AutoGineer
Generated banner for memanto
Generated logo for memanto

memanto

Agent plugin

First committed by het0814

Published in moorcheh-ai/memanto. Publisher page

2,363 GitHub stars

What it is

Memory that AI Agents Love!
— the description by het0814

AutoGineer overview, from the brain’s own files

Memanto acts as a chief of staff for your AI agents, moving beyond simple storage to actively manage the lifecycle of agentic knowledge. Unlike passive vector stores, Memanto observes interaction streams to extract durable facts, decisions, and preferences. It handles the complex tasks of consolidating duplicate information, resolving contradictions between agents, and enforcing retention policies to prevent memory bloat. By providing a unified, portable estate that works across different frameworks and vendors, Memanto ensures that your agents remain consistent and informed without requiring manual intervention or complex application-level logic.

How it works

Memory model: Vector store

AutoGineer overview, from the brain’s own files

Memanto runs as a companion agent alongside your existing AI fleet. It uses a vector-store-based memory model to store knowledge, which it organizes into namespaces for different agents. It observes agent traffic to extract and categorize information, merges duplicates, and reconciles conflicting data points. Users can define retention policies in YAML files to automate the expiration of stale memories. The system provides a CLI for manual interaction, a REST API for integration, and supports exporting the entire memory estate into the Open Knowledge Format (OKF) for portability.

Folders
FolderRoleFiles
.githubagent-config7
assetsattachments11
docsdocs10
examplesexamples640
scriptsscripts1
teststests62
i18nfolder3
integrationsfolder105
memantofolder103
sdksfolder41

Requirements

Runtimes: Python >=3.10,<4

API keys (by name): MOORCHEH_API_KEY

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Google Antigravity, Kiro, OpenCode, Amp, Roo Code, Cline, JetBrains Junie, Devin (ex-Windsurf)

Set it up

  1. This brain runs code automatically: 4 hooks (claude-code), 3 scripts. Review examples/claudecode-skills-memanto/lifecycle-hooks/install.py, integrations/hermes-agents/hermes_memanto/install.py, memanto/cli/connect/assets/hooks/hooks.json, pyproject.toml before opening the folder in Claude Code. No step below turns a hook on for you.

    • examples/claudecode-skills-memanto/lifecycle-hooks/install.py: python examples/claudecode-skills-memanto/lifecycle-hooks/install.py
    • integrations/hermes-agents/hermes_memanto/install.py: python integrations/hermes-agents/hermes_memanto/install.py
    • memanto/cli/connect/assets/hooks/hooks.json: ${SYS_EXECUTABLE}
    • memanto/cli/connect/assets/hooks/hooks.json: ${SYS_EXECUTABLE}
    • memanto/cli/connect/assets/hooks/hooks.json: ${SYS_EXECUTABLE}
    • memanto/cli/connect/assets/hooks/hooks.json: ${SYS_EXECUTABLE}
    • pyproject.toml: hatch build hook vcs (hatch_build.py)
  2. Not scanned by AutoGineerIts dependencies are installed by pip or uv when you run it and were not scanned by AutoGineer (14 declared). https://pypi.org/project/memanto/

  3. First committed by het0814. Published in moorcheh-ai/memanto. Licence: MIT License.

Usage

AutoGineer overview, from the brain’s own files

  • Automating memory curation across multiple agent frameworks
  • Resolving conflicting information between different agents
  • Enforcing data retention and expiration policies
  • Exporting agent memory to portable Markdown files
  • Bootstrapping agents with relevant context before they act
“memanto remember "Auth migrated to JWT — session cookies deprecated" --type decision”
The agent captures this decision as a durable memory, making it available for other agents in the fleet to recall later.
“memanto recall "how does auth work"”
The agent retrieves the relevant, consolidated knowledge about the authentication system, grounded in previous decisions.
“memanto policy apply-preset balanced”
Applies a predefined retention policy to automatically manage memory expiration and keep the knowledge base sharp.
“memanto memory export --okf”
Generates a portable, human-readable Markdown bundle of the entire memory estate for backup or migration.

Documentation by het0814

<p align="center"> <a href="https://www.memanto.ai/"> <img alt="Memanto" src="https://github.com/moorcheh-ai/memanto/raw/main/assets/memanto-logo.svg" width="440"> </a> </p>

<p align="center"> Memanto is a <strong>Memory Agent</strong>; a companion agent that manages the memories of your other agents:<br> what to keep, what conflicts, what expires, and who needs to know. </p>

