Devin Memory

Part of the [DEVIN ecosystem](https://github.com/Icaro0310/awesome-devin)

Track: Build · Nature: product

For: AI engineers, Developers, Data Scientists

Interface: CLI / Python library / MCP server / Service

Path: AI engineers · step 3/3 — after devin-orchestrator

Where this fits

• Job: Build
• Product: devin-brain
• Packages: devin-memory
• Mode: mixed
• Foundation: devin-internals-spec
• Ecosystem: awesome-devin · registry: devin-powerups

devin-memory

Renamed (Oct 2026): this repository moved from Icaro0310/devin-memory

to Icaro0310/devin-brain — the PyPI package, CLI commands and MCP server

name stay devin-memory; stars, issues and history are preserved by the

GitHub redirect.

Unofficial community project. Not affiliated with, endorsed by, or

sponsored by Cognition AI. "Devin" is a trademark of Cognition AI.

[Linux](README.linux.md) · [Personal Windows](README.windows.md) · [Corporate Windows](README.corporate-windows.md)

Part of the awesome-devin ecosystem: the curated hub for the devin-* tools.

An anti-poisoning memory store for Devin: durable facts with provenance, versioning, and a quarantine gate — so agent memory can't be silently corrupted by a bad session or injected content.

The problem

Agent memory is a poisoning vector. Any tool that persists "facts" between sessions can be corrupted by a single bad session — an injected instruction or a pasted secret becomes a trusted belief in every future session, with no review step and no way to answer *"where did this come from?"*.

Prior art

• The Devin memory MCP (retain/recall/reflect over .devin/memory/memories.jsonl) — append-only, no screening, no session provenance. devin-memory exports to that exact line shape.
• MemGPT / LangChain memory — persistence layers that optimize for recall, not for auditing or distrusting what was stored.

devin-memory adapts the memory-store idea; it adds the parts those tools don't have: a quarantine gate and provenance back to real session rows.

What makes it Devin-native

1. Side-by-side: every entry can carry source_session_id + source_rowid, auditable against Devin's sessions.db via devin-internals' read-only store — the memory MCP cannot verify that a claimed source session (or a specific message row) ever existed. The quarantine gate also screens every write for secret and injection shapes.
2. No-Devin: without sessions.db there is no session provenance to audit — the extra disappears.
3. One sentence: *it's a memory store that remembers where each memory came from — and quarantines suspicious ones until a human releases them.*

Install

Python ≥ 3.10 required; install with uv (recommended) or pipx.

uv tool install 'devin-memory[mcp]'

or with pipx (alternative):

pipx install 'devin-memory[mcp]'

For development:

pip install -e ".[dev]"

pytest

Usage

# Store a fact (screened on write; suspect content lands in quarantine)

devin-memory retain "CI is green on Windows + Linux" --tags ci,status devin-memory retain "..." --source-session --source-rowid devin-memory retain "..." --workspace /path/to/project # scope to a workspace devin-memory retain "..." --expires-at 2026-12-31T00:00:00Z # TTL: drops

out of recall/prime after this instant

Keyword-ranked recall — returns active, unexpired entries only;

scores are weighted by recency decay so fresh memories outrank stale ones

devin-memory recall "ci status" [--json] [--limit 5] [--tags a,b] devin-memory recall "ci status" --include-expired # also surface expired

Quarantine lane: list, mark an existing entry, or release one

devin-memory quarantine # list with reasons devin-memory quarantine [--reason manual:x] # mark entry as quarantined devin-memory quarantine --hold-supersede # mark + hold the supersession:

the superseded parent returns

to active until release/retract

devin-memory quarantine --release # human override -> active

(applies a held supersession)

devin-memory quarantine --digest [--json] # audit hash (read-only)

Contradictions: a conflicting retain is linked, not overwritten

devin-memory conflicts [--json] # (newer, older) pairs; resolve with

supersede / retract / quarantine

Mine a session for durable knowledge -> proposed entries (inactive

until reviewed); extraction is heuristic — see "Limitations"

devin-memory extract --sessions-db path/to/sessions.db devin-memory extract --latest --sessions-db path/to/sessions.db [--auto-approve] devin-memory list --status proposed # review queue devin-memory approve # proposed -> active

