LLM-Kosh
Local-first durable memory for AI agents.
Give Claude, Cursor, and other MCP-compatible clients persistent, inspectable memory without handing your workspace to a hosted memory service.
Kosh Verify makes that memory show its work: evidence, timing, causal paths, contradictions, inference boundaries, missing evidence, and abstention.
Quickstart ·
Kosh Verify ·
Architecture ·
MCP ·
Security ·
Contributing
---
## Why this exists
AI agents can reason across increasingly long workflows, but their memory is often either ephemeral or delegated to opaque hosted services.
**LLM-Kosh treats memory as local infrastructure:** inspectable, portable, auditable, permissioned, and usable across MCP-compatible clients.
It gives agents a durable memory layer built from ordinary local files plus structured indexes and governance controls:
- **Local-first** — your cartridge stays on your machine by default.
- **Inspectable** — memory remains readable, backupable, diffable, and reviewable.
- **Auditable** — mutations are recorded in a tamper-evident ledger.
- **Permissioned** — MCP starts read-only; write, mutation, and private export require explicit opt-in.
- **Portable** — one cartridge can support multiple compatible AI clients and workflows.
- **Evidence-aware** — Kosh Verify can distinguish support, contradiction, inference, evidence gaps, and absence.
> **Install it:** `python -m pip install --upgrade llm-kosh`
## Kosh Verify: memory that can show its work
Long-lived memory creates a different failure mode from a one-off bad answer: a weak or misunderstood memory can be recalled again in later sessions.
Kosh Verify is LLM-Kosh's evidence-aware verification surface. Given the evidence already present in a cartridge, it can produce a structured report containing temporal context, supporting facts, causal paths, contradictions, inferred-but-not-discovered relationships, missing evidence, stability information, and an explicit abstention state when there is not enough evidence.
It is **not a universal truth oracle** and it does not make an imported source trustworthy simply because it was stored. The aim is to preserve the difference between what the cartridge observed, what it inferred, what conflicts, and what it cannot support.
Try the deterministic synthetic incident demo:
```bash
llm-kosh --root ./kosh-demo kosh-verify \
"Why did checkout fail and what evidence contradicts the explanation?" \
--when "2026-05-01T13:30:00+00:00" \
--depth 5 \
--demo-seed \
--json
```
`--demo-seed` writes synthetic incident evidence into the selected root, so use a disposable directory. The same behavior is covered by automated tests and a network-free acceptance harness:
```bash
python scripts/kosh_verify_acceptance.py
```
See [Kosh Verify](docs/KOSH_VERIFY.md) for the contract, boundaries, API example, MCP surface, and reproducible checks.
## What makes LLM-Kosh different
| Capability | LLM-Kosh |
| --- | --- |
| Local-first persistent memory | ✅ |
| MCP-native access | ✅ |
| Human-inspectable storage | ✅ |
| Tamper-evident mutation ledger | ✅ |
| Read-only-by-default agent access | ✅ |
| Evidence-backed context packs | ✅ |
| Temporal/causal verification | ✅ |
| Contradiction and evidence-gap reporting | ✅ |
| Explicit no-evidence abstention | ✅ |
| Hosted memory service required | ❌ |
| Automatic cloud sync required | ❌ |
## Architecture
```mermaid
flowchart TB
A[AI client / agent] -->|MCP| R[Access layer]
M[CLI] --> R
N[Background service] --> R
O[Local HTTP MCP - optional] --> R
subgraph KOSH[LLM-Kosh]
R
C[Memory]
D[Evidence]
E[Search]
F[Policy]
G[Ledger]
H[Context packs]
V[Kosh Verify]
R --> C
R --> D
R --> F
C --> E
C --> G
C --> H
C --> V
D --> V
end
C --> I[(Local cartridge)]
D --> I
E --> I
G --> I
I --> J[Plain files]
I --> K[SQLite / FTS]
I --> L[Audit ledger]
```
The **repository root** contains the code. The **cartridge root** contains the live memory store. Watched **intake folders** can feed new material into the cartridge without mixing runtime data into the source checkout.
## 60-second quickstart
Python 3.10 or newer is required.
```bash
python -m pip install --upgrade llm-kosh
llm-kosh install --yes
llm-kosh status
```
That installs the package, creates the default cartridge at `~/.llmkosh/cartridge`, configures local defaults, and registers supported desktop integration where possible.