<p align="center"> <a href="https://github.com/moorcheh-ai/memanto"><img alt="GitHub stars" src="https://img.shields.io/github/stars/moorcheh-ai/memanto?style=social"></a> <a href="https://pepy.tech/projects/memanto"><img alt="Downloads" src="https://static.pepy.tech/personalized-badge/memanto?period=total&units=INTERNATIONAL_SYSTEM&left_color=BLACK&right_color=GREEN&left_text=downloads"></a> <a href="https://arxiv.org/abs/2604.22085"><img alt="arXiv" src="https://img.shields.io/badge/arXiv-2604.22085-b31b1b.svg"></a> <a href="https://pypi.org/project/memanto/"><img alt="PyPI" src="https://img.shields.io/pypi/v/memanto.svg?color=%2334D058"></a> <a href="https://mcptoplist.com/server/io.github.moorcheh-ai%2Fmemanto"><img alt="MCP Toplist" src="https://mcptoplist.com/badge/io.github.moorcheh-ai%2Fmemanto.svg"></a> <a href="https://opensource.org/licenses/MIT"><img alt="MIT License" src="https://img.shields.io/badge/license-MIT-yellow.svg"></a> </p>

<p align="center"> <sub><a href="README.md">English</a> · <a href="i18n/README_es.md">Español</a> · <a href="i18n/README_zh-CN.md">简体中文</a> · <a href="i18n/README_ja.md">日本語</a></sub> </p>

pip install memanto
npm install @moorcheh-ai/memanto
go get github.com/moorcheh-ai/memanto/sdks/go

<!-- ============================================================ DEMO GIF — highest-impact missing asset. assets/demo.gif VHS tape provided separately. Under 15s, under 3MB. ============================================================ -->

<!-- <p align="center"> <img alt="Memanto in 15 seconds" src="https://github.com/moorcheh-ai/memanto/raw/main/assets/demo.gif" width="900"> </p> -->

Every platform will store your agents' memory. None of them will manage it. Managing it across platforms is against their interest. That is the job of a Memory Agent.

Persistence is solved. Claude, Bedrock, Cursor, and every vector store will happily keep what your agents write. None of them will tell you that two of your agents now believe opposite things about your auth service, that a preference from March has quietly outranked a decision from last week, or that the agent you spun up this morning is about to redo work another one finished and reverted.

Storage is a filing cabinet. Memanto is the chief of staff; it decides what goes in, watches the access, resolves what contradicts, discards what's stale, and briefs each agent before it acts.

It's an agent, not an API

Memanto isn't a library you call. It's a second agent that runs beside your fleet and does six things on its own judgment. Each one is a real behavior with a command behind it, nothing here is a roadmap item.

What Memanto doesRun it
Observes & extractsWatches the interaction streams of the agents it serves and pulls durable knowledge out of ephemeral traffic — decisions, preferences, facts, failures — instead of archiving transcripts wholesale.memanto remember --from-conversation
ConsolidatesMerges extracted memories into one canonical estate. Duplicates collapse, fragments join, repeated observations strengthen confidence instead of multiplying rows.memanto schedule enable
ReconcilesWhen new knowledge contradicts old, Memanto supersedes rather than appends — preserving what was believed and when. "What's true now" and "what did we believe then" stay different questions.memanto conflicts
ForgetsDecay, expiry, and deliberate deletion are policies it executes, not cleanup you remember to do. An estate that only grows becomes noise; managed forgetting is what keeps recall sharp at month twelve.memanto forget
BriefsBefore an agent acts, Memanto hands it the minimal relevant slice of the estate. Your agents don't query anything — they get briefed by a colleague.memanto agent bootstrap
Moves knowledgeThrough the Open Knowledge Format, the estate crosses frameworks and vendors — so a fleet spanning Claude Code, Cursor, and your own stack shares one memory instead of five silos.memanto memory export --okf

And it does this while you're asleep. memanto schedule enable and the loop runs daily: new memories curated, duplicates merged across agents, contradictions flagged for your review. You come back to a fleet that knows more than it did yesterday, without having sorted anything yourself.

60 seconds to a managed fleet

pip install memanto
memanto                            # "On-Prem" (Docker, no account) or "Cloud" (free key)
memanto connect claude-code        # also: cursor, codex, windsurf, cline, goose, copilot…

Your agents now share one managed estate. No code changes, no wrapper, no rewrite of your agent loop.

# backend-agent learns something on Monday
memanto remember "Auth migrated to JWT — session cookies deprecated" --type decision

# review-agent, which never saw that session, knows it on Friday
memanto recall "how does auth work"
memanto answer  "why did we drop session cookies?"     # grounded, no extra API key

# what did the fleet believe last Tuesday? what changed since the release?
memanto recall "deployment policy" --as-of 2026-08-05
memanto recall "deployment policy" --changed-since v2.1

macOS, Linux, Windows. memanto ui opens a local dashboard over the whole estate — browse it, search it, audit it.

Own your agentic memory

This is the part that matters in two years, and it's the part every platform-native memory feature is designed to prevent.

Your estate is a file. memanto memory export --okf gives you the Open Knowledge Format — plain Markdown, readable, diffable, committable, greppable. Not a proprietary dump you can technically request. The actual working format.

