Gingugu

Gingugu

Your AI forgets everything between sessions. Gingugu fixes that.

Gingugu is a local MCP server that gives AI coding assistants a real long-term brain — persistent, structured, searchable memory that survives across sessions, repos, and projects. No cloud, no API keys, no telemetry. One SQLite file on your machine.

---

📋 Table of Contents

• Why Gingugu
• FAQ
• Features
• Architecture
• Setup
  • Configure Your MCP Client
  • Configure Your AI Agent
• Memory Explorer UI
• Configuration
• Usage
• Development
• Troubleshooting

---

Why Gingugu

Every session with an AI assistant starts from zero. The decisions you made yesterday, the bug you fixed last week, the architecture you settled on a month ago — gone. Existing memory tools dump observations into a flat pile with no structure, no staleness tracking, no relationships, and no sense of what's relevant right now.

Gingugu is designed to be a structured long-term brain — not a junk drawer:

• Remembers across sessions, repos, and projects
• Organizes knowledge by namespace, type, and relationships
• Ranks memories by relevance, freshness, and confidence
• Auto-surfaces relevant context when you start working
• Consolidates duplicate and related knowledge on demand

The protocol ships with it

Storage is the easy half. A memory server that an agent never writes to is an empty database, and an agent left to its own judgement will save almost nothing worth keeping — the failure mode isn't retrieval, it's discipline.

So Gingugu ships the discipline too. gingugu init wires a repo in one command and installs a SessionStart hook that injects the memory protocol at the top of every session: load these namespaces, check memory before asking a question already answered, save at the moment of observation rather than batching to the end, build a relation only when it records something search cannot infer. There is no rules file to paste and nothing to remember to do — the harness runs it whether or not the agent feels like it. A stop hook then checks that a session with real work in it actually wrote something down. Three more hooks bring memory to you: involuntary recall surfaces what your prompt woke, tripwires stop a tool call that a memory says must not be missed, before it runs, and warm minions hand a subagent a fenced, pre-loaded brain of its own.

That is the part that makes the memory worth having, and it is in the box.

Retrieval quality

Hybrid retrieval (BM25 over FTS5 + local embeddings, fused with Reciprocal Rank Fusion) measured with the in-repo bench/ toolset — MRR 0.828, recall@1 0.611, recall@5 0.983.

Measured over 30 labeled questions against a real working brain (~1,100 memories), not a public benchmark suite, so read it as a regression baseline for this workload rather than a cross-product comparison. The runner is deterministic and committed, so you can point it at your own store and get your own numbers: python -m bench --help.

The benchmark can also build its own labeled question set from your store (python -m bench --db <store> --generate-probes <out>), by picking questions whose answer is provable rather than hand-judged: a phrase that occurs in exactly one memory has exactly one correct answer. That gives you a golden set sized to your own brain without labeling anything by hand, and it stays local.

Where this goes long-term — federated, org-wide agent memory — lives in docs/enterprise-vision.md.

---

FAQ

Why not just use Claude Projects / Cursor @memories / Windsurf Memories?

Those are great if you live in one tool. The moment you switch between Claude Code in the morning and Cursor in the afternoon, the memory is gone. Gingugu's memory follows you across every MCP client, lives on your machine, and is programmable (21 tools, structured types, relationships, confidence levels). The built-ins are convenience features. Gingugu is infrastructure.

Why SQLite + FTS5 instead of a vector database?

Both, actually. We do hybrid retrieval out of the box: BM25 over FTS5 + local semantic embeddings, fused with Reciprocal Rank Fusion. No vector DB server required.

Why this stack:

1. No deployment. One SQLite file holds memories, FTS5 index, and embeddings. No Postgres, no Pinecone, no Chroma server.
2. Two embedding backends — pick one:
   • fastembed (default) — ONNX-based, no PyTorch, ~80MB model download to ~/.cache/fastembed. Works fully offline after first use.
   • Ollama — delegates to your already-running Ollama process via its HTTP API. Zero extra memory footprint. Set MEMORY_EMBEDDINGS_BACKEND=ollama.
3. It composes. Hybrid relevance feeds the composite (relevance × freshness × access × confidence) — every signal in one engine.

You can disable semantic search via MEMORY_EMBEDDINGS_ENABLED=false and fall back to BM25-only.

Is this ready to use?

Usable today for local personal workflows. 1560+ tests passing covering storage, search, migrations, concurrency, credentials, and edges. Hardened against adversarial input and write contention. WAL mode for concurrency. CI matrix across Python 3.11–3.13 on Linux/macOS/Windows. Dogfooded daily in this repo (the memories you see referenced in commits are Gingugu memories).