Create and query a custom cartridge:
```bash
llm-kosh --root ./my-cartridge init --owner "Local User"
llm-kosh --root ./my-cartridge add --kind note --title "First memory" --body "Hello"
llm-kosh --root ./my-cartridge query "Hello"
```
Manage the background service:
```bash
llm-kosh service start
llm-kosh service status
llm-kosh service stop
```
## What works today
The core project is usable now:
- Python package published as [`llm-kosh`](https://pypi.org/project/llm-kosh/)
- local CLI for creating, searching, importing, packing, and verifying cartridges
- governed `llm-kosh-memory` CLI for proposing, recalling, inspecting, conflicting, and explicitly reviewing Trusted Memory
- Kosh Verify CLI and Python API for evidence-aware temporal/causal verification
- deterministic Kosh Verify incident demo and acceptance tests
- local MCP server with explicit write, mutation, and private-export capability gates
- source-level MCP composition that adds read-only `kosh_verify` plus governed Trusted Memory tools without changing those gates
- background service for intake and maintenance jobs
- plain-file, inspectable storage with local indexes
- tamper-evident mutation ledger
- GitHub Actions test, quality, security-scanning, and publishing workflows
- experimental company-brain foundation for evidence-backed memory and cited context
The remaining release work is primarily desktop packaging polish and signing across Windows, macOS, and Linux. The `llm-kosh-mcp` and `llm-kosh-memory` entry points described here are present on current `master` source and are intended for the next package release; the currently published PyPI 2.1.3 package predates those entry points.
## Use with MCP clients
The currently published package exposes the standard MCP server through the existing CLI:
```bash
llm-kosh --root ./my-cartridge mcp-server
```
On current source, the composed MCP entry point exposes the standard server, read-only `kosh_verify`, and governed Trusted Memory tools:
```bash
python -m pip install -e .
llm-kosh-mcp --root ./my-cartridge
```
Equivalent module invocation:
```bash
python -m llm_kosh.mcp_trusted_memory_server --root ./my-cartridge
```
The Trusted Memory MCP surface is deliberately permissioned:
- `trusted_memory_recall`, `trusted_memory_inbox`, `trusted_memory_conflicts`, and `trusted_memory_explain` are read-only.
- `trusted_memory_propose` requires `--allow-write`.
- `trusted_memory_review` requires `--allow-mutate`.
- agent-created proposal evidence is recorded as `agent_observation`, never self-elevated to `user_direct`.
- explicit review can change lifecycle without rewriting the original source authority; strict recall still requires authoritative/trusted evidence.
Kosh Verify does **not** require additional privileges. Write, mutation, and private-export capabilities remain opt-in and continue to use the standard server flags:
```bash
llm-kosh-mcp --root ./my-cartridge --allow-write
llm-kosh-mcp --root ./my-cartridge --allow-write --allow-mutate
llm-kosh-mcp --root ./my-cartridge --allow-private
```
The composed server also supports local streamable HTTP:
```bash
llm-kosh-mcp --root ./my-cartridge --http --port 8000
# endpoint: http://127.0.0.1:8000/mcp
```
Treat HTTP transport as a real network boundary if you expose it beyond loopback. See [Trusted Memory over MCP](docs/TRUSTED_MEMORY_MCP.md) for the governed memory contract, [Kosh Verify](docs/KOSH_VERIFY.md) for the `kosh_verify` contract, and [MCP guide](docs/MCP_GUIDE.md) for general MCP setup.
## Company-brain foundation
The experimental company-brain layer extends the cartridge beyond simple note recall. It introduces reference-first evidence, session and episode understanding, evidence-backed memories, review lifecycles, permission-first retrieval, and structured cited context packs.
Migrate an existing cartridge:
```bash
llm-kosh --root ./my-cartridge brain migrate --dry-run
llm-kosh --root ./my-cartridge brain migrate
llm-kosh --root ./my-cartridge brain health
llm-kosh --root ./my-cartridge brain context "Prepare the next project decision"
```
Register existing files without copying their source bytes:
```bash
llm-kosh --root ./my-cartridge brain register ./report.xlsx --artifact-type worksheet
llm-kosh --root ./my-cartridge brain inspect