Open source · MIT · MCP server

Give your AI agents memory they can verify.

Agents act on stored memory. But that memory can be edited, overwritten, or silently corrupted. verifiable-memory-mcp gives an agent an integrity layer: it checks memory before acting, stops if it was changed outside the approved flow, and exports portable evidence of what happened.

v0.2.1 · published on npm · 6 MCP tools · local-first, runs offline

Try it

Run the flow, then verify the evidence.

The sandbox lets anyone create controlled runs, trigger a prompt-injection warning, apply memory tamper, export an Evidence Record plus ECO artifacts, and verify them in the browser.

Start here

Run the interactive sandbox

Generate clean runs, trigger a prompt-injection warning, apply memory tamper, and verify the resulting ECO artifacts in the browser.

  • No account, backend, or live search required
  • Every run can produce an Evidence Record, ECO receipt, and sanitized ECOX replay
  • The verifier checks the evidence independently
Go deeper

Install and reproduce locally

Run the same integrity flow from the repository scripts, then export and verify the generated evidence on your own machine.

  • Uses concrete repo scripts
  • Keeps the verifier as the independent endpoint
  • Runs local-first with no backend trust requirement

How it works

Sandbox: verify, stop, export, verify again.

This is the product story a visitor should understand without extra explanation. The sandbox is controlled and repeatable: it demonstrates governed agent behavior under integrity failure, not a free-form live search demo.

01

Load brief

A sample brief or criterion is loaded into verifiable memory as the starting state.

02

Run agent

The agent reads that state and executes with an auditable memory checkpoint before acting.

03

Generate evidence

The system records the cycle and prepares a portable ECO package describing what the agent relied on.

04

Alter memory

A later modification outside the approved flow changes the state the next run would inherit.

05

Stop before action

Before continuing, the agent detects that inconsistency and halts instead of acting on corrupted context.

06

Export ECO

The resulting evidence package captures the stop condition, the integrity finding, and the run metadata.

07

Verify independently

Anyone can re-check that package in the browser without trusting our backend or our screen.

Local install

Reproduce the same flow on your own machine.

The browser sandbox is the fastest way to understand the flow. The local path lets anyone reproduce the same sequence from the repository scripts without trusting the landing page.

1. Install

Install the package and its local demo tooling.

npm install -g verifiable-memory-mcp

2. Run the clean cycle

Reset the scenario, load the sample state, and execute one clean pass.

npm run demo:scenario:reset
npm run demo:cycle

3. Trigger the stop condition

Alter the ledger outside the approved flow, then execute the next cycle.

npm run demo:tamper
npm run demo:cycle-after-tamper

4. Export and verify

Export the ECO package, then open the independent verifier in your browser.

npm run demo:export
npm run demo:verifier

The point is not general AI correctness. The point is whether the agent can prove the state it acted from and stop when that state changes.

Evidence

A portable package, not a screenshot.

The main evidence artifact is an .eco package: the Evidence Record, an integrity anchor, agent decision metadata, and a human-readable report. The verifier checks it entirely in the browser.

Evidence Recordverifiable-memory-bundle
Evidence Hashsha256(record)
manifestagent · cycle · decision · status
reporthuman-readable explanation
ECOXpermissioned replay package
Important: ECO is the shareable receipt; ECOX is the extended replay for controlled review. This proves integrity state and evidence portability, not that an AI answer is universally correct.
VERIFIED — intact ALTERED — chain broken UNKNOWN — no valid anchor

Applied workflow proof

The same control pattern is being applied inside a real recruiting workflow.

Beyond the sandbox, this pattern is being validated inside a full recruiting application workflow: verifying memory before action, pausing for owner approval, and stopping when integrity fails. A demo video will be published here once recorded.

Applied recruiting workflow

Verifiable Memory MCP running inside a full application.

The recording will show external candidate documents, owner approval, evidence generation, and stop-by-integrity behavior in a real operational flow. Until it's published, the sandbox above remains the reproducible way to evaluate the pattern directly.

Ecosystem

One verification pattern, multiple applied workflows.

These are not separate product claims. Every application below shares one discipline: a claim about information is only trustworthy if it can be checked against the record it came from, not taken on faith. Evidence travels in a portable package (ECO) that anyone can verify independently — outside the system that produced it.

Verifiable Memory MCP

Public reproducible technical demo — this site.

A local, tamper-evident memory layer that lets agents verify what they know before acting — and stop when integrity fails. Install it from npm, tamper with it, verify it yourself.

ECO Evidence Package

Shared evidence packaging layer.

The bridge between memory, evidence, and verification: portable evidence packages that can be checked independently, outside the original system, across workflows, devices, and operators. The open verifier runs on this site.

EcoSign

Commercial application in preparation.

Document and agreement workflows with verifiable evidence: integrity, export, and independent verification for document-centered work. Open verifier source: ecosign-public.

CustodyArt

Applied provenance and custody workflow.

Custody and evidence discipline for creative digital assets, where provenance and traceability matter over time. Sealing flow live: upload, fingerprint, witness, exportable evidence.

WITH

Roadmap — personal verifiable memory.

The same evidence-first principle applied to personal memory for AI assistants: answers that link back to the records that support them. In active development; core remains private.

Talo

Applied agent workflow — controlled demo.

The same integrity-before-action pattern running inside a recruiting operations workflow: agents verify memory before acting, pause for owner approval, and stop when integrity fails. Private demo access — restricted.

AI agents should not just act. They should prove the state they acted from, and stop when that state changes.