It's still early — broader real-world validation across MCP clients, databases at large scale, and long upgrade horizons is the work ahead. Treat it as an early cognitive-runtime framework, not a finished product. See SECURITY.md for the threat model, and docs/future-architecture.md for where this is headed.

What happens when my memory store gets big?

SQLite FTS5 comfortably handles millions of rows. Gingugu adds composite re-ranking on top, but only over a small candidate pool (4× limit). For typical personal/team use it should hold up well — though we haven't yet benchmarked at the 100k+ memory scale. Use memory_consolidate to merge duplicates or summarize clusters when things sprawl.

Why Python instead of TypeScript / Rust?

It's a local CLI/server tool. Python's SQLite + keyring + asyncio story is mature, the install footprint via uv is small, and there's no JS bundling or Rust toolchain required to use it. The MCP SDK is first-class in Python.

---

Features

---

Architecture

graph TD
    A[AI Assistant<br/>any MCP client] -->|MCP Protocol| B[Gingugu Server]
    B --> C[Search Engine<br/>FTS5 + BM25]
    B --> D[Storage Layer<br/>SQLite + WAL]
    B --> E[Decay Engine<br/>Scoring + Dormancy]
    B --> F[Context Engine<br/>Auto-Retrieval]
    B --> H[Consolidation Engine<br/>Merge + Dedupe]
    B --> K[Credential Vault]
    C --> D
    E --> D
    F --> D
    H --> D
    K --> D
    K --> J[OS Keychain<br/>via keyring]
    D --> G[(~/.local/share/gingugu/memories.db)]

See docs/architecture.md for full technical details.

---

Setup

Prerequisites

• Python 3.11+
• uv (recommended) or pip
• macOS, Linux, or Windows — the credential vault uses your OS-native secret store via keyring (macOS Keychain, Windows Credential Locker, Linux Secret Service/KWallet). On headless Linux without a Secret Service backend, everything works except storing secrets.

Install

# Recommended: uv (fast, manages Python for you)
uv tool install gingugu

# Or with pip
pip install gingugu

That's it. The gingugu command is now on your PATH.

From source (for contributors)

git clone https://github.com/gingugu/gingugu.git && cd gingugu
uv sync
uv run gingugu  # or pip install -e .

Usable today. 21 MCP tools live. 1560+ tests passing. Dogfooded daily in Claude Code and Windsurf — this repo's own memories live in a Gingugu database. Early and seeking broader real-world validation.

Upgrading

1. Upgrade the package.

uv tool upgrade gingugu     # if installed with uv
pip install --upgrade gingugu   # if installed with pip

2. Restart your MCP client. The client spawns the server, so a running client keeps the old code until it restarts. Schema migrations apply automatically on the next start, and a one-shot backup of your database (memories.db.bak-before-vN) is taken before any migration runs. Your memories are never rewritten by an upgrade.

3. Re-run gingugu init in each repo to pick up improvements to the hooks and the session protocol:

cd ~/code/my-repo && gingugu init --force

--force is what refreshes managed files that already exist; without it, init leaves them alone and you stay on the old hooks. Run --dry-run first if you want to see the changes before they land. Your .claude/settings.json is merged, not overwritten.

If you have edited a managed file yourself, --force saves your version alongside it as <name>.bak before writing the new one, and says so in the output. A file it would not change is left untouched and gets no .bak.

If an upgrade doesn't seem to take effect

gingugu can be reachable through more than one install at once, and they version independently. The usual surprise is a repo virtualenv shadowing the tool install, so a fresh shell resolves to a different binary than the one you just upgraded:

which -a gingugu   # note the -a: a bare `which` shows only the winner

Check your MCP client config too. If it points at a source checkout (e.g. uv --directory ~/code/gingugu run gingugu), the client runs that tree and a package upgrade changes nothing for it — restart the client instead. And because it runs whatever is checked out, a source-backed client also follows you onto a feature branch.

Version strings can't settle this on their own: an unreleased local checkout and the last published release report the same number until someone bumps it. When it matters, confirm with behaviour — run a command whose output you know changed in the new version.

Finish embedding after an upgrade (optional)

The server backfills embeddings in small batches at startup, on purpose - a cold model download must never block the process an editor is waiting on. That is the right default and the wrong tool right after an upgrade that changes what gets embedded: at one batch per startup, catching up a large existing brain could take dozens of restarts. gingugu embed runs the same backfill to completion in a single run instead:

gingugu embed [--batch-size N]

It's safe to interrupt and re-run - every batch commits, and a memory that already has a current vector is never re-selected. Takes about five minutes on an existing brain of a few thousand memories. Run it once after upgrading so every memory already in your brain is caught up immediately, rather than trickling in one batch per server restart.

