io.github.calasdan-sketch/monomem

Shared memory for your AI coding agents that records who wrote each note and holds suspicious writes for your review.

npx monomem setup

Want to see it first? npx monomem demo runs a short tour on a throwaway store (deleted at the end); it never touches your notes.

Needs Node 22.16 or newer (check with node -v). No new enough Node? One command instead (needs Docker; put a long random MONOMEM_TOKEN in .env first):

git clone https://github.com/calasdan-sketch/monomem && cd monomem && cp .env.example .env && docker compose up -d

(More: Docker.)

An independent scan's grade, updated by mcprush after each scan: it reads the published package, not our claims.

What it does not do: it holds writes that match known attack patterns and records who wrote each note. It only covers what goes through Monomem: anything that can run shell commands or open ~/.monomem/state.db itself can read or change your notes directly, and a reworded attack the pattern check does not know can still get through. Sensitivity limits apply to apps that connect with their own key. See Known limits.

Recorded from a real run against a throwaway store (transcript): a write containing an injected instruction is held and never reaches the other agent's search, then rejected from the real dashboard. The two terminal panes are drawn from the real REST responses; the dashboard is a screen recording. Nothing sped up.

• One memory for all your assistants. Tell Claude Code something once, and Cursor, Codex and Gemini CLI can read it too. It's one SQLite file on your own machine: no cloud, no API keys, no hidden model calls. Already use another memory tool? See how it compares.
• Knows who wrote it. Every note records its writer. For callers that use a token, the server stamps the name; for local apps it is a label from that app's config file, so it tells your apps apart but is not proof.
• Holds suspicious writes. A write that looks like an instruction planted to steer your other assistants is held until you approve it, and monomem approve-first --all on makes every agent write wait for your OK. The check is pattern matching, so it doesn't catch everything. An agent that can run shell commands, like Claude Code, can run the monomem command itself and its writes are not held, so this protects you from tools that only have the memory connection (see SECURITY.md).

How it works:

Diagram source: docs/monomem-architecture.mmd (Mermaid). More detail: docs/architecture.md.

[![npm](https://img.shields.io/npm

... View full README on GitHub