The auditable memory layer for AI agents — provenance, bi-temporal recall, and provable deletion. Exposes memory operations (add, search, timeline, provenance, forget) as MCP tools.
Attestari provides 8 tools with complete input schemas and descriptions. Naming follows verb_noun convention (add_memory, search_memory, get_timeline, etc.). Descriptions are substantive (100-200 chars), explaining WHAT and WHEN. However, output schemas are not documented in the MCP tool definitions, the server code shows FastAPI endpoints returning structured responses, but the MCP layer does not expose return type documentation. Parameters are well-described with types and constraints. Error handling is implicit (HTTP status codes) but not surfaced as recovery guidance in tool descriptions. Security-sensitive operations (forget, resolve_entities) lack explicit confirmation/dry-run patterns in the schema, though the code supports dry_run for forget.
Store a message as an episode and extract durable facts from it. Exact duplicates are skipped; a new value for a single-valued predicate supersedes the old one.
Right-to-be-forgotten: crypto-shred plus signed certificate (GDPR Art. 17). Erase one subject's entire scope. With encryption enabled, their per-subject key is destroyed. Returns a DeletionCertificate with counts and manifest hash.
Retrieve conflicting values for predicates where multiple values exist for the same subject. Shows resolution strategy (recency-based).
Trace a fact to its source. Returns the source episode, the exact snippet of raw text the fact was extracted from, the caller-supplied source_ref, and when it was learned.
Retrieve full bi-temporal history for a subject or entity. Returns every fact — current and superseded — oldest first, each with its valid-time window and alive flag.
Entity resolution: identify and merge aliases of the same entity. Returns auto-detected merges with confidence scores.
Output schemas not documented in MCP tool definitions. Clients cannot infer return types, field names, or structure. FastAPI endpoints return structured JSON, but MCP layer does not expose schema.
Destructive operations (forget, resolve_entities with auto=true) lack explicit confirmation/dry-run guidance in descriptions. Code supports dry_run for forget, but description does not emphasize this safety mechanism.
Error handling not surfaced in tool descriptions. No guidance on retryability, user-fixable vs fatal errors, or recovery steps. LLMs receive HTTP errors but no actionable next steps.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 56 | 2025-06-18+ | v2 |
Hybrid semantic and keyword retrieval over facts valid at the requested instant. Omit as_of to query current state, or pass an ISO date/datetime to time-travel.
Verify the tamper-evident audit chain. Optionally re-check stored event content against the chain's digests to catch silent in-place edits.
Parameters like subject_id, agent_id, org_id are optional but lack guidance on when they are required vs optional. Descriptions do not explain dependency relationships.
No pagination or result-limiting guidance in search_memory or get_timeline descriptions. Large result sets could exhaust context windows.