It moves. memanto migrate imports from Mem0, Letta, Supermemory, Zep, Hindsight, or any OKF bundle. The same command works in reverse. OKF is an open interchange format any framework or vendor can implement — including ours' competitors, deliberately.

It runs on your machine. Local Docker + Ollama, no account, no API key, nothing leaves your infrastructure. Or free cloud, or your own hosting. memanto config backend switches between them in one command, and the estate comes with you.

MIT. No open-core tier waiting to gate the useful half. No feature flags, no seat limits, no rug pull.

There is no lock-in because there is nothing to lock.

Security & sovereignty

<!-- ============================================================ TODO — Majid: fill from your hardening work. Structure is right; the specifics are yours. Items marked ⟨…⟩ need input. Anything you can't substantiate today, delete rather than soften. ============================================================ -->

Nothing leaves your machine in on-prem mode. Docker + Ollama, no account, no outbound calls. The full loop — extraction, consolidation, reconciliation, briefing — runs locally.

Scoped by default. Each agent gets its own namespace. Your production-ops agent doesn't read your scratch experiments; you provision exactly what each one should know and nothing more.

Every belief is traceable. Confidence score, source, provenance, and timestamp. When an agent acts on something, you can walk back to where that belief entered the fleet and when — which is the difference between an auditable estate and a black box.

Forgetting is a decision you make, not a side effect. A memory is active or expired — nothing else. It becomes expired only because a policy you wrote says so, and it carries the date and the rule name that did it. Expired memories still recall, clearly labelled, and memanto memory restore puts one back. Deleting is a separate, explicit act.

Memory that expires on your terms

Every memory is active until a policy retires it. Expiry is stamped, auditable, and reversible — the content survives, and the memory keeps showing up in recall marked [EXPIRED] with the reason it aged out.

memanto policy list-preset          # conservative / balanced / aggressive
memanto policy apply-preset balanced  # shows it in full, then asks
memanto policy apply --dry-run      # exactly what would expire, per rule
memanto policy apply                # shows the policy + matches, then confirms

Policies live in ~/.memanto/policies/<agent>.yaml and have two halves — a per-type retention table for broad strokes, and named rules for everything sharper. The first matching rule wins, so a rule can also pin a memory that the table would otherwise expire:

retention:
  context: 7d
  event: 30d
  preference: never          # durable user truths don't age out
rules:
  - name: pinned
    match: {tags: [pinned]}
    expire_after: never      # an explicit pin beats the table
  - name: low-confidence-guesses
    match: {provenance: [inferred], confidence_below: 0.5}
    expire_after: 14d
purge_expired_after: never   # optional hard delete, off by default

Recall shows both states side by side; narrow with --active or --expired. Point-in-time recall is unaffected — --as-of still reconstructs what was true then, including memories that have expired since.

memanto memory expire mem-123       # retire one by hand
memanto memory restore mem-123      # and put it back

The nightly job (memanto schedule enable) runs the sweep for you. An agent with no policy set never expires anything.

Unlike memory storage

Memory storageMemanto
What it isA database with an SDK — write, embed, retrieveAn agent with judgment over your fleet's memory
Core behaviorPersistCurate, reconcile, consolidate, forget, brief
Who decides what's keptYou, in application codeMemanto, on policy you set once
When two agents disagreeLast write wins, silentlyBoth versioned, surfaced for review
ForgettingA DELETE you remember to runA first-class policy that runs on schedule
ScopeOne app, one stack, one vendor's wallsA fleet, across stacks and vendors
Your dataExportable in theoryThe working format is portable Markdown

Storage substrates sit beneath Memanto — vector stores, filesystems, and platform-native memory features are all backends it manages. Their commoditization is good for you: it makes the substrate free and leaves the management to something that's actually good at it.

<p align="center"> <strong>⭐ Star the repo if Memanto is managing your fleet's memory</strong><br> <sub>It's the signal that tells us to keep building this in the open, under MIT, with nothing held back.</sub> </p>

Developer experience

One pip install. No vector store to provision, no embedding pipeline, no reranker, no schema migration, no backend to babysit. The retrieval engine ships in the box.

Works with what you already run. memanto connect claude-code — same for Cursor, Codex, Windsurf, Cline, Continue, Goose, Copilot, and more. One command each.

Searchable the moment it's written. No extraction pass at write time, no graph to rebuild, no indexing queue. remember returns and every agent in the fleet can already recall it.

Typed, not soup. 13 memory categories — instruction, fact, decision, goal, preference, relationship, and more — so recall is filterable instead of one undifferentiated blob.

A dashboard, not a log file. memanto ui for the whole estate. memanto daily-summary for a readable digest of what changed across your agents. memanto status for registered agents, sessions, and health.

