EMET

EMET

EMET is an MCP (Model Context Protocol) memory server, persistent shared memory for AI agents, bot teams and chats.

אמת — Hebrew for truth. Also Enduring Memory & Epistemic Tiers.

Website: https://dreamforgestudiollc.github.io/EMET/

See also: CHANGELOG · CONTRIBUTING · SECURITY · Charter · Feature map · Development practices

What it does

• Layered memory. Six layers — identity, semantic, episodic, procedural, meta, and working — hold curated claims, split by what kind of thing an entry is.
• Verified writes. Every write is read back and compared before it is reported as saved.
• Word-for-word transcript tier. A separate tier stores the conversation as it was written, so a summary cannot overwrite the record it came from.
• stdio and remote HTTP with OAuth. The same server runs locally over stdio, and remotely over HTTP with OAuth. The transport changes. The store does not.
• MongoDB. Atlas, or MongoDB you run yourself. A one-machine trial can use MongoDB 6 or newer. Only semantic_recall needs Atlas.
• Golem Expertise Module (GEM) socket. Add-on behavior ships as GEMs, seated at startup and checked by gem-check against the GEM standard in gem-library/. A GEM ranks below the core floor and below the user's current word, and cannot remove a protected floor line. Two work-in-progress examples ship bundled and stay off unless you ask: Neurendipity (neurodivergent engagement and autistic burnout support; support only, not counseling or treatment; EMET_ACTIVE_GEMS=neurendipity) and Lean Six Sigma (DMAIC and DMADV guidance, templates, and client-side calculators; EMET_ACTIVE_GEMS=lean-six-sigma). Fieldnote stays in the tree as a developer case-study of a runed GEM. It is not a user-facing third GEM, and it is off by default.
• Bot-team backup (optional). Off unless the first-run interview records yes. Yes is the recommended choice. The recipe and the recovery template ship as the bundled bot-team-backup GEM. EMET does not copy prompts or settings itself, and secret values are never stored.
• Client-side GEM execution. A GEM may declare a tool. EMET does not run that computation. EMET verifies the record, not the computation. The client runs the tool, and what is written back is checked the same way as any other write.
• Released flag. A GEM is seated only when its released flag is the boolean true. Any other value is refused. A missing flag is refused except for a legacy manifest pinned by id, version, and file digests.
• Per-client attribution and approvals. Every write is attributed to the client that made it. A new client is read-limited until it is approved. The approval is recorded.
• Error codes and problem reports. Every error carries a stable EMET- - code. An operational error log keeps 10,000 entries or 90 days, plus daily summaries. The owner-only emet_error_report returns the report and an email draft that you send yourself. See Reporting a problem.
• verify-emet and the feature map. npm run verify runs scripts/verify-emet.mjs from a checkout. It starts EMET in a temporary directory on the in-memory test database, with no .env, and drives every registered tool. A tool that needs a service a plain install does not have is reported as a gap. A run whose only problems are gaps exits 3. A failed tool exits 1. The map is docs/features/README.md.
• MIT. Version 0.3.3. EMET is still 0.x: stored document shapes may change before 1.0. Pin a version if you depend on them.

The store has one owner, and other people can join only through the optional Guest (read-only) and Member (read and write) access, both off by default.

Document control (ISO 9001 7.5.3 / ISO 13485 4.2.5)

EMET is built for document control in environments that work under ISO 9001 and ISO 13485. It supports that work; it holds no certification and claims no conformity. An organization that uses it stays responsible for its own quality system, including validating EMET for its intended use.

• No delete, on any store, by design. No tool removes a memory entry, a document or a transcript. The database role EMET runs under is not granted remove on the record either.
• Corrections are made by adding. A memory entry is superseded by a revision that stands alone. A document is revised or retired. A transcript part is revised. Events are never rewritten.
• Retired means obsolete, not gone. retire_doc marks a document obsolete and keeps its id, content, version and digest. read_doc still returns it, flagged retired, with the reason.
• Prior versions are retained. Every document write archives the copy it replaces, and read_doc_history reads any retained revision back, checked against its stored digest.
• Records are superseded whole, never patched. The handoff and any other record document cannot be patched. A new revision is written in full and names the version it supersedes.
• Templates are controlled documents. Base templates ship with the release, and the shipped copy governs. Every templated write is checked against its template, and a write that fails is kept and marked for review, never silently accepted or discarded.
• A test holds the line. write-path.test.js fails if anything in src/ removes from a layer, document or transcript collection, and atlas-role.test.js fails if the database role grants remove.