Context block for a UserPromptSubmit hook — active entries only,

filtered by workspace + machine profile, bounded by ~4 chars/token;

also appends a generated ecosystem-state block (see below)

devin-memory prime [--workspace PATH] [--max-tokens N] [--state-md PATH] [--max-chars N]

Versioning and housekeeping

devin-memory supersede "corrected fact" [--expires-at ]

default: inherit old expiry

devin-memory retract devin-memory list [--status active|proposed|quarantined|retracted] [--json] devin-memory compact [--json] # dedup report (dry-run) devin-memory compact --apply # retract copies + vacuum the file

Audit an entry's provenance: the write-time seal always runs; with

--sessions-db it also cross-checks source_session_id/source_rowid

devin-memory verify [--sessions-db path/to/sessions.db]

Export active memories to a memory-MCP-compatible JSONL

devin-memory export --out memories.jsonl

MCP server

devin-memory is also a real MCP server (stdio) — the same retain/recall pipeline with the quarantine gate on every write, callable from Devin, Claude Desktop, Cursor or any MCP client:

pipx install "devin-memory-mcp"

The devin-memory-mcp console script also ships inside the base devin-memory dist, so a bare uv tool install devin-memory (no extra) leaves a script that exits with error: The MCP server needs the 'mcp' extra — recovery steps live in the Troubleshooting section of each platform guide (Linux, Personal Windows, Corporate Windows).

Client config:

{

"mcpServers": { "devin-memory": { "command": "devin-memory-mcp", "args": ["--db", "/path/to/memory.db"] } } }

The same stdio server registers in other MCP hosts:

Zed — context_servers in settings.json:

{

"context_servers": { "devin-memory": { "command": { "path": "devin-memory-mcp", "args": ["--db", "/path/to/memory.db"] } } } }

JetBrains — Settings → Tools → AI Assistant → Model Context Protocol → Add:

{ "mcpServers": { "devin-memory": { "command": "devin-memory-mcp", "args": ["--db", "/path/to/memory.db"] } } }

Antigravity — ~/.gemini/config/mcp_config.json:

{ "mcpServers": { "devin-memory": { "command": "devin-memory-mcp", "args": ["--db", "/path/to/memory.db"] } } }

Tools: retain, recall, screen (dry-run the gate, no write), list, retract, supersede, quarantine, release, approve, conflicts, prime, verify, extract, compact, quarantine_digest. The release and approve promotion overrides are only registered when the server runs with DEVIN_MEMORY_MCP_PROMOTE=1 — otherwise promotion stays human-only via the CLI (devin-memory quarantine --release / devin-memory approve ). The same flag gates extract's auto_approve parameter and quarantine's hold_supersede (restoring a superseded parent is promotion-shaped), both forced off without the opt-in so an AI client cannot skip the review step. Every tool returns structured data or a {"error", "detail"} object — nothing raises through the transport. DEVIN_MEMORY_DB works as an alternative to --db.

VS Code: adapters/vscode/ ships an extension that registers this server with the editor's built-in MCP support (server definition provider, VS Code ≥1.102) — launch command, optional DEVIN_MEMORY_DB and workspace cwd are declared there; the promotion opt-in is pinned off so the editor-facing server keeps its non-promoting surface.

adapters/ is a self-contained Devin plugin root (adapters/.devin-plugin/plugin.json + adapters/skills/devin-brain/SKILL.md), installed with devin plugins install Icaro0310/devin-brain#adapters — it ships in the repo, not inside the wheel. The manifest launches the server through uvx --from 'devin-memory[mcp]' devin-memory-mcp; the promotion opt-in (DEVIN_MEMORY_MCP_PROMOTE) is never set, so the plugin-facing server keeps its non-promoting surface. To run against a checkout instead of PyPI, point a local manifest copy at uvx --from '.[mcp]' devin-memory-mcp.

Learn from sessions with devin-learning

This companion CLI extracts candidate lessons from a `sessi