<details> <summary><strong>Full CLI reference</strong></summary>

<br>

CapabilityCommandsWhat it does
System statusmemanto statusEnvironment, configuration, server health, active session, registered agents.
Local REST API + web UImemanto serve, memanto uiRun the REST API locally and open an interactive browser UI.
Agent lifecyclememanto agent ...Create/list/delete agents, activate sessions, run agent bootstrap.
Memory capture at scalememanto rememberSingle memories, batch JSON, or --from-conversation to extract from chat logs.
Editing & deletionmemanto edit, memanto forgetUpdate fields on a memory, or permanently delete a bad one.
File ingestionmemanto uploadBring .pdf, .docx, .xlsx, .json, .txt, .csv, .md into an agent's namespace.
Advanced recallmemanto recallStandard search plus temporal queries (--as-of, --changed-since) with filters.
Grounded answersmemanto answerGenerate answers from retrieved memory context.
Daily intelligencememanto daily-summary, memanto conflictsSummaries, contradiction detection, interactive resolution.
Sessions & automationmemanto session ..., memanto schedule ...Inspect sessions, enable scheduled daily runs.
Estate export & syncmemanto memory export, memanto memory syncExport structured Markdown, sync MEMORY.md into projects. --okf for a portable OKF bundle.
Import & migrationmemanto migrateImport from Mem0, Letta, Supermemory, Zep, Hindsight, or an OKF bundle.
Configurationmemanto config showAPI key status, active agent/session, server settings, schedule time.
Fleet integrationmemanto connect ...Claude Code, Codex, Cursor, Windsurf, Antigravity, Gemini CLI, Cline, Continue, OpenCode, Goose, Roo, GitHub Copilot, Augment.

Memory types: instruction, fact, decision, goal, commitment, preference, relationship, context, event, learning, observation, artifact, error

memanto remember "User prefers concise answers" --type preference
memanto recall "user communication style" --type preference

Complete reference: CLI User Guide

</details>

<details> <summary><strong>Install options — fully local vs. free cloud</strong></summary>

<br>

Fully local. No account, no API key, nothing leaves your machine:

pip install memanto
memanto           # choose "On-Prem" — guides through Docker + Ollama setup

Requires Docker.

Free cloud. No card, ~60 seconds:

pip install memanto
memanto           # choose "Cloud" — paste your free API key

Free key at console.moorcheh.ai/api-keys — 100K free operations.

Switch any time: memanto config backend

</details>

<details> <summary><strong>Architecture</strong></summary>

<br>

Recall is powered by an information-theoretic semantic engine that ships in the box — as a local Docker container or as a free cloud service. The memanto CLI manages either for you. Storage substrates beneath it are pluggable; Memanto is the agent above them.

<p align="center"> <img alt="Architecture" src="https://github.com/moorcheh-ai/memanto/raw/main/assets/Architecture-diagram.png" width="900"> </p>

On-prem:

<p align="center"> <img alt="On-prem architecture" src="https://github.com/moorcheh-ai/memanto/raw/main/assets/On-prem-architecture-diagram.png" width="900"> </p>

</details>

<details> <summary><strong>SDKs & REST API</strong></summary>

<br>

Python — the memanto package ships an in-process client; no server to start:

from memanto import Memanto

memanto = Memanto(agent_id="my-agent")   # creates the agent on first use
memanto.remember("Alex prefers oat milk.", type="preference")
memanto.recall("what does Alex drink?")
memanto.answer("Does Alex drink dairy?")

Reference: docs.memanto.ai/sdk/python.

TypeScript / Node.js — @moorcheh-ai/memanto boots a local Memanto server via uvx and exposes an ergonomic client (remember / recall / answer).

Go — github.com/moorcheh-ai/memanto/sdks/go connects to a running Memanto server or starts one via uvx.

REST API — start with memanto serve. Endpoint reference at docs.memanto.ai/api and http://localhost:8000/docs while running.

</details>

Watch it work

Recall is more than search — 6:20Setup & demo
Local dashboard tourDocs →

Research

Memanto: Typed Semantic Memory with Information-Theoretic Retrieval for Long-Horizon Agents

On public recall benchmarks we report 89.8% on LongMemEval and 87.1% on LoCoMo. <!-- TODO: state reader model, judge model, and subset here — you should be the one in this space whose conditions are legible. --> Datasets and harness are open at huggingface.co/moorcheh — run them yourself.

A caveat we'd rather say out loud: cross-project scores on these benchmarks are not comparable. Reader model, judge model, judge prompt, and retrieval budget each move results by several points, and no two published runs share a configuration. Treat every number in this category — including ours — as directional. What a Memory Agent should eventually be measured on isn't recall at all, but estate quality over time: contradiction rate, staleness, and precision at month six.

