MemoryGuard

Project a trusted MemoryGuard Graphify Core metadata export into scoped CodeGraph storage. Source bodies are rejected.

Use when starting one new task to build bounded mandatory rules and relevant governed memory context. Do not use for exact record lookup or repeatedly within same task. Uses trusted binding and may mark one pending local CodeGraph receipt consumed.

Read-only governance diagnostics snapshot JSON: reconciliation jobs by status, canonical activation, projection, source links, bindings. Snapshot uses sqlite3.Connection.backup(); never copies DB/WAL files and accepts no arbitrary SQL or file paths. Always allowed, even when governance is degraded.

Check enrichment queue status: pending/applied counts. Primary enrich happens inside build_projection; use this to see residuals.

Use when a memoryguard_audit finding_id needs its evidence, impact, and suggested repair. Do not use for generic memory lookup or to apply a repair.

Import a new external MCP descriptor (JSON). Classifies the server (L0-L4), persists it, and returns the detection result. Descriptor-level import only; does not call the live MCP server.

List imported external MCP server descriptors and their resources. Descriptor-level only (no live MCP client discovery). Read-only.

Extract memory segments from a source file under an authorized source root (read-only preview). Returns candidate list with kind, risk_level, and preview. Does NOT write to shared memory. Use memoryguard_accept_candidates to write accepted candidates.

Permanently delete explicitly selected raw-history sessions for the trusted Agent. Requires confirmed=true; never deletes long-term memories.

Export explicitly selected sessions owned by the trusted Agent. This is raw-history evidence, not long-term memory.

Preview long-term-memory candidates with history evidence; never writes memory.

List the trusted Agent's local conversation-history sessions. Read-only; raw text is not returned.

Read one authorized session or turn; raw content is final-stage only.

Search local history; returns IDs and summaries, never raw turns.

Read a bounded preview around one authorized turn.

Preview an offline import bundle (ChatGPT/Claude/Gemini/Generic). Read-only detection + inventory.

Invoke one operation published by memoryguard_capabilities, including a headless broker operation that shares a GUI name. Never accepts an unpublished native handler. Mutating targets require confirmed=true and idempotency_key.

Start a bound background knowledge import. Requires confirmed=true and idempotency_key.

Get detailed info about a single book: table of contents, chapters, documents. Read-only.

Review one bound knowledge candidate. Requires confirmed=true and idempotency_key.

List pending memory-review candidates distilled from the knowledge bookshelf. Read-only; approval/rejection happens in the GUI.

List all books on the shared knowledge bookshelf. All MCP agents sharing the same workspace see the same books. Read-only.

Permanently purge one bound knowledge deletion. Requires confirmed=true and idempotency_key.

Read a single knowledge chunk by chunk_id, including adjacent context. Returns the full text, source file, line numbers, and neighbor chunks.

Start a bound smart rebuild for one knowledge book. Requires confirmed=true and idempotency_key.

Start a bound background reingest for one knowledge book. Requires confirmed=true and idempotency_key.

Remove one book from bound knowledge scope. Requires confirmed=true and idempotency_key.

Restore one bound knowledge deletion. Requires confirmed=true and idempotency_key.

Search the shared knowledge bookshelf by full-text query. Returns chunks with book title, chapter, file path, and line numbers. book_ids empty = search all books.

Update settings for one bound knowledge book. Requires confirmed=true and idempotency_key.

List pending memory enrichment tasks. Skill path: after build_and_enrich returns host_action_required, YOU (host agent) must classify+translate each task and call apply_enrichments — do not ask the user to pick a CLI.

List authorized sources (project directory, selected folders, Obsidian vaults). Read-only.

Use when owner must remove one known memory from future recall. Do not use for irreversible erasure: this is a local soft-delete recorded as status=deleted.

Admin-only governed supersede of one active same-group duplicate memory atom into a stronger canonical atom. Reuses GovernanceV2.supersede. Requires confirmed=true. There is no force or bypass; owner update/delete stay unchanged.

