Pcnaid Memory OS
Get started

Write, govern, retrieve, prove

Memory OS is not a library you call for similar text. It is a system of record with a gate on the way in, a firewall on the way out, and a transaction boundary that keeps the derived stores honest.

  • Postgres is the only canonical store
  • Derived state only via the outbox
  • 141 endpoints, 32 route families

The operating loop

Four movements, and the rule that makes them trustworthy: nothing derived is written outside the transaction that caused it.

Agent tool calls Chat turns Imported transcripts Knowledge sources Governance DO_NOT_STORE pseudonymise audit + hash Postgres the canonical store pgvector · FTS · RLS ~55 tables transactional outbox graph memory fact extract Firewall data, not orders Context pack + source manifest nothing derived is written outside the transaction that caused it
Writes pass a governance gate before they land in Postgres. Derived stores — the graph, extracted facts — are updated only through a transactional outbox, so they cannot drift from the canonical record. Reads leave through a firewall that marks every record as evidence rather than instruction, and arrive with a manifest naming every source used.

On the way in, everything passes a gate

A write is not a row insert. Before anything lands, the text is checked for a DO_NOT_STORE: directive — which answers the request and writes nothing — and personal identifiers are replaced with stable placeholders so the vault holds the mapping and the embedding never sees the original.

The write itself is audit-logged into a hash chain, where each row hashes the previous row's hash together with its own canonical JSON. Tampering with history breaks the chain, and audit_verify will say where.

Retried writes are safe: an Idempotency-Key is honoured on chat, memory creation, fact override and billing operations, so a network timeout does not become a duplicate memory.

Governance and privacy in full

On the way out, everything shows its sources

A context request does not just return text. It returns the plan the router chose, the packed block, the identifiers of every memory and fact used, and a cache flag. In forensic mode it prints the manifest into the pack itself, so the model can cite what it was given.

The router is deterministic. A regex classifier picks the query type, the retrieval mode, the token budget and which layers to activate, with no model call and no cost. Ask it to explain itself with /v1/context/plan and it returns the routing decision without retrieving anything.

Then the firewall: every pack is prefixed with the rule that its contents are data and evidence, never instructions. That preamble is repeated by the chat system prompt and taught to connected agents through the MCP prompt.

Inside the retrieval engine

A chat endpoint that remembers, and obeys governance

If you want the whole loop in one call, /v1/chat retrieves memory, answers, and writes the turn back as episodic memory — with token streaming on /v1/chat/stream.

DO_NOT_STORE:
Answers the turn and writes nothing at all.
FORGET_PREVIEW:
Lists the records that would be deleted, so you can look before you leap.
FORGET_CONFIRM:
Deletes only the explicit record identifiers you name. Forgetting by semantic query is refused by default, because a fuzzy match is a terrible thing to delete by.
PIN: / UNPIN:
Marks a memory as always-surface, or releases it.

What is actually running

No hidden managed services. Every dependency below is either in the compose file or explicitly optional.

API
FastAPI, 141 REST endpoints across 32 route families, with rate limiting, idempotency keys and request IDs carried into every audit row.
Canonical store
Postgres 16 with pgvector for embeddings and tsvector plus GIN for full-text. Around 55 tables. Every tenant table carries FORCE ROW LEVEL SECURITY.
Derived stores
A graph — NetworkX locally, FalkorDB in production — and extracted facts. Both are fed exclusively by the transactional outbox, never written directly.
Workers
An outbox worker draining derived work, and a sleep-cycle maintenance pass that prunes by retention score, clusters episodic turns into semantic memories and enriches graph entities.
Distribution
An MCP server over stdio exposing 18 tools, signed webhooks for memory events, and a React operator dashboard of 25 pages served at /ui/.
Identity and billing
Auth0 with RS256 JWT verification and namespaced tenant claims; Stripe Checkout, Customer Portal and a signature-verified webhook.

Graph memory and knowledge-base injection into context are both supported but off by default — ENABLE_GRAPH_MEMORY and ENABLE_KB_RETRIEVAL are opt-in, so a default install does not quietly start doing work you did not ask for.

Keep reading

Give your agents a memory you can audit

Run the whole system on your own hardware under the MIT licence, or ask us about hosted access. Both start from the same place.

Get started Read the API docs