Attestari

Attestari

The auditable memory layer for AI agents. Give your agent long-term memory — like any memory layer — except every fact carries a receipt (where it came from, when), it runs on plain Postgres, the audit trail is tamper-evident, and any user's data can be provably deleted with a signed certificate.

from attestari import Memory

mem = Memory() mem.add("Hi, I'm Alice. I live in Toronto and I work at Acme.", subject_id="alice", valid_from="2021-06-01") mem.add("Update: I moved to Berlin and I now work at Globex.", subject_id="alice", valid_from="2026-01-01") # supersedes Acme + Toronto

mem.answer("where does the user work", subject_id="alice") # -> "Globex" (latest) mem.answer("where did the user live", subject_id="alice", as_of="2022-01-01") # -> "Toronto" (time-travel)

cert = mem.forget("alice") # right-to-be-forgotten -> a signed deletion certificate

No database, no API key, no model download required to run that — the core engine has zero dependencies.

Contents

• Why it's different
• What you get
• Quickstart (30 seconds)
• The Python API
• Run it for real — Postgres · server + console · MCP · TypeScript
• REST API
• Configuration
• Provable deletion + tamper-evident audit, in one demo
• Already using Mem0 or Zep? Wrap it
• For auditors and DPOs
• How it works — and the Atlas, the engine on one illustrated page
• Project layout
• Docs & contributing

Why it's different

Hosted memory is a black box: you can't see where a "memory" came from, you can't cleanly delete one user's data, and you can't *prove* the history wasn't altered. For a bank, hospital, or insurer — and under GDPR / the EU AI Act — that's a dealbreaker. Attestari is the neutral, self-hostable layer that fixes exactly that.

The last two rows are the moat. Deletion you can prove: each user's data is encrypted with their own key; forget() destroys the key, so the content is unrecoverable — while an immutable log and a signed certificate remain as proof. A history you can verify: every event is hash-linked, so verify_audit() catches any edit, insert, or delete — and the proof survives deletion.

What you get

• Provenance on every fact — each memory traces back to the exact source message, with a character span, confidence, and timestamps.
• Bi-temporal time travel — query memory as_of any past instant; corrections supersede old facts without erasing them, so history is always reconstructable. as_of filters on valid time (when a fact was true). System time (when Attestari recorded it) is stored on every fact, but there's no query on it yet.
• Provable deletion — forget(subject_id) crypto-shreds a user's data and returns a signed DeletionCertificate; content backups and replicas are covered (key storage needs its own backup policy — see the threat model).
• Tamper-evident audit — a hash-linked event chain; verify_audit() detects any edit/insert/delete, and the proof survives crypto-shred.
• Conflict resolution — single- vs multi-valued predicates; conflicts are surfaced via conflicts(), not silently dropped.
• Entity resolution — merge "the same entity, many surface forms," reversibly. Merges are recorded, but reads don't follow them yet: search() and timeline() still see each surface form separately.
• Hybrid retrieval — semantic (pgvector) ⊕ keyword (full-text), with the bi-temporal filter built in.
• Runs anywhere — zero-dependency in-memory engine, or durable on one Postgres
• pgvector container. No graph database. Works across model vendors.

Quickstart (30 seconds)

git clone https://github.com/attestari/attestari && cd attestari

python examples/spike.py # zero-dep end-to-end loop python examples/agent_with_memory.py # the "give an agent memory" pattern

You'll see facts change over time, a bi-temporal query answer differently "as of" different dates, a provenance trace back to the source, and a forget() that issues a certificate. No install, no API key, no database.

