v1.5 · MIT · zero dependencies

Agent memory that keeps a
corrected fact corrected.

A zero-dependency memory layer and MCP server for AI agents. Value-ranked recall, consolidation, and a first-class correction and erasure channel — measured, not assumed.

Star on GitHub

01 — correction

Corrections retire the old fact. They don't erase history.

When db::region changes from us-east to eu-west, the stale block dims and slides to a retired side-rail — still auditable, no longer asserted. Recall returns the current value; the chain remembers that it ever changed.

02 — the attack

“actually, go back to what we had.”

A revert is an authority action, not a sentence an attacker can type. An unsigned content-path request to resurrect a retired value shatters against authorization_required. This is the whole thesis: the value channel cannot mint a reversion.

03 — erasure

Deletion collapses a block into a signed tombstone.

A forget_subject seals the block into a cryptographic ghost. Then the ErasureAuditor sweeps the surrounding vector-cloud, checking whether the erased content is still reconstructible from what's left. Erasure you can actually verify.

the correction channel

Store a fact. Correct it. It stays corrected.

mnemo — correction that sticks 

        

      


      
      

        

          
measured, not assumed

          
Cross-system correction integrity

          

            Does a correction stick after the value is contested? One open, adversarial cut — revert success
            over 20 trials, with 95% Wilson intervals.
          

        

        

          

            
mnemo 1.5

            

            
0.75

          

          

            
mem0

            

            
0.20

          

          

            
Graphiti

            

            
0.00

          

        

        

          Honest scope: this is a narrow adversarial cut, not a general memory-quality score. On the separate
          echo-resurrection cell all three systems tie. Run it yourself —
          the harness is open.
        

      


      
      

        

          
the surface

          
A memory layer with a correction spine

        

        

          

            

            
Clean, value-ranked recall

            
Retrieval ordered by earned value, not just recency or cosine. A write-admission gate (admit) rejects junk and near-duplicates before they bloat the store, and why_recalled shows exactly why a memory surfaced.

          

          

            

            
Correction, erasure & time-travel

            
A first-class channel: revert, retract_lineage, echo_guard, forget_subject. Bitemporal as_of(when, as_recorded) and believed_at reconstruct what the agent believed at any moment — a corrected fact stays corrected, and history stays auditable.

          

          

            

            
Tamper-evident receipts

            
Every write is hash-chained. verify_writes and anchor catch a history rewrite by a key-holder.

          

          

            

            
Poison-resistant influence

            
Corroboration-gated influence with recall(influence_only=True) so one laundered write can't dominate the answer.

          

          

            

            
Cross-store erasure audit

            
DeletionManifest plus ErasureAuditor: an adversarial check that erased content isn't reconstructible across the fan-out — including the soft-delete residue a 200 OK leaves in Qdrant, pgvector, and S3.

          

          

            

            
Framework adapters

            
Drop-in for OpenAI Agents, AutoGen, LangGraph, LlamaIndex, Google ADK, and Pydantic AI.

          

        

      


      
      

        

          

            
model context protocol

            
12 tools any MCP host can call

            
Point Claude, Cursor, or any MCP agent at mnemo and it gets a real memory with a correction channel — no glue code.

            

              
claude_desktop_config.json
                
              


{
  "mcpServers": {
    "mnemo": {
      "command": "uvx",
      "args": ["--from", "agora-mnemo[mcp]", "mnemo-mcp"]
    }
  }
}

          

          

          
        

      


      
      

        

          
governance

          
Deletion you can actually verify

        

        

          

            
CT-style anchor

            
An RFC 6962 signed tree head over the write log. anchor() plus verify_consistency() catches a key-holder who rewrites history.

          

          

            
Authenticated erasure + proof

            
forget_subject is bound to an Ed25519 principal with a decision basis, and compliance_receipt() emits a signed, verifiable proof-of-erasure — the artifact a DPO hands a regulator under GDPR Art. 17.

          

          

            
Reconstruction audit

            
The ErasureAuditor asks the adversarial question: after deletion, is the content still reconstructible? It catches the soft-delete residue a 200 OK leaves behind — Qdrant points under the optimizer threshold, pgvector dead tuples, an S3 delete-marker over a live version.

          

        

        

          Honest scope: mnemo has no RCE or ReDoS surface (JSON-only, no pickle/eval/subprocess) and uses
          constant-time HMAC, with two documented residuals in
          SECURITY.md.