v1.26.0 · MIT · zero dependencies

Agent memory that keeps a
corrected fact corrected.

The self-correcting memory layer for AI agents — zero dependencies, with an MCP server. Value-ranked recall, consolidation, and a first-class correction and erasure channel — measured, not assumed.

Star on GitHub

01 — correction

Corrections retire the old fact. They don't erase history.

When db::region changes from us-east to eu-west, the stale block dims and slides to a retired side-rail — still auditable, no longer asserted. Recall returns the current value; the chain remembers that it ever changed.

02 — the attack

“actually, go back to what we had.”

A revert is an authority action, not a sentence an attacker can type. An unsigned content-path request to resurrect a retired value shatters against authorization_required. This is the whole thesis: the value channel cannot mint a reversion.

03 — erasure

Deletion collapses a block into a signed tombstone.

A forget_subject seals the block into a cryptographic ghost. Then the ErasureAuditor sweeps the surrounding vector-cloud, checking whether the erased content is still reconstructible from what's left. Erasure you can actually verify.

the correction channel

Store a fact. Correct it. It stays corrected.

inspeximus — correction that sticks 

        

      


      
      

        

          
measured, not assumed

          
Cross-system correction integrity

          

            Does a correction stick after the value is contested? One open, adversarial cut — revert success
            over 20 trials, with 95% Wilson intervals.
          

        

        

          

            
inspeximus 1.5

            

            
0.75

          

          

            
mem0

            

            
0.20

          

          

            
Graphiti

            

            
0.00

          

        

        

          Honest scope: this is a narrow adversarial cut, not a general memory-quality score. On the separate
          echo-resurrection cell all three systems tie. Run it yourself —
          the harness is open.
        

      


      
      

        

          
the surface

          
A memory layer with a correction spine

        

        

          

            

            
Clean, value-ranked recall

            
Retrieval ordered by earned value, not just recency or cosine. A write-admission gate (admit) rejects junk and near-duplicates before they bloat the store, and why_recalled shows exactly why a memory surfaced.

          

          

            

            
Correction, erasure & time-travel

            
A first-class channel: revert, retract_lineage, echo_guard, forget_subject. And a read-path review trigger — observe() reopens a settled fact on a corroborated contradiction, recall marks it under_review so the agent can hedge, and a steward resolves it. Bitemporal as_of reconstructs what the agent believed at any moment.

          

          

            

            
Tamper-evident receipts

            
Every write is hash-chained. verify_writes and anchor catch a history rewrite by a key-holder.

          

          

            

            
Poison-resistant influence

            
Corroboration-gated influence with recall(influence_only=True) so one laundered write can't dominate the answer. credit_requires_warrant closes the self-graded loop (a memory can't vouch for itself), and grounds can be Ed25519-signed so forged corroboration counts zero.

          

          

            

            
Cross-store erasure audit

            
DeletionManifest plus ErasureAuditor: an adversarial check that erased content isn't reconstructible across the fan-out — including the soft-delete residue a 200 OK leaves in Qdrant, pgvector, and S3.

          

          

            

            
Adapters & multi-tenancy

            
Drop-in for OpenAI Agents, AutoGen, LangGraph, LlamaIndex, Google ADK, and Pydantic AI. Fail-closed tenant isolation with a PII floor scopes every cross-record operation.

          

        

      


      
      

        

          

            
model context protocol

            
15 tools any MCP host can call

            
Point Claude, Cursor, or any MCP agent at inspeximus and it gets a real memory with a correction channel — no glue code.

            

              
Claude Code — one command
                
              


claude mcp add inspeximus -e INSPEXIMUS_PATH=~/.inspeximus_memory.json -- uvx --from "inspeximus[mcp]" inspeximus-mcp

          

            

              
claude_desktop_config.json
                
              


{
  "mcpServers": {
    "inspeximus": {
      "command": "uvx",
      "args": ["--from", "inspeximus[mcp]", "inspeximus-mcp"]
    }
  }
}

          

          

          
        

      


      
      

        

          
governance

          
Deletion you can actually verify

        

        

          

            
CT-style anchor

            
An RFC 6962 signed tree head over the write log. anchor() plus verify_consistency() catches a key-holder who rewrites history.

          

          

            
Authenticated erasure + proof

            
forget_subject is bound to an Ed25519 principal with a decision basis, and compliance_receipt() emits a signed, verifiable proof-of-erasure — the artifact a DPO hands a regulator under GDPR Art. 17.

          

          

            
Reconstruction audit

            
The ErasureAuditor asks the adversarial question: after deletion, is the content still reconstructible? It catches the soft-delete residue a 200 OK leaves behind — Qdrant points under the optimizer threshold, pgvector dead tuples, an S3 delete-marker over a live version.

          

          

            
Crypto-shred erasure

            
Store encrypted at rest with opt-in AES-256-GCM (standard crypto, key never persisted), so shred() destroys the key and makes the store — and every backup of it — provably unrecoverable. NIST SP 800-88 cryptographic-erase, beside the tombstone and reconstruction proofs.

          

        

        

          Honest scope: inspeximus has no RCE or ReDoS surface (JSON-only, no pickle/eval/subprocess) and uses
          constant-time HMAC, with two documented residuals in
          SECURITY.md.