LLM-Kosh

Local-first durable memory for AI agents.

Give Claude, Cursor, and other MCP-compatible clients persistent, inspectable memory without handing your workspace to a hosted memory service.

Kosh Verify makes that memory show its work: evidence, timing, causal paths, contradictions, inference boundaries, missing evidence, and abstention.

Quickstart · Kosh Verify · Architecture · MCP · Security · Contributing

Why this exists

AI agents can reason across increasingly long workflows, but their memory is often either ephemeral or delegated to opaque hosted services.

LLM-Kosh treats memory as local infrastructure: inspectable, portable, auditable, permissioned, and usable across MCP-compatible clients.

It gives agents a durable memory layer built from ordinary local files plus structured indexes and governance controls:

• Local-first — your cartridge stays on your machine by default.
• Inspectable — memory remains readable, backupable, diffable, and reviewable.
• Auditable — mutations are recorded in a tamper-evident ledger.
• Permissioned — MCP starts read-only; write, mutation, and private export require explicit opt-in.
• Portable — one cartridge can support multiple compatible AI clients and workflows.
• Evidence-aware — Kosh Verify can distinguish support, contradiction, inference, evidence gaps, and absence.

Install it: python -m pip install --upgrade llm-kosh

Kosh Verify: memory that can show its work

Long-lived memory creates a different failure mode from a one-off bad answer: a weak or misunderstood memory can be recalled again in later sessions.

Kosh Verify is LLM-Kosh's evidence-aware verification surface. Given the evidence already present in a cartridge, it can produce a structured report containing temporal context, supporting facts, causal paths, contradictions, inferred-but-not-discovered relationships, missing evidence, stability information, and an explicit abstention state when there is not enough evidence.

It is not a universal truth oracle and it does not make an imported source trustworthy simply because it was stored. The aim is to preserve the difference between what the cartridge observed, what it inferred, what conflicts, and what it cannot support.

Try the deterministic synthetic incident demo:

llm-kosh --root ./kosh-demo kosh-verify \
  "Why did checkout fail and what evidence contradicts the explanation?" \
  --when "2026-05-01T13:30:00+00:00" \
  --depth 5 \
  --demo-seed \
  --json

--demo-seed writes synthetic incident evidence into the selected root, so use a disposable directory. The same behavior is covered by automated tests and a network-free acceptance harness:

python scripts/kosh_verify_acceptance.py

See Kosh Verify for the contract, boundaries, API example, MCP surface, and reproducible checks.

What makes LLM-Kosh different

Architecture

flowchart TB
    A[AI client / agent] -->|MCP| R[Access layer]
    M[CLI] --> R
    N[Background service] --> R
    O[Local HTTP MCP - optional] --> R

    subgraph KOSH[LLM-Kosh]
      R
      C[Memory]
      D[Evidence]
      E[Search]
      F[Policy]
      G[Ledger]
      H[Context packs]
      V[Kosh Verify]

      R --> C
      R --> D
      R --> F
      C --> E
      C --> G
      C --> H
      C --> V
      D --> V
    end

    C --> I[(Local cartridge)]
    D --> I
    E --> I
    G --> I
    I --> J[Plain files]
    I --> K[SQLite / FTS]
    I --> L[Audit ledger]

The repository root contains the code. The cartridge root contains the live memory store. Watched intake folders can feed new material into the cartridge without mixing runtime data into the source checkout.

60-second quickstart

Python 3.10 or newer is required.

python -m pip install --upgrade llm-kosh
llm-kosh install --yes
llm-kosh status

That installs the package, creates the default cartridge at ~/.llmkosh/cartridge, configures local defaults, and registers supported desktop integration where possible.

Create and query a custom cartridge:

llm-kosh --root ./my-cartridge init --owner "Local User"
llm-kosh --root ./my-cartridge add --kind note --title "First memory" --body "Hello"
llm-kosh --root ./my-cartridge query "Hello"

Manage the background service:

llm-kosh service start
llm-kosh service status
llm-kosh service stop

What works today

The core project is usable now:

• Python package published as llm-kosh
• local CLI for creating, searching, importing, packing, and verifying cartridges
• governed llm-kosh-memory CLI for proposing, recalling, inspecting, conflicting, and explicitly reviewing Trusted Memory
• Kosh Verify CLI and Python API for evidence-aware temporal/causal verification
• deterministic Kosh Verify incident demo and acceptance tests
• local MCP server with explicit write, mutation, and private-export capability gates
• source-level MCP composition that adds read-only kosh_verify plus governed Trusted Memory tools without changing those gates
• background service for intake and maintenance jobs
• plain-file, inspectable storage with local indexes
• tamper-evident mutation ledger
• GitHub Actions test, quality, security-scanning, and publishing workflows
• experimental company-brain foundation for evidence-backed memory and cited context

The remaining release work is primarily desktop packaging polish and signing across Windows, macOS, and Linux. The llm-kosh-mcp and llm-kosh-memory entry points described here are present on current master source and are intended for the next package release; the currently published PyPI 2.1.3 package predates those entry points.