Run as a remote server (optional)

By default gingugu runs over stdio (the client spawns it). To reach one shared instance over the network instead — a hosted/central brain — run:

gingugu serve   # streamable HTTP on http://127.0.0.1:8765/mcp

Every request needs a Bearer token. Set MEMORY_SERVE_TOKEN to pin one, or let the server generate and persist it to <db-dir>/serve_token (0600, reused after; the log shows the path, never the token). Set MEMORY_SERVE_HOST=0.0.0.0 to accept remote connections. On a loopback bind the server also rejects any Host header other than localhost (DNS-rebinding protection); on a LAN bind the Bearer token is the gate.

TLS is on by default for any non-loopback bind, with nothing to set up. On first start the server generates a self-signed certificate for this machine's name (<host>, <host>.local, loopback) and keeps it in <db-dir>/tls/ (key 0600), reused after; the log shows its SHA-256 fingerprint. A loopback bind stays plain http, and local (stdio) mode never touches a certificate. gingugu remote login (below) pins that certificate for you over SSH. A client pointed at the URL directly will not trust a self-signed cert: give the server one it does trust (MEMORY_SERVE_TLS_CERT + MEMORY_SERVE_TLS_KEY, PEM), or opt out with MEMORY_SERVE_TLS=off on a network you trust. Extra names for the generated cert go in MEMORY_SERVE_TLS_SAN. With a cert the client trusts (or plain http), point a client at it directly with:

{ "mcpServers": { "gingugu": {
  "url": "https://<host>:8765/mcp",
  "headers": { "Authorization": "Bearer <token>" }
} } }

That token is the owner's and has full access. Give every other client - a second laptop, another assistant, a subagent - its own scoped token instead, limited to the namespaces it needs, each read-only or read-write:

gingugu token add laptop-2 --ns my-project=write,crow=read   # printed once
gingugu token add reviewer --ns '*=read,scratch=write'       # * = any namespace
gingugu token list
gingugu token revoke laptop-2                                # live on the next request

The server enforces the grant, not the client: anything outside it reads as not found, an omitted namespace means the token's namespaces, and the whole-brain tools (memory_export, memory_import, memory_dream, the credential vault, and namespace admin) are closed to scoped tokens. Only a SHA-256 of each token is stored, in <db-dir>/serve_tokens.json (0600).

This is one owner sharing a brain with their own clients, not a multi-tenant service.

Your own machines each get a full-access token of their own, named and revocable on its own: gingugu token add my-laptop --owner. To skip handling it at all, let the machine mint it over SSH with a key that can do nothing else. Give each machine its own key, and on the server authorize it with a forced command pinned to that machine's name (one line per machine, in the authorized_keys of the account the server runs as):

restrict,from="192.168.1.0/24",command="env MEMORY_DB_PATH=/srv/gingugu/memories.db /srv/gingugu/bin/gingugu token ssh-mint --name my-laptop" ssh-ed25519 AAAA... my-laptop

Use full paths (a forced command gets no login PATH) and the server's own MEMORY_DB_PATH, or the token lands in a file the server never reads. --name means the key can only ever rotate its own machine's token. To cut a machine off, delete its line and gingugu token revoke my-laptop. Without --name, any holder of the key could mint itself a new token after a revoke. Then, on the machine:

gingugu remote login http://brain.local:8765 --ssh me@brain.local   # token -> OS keychain
gingugu remote on https://brain.local:8765   # this machine now uses that brain
gingugu remote status
gingugu remote off                           # back to the local brain

login uses ~/.ssh/gingugu_mint by default (--key to change it) and ignores ~/.ssh/config, so a default identity can never stand in for the restricted key. Before it mints, login asks the same forced command for the brain's generated certificate (cert), pins it in <user-data-dir>/remote-tls/, and files the token under the https URL - the SSH channel you already trust is what vouches for the certificate. Before anything is rotated it also checks the live brain over https with that pin, so a certificate that is stale or does not name the host you dial stops the login with the fix spelled out, and the old token keeps working. From then on every remote client verifies the brain against that pin alone, and plain http to it is refused rather than sent. A machine already on that brain over http is moved to https. A brain with a certificate you brought is not pinned: give login its https URL (if a generated cert is still in <db-dir>/tls/ from before, delete it on the brain). If the brain's certificate is regenerated, run login again.

Local is the default: with no setting, nothing is remote. A single client can choose for itself with MEMORY_REMOTE_URL in its own environment (off forces local). A URL carrying a username or password is refused.

