memproof
Evidence-first health checks for Markdown knowledge vaults.
memproof answers one question: can you prove what your knowledge base claims?
Every finding carries a path:line, the evidence behind it, and a concrete fix.
It is read-only, offline, and deterministic.
Check Agent Skills (agentskills.io)
Point memproof skills at a directory of skills/<name>/SKILL.md to validate the agentskills.io
contract: kebab-case names that match their directory, description limits,
optional-field types and unknown keys. Add --registry skills.json to diff the disk against a declared skill registry in both directions.
memproof skills ./skills --registry config/skills.json --fail-on high
Install
uv tool install memproof
# or
pip install memproof
# before the PyPI release, install straight from GitHub:
uv tool install git+https://github.com/hsys123/memproof
Use
memproof check ~/my-vault
memproof check ~/my-vault --format json --fail-on high
memproof check ~/my-vault --output report.md
Exit codes: 0 clean (or below --fail-on), 1 findings at/above the threshold, 2 usage/environment error.
Archives often contain frozen snapshots with dead links. Exclude them explicitly:
memproof check ~/my-vault --exclude 'archive/**' --exclude 'templates/**'
What it checks (v0.1)
| Check | What it catches |
|---|---|
frontmatter |
missing/unparseable frontmatter, missing required keys, unknown status, invalid dates |
links |
dead wikilinks, ambiguous bare-name targets, duplicate basenames, orphan pages |
provenance |
agent-authored notes missing author / sink / generated_by |
freshness |
drafts older than 30 days; evergreen pages older than 180 days with no inbound links |
structure |
empty sections; memory atoms not registered in their _index.md |
Example
# memproof report — demo-vault
Score: 64/100 · Files: 12 · Links: 18 · Findings: 2 high / 6 medium / 1 low
## High
- [provenance] notes/agent-note.md:1 — agent-authored note missing generated_by
Evidence: author=agent, sink=agent, generated_by missing.
Fix: add `generated_by: <tool>` or remove the agent marker.
A full generated report is in docs/sample-report.md.
Roadmap
- v0.1 — five vault checks (current).
- v0.2 — archive profile, fold/derived checks.
- v0.3 —
memproof skills: capability contracts and with/without evaluation.
Design principles
- Read-only: never edits the vault, no network access, no LLM calls.
- Evidence-first: every finding points to a line; no aggregate-only claims.
- Deterministic: same vault + same date = same report.
- Small surface: five checks, not fifty. Add a check only with a failing fixture.
Development
python -m pytest
ruff check .
mypy memproof
License: MIT.
Metadata
Release files for memproof 0.2.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| memproof-0.2.0.tar.gz | 18.7 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| memproof-0.2.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 38.0 kB
Release files / memproof-0.2.0.tar.gz
| Download URL | memproof-0.2.0.tar.gz |
|---|---|
| Size | 18.7 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
35c737e30f4bba99901bc110345efee8aaad10eddc4e1f4255abb1835b072633
|
|
BLAKE2b-256 checksum How to use checksums |
28e01cc1e043d655d972dded39ffb0a9f72ddebd6aa8c2495d5b0f4e626ffe82
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 23, 2026.
Transparency logRelease files / memproof-0.2.0-py3-none-any.whl
| Download URL | memproof-0.2.0-py3-none-any.whl |
|---|---|
| Size | 19.3 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
0f5670d4c3052e1b7203d88e4b2d9cab792192336c7760619a8dfaa229c47005
|
|
BLAKE2b-256 checksum How to use checksums |
597e4f5691d2c69036ba3bec660efefbbb02102b47010f861e26edb953a0ebf1
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 23, 2026.
Transparency logSecurity for memproof 0.2.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for memproof-0.2.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 23, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.