tool with no output schema, the description covers the highest-risk behavioral details: dedup/merge behavior, force_insert bypass, immediate persistence, auth, and response status values. It does not describe the response shape beyond status, but given full schema coverage for parameters, it is largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all 16 parameters are already documented in the input schema, which sets the baseline at 3. The description mentions force_insert and auth in prose, but those meanings are also present in the schema, so it adds little parameter-level detail beyond the structured fields.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource ("Save a new memory") and immediately defines what a memory is (preferences, facts, episodes, skills), which clearly separates it from siblings like search_memory, delete_memory, and add_evidence. An agent can identify the tool's role without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly explains the default delta-write behavior and the exact condition for using force_insert=true, which is strong intra-tool guidance. It stops short of explicitly routing the agent between save_memory and related siblings such as add_evidence or extract_memories, so it is clear but not fully comparative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_memoryA
Read-onlyIdempotent

Search stored memories. mode defaults to 'hybrid' (keyword + vector via RRF); 'keyword' is text-only and 'semantic' is vector-only. Semantic/hybrid need an embedding provider — when embeddings are unavailable the query falls back to keyword and each result reports search_mode='keyword'. Supports namespace, type_filter, priority_filter, top_k (default 10), min_score, and optional expand_relations for one-hop relation context. Read-only; does not mutate memories.

NameRequiredDescriptionDefault
modeNoSearch mode: "hybrid" (default; keyword + vector via RRF), "keyword" (text-only), or "semantic" (vector-only). Semantic/hybrid fall back to keyword when embeddings are unavailable.hybrid
queryYesSearch query string
top_kNoMaximum number of results to return
api_keyNoAPI key for agent authentication (required if agent has a registered key)
agent_idNoID of the requesting agent
min_scoreNoDrop results whose final (post-rerank) relevance score is below this threshold. Unset = return the full top_k regardless of score, the pre-existing behavior. Lets callers distinguish "no confident match" (empty result) from "weak matches padded to top_k".
namespaceNoFilter by namespace
type_filterNoFilter by memory type
priority_filterNoFilter by priority
expand_relationsNoAttach each result's one-hop relation neighborhood (semantic graph expansion, C5). Default off.

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and idempotentHint=true, but the description adds meaningful behavior beyond them: hybrid/keyword/semantic fallback, search_mode reporting, min_score filtering semantics, and one-hop relation expansion. It also explicitly confirms the tool does not mutate memories.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the purpose, then explains mode behavior, fallback, supported filters, and safety in a compact sequence. It is dense but every clause is relevant for a 10-parameter search tool, with no wasted framing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a search tool with no output schema, the description covers the important invocation context: retrieval modes, fallback behavior, filtering options, score thresholding, relation expansion, and read-only safety. It also notes that results report search_mode, which is enough for correct use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all parameters and a baseline of 3 would be appropriate. The description adds useful context for mode defaults, embedding fallback, top_k default, min_score purpose, and expand_relations, though it does not mention api_key/agent_id because the schema covers them.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Search stored memories") and outlines the available modes, so the core purpose is clear. It does not explicitly distinguish this from sibling retrieval tools such as list_inbox or review_memory, but an agent can still infer that this is the query-based memory lookup tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explains the mode choices and the important fallback behavior when embeddings are unavailable, including that results report search_mode='keyword'. It does not explicitly say when to prefer this tool over alternatives like list_inbox or review_memory, but the retrieval context is otherwise clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

session_startA

Start an agent session. Returns relevant memories filtered by agent identity, formatted as MUST/REF instructions ready for injection into the conversation context; overflow memories are summarized with a hint to use search_memory for details. If this agent's canonical inject channel is not MCP, returns a skip explanation instead of injecting. When compliance tracking is enabled, records the injected memories and returns inject_session_id in structured_content for a later report_compliance call. Not read-only; requires agent auth when the agent has a registered key.

