weavory.ai

Responsible-AI memory for agent swarms. Every belief signed. Every decision auditable. Works with any MCP-native agent — in five tools.

Why Responsible AI

Agents in banking, insurance, and healthcare can't be trusted without a paper trail. Today, when an agent denies a claim, nothing signed that. When it changes its mind, nothing records the history. When compliance asks what it knew on Tuesday, nothing answers. weavory is the shared memory layer that closes that gap — signed beliefs, per-(signer, predicate) trust gating, hash-chained audit, bi-temporal replay, and revocation by tombstone — in an MCP-native server any agent can spawn with one command.

Install

# npx — zero install, no build
npx -y @weavory/mcp start

# Docker — multi-arch (linux/amd64, linux/arm64)
docker run -v weavory-data:/data ghcr.io/deepakkts/weavory:latest

# From source
git clone https://github.com/DeepakKTS/weavory.ai.git
cd weavory.ai && pnpm install && pnpm build

The server speaks MCP over stdio. Point Claude Desktop, Cursor, any MCP-capable agent, or the official MCP SDKs at it. See docs/INSTALL.md for the Claude Desktop config snippet.

The five tools

| Tool | What it does | |------|--------------| | weavory_believe | Sign a claim (Ed25519), content-address it (BLAKE3), store it, append to the audit chain, fan out to matching subscribers. | | weavory_recall | Retrieve beliefs with trust gating, bi-temporal as_of, quarantine filter, tombstone visibility (include_tombstoned), and subject / predicate / confidence filters. | | weavory_subscribe | Register a bounded queue keyed on a pattern + filters. Drain via recall. | | weavory_attest | Update trust(signer, topic) in [-1, 1]. | | weavory_forget | Tombstone a belief — invalidated_at set, history preserved for as_of queries. |

This is the complete public API. No magic, no hidden surface.

60-second example

Four agents triage a $42,000 insurance claim: intake → fraud → underwriting → approver. An unknown signer tries to inject a forged approval. Under WEAVORY_ADVERSARIAL=1, weavory's default trust floor (0.6) quarantines the forgery automatically. The honest chain completes. An incident JSON is exported for forensic replay.

pnpm exec tsx examples/bfsi_claims_triage.ts

Self-asserts: the attacker's belief is never visible in the approver's default recall (under WEAVORY_ADVERSARIAL=1 where the trust floor is 0.6), but is visible in the compliance audit view (min_trust: -1, include_quarantined: true, include_tombstoned: true). Audit chain verifies ok at the end.

Full walkthrough in docs/REAL_WORLD_USAGE.md.

What you get

• Ed25519-signed beliefs — every claim is cryptographically attributable to a signer.
• BLAKE3 hash-chained audit log — retroactive edits break the chain; tamper is detected.
• Trust-gated recall — per-(signer, predicate) trust in [-1, 1]. Default min_trust=0.3 (0.6 under WEAVORY_ADVERSARIAL=1); neutral trust for an unattested signer is 0.5. Pass min_trust: 0.6 explicitly to enforce "only attested signers" without adversarial mode. Attest at topic=<predicate> to gate that predicate.
• Bi-temporal replay — recall({ as_of: "<ISO>" }) reconstructs the world as it was at any past instant.
• Dual persistence — JSONL (default, zero native deps, synchronously durable) or DuckDB (opt-in, WAL-backed) with graceful binary fallback.
• Pre-ingest policy hook — WEAVORY_POLICY_FILE=<json> for allow / deny rules on subjects (glob), predicates (exact), payload size.
• Incident export + replay — exportIncident() snapshots state; weavory replay --from <path> rehydrates off-process for review.
• Honest scope — G-Set beliefs + LWW tombstones + optional consensus merge. Not a full state-merging CRDT; we don't overclaim.

Canonical audit view — compliance-grade enumeration of every belief under a subject, including tombstoned and quarantined:

weavory_recall({
  query: "",
  filters: { subject: "claim/CLM-42017" },
  min_trust: -1,
  include_quarantined: true,
  include_tombstoned: true,
  top_k: 100,
})

Works with any MCP-native agent

Weavory's only interface is the five MCP tools — any MCP-capable agent can use it from docs/README.md alone. We verify this end-to-end by running a stock Claude Opus 4.7 agent against the public quickstart, with no agent-specific wiring, and recording every tool call + result.

• docs/evidence/stock-agent-session-v0.1.18.md — redacted transcript (signer ids shortened; API key never persisted).
• Regenerate with pnpm exec tsx scripts/capture-gate7-transcript.ts (requires ANTHROPIC_API_KEY).

Excerpt — the stock agent discovers Alice's belief, trusts her, and answers:

weavory_recall({ query: "traffic cambridge", top_k: 5 })
weavory_attest({ signer_id: "<alice>", topic: "observation", score: 0.9 })
→ "Yes, Cambridge is congested with an ETA delta of 14 minutes."

Documentation

| Doc | What's inside | |-----|---------------| | docs/README.md | 60-second quickstart | | docs/ARCHITECTURE.md | One-page system model | | docs/REAL_WORLD_USAGE.md | Enterprise integration patterns + the BFSI scenario | | docs/INSTALL.md | Three install paths, Claude Desktop config | | docs/DEPLOYMENT.md | Env-var reference, persistence modes, Compose | | docs/RUNBOOK.md | Operational scenarios — restart, policy denial, incident replay, key rotation | | docs/COMPLIANCE.md | SOC2 / ISO27001 / GDPR / EU AI Act / NIST AI-RMF mapping | | docs/SECURITY.md | Protected · mitigated · deferred |

Status

• 232/232 automated tests — unit + integration + performance
• CI green on Ubuntu + macOS with Node 22 LTS
• Strict TypeScript — no any in src/
• Published to npm and GitHub Container Registry on every release tag
• Time-to-first-belief from fresh npx -y @weavory/mcp start: under 30 seconds

What weavory is not (deliberate scope)

• Not a generic memory-as-a-service — run one weavory per trust boundary.
• Not a vector database — substring recall today.
• Not federated — single writer per data directory.
• Not multi-tenant — isolation is filesystem / process level.
• Not encrypted at rest — use filesystem-layer encryption (LUKS, EFS/KMS).
• Not an identity provider — signer IDs are public keys; SSO mapping is external.

Each is a documented boundary, not a hidden gap.

Contributing

Issues and PRs welcome. Please read docs/ARCHITECTURE.md before proposing core changes; the public API (five MCP tools) is locked and any new surface requires a design discussion.

Run the full test suite before submitting:

pnpm install && pnpm test && pnpm lint

License

Apache-2.0. See LICENSE and NOTICE.

Copyright © 2026 DeepakKTS.

Built for NandaHack 2026 @ MIT Media Lab.