The Python API

One facade, Memory, covers the whole surface:

from attestari import Memory

mem = Memory() # zero-dep, in-memory (tests, demos)

mem = Memory.local() # durable in one local SQLite file — zero infrastructure

mem = Memory.postgres() # durable on Postgres + pgvector (production service)

--- write -------------------------------------------------------------

fact_ids = mem.add( "I moved to Berlin and I now work at Globex.", subject_id="alice", # whose memory this is valid_from="2026-01-01", # when it became true (defaults to now) source_ref="chat:msg-42", # where it came from (for provenance) )

--- read --------------------------------------------------------------

mem.search("where does the user work", subject_id="alice") # ranked SearchResults mem.answer("where does the user work", subject_id="alice") # -> "Globex" mem.answer("where did the user live", subject_id="alice", as_of="2022-01-01") # time travel: recall as-of a past date mem.timeline(subject_id="alice") # full bi-temporal history mem.get_provenance(fact_ids[0]) # source episode + span mem.conflicts(subject_id="alice") # surfaced conflicts

--- govern ------------------------------------------------------------

report = mem.verify_audit() # AuditReport — is the hash chain intact? cert = mem.forget("alice") # DeletionCertificate — provable erasure

Run it for real

Three storage tiers, one engine — every guarantee (audit chain, crypto-shred, deep verification, time travel) holds on all three:

Durable with zero infrastructure (survives restarts; nothing to install or run):

from attestari import Memory

mem = Memory.local() # or Memory.local("path/to/agent.db")

Durable, on Postgres + pgvector (one container, no graph DB):

ATTESTARI_PG_PORT=5433 docker compose up -d       # applies the schema on first boot

pip install -e ".[postgres,embeddings]" export ATTESTARI_DATABASE_URL=postgresql://attestari:attestari@localhost:5433/attestari

Already have a Postgres (managed or local)? The schema ships inside the pip package — no clone needed:

python -m attestari.initdb postgresql://user:pass@host:5432/db   # idempotent

from attestari import Memory

mem = Memory.postgres() # durable; materialized projections + pgvector + full-text search

As a REST API + visual console:

pip install -e ".[server]"

uvicorn attestari.server:app # API at /v1/*, the memory-graph console at /

As an MCP server (any agent — Claude, frameworks — can use it) — exposes add_memory / search_memory / get_provenance over stdio, plus forget_subject if you opt in (below). Register it in your MCP client's config (e.g. Claude Desktop's claude_desktop_config.json); the client launches the process for you:

{

"mcpServers": { "attestari": { "command": "attestari-mcp", "args": [], "env": { "ATTESTARI_SQLITE_PATH": "~/.attestari/attestari.db", "ANTHROPIC_API_KEY": "sk-ant-...", "ATTESTARI_KEK": "base64-kek-here" } } } }

Only `command`/`args` are required. Durable by default (memories go to the local

SQLite file, so they survive app restarts); the env block is where per-server config lives — add ATTESTARI_DATABASE_URL to use Postgres instead of SQLite, ANTHROPIC_API_KEY to upgrade extraction to Claude, ATTESTARI_KEK to enable crypto-shred. To run it standalone (e.g. to debug): attestari-mcp (or python -m attestari.mcp). Without a local install, MCP clients can spawn it straight from PyPI: uvx --from "attestari[server]" attestari-mcp.

Erasure over MCP is opt-in. An agent can be steered by text it reads, and erasure can't be undone, so forget_subject is only offered when the env block sets "ATTESTARI_MCP_ALLOW_FORGET": "1". It is then flagged destructive (clients that honour tool annotations ask before running it) and takes two calls: the first previews what would be erased and returns a manifest_hash; the second passes that hash back as confirm_manifest_hash, and erases only if the subject's records still match the preview. Leave it off unless the agent is meant to erase people; Memory.forget() and POST /v1/forget are unaffected.

From TypeScript — the TS client talks to the REST API, so start the server first (see above; it defaults to http://localhost:8000). Then see clients/ts (@attestari/client), a thin typed client mirroring the Memory surface.

With LangChain: see clients/langchain (attestari-langchain) — a AttestariRetriever (recall facts with provenance) and AttestariChatMessageHistory (drop-in memory for RunnableWithMessageHistory) for any chain or agent.

With real Claude extraction (instead of the zero-dep deterministic extractor):

pip install -e ".[anthropic]"

export ANTHROPIC_API_KEY=sk-ant-... python examples/spike.py --llm anthropic

Enable crypto-shred deletion (turn forget() from a logical delete into cr