@misc{abtahi2026memantotypedsemanticmemory,
      title={Memanto: Typed Semantic Memory with Information-Theoretic Retrieval for Long-Horizon Agents},
      author={Seyed Moein Abtahi and Rasa Rahnema and Hetkumar Patel and Neel Patel and Majid Fekri and Tara Khani},
      year={2026},
      eprint={2604.22085},
      archivePrefix={arXiv},
      primaryClass={cs.AI},
      url={https://arxiv.org/abs/2604.22085},
}

Community

<p align="center"> <a href="https://memanto.ai/discord"><img src="https://img.shields.io/badge/Join-Discord-5865F2?style=for-the-badge&logo=discord&logoColor=white" alt="Discord"></a> <a href="https://www.reddit.com/r/Memanto/"><img src="https://img.shields.io/badge/Join-Reddit-FF4500?style=for-the-badge&logo=reddit&logoColor=white" alt="Reddit"></a> <a href="https://docs.memanto.ai"><img src="https://img.shields.io/badge/Docs-memanto.ai-000000?style=for-the-badge&logo=readthedocs&logoColor=white" alt="Docs"></a> </p>

<p align="center"> <a href="https://trendshift.io/repositories/27378"><img src="https://trendshift.io/api/badge/repositories/27378" alt="Trendshift" width="220"></a> <!-- <a href="https://mcptoplist.com/server/glama%2Fmoorcheh-ai%2Fmemanto"><img src="https://mcptoplist.com/badge/glama%2Fmoorcheh-ai%2Fmemanto.svg" alt="MCP Top List" width="220"></a> --> <a href="https://deepwiki.com/moorcheh-ai/memanto"><img alt="DeepWiki" src="https://deepwiki.com/badge.svg"></a> </p>

Questions: [e-mail address on the upstream page](mailto:e-mail address on the upstream page) · @moorcheh_ai

<p align="center"> <strong>MIT License</strong> </p>

docs/SESSION_ARCHITECTURE.md

MEMANTO Session-Based Architecture

Status: Design Specification Date: December 2025 Author: Dr. Majid Fekri, CTO Moorcheh.ai

Overview

MEMANTO v2 introduces a session-based authentication model that eliminates the tenant_id concept and provides a secure, stateful interaction model for AI agents.

Core Principles

  1. Moorcheh API Key = Identity: The Moorcheh API key uniquely identifies the user/organization

  2. Agent = Memory Namespace: Each agent has one persistent namespace

  3. Session = Time-Bounded Access: Sessions provide temporary, scoped access to specific agents

  4. CLI-First UX: Users interact via CLI, not raw HTTP calls

  5. Zero Configuration for Agents: Real AI agents just call memanto remember "content"

Architecture Components

1. Authentication Flow
┌─────────────────────────────────────────────────────────────┐
│ User provides Moorcheh API Key                              │
│ (stored in ~/.memanto/config.yaml, encrypted)                 │
└─────────────────────────────────────────────────────────────┘
                           │
                           ▼
┌─────────────────────────────────────────────────────────────┐
│ User creates MEMANTO agent                                    │
│ POST /api/v2/agents                                         │
│ Auth: Bearer {moorcheh_api_key}                             │
└─────────────────────────────────────────────────────────────┘
                           │
                           ▼
┌─────────────────────────────────────────────────────────────┐
│ MEMANTO creates namespace: memanto_agent_{agent_id}             │
│ (Isolated by Moorcheh API key at Moorcheh backend)         │
└─────────────────────────────────────────────────────────────┘
                           │
                           ▼
┌─────────────────────────────────────────────────────────────┐
│ User activates agent (starts session)                       │
│ POST /api/v2/agents/{agent_id}/activate                    │
│ Auth: Bearer {moorcheh_api_key}                             │
└─────────────────────────────────────────────────────────────┘
                           │
                           ▼
┌─────────────────────────────────────────────────────────────┐
│ MEMANTO issues session token (JWT)                            │
│ - Includes: agent_id, namespace, moorcheh_api_key (enc)    │
│ - Expires: 6 hours (configurable)                          │
│ - Signed: HMAC-SHA256                                      │
└─────────────────────────────────────────────────────────────┘
                           │
                           ▼
┌─────────────────────────────────────────────────────────────┐
│ Agent operations use API key + session token               │
│ POST /api/v2/agents/{agent_id}/remember                    │
│ Auth: Bearer {moorcheh_api_key} + X-Session-Token          │
└─────────────────────────────────────────────────────────────┘
2. Namespace Model

Format: memanto_agent_{agent_id}

Isolation: Moorcheh backend enforces isolation by API key

User A (API Key: key_abc123)
├── memanto_agent_customer-support    (accessible)
├── memanto_agent_sales-bot           (accessible)
└── memanto_agent_research-assistant  (accessible)

User B (API Key: key_xyz789)
├── memanto_agent_customer-support    (different namespace, isolated)
└── memanto_agent_project-manager     (accessible)

