# Memotrust

> Verified memory for AI agents.

- **Type:** MCP server
- **Install:** `agentstack add mcp-idanref-memotrust`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Idanref](https://agentstack.voostack.com/s/idanref)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Idanref](https://github.com/Idanref)
- **Source:** https://github.com/Idanref/memotrust
- **Website:** https://www.npmjs.com/package/memotrust

## Install

```sh
agentstack add mcp-idanref-memotrust
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# memotrust

### Verified memory for AI agents. Your agents remember only what's **true**.

[](https://www.npmjs.com/package/memotrust)
[](LICENSE)
[](https://modelcontextprotocol.io)
[](https://github.com/Idanref/memotrust)

Agents propose memories. **Evidence** verifies them. `recall()` returns only what has *earned* trust, so a hallucinated, stale, or **poisoned** "fact" never reaches your other agents.

---

## Why memotrust

Give your agents a shared memory and it's a superpower, until one agent hallucinates a fact, copies a stale number, or reads a poisoned note. In every other memory layer, that mistake becomes **every agent's "truth"**, silently, forever. (Memory poisoning is OWASP agentic risk **ASI06**.)

memotrust flips the default: **nothing is trusted on arrival.** A memory reaches `recall()` only after it's **verified against a real source** or **approved by a human**. Trust decays. Disputes withhold. Every verdict keeps a receipt.

## What's inside

| | |
|---|---|
|   **Trusted recall** | `recall()` returns only verified, fresh, in-scope memory, ranked. No guesses, no stale wins. |
|   **One shared memory** | Every agent, Claude Code, Cursor, any MCP client, reads and writes the same store. Git-backed, so what your agents know is versioned, diffable, and portable. |
|   **Poison can't spread** | Every new memory is quarantined until proven. One agent's bad note can't become another's fact. |
|   **MCP Verifiers** | Read-only checks that turn a claim into trusted knowledge: built in, or connected to a source of truth. |
|   **Read-only connectors** | Confirm domain claims against live data. **Mixpanel** built-in; connect any read-only MCP source. |
|   **Dashboard** | A local UI to review, approve, dispute, and manage every memory and every verifier connection. |
|   **Receipts, not vibes** | Every verdict records the query, the reading, and the judgment. Audit *why* anything is trusted. |
|   **Just files** | Markdown claims plus an append-only log, git-backed. Human-readable, diffable, no database. |

## One memory, every agent

memotrust is the **shared source of truth** for your whole agent fleet. Claude Code, Cursor, and every MCP client read and write the *same* store, so a fact one agent proves, all of them can trust.

And because it's **git-backed**, that memory is versioned, diffable, and portable: branch it, review it, roll it back, sync it however you sync code. It's the home for everything your agents know, and every line of it has earned its place.

## Quick start

```bash
npx memotrust install     # create the store, git-init it, register the MCP with your agent
```

Point **Claude Code**, **Cursor**, or any MCP client at it, and your agents can `propose` and `recall`. The dashboard comes up at **http://localhost:8765**.

## The dashboard

Everything your agents know, and exactly how much of it is proven. Review the inbox, approve or dispute at a glance, watch trust coverage, and audit any claim's full evidence chain.

## MCP verifiers, read-only

A verifier confirms or refutes a claim against a **source of truth**. It is **always read-only**: it can query, never write, update, or delete.

- **Built in, zero credentials.** Check a claim against a file, a URL, or a command:
  ```yaml
  check: {"kind": "file", "path": "package.json", "contains": "pnpm"}
  check: {"kind": "url",  "url": "https://api.example.com/health", "status": 200}
  ```
- **Connect a source of truth.** **Mixpanel** is built-in (a read-scoped service account confirms growth and metric claims). Connect any other read-only MCP data source, or let your agent submit a read-only observation, and **memotrust decides the verdict, the agent never can.**
- **Human approval.** Anything you'd rather confirm yourself, in one click.

> `command` checks are **disabled by default**: a poisoned claim must never become code execution. Opt in with `MEMOTRUST_ALLOW_COMMAND_CHECKS=1`.

## How it works

There is **no LLM inside the store**: your agent extracts durable facts and proposes them over MCP; memotrust only ever *judges* the evidence and records the receipt.

## The tools your agent gets

| Tool | What it does |
|---|---|
| `recall` | Only trusted + fresh + in-scope memory; disproven approaches come back as **warnings** |
| `propose` | File a new memory; it lands quarantined, never trusted on arrival |
| `search` | Everything at any trust level, each result labeled with its status |
| `vocabulary` | Existing spaces + tags, so agents reuse names instead of inventing synonyms |
| `pending_verifications` | Claims that carry a machine-checkable assertion, awaiting a reading |
| `submit_evidence` | Submit a read-only observation; memotrust judges, not the agent |

## memotrust vs. a plain memory layer

| | plain memory | **memotrust** |
|---|---|---|
| New memory is… | trusted immediately | **quarantined until verified** |
| Hallucinated / poisoned note | served to every agent | **withheld, never recalled** |
| Stale facts | linger and win | **decay after 60 days, re-verify** |
| "We already tried that" | forgotten | **returned as a warning** |
| Why is this trusted? | ¯\\\_(ツ)\_/¯ | **an auditable receipt** |

## Contributing

Issues and PRs welcome. `npm test` runs the store + verifier suite; `npm run test:e2e` runs the end-to-end MCP acceptance test. House style: [docs/code-style.md](docs/code-style.md).

**If verified memory is something your agents need, [⭐ star the repo](https://github.com/Idanref/memotrust). It helps a lot.**

[MIT](LICENSE) · built for the [Model Context Protocol](https://modelcontextprotocol.io)

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Idanref](https://github.com/Idanref)
- **Source:** [Idanref/memotrust](https://github.com/Idanref/memotrust)
- **License:** MIT
- **Homepage:** https://www.npmjs.com/package/memotrust

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-idanref-memotrust
- Seller: https://agentstack.voostack.com/s/idanref
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.