{
  "markdown": "# fireweed-mcp\n\n<!-- mcp-name: io.github.Starksood/fireweed-mcp -->\n\nAgent memory where every fact carries a receipt.\n\n```\nremember(claim    = \"Priya joined Acme in 2019 under duress.\",\n         evidence = \"Priya Raman joined Acme in 2019 as a logistics analyst.\")\n\nREFUSED (asserts_more_than_evidence) — the claim adds something the evidence does not say.\n  claim   : Priya joined Acme in 2019 under duress.\n  evidence: Priya Raman joined Acme in 2019 as a logistics analyst.\n```\n\n```\nrecall(\"Priya's salary\")\n\nABSTAINED (unknown_predicate) — no claims ground \"salary\"; 1 claim about Priya Raman exists\nThis is a refusal, not an empty result.\n```\n\n```\nforget(\"Priya\")\n\nERASED Priya Raman — certificate issued\n  signature            : hmac-sha256:f4d0768ef3b0fec624afec12f25bfd91…\n  nodes in closure     : 1\n  every probe abstains : True\n  bystanders surviving : 1\n```\n\nThat last one is the artifact behind *\"delete me from your agent's memory — and prove it.\"*\n\n## Install\n\n```bash\nuvx fireweed-mcp          # try it\npip install fireweed-mcp  # keep it\n```\n\n```bash\nclaude mcp add fireweed -- uvx fireweed-mcp\n```\n\nNo dependencies. No API keys. No model — nothing in this server calls an LLM.\n\n## What it does\n\n| tool | |\n|---|---|\n| `remember` | admits a claim **only if the evidence you cite supports it**. Refusals are typed and say what to fix. |\n| `recall` | grounded claims **with the byte range they came from**; abstains and names the term it could not ground |\n| `verify_receipts` | re-hash every source, re-slice every range — **tamper-evident** |\n| `trace_evidence` | audit one memory **backwards** to its evidence's arrival: the bytes it binds, whether they still match, the ledger event that recorded the document, and whether the chain verifies |\n| `review_reads` | what has been asked of this substrate and what it answered — **off by default**, and queries are salted fingerprints unless you also opt into recording text |\n| `forget` | erasure with exact closure and a **signed certificate**; bystanders survive |\n| `export_memory` | the whole substrate as a portable open-format blob |\n\n## Why the refusals are the point\n\nMost memory servers store what the model says and return what's nearest. This one **adjudicates**.\n\nThe rule is *the model proposes, deterministic code decides.* Across an RPC boundary that stops\nbeing a slogan: **your agent is the proposer**, and it cannot talk its way past the gate, because\nthe gate is not a prompt. Pass a claim and the text you're quoting; pure functions check that the\nevidence names the subject, preserves the relation, invents no numbers, and asserts nothing the\nspan doesn't say. What survives is stored with a byte range into the source.\n\nThen anyone can check it afterwards — including someone who trusts neither your agent nor this\nserver. That is the whole product.\n\n## What it does NOT do\n\nStated up front, because this project's last headline number turned out to be measuring nothing\n(see [the retraction](https://github.com/Starksood/Fireweed_Fabric/blob/main/RETRACTION.md), which\nships with a script that proves it):\n\n- **The server itself does not extract memories from free text.** You supply the claim and the\n  evidence, and nothing in this server calls a model. Since 0.5.0 an optional companion,\n  `fireweed_extractor`, will propose claim/evidence pairs from a transcript using a model you\n  run — and it is **never trusted**: every proposal goes through the same four checks a\n  hand-written one does. Measured across four model families, admitted yield ranged from 0% to\n  99.3% while every unfaithful proposal was rejected with a typed reason. One 4B model produced\n  46 pairs its own cited span did not support; all 46 were refused. The failure mode is *fewer*\n  memories, never false ones.\n- **It does not make an LLM truthful.** It governs what enters the *record* and what can be proven\n  about it. Your model can still say whatever it likes in its own prose.\n- **Recall is the weak half, and the honest number is far worse than this page used to claim.**\n  A previous version of this README said the gate finds a stored fact **98.4%** of the time. That\n  figure is withdrawn. It was measured on a corpus whose fourteen question phrasings *all* have a\n  matching entry in the hand-written category table that answers them — because those entries were\n  derived from that same corpus's failures. It measured the table's coverage of one question set,\n  not the system's recall.\n\n  Measured 2026-08-27 against a corpus held out on **both** axes — unseen personas and, crucially,\n  unseen question phrasings:\n\n  | asked with… | default install refuses |\n  |---|---|\n  | the phrasings the table was built from | 4.8% |\n  | phrasings it has never seen | **99.2%** |\n\n  A default install answers almost nothing phrased in words nobody tuned for. That is the number\n  that describes the system, and it replaces every recall claim this page previously made.\n\n- **What is genuinely strong is the other axis.** On absent-answer traps the gate correctly refuses\n  **96.1%** — it is far better at declining than at answering, and it does not fabricate. If you\n  need a memory that never invents, this is that. If you need one that reliably finds things, it\n  is not there yet, and the number above is why.\n\n- **It does not yet handle multi-subject questions with scope.** Questions naming exactly one\n  subject are scoped to that subject; questions naming two or more still match against the whole\n  store.\n\n  Numbers come from a calibrated instrument that prints its own controls before measuring. The\n  corpora and method live in the private evaluation repo, so treat these as reported rather than\n  independently checkable — the write path, receipts, provenance and erasure are the parts you can\n  verify yourself with the commands above.\n\n## Your data\n\n`~/.fireweed/mcp/` (`FIREWEED_MCP_STORE` to change). The substrate is an open format — see\n[`open_format/SPEC.md`](open_format/SPEC.md) — and `open_format/reference_reader.py` reads it with\nthe standard library alone. Your memory outlives this server, this engine, and any model. A test\nasserts that round trip.\n\n**Do not install `fireweed-mcp[semantic]`.** It enables paraphrase matching in `recall`, and\nmeasured against the absent-answer traps it collapses correct refusal from **96.1% to 32.8%** — it\nanswers two thirds of questions whose answer is simply not in the store. A threshold sweep found no\nsetting where it buys recall without that cost: tightened far enough to be safe, it contributes\nnothing at all. It stays installable because the mechanism may be salvageable when scoped to a\nsubject's own predicates, which is untested. Until then it is off, and `memory_stats` tells you\nwhich mode you are in.\n\n## License\n\n**FSL-1.1-ALv2** — source-available. Free for everything except building a competing product;\nconverts to **Apache 2.0 on 2028-01-01**. Full text in [`LICENSE.md`](LICENSE.md).\n\nWant to use Fireweed in a commercial product or competing service? → **sanyamsood2@gmail.com**\n",
  "bytes": 7034,
  "sha": "6a242e97ffeefe2c4a0525f4a69a55cd935073a16bdbafb2c563aca7ed9a9468",
  "repo_slug": "starksood/fireweed-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_starksood_fireweed_mcp_1d9cc313/readme"
}