Read-only preflight for memoryguard_memory_merge_safe. Resolves one explicit canonical/duplicate atom pair in the trusted share group, returns current atom revisions, policies, priorities, and relation safety, and does not write transactions, decisions, undo, or idempotency records. There is no force or bypass.

Use when an exact memory_id is already known and its governed record is needed. Do not use for discovery; use memoryguard_memory_search instead.

Use when finding governed memories by text and lifecycle status. Do not use when an exact memory_id is known; use memoryguard_memory_read instead.

Use when checking shared-memory availability, bound scope, total and active records, lifecycle and kind counts, and evidence-link count. Do not use to search or read individual memory content.

Use when owner must correct body, kind, recall policy, or priority of one known memory. Use related_updates with expected revisions, reason and retry key to replace linked rules atomically; preview validates the final package without committing. This recovery entrance remains available when bootstrap is blocked. Do not use to create a record, change lifecycle status, or modify another owner's memory.

Use when user explicitly asks to retain a durable fact, preference, project decision, or procedure. Do not use for raw transcripts or temporary task notes. Writes locally and may organize duplicates or conflicts.

Read the scoped neuron graph projection (read-only). Requires explicit agent_instance_id or share_group_id. Returns {empty: true, reason: 'not_built'|'missing_governance_scope'|...}.

Read-only projection status (projection_lag / projection_error / scopes) for a group. Always allowed, even when governance is degraded.

Install/repair the provider's global MCP, redirect rules, and supported user-level lifecycle Hook (Claude/Codex/Cursor; TRAE reports MCP+rules fallback). Ensures the trusted Agent has a personal binding unless an explicit shared binding already exists. Requires admin capability; idempotent.

Resolve which share_group_id an agent should write to, based on its AgentBinding. Read-only. Agents should call this before memory_write to know their group.

Read one UTF-8 page from a bounded response reference. Private references revalidate the original read under the current trusted binding and session; changed, deleted, sensitive, revoked, or expired results are refused.

Create one mandatory rule from text. Automatic scope inference is fail-closed: only the trusted current agent or that agent plus the trusted project cwd are allowed. Broader scope requires explicit manual=true, an explicit scope object, and admin capability.

Read one explainable rule lifecycle decision by decision_id. Read-only.

Record explicit evidence for a mandatory-rule bootstrap match. This closes the loop for follow/violate/not_applicable/corrected decisions. One feedback is bound to one receipt_id.

Acknowledge first-merge risk with a server-issued single-use capability and trusted admin AccessContext.

Approve one candidate rule-merge proposal with a server-issued single-use capability and trusted admin AccessContext.

Issue one opaque, single-use rule-merge capability for a candidate proposal. Requires the trusted admin AccessContext. The raw token is returned once to the caller; persistent storage keeps only its hash.

Clear one rule-merge proposal cooldown with a server-issued single-use capability and trusted admin AccessContext.

Admin-only source-aware fold of active same-group duplicate rules into one canonical definition. Reuses the V2 historical reconciliation transaction. Requires confirmed=true. There is no force or bypass; composer/pair safety still decides mergeability.

Read-only preflight for memoryguard_rule_merge_safe. Resolves the requested canonical/duplicate source or definition ids in the trusted share group, returns current definition revisions and pair safety, and does not write transactions, decisions, undo, settlement, or idempotency records. There is no force or bypass; composer/pair safety still decides mergeability.

Read rule audience statistics and the automatic scope policy. Read-only.

Undo a V2 rule lifecycle mutation (including feedback/evidence compensation) using its persisted pre-rule undo_id. Requires the trusted actor or admin capability.

Read-only runtime process facts: current pid, memoryguard_version, code_fingerprint, control_workspace, database_paths, runtime lease status. Always allowed, even when governance is degraded.

Run a read-only scan and return snapshot + coverage ledger. Proves scan completeness (unaccounted_count must be 0).

Check a new text against existing memories for semantic duplicates/conflicts (cross-lingual, paraphrase). Returns similar memories with similarity scores. Read-only.

Cancel one task in caller's bound scope. Requires confirmed=true and idempotency_key.

List pending tasks in caller's bound scope.

Read status for one task in caller's bound scope.