MemoryGuard v0.5.0

Shared memory for coding agents, without shared-memory chaos.
A local-first MCP memory layer that organizes writes automatically and keeps every governance decision reversible.

中文文档

Your agents can write freely. MemoryGuard classifies, deduplicates, supersedes, quarantines, and compresses shared memory on every write - then lets you inspect, correct, or roll back the result afterward.

No account. No server. No telemetry. Your memory stays local.

Install in 60 seconds · See the governance loop · What it is and isn't

Why MemoryGuard

Persistent memory solves only half the problem. When several coding agents write into the same context, memory can become duplicated, stale, contradictory, or unsafe to reuse.

MemoryGuard is the local control layer between your coding agents and their shared memory:

See the governance loop

Agent writes memory
  -> MemoryGuard MCP write
  -> auto-organize
      classify · deduplicate · supersede · detect conflict · quarantine · compress
  -> active shared memory
  -> governance console
      inspect · correct · merge · lock · restore · roll back

The console is not an approval queue. Agents keep moving; you govern the outcome with evidence when it matters.

Rules, habits, and conversation history

These are deliberately separate surfaces:

History retrieval is progressive: search result → bounded timeline → one raw turn/session. extract preview only proposes evidence-backed memory candidates; it never writes a long-term memory. A user can explicitly govern a candidate through the normal memory path. Hooks archive only payloads exposed by their verified host seam, honor private/disabled markers, and report partial coverage rather than inventing unseen assistant text. A shared-history read is resolved server-side from the caller's current active binding: it includes only the group's current members and loses access immediately on leave. Shared visibility never grants deletion of another Agent's source. Imported sessions are grouped by trusted cwd/project_ref metadata (or “unknown”), never by chat body.

The neuron graph is a governed view: select a node to inspect and manage the corresponding record without turning raw conversation history into injected memory.

Install in 60 seconds

pip install agent-memguard

Choose the coding agent you use. Each command installs the global MCP binding, redirect rules, and the verified user-level Hook supported by that host.

# Claude Code
memoryguard source add . && python -m memoryguard.provider_adapters install claude

# Codex
memoryguard source add . && python -m memoryguard.provider_adapters install codex

# Cursor
memoryguard source add . && python -m memoryguard.provider_adapters install cursor

Then restart your agent and verify the environment:

memoryguard doctor
memoryguard mcp-status
memoryguard hooks status --provider all

Need a desktop window for the governance console?

pip install "agent-memguard[gui]"

For explicit configuration and provider-specific behavior, see the Claude Code, Codex, and Cursor guides.

What you can govern

Sources are authorized explicitly. Native memory can be governed with a backup; ordinary documents remain read-only evidence until you choose to extract them.

What MemoryGuard is - and isn't

MemoryGuard is a local MCP memory backend and governance console for coding agents. It provides a shared source of truth and organizes writes as they arrive.

It is not a cloud service, an account system, or a human gate that blocks every memory write. It also does not pretend every agent's native memory can be disabled: provider support is reported as redirected, observed, or unsupported where appropriate.

Architecture

Core surfaces

The complete MCP tool reference and CLI command reference are below for evaluation and integration work.

Mandatory rules

memoryguard_memory_write defaults to injection_policy="relevant". Use always (and optional bounded priority) only for an explicit long-term mandatory/default rule; do not promote every procedure. memoryguard_memory_update can switch the policy. Bootstrap injects mandatory rules under an independent budget before relevant recall and fails closed for sensitive or over-limit rule packages. The GUI can return a rule to on-demand, delete, or restore it.

Privacy and safety boundaries

• MemoryGuard runs as a local MCP stdio server; it requires no account, remote server, or telemetry.
• Shared memory is stored locally in SQLite under .memoryguard/.
• Source scanning is read-only by default. Changes use explicit plans, backups, rescans, and undo paths.
• A quarantined memory is deliberately kept out of active shared memory until you decide what to do with it.

Roadmap

• Now: local MCP backend, auto-organization, governance console, provider adapters, and rollback.
• Later: enhanced governance signals such as decay, derivation, and governance reports. No committed date.
• Later: team and enterprise capabilities after proven demand. No committed date.

Changelog

v0.5.0 (2026-08-04)

• Add the P3 rule-merge intelligence layer: semantic judge, candidate merge proposals, single-use capabilities, and Phase5 canonical read path.
• Close the P3 governance acceptance gaps (P3-01..P3-06, PR1 review items).
• Tighten resolve_canonical_map to prefer the active rule over alias.
• Add toml_compat module and conditional tomli dependency for Python 3.10.

v0.4.0 (2026-08-01)

• Add scoped rules and governed conversation-history storage and import.
• Add neuron-graph governance controls in the desktop GUI.
• Harden Hook UTF-8 handling and write receipts for Windows hosts.

v0.3.2 (2026-07-29)

• Force Hook stdin, stdout, and stderr to UTF-8 so Chinese context survives Windows GBK defaults
• Add the official Codex commandWindows override and run every Hook with Python UTF-8 mode
• Bind runtime receipts to the exact installed Hook definition so changed commands cannot inherit a stale operational status
• Defer pending-memory reminders from PreCompact to SessionStart(source="compact"), matching the Codex event output contract

v0.3.1 (2026-07-29)

• Migrate legacy unmarked Codex MCP sections before installing the managed section, preventing duplicate TOML tables during upgrades
• Make memoryguard doctor output safe on GBK Windows consoles

v0.3.0 (2026-07-29)

Hook-only automatic takeover:

• User-level Hook management for Claude Code, Codex, and Cursor; TRAE keeps the verified MCP + rules fallback
• Bounded, task-relevant context injection for main agents and subagents
• Native-memory write interception so long-term memory stays in the MemoryGuard-managed store
• Enforce, observe, pause, repair, status, and uninstall controls in CLI and GUI
• Idempotent configuration merges that preserve unrelated user hooks

MCP and Skill integration:

• Global provider installation now installs MCP, redirect rules, and supported Hooks together
• First Skill activation detects only the current host and repairs its integration
• Runtime receipts expose whether the takeover path is actually operational

v0.2.0 (2026-07-23)

重构记忆发布与回滚:

• 重构记忆 → 投影文件 → 目标文件的完整发布链路
• 目标文件 hash 校验：发布后若目标文件被修改，禁止回滚（避免误伤后续修改）
• 发布状态追踪：applied_verified / rolled_back / published
• 回滚版本列表 UI：只展示真正可回滚的版本，清晰显示状态

UI/UX 改进:

• 回滚版本选择弹窗：radio 单选 + 确认按钮，替代 prompt 输入
• 神经图谱：节点点击自动展开详情，操作反馈即时显示
• 重构记忆自动确认写入：不再每个光点都需要手动接受

安全与稳定性:

• 目录可写性预检：发布前检查目标目录权限，避免 PermissionError
• 备份校验：existed_before=true 时必须有 backup_path 存在
• 目标文件存在性检查：文件不存在时给出明确原因

新增测试:

• 发布目标验证测试
• 回滚状态判定测试
• 投影模式测试
• 安全测试

Contributing

Issues and pull requests are welcome. Read CONTRIBUTING.md; by submitting a pull request, you agree to the CLA.

License

MIT