Key insight: Same agent_id under different API keys = different namespaces (isolated by Moorcheh)

3. Session Token Structure

JWT Payload:

{
  "agent_id": "customer-support",
  "namespace": "memanto_agent_customer-support",
  "moorcheh_api_key_hash": "sha256...",
  "session_id": "sess_abc123xyz",
  "started_at": "2025-12-28T16:00:00Z",
  "expires_at": "2025-12-28T20:00:00Z",
  "iat": 1735401600,
  "exp": 1735416000
}

Security:

  • Moorcheh API key NOT included in plaintext (hash only)

  • Token signed with MEMANTO secret key

  • Short expiration (6 hours default, configurable)

  • Scoped to specific agent (cannot access other agents)

4. Session Storage

File-based storage (v1): ~/.memanto/sessions/

Important: CLI local session state and API server session are related but distinct.

  • CLI stores local "active session" pointers for convenience.

  • API enforces actual server-side session lifecycle and token validity.

  • Clearing local CLI state does not, by itself, guarantee server session termination.

~/.memanto/
├── config.yaml                      # Main configuration
└── sessions/
    ├── customer-support.json        # Session state
    ├── sales-bot.json
    └── active                       # Symlink to active session

Session file structure (customer-support.json):

{
  "agent_id": "customer-support",
  "session_id": "sess_abc123xyz",
  "session_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "namespace": "memanto_agent_customer-support",
  "started_at": "2025-12-28T16:00:00Z",
  "expires_at": "2025-12-28T20:00:00Z",
  "pattern": "support",
  "status": "active"
}

Future: Moorcheh.ai backend is capable of handling millions of input memories as well as calls to the backend llms for intelligent and smart tasks

API Endpoints

Agent Lifecycle
Create Agent
POST /api/v2/agents
Content-Type: application/json

{
  "agent_id": "customer-support",
  "pattern": "support",
  "description": "Customer support AI agent"
}

Response:
{
  "agent_id": "customer-support",
  "namespace": "memanto_agent_customer-support",
  "pattern": "support",
  "created_at": "2025-12-28T16:00:00Z",
  "status": "created"
}
List Agents
GET /api/v2/agents

Response:
{
  "agents": [
    {
      "agent_id": "customer-support",
      "namespace": "memanto_agent_customer-support",
      "pattern": "support",
      "created_at": "2025-12-27T10:00:00Z",
      "last_session": "2025-12-28T15:30:00Z",
      "memory_count": 1547,
      "session_count": 23,
      "status": "inactive"
    }
  ]
}
3. Use the Session

All memory operations now require the X-Session-Token header and use the /api/v2/ path prefix.

# Store memory in agent's session
curl -X POST "http://localhost:8000/api/v2/agents/my-agent/remember" \
  -H "X-Session-Token: eyJhbGciOiJIUzI1..." \
  -H "Content-Type: application/json" \
  -d '{
    "content": "Customer prefers concise responses",
    "type": "preference"
  }'

# Ask a question
curl -X POST "http://localhost:8000/api/v2/agents/my-agent/answer" \
  -H "X-Session-Token: eyJhbGciOiJIUzI1..." \
  -H "Content-Type: application/json" \
  -d '{
    "question": "How should I respond to this customer?"
  }'
Activate Agent (Start Session)
POST /api/v2/agents/{agent_id}/activate

Response:
{
  "session_id": "sess_abc123xyz",
  "session_token": "eyJhbGc...",
  "agent_id": "customer-support",
  "namespace": "memanto_agent_customer-support",
  "started_at": "2025-12-28T16:00:00Z",
  "expires_at": "2025-12-28T20:00:00Z"
}
Deactivate Agent (End Session)
POST /api/v2/agents/{agent_id}/deactivate

Response:
{
  "session_id": "sess_abc123xyz",
  "agent_id": "customer-support",
  "ended_at": "2025-12-28T18:30:00Z",
  "duration_hours": 2.5,
  "memories_created": 67,
  "summary_memory_id": "mem_summary_xyz"
}
Memory Operations (Session-Scoped)
Remember
POST /api/v2/agents/{agent_id}/remember
X-Session-Token: {session_token}

Parameters:
  memory_type: str
  title: str
  content: str
  confidence: float = 0.8
  tags: str = None  (comma-separated)
  source: str = "agent"

Response:
{
  "memory_id": "mem_abc123",
  "agent_id": "customer-support",
  "session_id": "sess_abc123xyz",
  "namespace": "memanto_agent_customer-support",
  "status": "queued"
}
Recall
POST /api/v2/agents/{agent_id}/recall
X-Session-Token: {session_token}
Content-Type: application/json

Body:
{
  "query": "customer preferences",
  "limit": 10,
  "type": ["preference"]
}

