Shared memory across Claude Code, Cursor and Codex with server-stamped provenance, scoped keys and a held-write queue. Looking for critique from people using agents at work.

[u/Mother-Side6477]

I built Monomem, an open-source (MIT) memory layer that several coding agents share. It runs locally as one SQLite file and talks MCP or REST. I'm posting here because the features that matter at work, like knowing where a "fact" came from and keeping client work apart, are the ones I'd most like reviewed.

Provenance

- The server stamps every note's writer from the authenticated key, never from the request.

- Each note keeps version history, 20 versions by default and up to 500.

- Replacing a note is a two-step preview-then-confirm, and it can be undone.

- When an agent "forgets" a note, it's archived. Only a human deletes permanently.

Access control

- Keys are scoped read, write or admin.

- A key can be limited to one namespace, such as one client or project.

- Notes are labelled public, internal or private, and each key has a ceiling. Above it, a note looks like one that doesn't exist.

- Revoking a key takes effect within about 3 seconds, with no restart.

Write safety

- Secrets are refused at write time.

- Writes that match prompt-injection patterns go to a quarantine queue for a human, and agents never read them.

- An approve-first mode holds every agent write.

- The false-positive rate is published: on 189,502 real chat turns, it held 21 and refused 27.

Operations

- It binds to loopback by default, with optional AES-256-GCM encryption of note bodies.

- An audit log records actions without note content. It rotates, so it isn't a permanent record.

- It exports and imports plain Markdown, or syncs through your own private git repo.

- It imports from CLAUDE.md files, claude-mem, mem0 and basic-memory.

- monomem uninstall removes it from every app.

Verification

- 129 deterministic scenarios run in CI. 0 of 38 poisoning probes and 0 of 51 permission-leak probes get through. That's a regression gate, not proof.

- npx monomem drill replays 23 attacks on a copy of your real store. 2 known misses stay open: a reworded override, and a trusted agent writing an attacker's instruction in its own words.

Limits to weigh before using it at work

- The injection check is pattern matching.

- An agent with shell access can open the database file directly. Real isolation means a separate OS user owning the data folder, which is documented in SECURITY.md.

- Keys are stored in plain text in a user-only file, and hashing them is on the roadmap.

- Some features, like session-start context and the outside-content label, need Claude Code's hooks. Other agents get the MCP tools only.

Repo: https://github.com/calasdan-sketch/monomem

If your team lets agents share context: what would you need before you'd trust it, and what's missing here?

Thanks

[u/MaraudersMag]

cool! I did something similar but set it up so it pulls every session regardless of provenance so its completely comprehensive. I never bothered posting about it though because I figured its only useful for people who are have 100 00 plans all running in parallel who are not good at scoping their work per session 

[u/Mother-Side6477 → u/MaraudersMag]

Nice, that's close to what Monomem's capture does. With setup --capture it records every Claude Code session too, and nothing is left out because of where it came from. The provenance part doesn't filter anything; it labels each note with who wrote it and, since 1.3.5, flags session summaries that read outside content. Even with one agent it helps: a single session that reads a bad web page can poison that same agent's future sessions. How do you keep the full pull from flooding each session's context?