LLM Kosh

LLM-Kosh Local-first durable memory for AI agents. Give Claude, Cursor, and other MCP-compatible clients persistent, inspectable memory without handing your workspace to a hosted memory service. Kosh Verify makes that memory show its work: evidence, timing, causal paths, contradictions, inference boundaries, missing evidence, and abstention.

Quickstart · Kosh Verify · Architecture · MCP · Security · Contributing

---

Why this exists

AI agents can reason across increasingly long workflows, but their memory is often either ephemeral or delegated to opaque hosted services.

LLM-Kosh treats memory as local infrastructure: inspectable, portable, auditable, permissioned, and usable across MCP-compatible clients.

It gives agents a durable memory layer built from ordinary local files plus structured indexes and governance controls:

• Local-first — your cartridge stays on your machine by default.
• Inspectable — memory remains readable, backupable, diffable, and reviewable.
• Auditable — mutations are recorded in a tamper-evident ledger.
• Permissioned — MCP starts read-only; write, mutation, and private export require explicit opt-in.
• Portable — one cartridge can support multiple compatible AI clients and workflows.
• Evidence-aware — Kosh Verify can distinguish support, contradiction, inference, evidence gaps, and absence.

Install it: python -m pip install --upgrade llm-kosh

Kosh Verify: memory that can show its work

Long-lived memory creates a different failure mode from a one-off bad answer: a weak or misunderstood memory can be recalled again in later sessions.

Kosh Verify is LLM-Kosh's evidence-aware verification surface. Given the evidence already present in a cartridge, it can produce a structured report containing temporal context, supporting facts, causal paths, contradictions, inferred-but-not-discovered relationships, missing evidence, stability information, and an explicit abstention state when there is not enough evidence.

It is not a universal truth oracle and it does not make an imported source trustworthy simply because it was stored. The aim is to preserve the difference between what the cartridge observed, what it inferred, what conflicts, and what it cannot support.

Try the deterministic synthetic incident demo:

llm-kosh --root ./kosh-demo kosh-verify \

"Why did checkout fail and what evidence contradicts the explanation?" \ --when "2026-05-01T13:30:00+00:00" \ --depth 5 \ --demo-seed \ --json

--demo-seed writes synthetic incident evidence into the selected root, so use a disposable directory. The same behavior is covered by automated tests and a network-free acceptance harness:

python scripts/kosh_verify_acceptance.py

See Kosh Verify for the contract, boundaries, API example, MCP surface, and reproducible checks.

What makes LLM-Kosh different

Architecture

flowchart TB

A[AI client / agent] -->|MCP| R[Access layer] M[CLI] --> R N[Background service] --> R O[Local HTTP MCP - optional] --> R

subgraph KOSH[LLM-Kosh] R C[Memory] D[Evidence] E[Search] F[Policy] G[Ledger] H[Context packs] V[Kosh Verify]

R --> C R --> D R --> F C --> E C --> G C --> H C --> V D --> V end

C --> I[(Local cartridge)] D --> I E --> I G --> I I --> J[Plain files] I --> K[SQLite / FTS] I --> L[Audit ledger]

The repository root contains the code. The cartridge root contains the live memory store. Watched intake folders can feed new material into the cartridge without mixing runtime data into the source checkout.

60-second quickstart

Python 3.10 or newer is required.

python -m pip install --upgrade llm-kosh

llm-kosh install --yes llm-kosh status

That installs the package, creates the default cartridge at ~/.llmkosh/cartridge, configures local defaults, and registers supported desktop integration where possible.

Create and query a custom cartridge:

llm-kosh --root ./my-cartridge init --owner "Local User"

llm-kosh --root ./my-cartridge add --kind note --title "First memory" --body "Hello" llm-kosh --root ./my-cartridge query "Hello"

Manage the background service:

llm-kosh service start

llm-kosh service status llm-kosh service stop

What works today

The core project is usable now:

• Python package published as llm-kosh
• local CLI for creating, searching, importing, packing, and verifying cartridges
• governed llm-kosh-memory CLI for proposing, recalling, inspecting, conflicting, and explicitly reviewing Trusted Memory
• Kosh Verify CLI and Python API for evidence-aware temporal/causal verification
• deterministic Kosh Verify incident demo and acceptance tests
• local MCP server with explicit write, mutation, and private-export capability gates
• source-level MCP composition that adds read-only kosh_verify plus governed Trusted Memory tools without changing those gates
• background service for intake and maintenance jobs
• plain-file, inspectable storage with local indexes
• tamper-evident mutation ledger
• GitHub Actions test, quality, security-scanning, and publishing workflows
• experimental company-brain foundation for evidence-backed memory and cited context

The remaining release work is primarily desktop packaging polish and signing across Windows, macOS, and Linux. The llm-kosh-mcp and llm-kosh-memory entry points described here are present on current master source and are intended for the next package release; the currently published PyPI 2.1.3 package predates those entry points.