Response:
{
  "agent_id": "customer-support",
  "session_id": "sess_abc123xyz",
  "query": "customer preferences",
  "memories": [...]
}
Answer (RAG)
POST /api/v2/agents/{agent_id}/answer
X-Session-Token: {session_token}

Parameters:
  question: str
  ai_model: str (optional)
  kiosk_mode: bool (optional)
  threshold: float (optional, only used when kiosk_mode=true; defaults to 0.15 in kiosk mode)

Response:
{
  "agent_id": "customer-support",
  "session_id": "sess_abc123xyz",
  "question": "What are customer communication preferences?",
  "answer": "Based on stored memories...",
  "sources": [...]
}

Security Model

1. API Key Protection
# Server key is owned by MEMANTO (MOORCHEH_API_KEY).
# NEVER expose MOORCHEH_API_KEY in request/response payloads.
# NEVER log MOORCHEH_API_KEY.
# Session tokens remain scoped credentials for runtime operations.
2. Session Validation
def validate_session(session_token: str) -> Session:
    """
    Validate session token

    Checks:
    1. Token signature valid (HMAC)
    2. Token not expired
    3. Agent still exists
    4. API key hash matches
    """
    payload = jwt.decode(session_token, SECRET_KEY)

    if datetime.now() > payload['exp']:
        raise SessionExpiredError()

    if not agent_exists(payload['agent_id']):
        raise AgentNotFoundError()

    return Session(**payload)
Auto-Recreate After Expiry

When auto_recreate_enabled is on (the default), a request that presents a token whose session has fully lapsed is not rejected outright — MEMANTO issues a brand-new session and continues, returning the replacement token in the X-Session-Token response header (and refreshing the cookie for browser callers). This is what lets you pick MEMANTO back up after an idle gap without hitting "No active session".

Three rules bound it:

  • Authorization is unchanged. Recreation runs behind the same require_management_access check as explicit activation — a valid management credential or a loopback caller. A stolen expired token on its own buys nothing, and anyone who does pass that check could already call /activate directly, so no new capability is granted.

  • Logout is authoritative. A session ended via /deactivate is TERMINATED and is never revived; the caller must activate explicitly.

  • Stale tokens never supersede a newer session. The token's session_id must still match the persisted record, so an old token cannot displace a session that was already replaced.

Note the trade-off: with auto-recreate on, expiry no longer bounds how long a leaked token remains useful to a caller who also has management access. Set SESSION_AUTO_RECREATE_ENABLED=False (or auto_recreate_enabled: false) where that matters.

3. Agent Isolation
@router.post("/{agent_id}/remember")
async def remember(
    agent_id: str,
    session: Session = Depends(get_current_session)
):
    # Enforce: session token MUST match agent_id
    if session.agent_id != agent_id:
        raise ForbiddenError(
            f"Session is for {session.agent_id}, "
            f"cannot access {agent_id}"
        )

    # Proceed with memory storage
    ...

Migration from tenant_id Model

Current (v1) - DEPRECATED
# ❌ OLD: tenant_id in query params (spoofable)
POST /api/v2/agents/{agent_id}/remember?tenant_id=any-value
New (v2) - RECOMMENDED
# ✅ NEW: Session token with scoped access
1. **Activate session**: `POST /api/v2/agents/{agent_id}/activate`
2. **Authorize**: Use `X-Session-Token` for subsequent operations
3. **Automatic isolation**: All memory operations (`remember`, `recall`, `answer`) are automatically scoped to the active agent.
4. **CLI Convenience**: In the CLI, `memanto agent create` automatically performs activation for you.
Namespace Migration
# OLD namespace format:
memanto_{tenant_id}_agent_{agent_id}
memanto_acme-corp_agent_customer-support

# NEW namespace format:
memanto_agent_{agent_id}
memanto_agent_customer-support

Configuration

User Configuration (~/.memanto/config.yaml)
memanto:
  version: "2.0"

  server:
    url: "http://localhost:8000"
    port: 8000

  moorcheh:
    api_key_encrypted: "enc_gAAAAABh..."  # Fernet encrypted

  session:
    default_duration_hours: 6
    auto_extend: true
    extend_threshold_minutes: 30  # Extend if < 30 min remaining
    auto_renew_enabled: true
    auto_renew_interval_hours: 6  # Fresh session every 6 hours
    auto_recreate_enabled: true   # Fresh session on first request after expiry

  # The two booleans above are overlaid onto the server settings at startup.
  # An explicitly exported SESSION_AUTO_RENEW_ENABLED / SESSION_AUTO_RECREATE_ENABLED
  # wins, so containerised deployments stay environment-driven. The numeric
  # session fields are read by the CLI only; set them via SESSION_* env vars
  # to change server behaviour.