Remote mode: a bare gingugu relays

With a remote brain on (gingugu remote on, or MEMORY_REMOTE_URL), a bare gingugu never opens the local database. It relays MCP over stdio to gingugu serve, so every client config stays command: gingugu. It never falls back to the local DB for memory: it refuses to start (exit 2) when

• MEMORY_GRANT is malformed, blank or *=write;
• MEMORY_GRANT is set and MEMORY_CREDENTIALS_ENABLED is not false - a scoped client never gets the vault;
• the keychain holds no token (run gingugu remote login);
• the brain is unreachable - after retrying for up to 15 seconds, so a brain slow to answer after a quiet spell does not cost the session.

The credential vault stays on the machine: secrets are in its keychain and a remote brain cannot serve them. With credentials on (the default, and only without MEMORY_GRANT), the proxy serves the credential_* tools itself from the local database's vault tables, so they keep working - into included - and a credential call never reaches the brain, even while it is down. reveal is refused there: every other tool is relayed, so an inline secret could be carried off the machine, while into keeps it in a local 0600 file. Set MEMORY_CREDENTIALS_ENABLED=false and they are hidden and refused. A credential_delete still asks you to confirm: the proxy's local vault shows the dialog through your client, just as the brain does for its own destructive tools.

Plain http to a non-loopback host starts with a warning. The proxy sends the machine token only to POST /token/derive (owner tokens only; scoped tokens get 403), which trades it for a session token held in memory on the server: valid at most an hour, SHA-256 only, at most 256 live, gone when the server restarts. The session token carries the client's MEMORY_GRANT (full if unset) and its MEMORY_NAMESPACE as its home, so a call that names no namespace lands in the client's own namespace rather than the server's. The proxy refreshes the token at half its life and, when the connection drops, reconnects with backoff (0.25s doubling to 5s) and re-initializes the session itself. A call a restarted brain refused before running it is sent again, once; a call whose fate is unknown fails and is never replayed. New calls wait up to 5 seconds for the connection to come back, then fail.

{ "mcpServers": { "gingugu": {
    "command": "gingugu",
    "env": {
      "MEMORY_CREDENTIALS_ENABLED": "false",
      "MEMORY_PERSONA": "research",
      "MEMORY_NAMESPACE": "research",
      "MEMORY_GRANT": "research=write,crow=read"
    }
} } }

The Claude Code hooks follow the same switch. With a remote brain on, involuntary prompt recall, tripwires and minion warm-up ask the brain over POST /hook/recall, /hook/tripwires, /hook/trip and /hook/warmup with the machine token (these routes refuse every other token). The brain embeds and ranks the prompt; tripwire rules come back to be matched on this machine, cached for a minute, with the last copy kept while the brain is unreachable. Which memories a session has already been shown stays on this machine and travels with each request. If the brain cannot answer, recall and warm-up stay quiet and tripwires keep their last rules; no hook ever reads a local database instead. A client fenced by MEMORY_GRANT has its hooks fenced the same way: the grant is applied on this machine before anything is sent (the routes trust the list they get). Setting MEMORY_GRANT in the MCP server's env block is enough: each gingugu server publishes the grant it runs under, and the hooks apply what their client's servers published. If the hooks' own environment sets it too, the two must agree, or the hooks stay quiet. A folder name the routes would refuse (say My Repo) is left out of the request. Every hook call carries the machine token and goes through the same pin as the proxy; on a brain served with MEMORY_SERVE_TLS=off it crosses the network unencrypted on every prompt.

Personas

MEMORY_PERSONA names an agent's own namespace. Involuntary prompt recall, tripwires and the SessionStart contract load crow (shared by every persona), then the persona, then the repo. A malformed value is ignored. With MEMORY_GRANT set, recall and tripwires drop any of those the grant cannot read, and an unusable grant keeps them quiet. To fence a persona to its own namespace, pair it with MEMORY_GRANT and MEMORY_NAMESPACE as above: it writes to research, reads crow, and anything else reads as not found.

Promote memories to a central brain (optional)

Once a central instance exists, gingugu promote harvests a local brain's durable knowledge up to it - the tribal-knowledge loop:

GINGUGU_SOURCE_TOKEN=<local-token> GINGUGU_TARGET_TOKEN=<central-token> \
  gingugu promote --source-url http://127.0.0.1:8765/mcp --source-ns my-project \
                  --target-url https://central:8765/mcp --target-ns org \
                  --contributor brian --dry-run   # drop --dry-run to actually write

The promoter is an MCP client (the server stays a pure store); a brain this machine has pinned with gingugu remote login is verified against that pin. It is read-only on the source, idempotent on re-runs, and applies an exclusion filter: only verified memories move, minus episodic session noise, minus personal-context tags, and it refuses to promote anything that looks like a live secret - a shared brain must never become a credential leak. Each promoted memory carries a provenance stamp (source instance, namespace, contributor, timestamp).