Use with MCP clients

The currently published package exposes the standard MCP server through the existing CLI:

llm-kosh --root ./my-cartridge mcp-server

On current source, the composed MCP entry point exposes the standard server, read-only kosh_verify, and governed Trusted Memory tools:

python -m pip install -e .

llm-kosh-mcp --root ./my-cartridge

Equivalent module invocation:

python -m llm_kosh.mcp_trusted_memory_server --root ./my-cartridge

The Trusted Memory MCP surface is deliberately permissioned:

• trusted_memory_recall, trusted_memory_inbox, trusted_memory_conflicts, and trusted_memory_explain are read-only.
• trusted_memory_propose requires --allow-write.
• trusted_memory_review requires --allow-mutate.
• agent-created proposal evidence is recorded as agent_observation, never self-elevated to user_direct.
• explicit review can change lifecycle without rewriting the original source authority; strict recall still requires authoritative/trusted evidence.

Kosh Verify does not require additional privileges. Write, mutation, and private-export capabilities remain opt-in and continue to use the standard server flags:

llm-kosh-mcp --root ./my-cartridge --allow-write

llm-kosh-mcp --root ./my-cartridge --allow-write --allow-mutate llm-kosh-mcp --root ./my-cartridge --allow-private

The composed server also supports local streamable HTTP:

llm-kosh-mcp --root ./my-cartridge --http --port 8000

endpoint: http://127.0.0.1:8000/mcp

Treat HTTP transport as a real network boundary if you expose it beyond loopback. See Trusted Memory over MCP for the governed memory contract, Kosh Verify for the kosh_verify contract, and MCP guide for general MCP setup.

Company-brain foundation

The experimental company-brain layer extends the cartridge beyond simple note recall. It introduces reference-first evidence, session and episode understanding, evidence-backed memories, review lifecycles, permission-first retrieval, and structured cited context packs.

Migrate an existing cartridge:

llm-kosh --root ./my-cartridge brain migrate --dry-run

llm-kosh --root ./my-cartridge brain migrate llm-kosh --root ./my-cartridge brain health llm-kosh --root ./my-cartridge brain context "Prepare the next project decision"

Register existing files without copying their source bytes:

llm-kosh --root ./my-cartridge brain register ./report.xlsx --artifact-type worksheet

llm-kosh --root ./my-cartridge brain inspect \ --locator '{"sheet":"Summary","range":"A1:F25"}' llm-kosh --root ./my-cartridge brain evaluate

Build a replayable session or episode graph from a registered JSONL export:

llm-kosh --root ./my-cartridge brain register ./session.jsonl --artifact-type structured_data

llm-kosh --root ./my-cartridge brain understand --dry-run llm-kosh --root ./my-cartridge brain understand llm-kosh --root ./my-cartridge brain episodes --query "what was implemented"

See Company brain foundation.

Core concepts

Three locations matter:

1. Repository root — the source checkout.
2. Cartridge root — the live memory store selected by --root or LLMKOSH_ROOT.
3. Watched intake folders — receipts/, intake/, and configured external drop folders.

If files are dropped into cartridge intake areas, the service can process them asynchronously. External folders can also be watched through [daemon].watched_directories.

Optional features

python -m pip install "llm-kosh[watch]"     # filesystem events

python -m pip install "llm-kosh[server]" # FastAPI service python -m pip install "llm-kosh[semantic]" # local semantic search python -m pip install "llm-kosh[ingest]" # document conversion helpers python -m pip install "llm-kosh[all]" # all optional features

MCP support is included in the base installation.

Security model

LLM-Kosh is intentionally conservative around agent privilege and export boundaries:

• storage and search are local by default
• there is no automatic cloud sync or package telemetry
• MCP starts read-only
• write, mutation, and private-export capabilities require