Your agent's memory
is lying to you.
Prove yours isn't.

The problem isn't forgetting. It's confidently wrong recall.

A stored fact silently goes stale - it points at code you've since changed or deleted - and the agent injects it with full confidence anyway. OWASP added Memory Poisoning (ASI06) to its 2026 Agentic Top 10. Most memory still stores everything and trusts everything. A memory that points at code you deleted is worse than none. memwarden flips the default: memory is untrusted until its source still checks out.

Verified Recall - four states, one firewall

Every memory is classified against the live repo before it can reach a model. memory_resume, the recall prompt, the Claude Code SessionStart hook, and the proxy all run with the firewall on. It blocks stale before injecting. It does not block unsourced - unsourced means unverified, not dangerous, so it stays available for explicit lookups. What passes is firewall-passing, trust-labeled memory - never laundered into one "verified" pile.

Two policies: balanced (default) blocks stale and keeps the rest - sourced and unsourced - each labeled; verified-only raises the floor so only hash-verified memory is ever auto-injected. memwarden why <id> explains one memory; doctor --fix-stale clears the stale inbox. No LLM, no fuzzy black box.

$ memwarden doctor .

  VERIFIED:   8 memories (code-backed, current)
  SOURCED:    3 memories (sourced, not content-verified)
  STALE:      2 memories reference files that changed/deleted
  UNSOURCED:  1 memory has no evidence

  [stale] Edit (obs_…) - references files that no longer match (changed: src/legacy.ts)

Déjà Fix - never solve the same error twice

memwarden is the one process that sees every agent's sessions, so it can do what no per-tool memory can: when any agent resolves an error, it captures {error signature → root cause + fix} with provenance file-hashes. When any agent later hits a matching error, the fix is surfaced automatically — but only if its files still hash-match. A stale fix is never surfaced.

# Codex solved a failing test yesterday. Today Claude Code hits the same failure:
Déjà Fix (memwarden): a prior session resolved this error and the fix
is verified current against your working tree.
  solved by: codex · root cause: clock skew · fix: mock NTP in conftest

# scriptable too - pipe a failing command's output straight in:
npm test 2>&1 | npx memwarden dejafix lookup

Cross-agent (a fix learned in Codex helps Claude Code), project-scoped (a fix never leaks across repos), and safe by construction - it reuses Verified Recall, so file drift or deletion auto-suppresses it. Only verified current fixes auto-inject.

Source-file hashes: the ground truth

A coding agent has something general-purpose memory doesn't: the repository on disk is the source of truth. When memwarden captures a code-backed memory it records a SHA-256 content hash for each referenced file. On recall it re-hashes the live file and compares. If the file moved or vanished, the memory is provably stale - not by heuristic, by hash.

Setup is one command

memwarden up starts a self-healing daemon (one global brain at ~/.memwarden), installs the on-device embedding runtime so recall is semantic from day one, and wires hooks + MCP into every installed tool - in that tool's own config schema, without clobbering anything you already have. No keys to paste, no cloud, no config files to hand-edit.

$ memwarden up
  daemon    ✓ http://localhost:3111   brain: ~/.memwarden
  semantic  ✓ local embeddings ready (all-MiniLM-L6-v2 - on-device)
  ✓ Claude Code   MCP + hooks - auto inject + auto capture
  ✓ Codex         MCP + hooks (run /hooks once to trust)
  ✓ Cursor        MCP + hooks
  ✓ Gemini CLI    hooks
  ✓ Kiro          MCP + hooks (per custom agent)
  ✓ OpenCode      MCP + plugin

  Done. Every agent on this machine now shares one verified brain.

Then prove it's flowing, per tool - detected (installed), configured (MCP + hooks on disk), live (a hook from that host actually reached the daemon). Wired-but-never-live is the failure every other memory layer hides; here it's a column in memwarden status.

How memory crosses your tools

Cross-tool reach is table stakes - the trust layer is the point. Still, the mechanics matter, so here they are honestly, with no "native hooks everywhere" hand-waving. There are three ways memory reaches a tool, and up wires whichever each supports.

How it works

Capture compresses on-device, redacts, and hashes into the store down the left; recall scopes, searches, classifies, and frames firewall-passing memory back up the right. Scoping is by canonical path, so recall never silently misses.

diagram by Kubesimplify

Measured, not claimed

The launch claim is a memory firewall, so the first number is the firewall itself - not retrieval. A deterministic corpus of 250 memories (file-backed, command-sourced, and unsourced) across 5 projects with 50 controlled staleness events, 5 poisoned-handoff traps, and 5 delimiter forgeries. Reproduce with npm run eval (CI-gated at 100% on all eight gates).

Retrieval next. Real on-device model (all-MiniLM-L6-v2), 30 labelled memories buried in 2,000 plausible distractors, 14 paraphrased queries, and the compressed index running with no exact rescoring. Reproduce with npm run benchmark.

And the engine: an optional native Rust backend built on turbovec (Google's TurboQuant algorithm - real IdMapIndex, O(1) deletion, allowlist filtering inside the SIMD kernel). Measured at 10,000 × 384-dim vectors.

~125× faster search, zero recall drop. Honest defaults: the native backend is quietly selected when its prebuilt binary loads (pin with MEMWARDEN_VECTOR_BACKEND), and memwarden status always names the backend actually serving - a native backend that failed to load reports its TypeScript fallback, never a silent claim. 602 tests across the Verified Recall suite, Déjà Fix, HTTP security, per-host hook dialects, and a cross-tool reliability harness.

MCP tools & the recall command

Plus the recall MCP prompt, surfaced in Claude Code as /mcp__memwarden__recall <query>. On other MCP hosts, ask the agent to call memory_resume; where hooks are automatic, recall arrives on its own at session start.

Start where you are

Audit the memory you already have - zero install, read-only - then wire every tool with one command.