30-second start

• Guided setup: docs/GUIDED-SETUP.md — never deployed anything. Your assistant installs, configures, deploys, and verifies. You sign in when asked and paste the connector URL.
• Setup: docs/SETUP.md — the manual walkthrough: MongoDB, both transports, and the first-run interview.
• Deploy: docs/DEPLOY.md — remote HTTP with OAuth, so a phone, a browser, or another vendor's agent reaches the same store.

npm lags the repo. npx -y @dreamforgestudiollc/emet installs 0.3.2 until 0.3.3 is

published. For 0.3.3, clone this repo and run npm ci && npm start, or deploy the

repository itself.

Status: 0.x. The stored document shapes are not frozen yet. Breaking changes to the

schema may land before 1.0. Pin a version if you depend on it.

Set `EMET_SOURCE_TAGS` before you let more than one host or bot write. The source-tag

guards (unregistered tags refused on the main records, and on another bot's bots/ folder)

are off unless `EMET_SOURCE_TAGS` is set. With it unset, any caller can write under any

tag. See .env.example and docs/DEPLOY.md.

Install as a Cursor / Grok Bot plugin

EMET ships a plugin for Cursor and Grok Bot (this repo's .cursor-plugin/plugin.json and mcp.json). The Cursor Marketplace listing is submitted and pending review. The plugin does not host memory for you: it connects to your own EMET server, so your records stay in your MongoDB.

1. Deploy EMET remotely: docs/DEPLOY.md. Set PUBLIC_URL and a strong EMET_OAUTH_PASSPHRASE. Check https:// /health returns {"ok":true,...}.
2. Install the EMET plugin and set the variable EMET_URL to https:// /mcp.
3. Connect. The OAuth sign-in opens EMET's passphrase page; enter your passphrase once per device.
4. Verify: call emet_status with {"probe": true} (it writes, reads back and removes a row from _emet_verify only), then save with save_to_layer and recall it from another client.

The plugin also ships an emet-memory skill that tells the agent when to recall, save and close a session.

Shared memory across hosts

EMET stores agent memory in MongoDB (Atlas or self-hosted) across six layers, keeps a separate word-for-word transcript tier, and verifies every write by reading it back. It runs as a local stdio server and as a remote HTTP server from the same source, so it works as a bridge: AI models on several hosts — desktop, CLI, browser, phone, another vendor's agent — read and write one shared memory, and the work, checks, and decisions one leaves behind are there for the next. That includes Grok Bot teams and single-session Grok chats connected to the same server: what the bots save is there for a fresh Grok chat to find once it initializes, and the reverse. To connect a single-session chat (a Grok project, or any chat host that takes a remote MCP connector and supports its OAuth sign-in), add your deployed server's URL, https:// /mcp, as a remote MCP connector there and complete the sign-in with the passphrase you set (EMET_OAUTH_PASSPHRASE; see Connecting clients). A connector that only takes a fixed header or key will not work. Then put the instruction block from docs/BOOTSTRAP.md in the project instructions: the chat reaches for that memory most reliably, unprompted from the first turn, with the block there, or, as a fallback where there is no such field, with it pasted as the first message. The store has one owner, and other people can join only through the optional Guest (read-only) and Member (read and write) access, both off by default.

Two ways in

A session that has not initialized can read everything and can write only a new drop (drops/ - .md): its items, wrap-up and handoff. A session with a registered source and the full startup has full access. Every initialized session sees unhandled drops first. A board edit is refused only for a drop that was listed at that session's boot. New drops are capped at 20 per New York day, in one bucket: the whole local process on stdio, one shared visitor bucket for HTTP with no signed-in client, the source tag bound at approval when there is one, or that OAuth client otherwise. A source the caller types does not move the bucket. Drops are never deleted.

Editing working state

The server provisions a blank board at setup. No session can write the board. It is edited with patch_doc and a reason; an added row names its origin. Once any working document exists, it is edited, not rewritten. A change that leaves a document under half the size it had when this session first touched it, or under half of its largest size in the last 24 hours, is refused. retire_doc refuses a working document. rename_doc issues a new id and marks the old id retired; the text stays readable and stays in the list. restore_doc is the one whole-document recovery, for an owner-listed tag, and only a stored conforming revision whose digest matches.

The name

EMET is אמת — Hebrew for *truth*. It is also an acronym for what the server does: Enduring Memory & Epistemic Tiers.

The choice is not decoration. In the golem legend the word *emet* is inscribed to animate the body, and erasing its first letter leaves מת — *met*, dead. One character is the whole difference.

That is why the verification layer is called `aleph`. Every write in EMET is read back and compared before it is reported as saved. That read-back is the aleph: a memory system without it still returns answers, still looks healthy, and is quietly a corpse — confidently serving things it never actually stored. Aleph is also the *first* letter, which matches the order the protocol insists on: verify before retrying, verify the premise before applying the remedy, read back before trusting.

The same image explains what setup is for. A golem is inert until the word is wri