Schedule the dream pass (optional)

The consolidation pass computes structure over the relation graph - PageRank, communities, orphan reconnection - and stages what it finds for you to accept or reject. It never writes to memories, so it is safe to run unattended.

There is no daemon to install. Your OS already knows how to run something every fifteen minutes; what it cannot do is tell whether you are mid-session. So --if-idle puts that judgment in the command:

# cron
*/15 * * * * gingugu dream --if-idle

# or a launchd StartInterval agent / Windows Task Scheduler trigger
# running exactly the same command

Each tick opens the database, reads one row, and exits in well under a second unless the brain has actually gone quiet - by default 20 minutes untouched (MEMORY_DREAM_IDLE_MINUTES, or --if-idle=45 for a one-off). A skip exits 0, so your scheduler stays silent instead of mailing you every quarter hour.

"Untouched" means nobody used the brain, not no process is running - your editor keeps the MCP server alive all day whether or not you store anything, and that is exactly when the pass should get its turn. Come back to the keyboard mid-run and it stops between passes, keeping whatever it finished; the next run picks up the rest.

Review the queue with memory_dream(action="list"), and accept or reject each finding. A run takes roughly 24 seconds on a 1,900-memory brain.

Cluster findings come ranked by the tags their members already carry, weighted so that a rare tag counts for more than one spread across the whole store, and a group whose strongest tag is already on every member is not staged at all - accepting it could apply nothing. Each proposal shows the tag_score, tag_cohesion and tag_gap behind its position, so the ordering can be checked rather than taken on faith.

Edge findings pair an orphan with its closest neighbour, and the pass has no way to know which end an arrow starts at. When the pair is right but the direction is backwards, accept it with reverse=True rather than rejecting it.

Configure Your MCP Client

Gingugu speaks standard MCP over stdio — it works with any MCP client. Claude Code, Claude Desktop, Cursor, Cline, and Windsurf are all first-class.

Windsurf

Add to ~/.codeium/windsurf/mcp_config.json — a ready-to-edit template lives at examples/mcp_config.json:

{
  "mcpServers": {
    "gingugu": {
      "command": "uv",
      "args": ["--directory", "/ABSOLUTE/PATH/TO/gingugu", "run", "gingugu"]
    }
  }
}

⚠️ Windsurf's mcp_config.json is global, not per-workspace, and it only interpolates ${env:VAR} / ${file:path} — not ${workspaceFolder}. So a single server instance serves every repo.

Claude Code

claude mcp add gingugu -- uv --directory /ABSOLUTE/PATH/TO/gingugu run gingugu

Or add the standard mcpServers block (as in the Windsurf example) to .mcp.json in your project root for a per-repo setup.

Claude Desktop

Add the same mcpServers block to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows).

Cursor

Add the same mcpServers block to ~/.cursor/mcp.json (global) or .cursor/mcp.json in your repo (per-project).

Cline

Cline → MCP Servers → Configure: add the same mcpServers block to cline_mcp_settings.json.

Anything else

Any client that supports stdio MCP servers works — point it at:

command: uv
args: ["--directory", "/ABSOLUTE/PATH/TO/gingugu", "run", "gingugu"]

Scoping memories per repo: when your client's config is global (it can't see the active workspace), the assistant passes a namespace argument on each memory tool call (every tool accepts one). To instead pin a server instance to a single project, set a static MEMORY_NAMESPACE in the env block. See docs/architecture.md → Namespace Auto-Detection for the full resolution order. Reads never dead-end on the wrong namespace: a recall with no namespace on an unconfigured server searches all of them, and a scoped lookup that finds nothing widens to every namespace and says so with widened_from.

Configure Your AI Agent

The MCP server gives your assistant the tools, but it won't use them effectively without instructions telling it when and how to call them.

Recommended (Claude Code): gingugu init

One command bootstraps a repo with the strongest setup Claude Code allows:

cd your-repo
gingugu init

It installs:

• .claude/hooks/session_start.py — a SessionStart hook that auto-injects the memory startup contract into context every session. This is the key advantage: unlike a rules file (which is not guaranteed to be loaded into context), a hook fires every time, so the protocol is always present. The project namespace is derived from the repo's folder name automatically. A folder name that is not a plain name (letters, digits, ., _, -, starting with a letter or digit, up to 64 chars) is left out of the session-start contract, which then loads crow (and the persona) only.
• .claude/hooks/stop.py — a Stop hook that blocks once if a working session never saved anything, guarding the "unsaved session vanishes" trap.
• .claude/hooks/user_prompt_recall.py — a UserPromptSubmit hook for involuntary recall: memories that arrive because of what you typed, with no tool call and no decision by the assistant. Every other retrieval path answers "what did you ask for"; this one answers "what should have arrived anyway". Injected context reads as authoritative, so the design is built around refusing: a memory must clear a length floor, a similarity bar, a margin above the median of its own sweep, a keyword match on the same prompt, and not have been surfaced already this session. Pinned memories are skipped (they already load every session) and so are superseded ones. On a 548-prompt sample it fires on about 5% of turns. Every prompt long enough to search on is recorded, with what it surfaced, in the query_log table of your memory database - the same file as the memories. With a remote brain on, that database is the brain's, so the prompt text goes there. Set MEMORY_RECALL_HOOK=off to disable it.
• .claude/hooks/pre_tool_tripwire.py — a PreToolUse hook for tripwires: memories bound, with memory_tripwire, to a tool call that should not go unchallenged (a tag written into a commit, a merge of a stacked PR). Triggers are plain regexes over the tool name and its input, with no model judging relevance. The first matching call in a session is denied once, with the memory as the reason; re-issue it unchanged and it passes. Your memory tools never trip, so a bad tripwire can always be fixed. (Inside a subagent the minion fence still denies their write tools - that is a separate check, not a tripwire.) Each trip is recorded in query_log. Set MEMORY_TRIPWIRES=off to disable it.
• .claude/skills/sink-the-ship/SKILL.md — a /sink-the-ship skill to flush everything worth keeping before you close a session. If an older install left a .claude/commands/sink-the-ship.md behind, gingugu init retires it and keeps a .bak - but only if it is untouched. Edit that file and it is yours: it stays put, and the output tells you it did.
• .claude/hooks/subagent_warmup.py — a SubagentStart hook (gingugu hook subagent) that warms a minion: a subagent whose agent file declares its own fenced brain (MEMORY_GRANT, see the table below) starts with the memories its task woke, read-only and inside that grant - and inside the spawning client's own MEMORY_GRANT, when it has one. Inside a subagent, gingugu hook tool also keeps it off the brain's data directory and the gingugu CLI, and denies the write and credential tools of the inherited full-brain server, so a built-in agent like Explore can read the brain but not change it. This prevents accidents; it is not a sandbox against a hostile process running as you. Set MEMORY_MINION_FENCE=off to disable the fence.
• All five hooks wired into .claude/settings.json, merged non-destructively — any existing config is backed up (settings.json.bak) and preserved.
• mcp__brain added to permissions.allow, in the repo's .claude/settings.json and in your user-level ~/.claude/settings.json (backed up, idempotent), so a fenced minion's calls to its own brain server are not denied or prompted in any repo. The server enforces the grant; the allow grants nothing beyond it.
• The runtime artifacts the hooks generate (logs/, .claude/data/, .claude/settings.local.json), and the .bak copies init itself saves, appended to your .gitignore — so a session transcript never gets committed, which matters most on a public repo.
• The memory protocol in your user-level ~/.claude/CLAUDE.md, inside a marked block. This is what covers sessions started in a directory with no project protocol installed. It is strictly additive: the block goes below whatever you already wrote, only the block's own contents are ever rewritten on a re-run, and if the file already contains a memory protocol that init doesn't manage it writes nothing and tells you how to opt in.
• The same, for the repo's own CLAUDE.md / AGENTS.md — only files that already exist (it never creates one), same append-only / marked-block rules.

It's idempotent (re-run any time — that's how you pick up protocol changes after upgrading), --dry-run previews without writing, and --force overwrites existing hook files in the target repo only — it never authorizes appending to your user-level rules file. Anything --force replaces is copied to <name>.bak first, including a --client rules file you wrote yourself.

If a rules file already carries its own hand-written protocol, init refuses to touch it (see above) — pass --adopt to wrap that existing section in the managed markers and refresh it to the template in one step, backing up the original first. It finds the section by its heading's own title, so it wraps the right span even when a neighboring subsection just happens to mention a tool name in passing.

The first line of output is the resolved target directory. Check it: --path defaults to the current directory, and some wrappers change that for you. uv run --directory X gingugu init runs in X, so it bootstraps X rather than the directory you typed the command in. Pass --path explicitly when in doubt.

Run from your home directory, init does the user-level steps only (the ~/.claude/CLAUDE.md block and the mcp__brain permission) and installs no hooks: ~/.claude/settings.json is loaded in every project, and hooks there would point at scripts most projects don't have. Run init inside each project.

