mcp-assist-memory

A generic, project-agnostic memory / coordination / artifact server for multi-agent and multi-surface work. One FastAPI process serves a 30-tool MCP over Streamable HTTP, backed by Postgres (+ pgvector), deployed standalone on a Replit Reserved VM.

This is Tier 1 of the reusability contract: every project reuses it as-is. It carries zero domain terms — project identity lives in namespace values, never in tool names, tables, columns, or code.

Capabilities at a glance

• 30-tool MCP over Streamable HTTP (memory, handoff, session, artifact, coordination, feedback, admin).
• Trust-boundary spine (Plan v2) — actor-scoped exactly-once writes with visible dedup, read-back-verified acks (verified_persisted), standardized error payloads with remedies, write-time screening + quarantine, provenance tiers (origin, model attribution, derived_from lineage), trust decay (needs_reverification), PHI-safe tool_events telemetry, per-namespace variant profiles, and an observation_log feedback channel.
• Namespace-scoped multi-tenancy — every per-project query filters on namespace.
• Resilient to transient DB drops — the server transparently retries genuine connection losses (Neon scale-down / PgBouncer recycle, SQLSTATE 57P01/08xxx) on a fresh pooled connection, and validates connections at checkout, so callers no longer have to retry. Retries are idempotency-gated, so they never double-write.
• Prompt-injection resistance layer — values are sanitized on write (forged markers are escaped one-way to [[UNTRUSTED_DATA]], never reconstructed on read), instruction-shaped writes are screened and quarantined (visible in the write ack; include_quarantined: true opts reads back in), and reads come back wrapped in <<<UNTRUSTED_DATA>>> markers; storage.sanitize.unwrap_value recovers the raw value when a consumer needs it (e.g. to json.loads). Honest framing: these are layers, not proofs — deterministic screens and wrappers are bypassable by an adaptive attacker; adversarial evaluation is pending (see Phase 10 backlog in DECISION-PROTOCOL.md).
• Content-addressed artifacts (sha256, global dedup), 50 MB cap, ranged reads.
• Per-surface rotatable tokens (web vs. desktop-cli) managed from a password-gated /admin dashboard.

The 30 tools

Sequences are the paths an agent should take. Correct use of this server has always been a sequence — learn which database answered, resolve the profile, check what is stale, then act — and that ordering used to live in tool descriptions and skills, i.e. it was enforced by a model remembering advice mid-task, and a skipped step produced no signal whatsoever. The three sequence tools run their steps server-side in a fixed order and return steps_run, so the ordering is something the server did rather than something a caller got right. They are strictly additive: every primitive they are built from still works exactly as before, for surgical use.

recall and memory_search now share ONE retrieval guard (storage/retrieval.py): the same absolute floor and relative alpha the Intent Gate applies. Previously memory_search had no floor at all while intent_open had both, so the same store answered the same question differently depend

... View full README on GitHub