NameRequiredDescriptionDefault
api_keyNoAPI key for agent authentication (required if agent has a registered key)
projectNoCurrent project name
agent_idNoID of the agent starting the sessionunknown
agent_typeNoType of the agentgeneral-assistant
context_hintNoHint about the current conversation context

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, the description discloses the return format (MUST/REF instructions), the overflow-summarization behavior, the non-MCP skip path, side effects of compliance tracking (recording and returning inject_session_id), and the authentication requirement. These are substantive behavioral details that an agent would not know from the annotations alone.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but front-loaded: the core purpose and return behavior come first, followed by special cases and side effects. Four sentences are appropriate for the complexity, though a slightly tighter wording could have preserved the same information with less reading overhead.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the full burden and does so completely: it explains the return format, the overflow fallback, the non-MCP skip path, compliance tracking side effects, and authentication requirements. An agent has everything needed to invoke and interpret the result correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents each parameter's meaning. The description adds marginal context by noting that memories are filtered by agent identity and that api_key is for authentication, but it does not meaningfully enrich the semantics of project, agent_type, or context_hint beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource ('Start an agent session') and immediately explains what it returns: relevant memories filtered by agent identity, formatted as MUST/REF instructions. It clearly distinguishes this session-initialization role from retrieval siblings like search_memory, which is named as the fallback for overflow details.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes the usage context explicit: it is the session-start step that primes the conversation with injected memories, and it names search_memory for overflow details and report_compliance for later compliance reporting. It does not state explicit exclusions (e.g., when not to call it), but the context is clear enough for an agent to select it correctly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool updatev0.6.10
    • Changedsearch_memory1 field changed
      • changedInput schema / properties / mode / description
        Previous value: -"Search mode: \"keyword\" (default), \"semantic\" (vector), or \"hybrid\" (both)"New value: +"Search mode: \"hybrid\" (default; keyword + vector via RRF), \"keyword\"\n(text-only), or \"semantic\" (vector-only). Semantic/hybrid fall back to\nkeyword when embeddings are unavailable."
  2. 20 tool updatesv0.1.0
    • First observedadd_evidence
    • First observedconfirm_read
    • First observeddelete_memory
    • First observedextract_memories
    • First observedforget_memory
    • First observedget_compliance_report
    • First observedget_effectiveness_report
    • First observedget_memory_evidence
    • First observedimport_skills
    • First observedinfer_outcome
    • First observedlist_inbox
    • First observedrecord_outcome
    • First observedreport_compliance
    • First observedreview_memory
    • First observedrun_decay
    • First observedrun_dedup
    • First observedrun_promote
    • First observedsave_memory
    • First observedsearch_memory
    • First observedsession_start

TDQS

A4.1/5.0

Scored across 20 tools

Disambiguation4/5

Most tools target distinct resource+action pairs, and the descriptions carefully delineate the trickiest pairs (delete_memory vs forget_memory, record_outcome vs infer_outcome, review_memory vs save_memory). A few boundaries remain soft — save_memory vs extract_memories with auto_save, and review_memory's edit action vs a dedicated update — but an agent can reason through them from the text.

Naming Consistency4/5

The set follows a strong verb_noun convention (confirm_read, add_evidence, delete_memory, save_memory, search_memory, get_compliance_report) with a consistent run_* prefix for batch pipeline operations. The only notable deviation is session_start (noun_verb), which breaks the pattern but is unambiguous.

Tool Count4/5

At 20 tools this sits slightly above the comfortable range, but the domain genuinely spans memory CRUD, decay, dedup, promotion, evidence chains, session injection, and compliance reporting, so nearly every tool earns its place. It could be trimmed (e.g. collapsing the report getters) but is not bloated.

Completeness4/5

Lifecycle coverage is broad: create, search, review/edit, soft-delete, hard-forget, decay, dedup, promote, import, extract, evidence, plus session and outcome/compliance loops. Minor gaps exist — restore is CLI-only, there is no get_memory-by-id or general list/pagination outside the inbox, and update is only reachable via review_memory's edit action.

Maintenance

ActivityActive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    MCP server that enables persistent, hybrid, local memory for LLM agents, with vector + BM25 search, knowledge graph, and policy-driven retention, providing token-budgeted context injection for AI assistants.
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    A vendor-independent memory layer MCP server that enables multiple LLMs and AI agents to share and persist personal memories, knowledge, and context across sessions, with support for full-text search and tagging.
    ISC
  • A
    license
    Not graded
    quality
    B
    maintenance
    Provides a self-hosted shared memory service that lets AI agents capture and recall durable facts, decisions, and context across multiple tools and MCP-capable clients.
    3
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    A self-hosted memory server that gives AI agents a shared, persistent second brain, enabling verbatim storage, hybrid semantic/keyword retrieval, and a synthesized wiki layer through MCP tools.
    MIT