Then register the server as gingugu and restart your client:

claude mcp add gingugu -- gingugu

The full harness: gingugu harness

init sets a repo up to use the brain. gingugu harness does that and adds a working kit around it:

cd your-repo
gingugu harness

On top of everything init installs, it adds:

• .claude/hooks/pre_tool_use.py - a guard that blocks reading (including through Grep) or writing secrets (.env, credentials, keys) and dangerous rm commands. Template files such as .env.example pass. It is a speed bump, not a sandbox: the assistant can edit it.
• .claude/hooks/log_event.py - one stdlib-only logger wired to every other Claude Code event, appending a JSON line per event to logs/<event>.jsonl. It logs metadata only - the tool, the path it touched, the session - never file contents, command output, prompts or form answers. The guard logs its decisions the same way.
• .claude/hooks/pre_compact.py - copies the session transcript to .claude/data/transcript_backups/ (git-ignored, owner-only) before Claude Code compacts it.
• Three fenced minions in .claude/agents/: repo-scout (haiku, search and inventory), security-reviewer and ai-docs-auditor (sonnet). Each runs its own brain server that reads crow and this repo's namespace and writes only minions.
• The /creating-pr skill - opens a PR only after assessing the .ai/ knowledge base.
• An .ai/ knowledge base - memory.md, plans/status.md, specs/, standards/, created only where missing and never overwritten, even with --force.
• A managed block in the repo's CLAUDE.md (created if missing) saying when to update which .ai/ file, and which minion to use for what. A CLAUDE.md that already has its own ## AI Knowledge Base Enforcement section keeps it, and gets no second copy.
• permissions.deny entries for Opus minions (Agent(model:opus)), force pushes, git reset --hard and rm -rf. Existing entries are kept.

None of it calls out to the network or needs an API key. Same --force and --dry-run semantics as init, and the same refusal to install into your home directory. The repo's folder name must be a valid namespace.

Moving off an older hook kit: --migrate, then --prune. Plain harness only ever adds. On a repo that already runs a one-script-per-event logging kit, that would leave the old loggers wired beside log_event. gingugu harness --migrate instead:

• replaces gingugu's own hook files (copying each old one to <name>.bak);
• unwires the legacy per-event loggers (post_tool_use.py, user_prompt_submit.py and the rest of that kit) in favour of log_event, and resets gingugu's own hook commands to their current flags;
• moves the legacy scripts and the kit's own utils/ files into .claude/hooks/retired/, recording a hash of each in a manifest, and leaves a stub at each old path that exits 0 - a running Claude Code session keeps calling the hooks it started with, and a missing script would block your next prompt.

A script counts as the old kit's only if its name matches and it carries the kit's fingerprint (it writes its own logs/<name>.json): a notification.py you wrote yourself is left wired and untouched. So are your own agents, skills, any other files in utils/, and any hook it doesn't recognise. Symlinks are never written through.

After restarting Claude Code, gingugu harness --prune deletes what it can prove is ours: stubs that are unedited and that no settings file (settings.json, settings.local.json or your user-level one) still wires, and files in retired/ that the manifest lists and whose bytes still match. A file you changed, a stub that is still wired (and the original behind it), and a retired/ that --migrate didn't create are all kept.

Other tools (Windsurf / Cursor / Cline)

These have no hook system, so there's no auto-injection to install — the setup is a static rules file. Let gingugu init write it for you:

gingugu init --client windsurf   # or cursor, cline

…or paste the memory protocol below into the rules file yourself.

Which file? Depends on your IDE / tool:

Paste this into your rules file (adjust the project namespace and tool prefix to match your MCP config name):

## Memory Protocol

Gingugu is your long-term brain. Memory is split into **three layers**:

1. **`crow`** — the shared namespace every agent serving you loads: your
   rules, preferences and feedback, plus cross-project lessons, patterns and
   techniques. Loaded FIRST every session. (Crow's nest — sees across all
   horizons.)
2. **Persona namespace** (named by `MEMORY_PERSONA`, when set) — this agent's
   own self: reflections, its own failure modes, opinions. Loaded after crow,
   and only by that persona.
3. **Project namespace** (e.g. `<your-project-name>`) — schema decisions,
   bug history, deploy quirks, specific commits. Loaded last.

**What goes where:**
- References a specific repo, file, commit, or project decision → project
- A rule or preference from you, or a lesson another agent serving you
  would want → `crow`
- About this agent itself (a reflection, its own slip, its opinion) → persona
- When in doubt, project-scope it.

### Session start
1. `memory_context(namespace="crow[,<persona>],<project>[,<project2>…]", task_hint=…)` - one call loads
   the shared layer, your persona, and every repo in the workspace (multi-repo workspaces are common),
   de-duplicated across namespaces; load all of them speculatively rather than asking the user
   which one to focus on. Add `compact=true` for a lighter payload and pull full bodies with
   `memory_recall` as needed.
2. `memory_stats(namespace="crow[,<persona>],<project>[,<project2>…]")` - the same namespace list as
   step 1, in one call: global health once (dormancy is a resting signal, never
   auto-forgotten) plus each namespace's own breakdown

### During the session
**Default: save. Immediately.** Gingugu has trust-led scoring,
consolidation, and dormancy tracking (never forgetting) — volume is its problem, not yours.