Use with MCP clients

The currently published package exposes the standard MCP server through the existing CLI:

llm-kosh --root ./my-cartridge mcp-server

On current source, the composed MCP entry point exposes the standard server, read-only kosh_verify, and governed Trusted Memory tools:

python -m pip install -e .
llm-kosh-mcp --root ./my-cartridge

Equivalent module invocation:

python -m llm_kosh.mcp_trusted_memory_server --root ./my-cartridge

The Trusted Memory MCP surface is deliberately permissioned:

• trusted_memory_recall, trusted_memory_inbox, trusted_memory_conflicts, and trusted_memory_explain are read-only.
• trusted_memory_propose requires --allow-write.
• trusted_memory_review requires --allow-mutate.
• agent-created proposal evidence is recorded as agent_observation, never self-elevated to user_direct.
• explicit review can change lifecycle without rewriting the original source authority; strict recall still requires authoritative/trusted evidence.

Kosh Verify does not require additional privileges. Write, mutation, and private-export capabilities remain opt-in and continue to use the standard server flags:

llm-kosh-mcp --root ./my-cartridge --allow-write
llm-kosh-mcp --root ./my-cartridge --allow-write --allow-mutate
llm-kosh-mcp --root ./my-cartridge --allow-private

The composed server also supports local streamable HTTP:

llm-kosh-mcp --root ./my-cartridge --http --port 8000
# endpoint: http://127.0.0.1:8000/mcp

Treat HTTP transport as a real network boundary if you expose it beyond loopback. See Trusted Memory over MCP for the governed memory contract, Kosh Verify for the kosh_verify contract, and MCP guide for general MCP setup.

Company-brain foundation

The experimental company-brain layer extends the cartridge beyond simple note recall. It introduces reference-first evidence, session and episode understanding, evidence-backed memories, review lifecycles, permission-first retrieval, and structured cited context packs.

Migrate an existing cartridge:

llm-kosh --root ./my-cartridge brain migrate --dry-run
llm-kosh --root ./my-cartridge brain migrate
llm-kosh --root ./my-cartridge brain health
llm-kosh --root ./my-cartridge brain context "Prepare the next project decision"

Register existing files without copying their source bytes:

llm-kosh --root ./my-cartridge brain register ./report.xlsx --artifact-type worksheet
llm-kosh --root ./my-cartridge brain inspect <evidence-id> \
  --locator '{"sheet":"Summary","range":"A1:F25"}'
llm-kosh --root ./my-cartridge brain evaluate

Build a replayable session or episode graph from a registered JSONL export:

llm-kosh --root ./my-cartridge brain register ./session.jsonl --artifact-type structured_data
llm-kosh --root ./my-cartridge brain understand <evidence-id> --dry-run
llm-kosh --root ./my-cartridge brain understand <evidence-id>
llm-kosh --root ./my-cartridge brain episodes --query "what was implemented"

See Company brain foundation.

Core concepts

Three locations matter:

1. Repository root — the source checkout.
2. Cartridge root — the live memory store selected by --root or LLMKOSH_ROOT.
3. Watched intake folders — receipts/, intake/, and configured external drop folders.

If files are dropped into cartridge intake areas, the service can process them asynchronously. External folders can also be watched through [daemon].watched_directories.

Optional features

python -m pip install "llm-kosh[watch]"     # filesystem events
python -m pip install "llm-kosh[server]"    # FastAPI service
python -m pip install "llm-kosh[semantic]"  # local semantic search
python -m pip install "llm-kosh[ingest]"    # document conversion helpers
python -m pip install "llm-kosh[all]"       # all optional features

MCP support is included in the base installation.

Security model

LLM-Kosh is intentionally conservative around agent privilege and export boundaries:

• storage and search are local by default
• there is no automatic cloud sync or package telemetry
• MCP starts read-only
• write, mutation, and private-export capabilities require explicit opt-in
• optional HTTP transport is a real network boundary and should be configured accordingly
• exported context is checked for common secret patterns before sharing
• cartridge files are plaintext by design, so use operating-system disk encryption when local data at rest requires encryption

See SECURITY.md for the canonical threat model, reporting guidance, and current security boundaries.

Project status

LLM-Kosh is actively maintained open-source infrastructure for durable agent memory.

The Python package, CLI, MCP server, local service, Kosh Verify surface, test workflow, and publishing path are operational. Current work focuses on interoperability, packaging, governed memory, evidence-aware verification, and making the project easier for external contributors to extend safely.

The Electron desktop app is packaged separately from the Python package. Local developer builds and Windows installer smoke tests are supported; public GA desktop distribution still requires verified Windows code signing and macOS Developer ID signing/notarization.

See GA_READINESS.md for the detailed release posture.

Developer workflow

python -m pip install -e ".[server,watch,ingest]"
python -m pytest -q

Run the small public verification acceptance contract separately:

python scripts/kosh_verify_acceptance.py

For packaging or release changes:

python -m build
python -m twine check dist/*

Native C++ math acceleration is optional. Set LLM_KOSH_BUILD_NATIVE=1 and install pybind11 before building to test it. Release wheels use the portable pure-Python fallback.

Contributing

Contributions are welcome, especially around:

• MCP interoperability
• tests and regression coverage
• packaging and cross-platform reliability
• documentation
• local-first memory workflows
• security hardening
• evidence and retrieval quality
• reproducible verification and benchmark methodology

Please read CONTRIBUTING.md before proposing substantial changes. Use GitHub Issues for reproducible, non-sensitive bugs and feature proposals, and follow SECURITY.md for security-sensitive reports.

Documentation

Open source

LLM-Kosh is maintained in the open under the MIT License.

Bug reports, focused pull requests, interoperability improvements, tests, and documentation contributions are welcome.