{
  "markdown": "# SPM Agent Connectors\n\nPublic connector package for SPM - Structured Project Memory.\n\nSPM turns project knowledge into durable, shareable, governed and internally\nsmart project memory for AI agents. This repository contains only the public\nconnector surface: the authenticated remote MCP configuration, installable\nbundles for Codex, Claude Code, Cursor and OpenClaw, browser authorization\nhelpers, lifecycle adapters, examples and security guidance.\n\nThe SPM application, backend, billing system, private console, memory engine and\ninfrastructure are not included in this repository.\n\n## Hosted MCP Endpoint\n\nHuman setup and inspection guide:\n\n```text\nhttps://getspm.com/agents\n```\n\n```text\nhttps://getspm.com/v1/mcp\n```\n\nOfficial MCP Registry descriptor:\n\n```text\nserver.json\n```\n\nRegistry name:\n\n```text\ncom.getspm/spm\n```\n\nThe endpoint is public for discovery, but authenticated for use. A client needs:\n\n- an SPM account;\n- an organization and at least one project;\n- a trial or paid plan;\n- an SPM token authorized for one project, a selected project set or the\n  projects the user may access in an organization.\n\n## What Agents Can Do\n\nConnector profiles expose the agent-facing SPM surface:\n\n- use durable project memory across chats, runs and tools;\n- resolve the active project without confusing it with other authorized\n  projects;\n- list authorized projects and compose cross-project context only when the\n  user explicitly requests it;\n- work with smart memory packs that preserve requirements, current decisions,\n  completed work, source-backed context and temporal signals;\n- query temporal project memory;\n- request scoped context packs;\n- verify context pack provenance and hashes;\n- query context graphs and boundaries;\n- run policy-aware preflight checks;\n- report completed actions, tests, evidence and decisions;\n- submit agent lifecycle turns to LLM-first memory triage with source\n  provenance, when the client supports lifecycle hooks.\n- choose selective, complete redacted, summaries-only or metadata-only source\n  capture independently from the memory that triage promotes for future use;\n- inspect and verify an append-ordered capture journal without exposing retained\n  conversation bodies to agent tools.\n- propose a source-grounded project-memory bootstrap when no authorized project\n  matches, request only the specific authorized evidence still needed, then wait\n  for the user to create, link or skip it in SPM;\n- continue an authorized project in another agent or device through a\n  short-lived one-time handoff that carries references rather than memory bodies\n  or credentials;\n- compare body-free workspace manifests before a handoff: Git identity,\n  revision and local-state hash; non-Git file or document snapshots; remote\n  version references; or memory-only work;\n- refresh workspace manifests automatically at session start, before user\n  turns and after completed work when the client supports lifecycle hooks,\n  making stale observations and out-of-band changes visible without uploading\n  local file bodies;\n- distinguish metadata-only source observations from material evidence and\n  request an authorized source handoff when current content is required.\n\n## Typical Use Cases\n\n- Coding agents receive the project memory they should actually use before\n  changing code: requirements, current decisions, tests, constraints and\n  completed work.\n- Delivery teams turn scattered project knowledge into scoped packs for\n  engineers, clients, partners or support without exposing the whole project.\n- Partners or external collaborators receive bounded memory with source,\n  expiry, revocation, provenance and audit evidence.\n- Agent workflows preserve memory after the task by reporting decisions, tests\n  and evidence back to SPM.\n\n## What Agents Cannot Do\n\nThe hosted MCP connector does not expose:\n\n- billing or checkout;\n- invoice payment;\n- customer portal creation;\n- destructive tenant administration;\n- raw secrets;\n- global operator tools.\n\nThis boundary is intentional. Agents receive the memory tools they need without\nbeing given commercial or destructive administrative powers.\n\n## Codex\n\nInstall the Codex plugin from this repository marketplace:\n\n```text\n.agents/plugins/marketplace.json\n```\n\nOr configure Codex manually:\n\n```toml\n[mcp_servers.spm]\nurl = \"https://getspm.com/v1/mcp\"\nbearer_token_env_var = \"SPM_CODEX_MCP_TOKEN\"\nstartup_timeout_sec = 30\ntool_timeout_sec = 120\n```\n\nAuthorize Codex for all projects the signed-in organization user may access:\n\n```bash\npython3 plugins/spm-codex/scripts/auth_spm_codex.py \\\n  --project-id <authorization-project-id> \\\n  --access-mode organization \\\n  --write-env ~/.spm/codex.env\nsource ~/.spm/codex.env\n```\n\nVerify:\n\n```bash\npython3 plugins/spm-codex/scripts/doctor_spm_codex.py\n```\n\nRun the functional remote MCP smoke:\n\n```bash\npython3 plugins/spm-codex/scripts/smoke_spm_remote_mcp.py \\\n  --project-id <authorized-project-id>\n```\n\nThe smoke uses the same `SPM_CODEX_MCP_TOKEN` as Codex and requires an\nexplicit authorized project id (or `SPM_SMOKE_PROJECT_ID`). It initializes the\nhosted MCP endpoint, verifies the project-resolution, multi-project,\nagent-session and memory tool surface, creates a small project-scoped smoke\nmemory event, reads temporal state, creates and verifies a context pack, queries\nthe context graph, runs agent preflight and reports post-action evidence. It\nnever prints the token and the hosted connector strips raw event bodies from\nreturned context.\n\nFor a non-mutating token check, use:\n\n```bash\npython3 plugins/spm-codex/scripts/smoke_spm_remote_mcp.py \\\n  --project-id <authorized-project-id> --read-only\n```\n\n## Claude Code, Cursor And OpenClaw\n\nThe repository includes native client bundles:\n\n- `plugins/spm-claude`\n- `plugins/spm-cursor`\n- `plugins/spm-openclaw`\n\nClients that only support MCP can use the same remote endpoint and bearer\ntoken. The generic authorization helper is\n`scripts/agent-connectors/authorize_spm_agent.py`. See also:\n\n- `examples/codex/config.toml`\n- `examples/claude-desktop/claude_desktop_config.json`\n- `examples/cursor/mcp.json`\n- `examples/windsurf/mcp_config.json`\n\n## Security\n\nDo not commit tokens. Prefer environment variables or each agent client's\nsecret storage. Tokens must be explicitly scoped and revocable from SPM.\nOrganization visibility does not permit silent project mixing: each task keeps\none active project, while cross-project packs require an explicit user request.\nSession continuation does not clone, pull, reset or overwrite a workspace.\nReceiving agents inspect their actual material state, compare it with SPM's\nmanifest and ask before obtaining or reconciling resources.\n\nSee `SECURITY.md` and `docs/security-boundary.md`.\n\n## Links\n\n- Website: https://getspm.com\n- Agent integration guide: https://getspm.com/agents\n- MCP setup: https://getspm.com/mcp\n- Docs: https://getspm.com/docs\n- Security: https://getspm.com/security\n- Demo: https://getspm.com/sales/spm-current-scoped-trusted-agent-memory.mp4\n- Directory listing pack: docs/directory-listing-pack.md\n",
  "bytes": 7058,
  "sha": "d126fb3c0aa40602d3743a04afd8da32be4e094a7e294124952e41148eec59fe",
  "repo_slug": "getspm/spm-agent-connectors",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_com_getspm_spm_e921da81/readme"
}