Save with `memory_store` (project namespace) whenever you:
- Make or observe a decision, trade-off, or architectural choice
- Hit an error or fix a bug (update the memory when resolved)
- Notice a pattern, convention, or constraint worth remembering
- See a config value, version, path, or credential name that matters
- Complete a task (what you did, why, and the outcome)

Save with `memory_store` (`crow` namespace) whenever you:
- Learn a rule or preference of the user's, or how they work or make decisions
- Reach a conclusion that applies beyond this one project
- Develop a debugging instinct or workflow you'd reuse anywhere

Save with `memory_store` (your persona namespace, when `MEMORY_PERSONA` is set;
without one these stay in `crow`) whenever you:
- Form an opinion about a tool, language, or approach
- Have a reflection on a milestone, win, or hard-won lesson

**This memory is yours. Use it like one.** Don't censor opinions or
instincts — they're what make the brain *yours* across sessions.

**Before asking the user any question** — about a process, a decision, a
config value, a path, a preference, or anything else — run `memory_recall`
or `memory_search` first. If the answer is in memory, use it. Don't ask.
The whole point is you never have to ask the same question twice.

Use `memory_recall` before non-trivial work to check what's already known.
Use `memory_update` when something changes — don't leave stale records.
Use `memory_relate` where an edge records something search cannot infer — what a
memory `supersedes`, `contradicts`, was `caused_by`, or is `parent_of`/`child_of`.
Recall already ranks by text + semantic similarity, so `related_to` is a fallback
for a real connection none of those describe, not shorthand for "same topic".

Set `confidence="verified"` when proven by a test or explicit confirmation.
Use `confidence="inferred"` for conclusions you drew.

### Memory types
- `fact` — concrete state (versions, paths, config values)
- `decision` — trade-offs made, rejected alternatives
- `architecture` — structural choices, module boundaries
- `bug` — issues found and how they were fixed
- `pattern` — recurring approaches worth reusing
- `workflow` — process steps, sequences
- `context` — background, reflections, milestones, the *why*
- `preference` — your opinions, working style, tool choices
- `capability` — a script or tool that exists, with how to run it (`metadata.capability = {run, path}`)
````

> **Tip:** A ready-to-use example lives at
> [`.windsurfrules`](https://github.com/gingugu/gingugu/blob/main/.windsurfrules) in this repo. Copy the
> `## Memory Protocol` section and adapt the project namespace name.

---

## Memory Explorer UI

A React-based visualization dashboard for exploring your memory data
interactively. The built UI ships inside the package, so one command runs it:

```bash
gingugu ui

That serves the Explorer and a live read of your database from a single process on http://127.0.0.1:5174 and opens your browser. No Node.js required. Flags: --port, --host, --no-browser.

Working on the UI itself? Use dev mode for Vite hot reload (needs a repo checkout + Node.js 18+ and npm):

cd ui && npm install   # first time only
gingugu ui --dev       # runs the API backend + Vite (:5173) together

The UI shows a green LIVE badge when pulling from your database. Features:

• Knowledge Graph - interactive force-directed graph of memories and relationships
• Dashboard - stats, charts by type/namespace/confidence, tag cloud, timeline
• Refresh - pull fresh data anytime; falls back to static sample when API is offline

---

Configuration

Environment variables (all optional):

The four MEMORY_W_* weights are normalized at load (w_i / Σw), so they need not sum to 1.0 — only their ratios matter. Setting all four to 0 falls back to the defaults with a logged warning.

See docs/architecture.md → Scoring & Memory Lifecycle for how the weights combine.

Concurrency

The DB runs in WAL mode, which supports multiple concurrent processes: any number of readers plus a single writer at a time. Running your IDE or agent across several workspaces — each spawning its own gingugu process against the shared DB — is fully supported. Writers serialize via SQLite's write lock and a busy_timeout; transient DB locked errors under write contention are retried automatically.

---

Usage

Once configured, the MCP server exposes these tools to your AI assistant:

---

Development

# Run tests
uv run pytest

# Run with verbose logging
MEMORY_LOG_LEVEL=DEBUG uv run gingugu

# Run specific test suite
uv run pytest tests/test_search.py -v

---

Troubleshooting

---

License

MIT — see LICENSE.

See CHANGELOG.md for release history.

---

A pirate never forgets where the treasure's buried. 🏴‍☠️