  cli:
    interactive_mode: true
    smart_parse: true
    auto_title: true

Benefits Summary

AspectOld (tenant_id)New (Session-based)
AuthQuery param (spoofable)JWT token (signed)
IdentityManual tenant_idAutomatic from API key
RotationBreaks on key rotationHandled by Moorcheh
IsolationManual namespaceMoorcheh backend
Agent AccessAny agent accessibleScoped to session
UXRaw HTTP callsCLI with guidance
SecurityLow (param injection)High (signed tokens)
API Endpoints and Authorization
EndpointHeader RequiredDescription
POST /api/v2/agentsServer MOORCHEH_API_KEYCreate a new agent namespace
`DELETE /api/v2/agents/{id}?delete-backup-too={truefalse}`Server MOORCHEH_API_KEY
POST /api/v2/agents/{id}/activateServer MOORCHEH_API_KEYStart session, get token
POST /api/v2/agents/{id}/deactivateServer MOORCHEH_API_KEYEnd the current agent session
GET /api/v2/agents/{id}/statusX-Session-TokenGet active agent status
POST /api/v2/agents/{id}/rememberX-Session-TokenStore memory in session
POST /api/v2/agents/{id}/recallX-Session-TokenSearch session memories
POST /api/v2/agents/{id}/answerX-Session-TokenAsk question over session memories

Future Enhancements

  1. Multi-agent sessions: Support activating multiple agents simultaneously

  2. Session persistence: Redis backend for production

  3. Session transfer: Transfer session between devices

  4. Audit logging: Track all session operations

  5. Rate limiting: Per-session rate limits

  6. Session analytics: Usage metrics per session

Conclusion: The session-based architecture provides secure, stateful, and user-friendly access to MEMANTO memory services while maintaining perfect isolation through Moorcheh's multi-tenant backend.

Questions? Contact Dr. Majid Fekri, CTO Moorcheh.ai

512 files · 493 not served here

Advantages

  • Provides active management of agent memory, including conflict resolution and automated forgetting, rather than just passive storage. evidence: README.md
  • Ensures memory portability through the Open Knowledge Format, preventing vendor lock-in. evidence: README.md
  • Supports local-first operation with Docker and Ollama, ensuring data sovereignty. evidence: README.md

Limitations

  • Requires Docker for the fully local on-premise deployment mode. evidence: README.md
  • Policy management requires creating and maintaining YAML configuration files for each agent. evidence: README.md

Security

Risk level: Low risk

This brain runs

Git hooks (3)

  • .pre-commit-config.yaml: uv run ruff check .
  • .pre-commit-config.yaml: uv run ruff format --check .
  • .pre-commit-config.yaml: uv run mypy .

Install scripts (2)

  • examples/claudecode-skills-memanto/lifecycle-hooks/install.py: python examples/claudecode-skills-memanto/lifecycle-hooks/install.py
  • integrations/hermes-agents/hermes_memanto/install.py: python integrations/hermes-agents/hermes_memanto/install.py

Agent instructions that run or fetch something (3)

  • examples/claudecode-skills-memanto/lifecycle-hooks/skills/memanto-companion/SKILL.md: Run:
  • examples/claudecode-skills-memanto/lifecycle-hooks/skills/memanto-companion/SKILL.md: If they ask "what do you remember about testing / TDD?" or want to preview what would be injected before a skill, run:
  • examples/claudecode-skills-memanto/lifecycle-hooks/skills/memanto-companion/SKILL.md: The hooks already inject context automatically — only run `recall` manually when the user explicitly wants to inspect or preview it.

Hooks (4)

  • memanto/cli/connect/assets/hooks/hooks.json (SessionStart): ${SYS_EXECUTABLE}
  • memanto/cli/connect/assets/hooks/hooks.json (PreCompact): ${SYS_EXECUTABLE}
  • memanto/cli/connect/assets/hooks/hooks.json (PostToolUse): ${SYS_EXECUTABLE}
  • memanto/cli/connect/assets/hooks/hooks.json (PostToolUse): ${SYS_EXECUTABLE}

Package scripts (1)

  • pyproject.toml (build-hook): hatch build hook vcs (hatch_build.py)
  • Low risk: scripts-present (examples/claudecode-skills-memanto/lifecycle-hooks/install.py)
  • Low risk: scripts-present (integrations/hermes-agents/hermes_memanto/install.py)

Attribution and licence

First committed by
GitHub avatar of het0814het0814
Declared authors
  • Majid Fekri (declared in pyproject.toml)
Publisher
Moorcheh.ai (Community)
Source
moorcheh-ai/memanto · commit 3ab4f67
Licence
MIT License (files served here)
  • ATTRIBUTION.md (written by AutoGineer)
Synced
Contributors
het0814, Xenogents, kircoders, HARSHAVARDHAN-RAJU5, Adam13y

AutoGineer is not affiliated with or endorsed by het0814 or Moorcheh.ai.

Install from source

493 of its files are not served here, so there is no ZIP. moorcheh-ai/memanto at 3ab4f67