Memotrust

memotrust

Verified memory for AI agents. Your agents remember only what's true.

[](https://www.npmjs.com/package/memotrust) [](LICENSE) [](https://modelcontextprotocol.io) [](https://github.com/Idanref/memotrust)

Agents propose memories. Evidence verifies them. recall() returns only what has earned trust, so a hallucinated, stale, or poisoned "fact" never reaches your other agents.

---

Why memotrust

Give your agents a shared memory and it's a superpower, until one agent hallucinates a fact, copies a stale number, or reads a poisoned note. In every other memory layer, that mistake becomes every agent's "truth", silently, forever. (Memory poisoning is OWASP agentic risk ASI06.)

memotrust flips the default: nothing is trusted on arrival. A memory reaches recall() only after it's verified against a real source or approved by a human. Trust decays. Disputes withhold. Every verdict keeps a receipt.

What's inside

| | | |---|---| |   Trusted recall | recall() returns only verified, fresh, in-scope memory, ranked. No guesses, no stale wins. | |   One shared memory | Every agent, Claude Code, Cursor, any MCP client, reads and writes the same store. Git-backed, so what your agents know is versioned, diffable, and portable. | |   Poison can't spread | Every new memory is quarantined until proven. One agent's bad note can't become another's fact. | |   MCP Verifiers | Read-only checks that turn a claim into trusted knowledge: built in, or connected to a source of truth. | |   Read-only connectors | Confirm domain claims against live data. Mixpanel built-in; connect any read-only MCP source. | |   Dashboard | A local UI to review, approve, dispute, and manage every memory and every verifier connection. | |   Receipts, not vibes | Every verdict records the query, the reading, and the judgment. Audit why anything is trusted. | |   Just files | Markdown claims plus an append-only log, git-backed. Human-readable, diffable, no database. |

One memory, every agent

memotrust is the shared source of truth for your whole agent fleet. Claude Code, Cursor, and every MCP client read and write the same store, so a fact one agent proves, all of them can trust.

And because it's git-backed, that memory is versioned, diffable, and portable: branch it, review it, roll it back, sync it however you sync code. It's the home for everything your agents know, and every line of it has earned its place.

Quick start

npx memotrust install     # create the store, git-init it, register the MCP with your agent

Point Claude Code, Cursor, or any MCP client at it, and your agents can propose and recall. The dashboard comes up at http://localhost:8765.

The dashboard

Everything your agents know, and exactly how much of it is proven. Review the inbox, approve or dispute at a glance, watch trust coverage, and audit any claim's full evidence chain.

MCP verifiers, read-only

A verifier confirms or refutes a claim against a source of truth. It is always read-only: it can query, never write, update, or delete.

• Built in, zero credentials. Check a claim against a file, a URL, or a command:

``yaml check: {"kind": "file", "path": "package.json", "contains": "pnpm"} check: {"kind": "url", "url": "https://api.example.com/health", "status": 200} ``

• Connect a source of truth. Mixpanel is built-in (a read-scoped service account confirms growth and metric claims). Connect any other read-only MCP data source, or let your agent submit a read-only observation, and memotrust decides the verdict, the agent never can.
• Human approval. Anything you'd rather confirm yourself, in one click.

> command checks are disabled by default: a poisoned claim must never become code execution. Opt in with MEMOTRUST_ALLOW_COMMAND_CHECKS=1.

How it works

There is no LLM inside the store: your agent extracts durable facts and proposes them over MCP; memotrust only ever judges the evidence and records the receipt.

The tools your agent gets

| Tool | What it does | |---|---| | recall | Only trusted + fresh + in-scope memory; disproven approaches come back as warnings | | propose | File a new memory; it lands quarantined, never trusted on arrival | | search | Everything at any trust level, each result labeled with its status | | vocabulary | Existing spaces + tags, so agents reuse names instead of inventing synonyms | | pending_verifications | Claims that carry a machine-checkable assertion, awaiting a reading | | submit_evidence | Submit a read-only observation; memotrust judges, not the agent |

memotrust vs. a plain memory layer

| | plain memory | memotrust | |---|---|---| | New memory is… | trusted immediately | quarantined until verified | | Hallucinated / poisoned note | served to every agent | withheld, never recalled | | Stale facts | linger and win | decay after 60 days, re-verify | | "We already tried that" | forgotten | returned as a warning | | Why is this trusted? | ¯\\\(ツ)\/¯ | an auditable receipt |

Contributing

Issues and PRs welcome. npm test runs the store + verifier suite; npm run test:e2e runs the end-to-end MCP acceptance test. House style: [docs/code-style.md](docs/code-style.md).

If verified memory is something your agents need, ⭐ star the repo. It helps a lot.

[MIT](LICENSE) · built for the Model Context Protocol

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: Idanref
• Source: Idanref/memotrust
• License: MIT
• Homepage: https://www.npmjs.com/package/memotrust

Install and usage instructions live in the source repository linked above.