m8m

AI memory observability, provenance & security. Eight eyes. Nothing gets past.

m8m monitors what your AI agents remember about you — where each memory came from, what changed, and whether anything looks suspicious. The core pieces share one local SQLite database:

• MCP server — live memory operations as your agent works
• File watcher — tracks local memory files (MEMORY.md, CLAUDE.md, …); it runs automatically inside the MCP server (and can also run standalone via m8m watch)
• Security analysis — pattern-based scanning of every memory for credentials, instructions, URLs/emails, and hidden characters
• Snapshots & rollback — point-in-time baselines to diff drift and roll back
• CLI — query and audit memory state from the terminal
• Local dashboard — a dark, browser-based visualization

Phase 1 is entirely local: SQLite storage, pattern-based analysis, and zero LLM or network calls in the analyzer itself.

Why m8m?

Your AI remembers everything about you — preferences, habits, work patterns, relationships. But do you know what it remembers? Can you tell if those memories have been tampered with?

• Microsoft Security identified 50 memory poisoning attempts across 31 companies in just 60 days (Feb 2026)
• A single email can silently rewrite your AI agent's memory (MemGhost, Jul 2026)
• More capable models are more vulnerable, not less — GPT-5.4 showed 87.5% injection success rate

m8m gives you visibility and control. Think of it as git log for your AI's memory.

Install

From npm (published) — one command

npm install -g @th0t3p/m8m

From source (this repo) — one command

./scripts/install.sh

That installs dependencies, builds, and runs npm link so m8m is on your PATH. (Equivalent manual steps: npm install then npm install -g ..)

Run without installing

node dist/cli/index.js --help
npx tsx src/cli/index.ts --help

The first command requires npm run build first; the second runs TypeScript directly with no build.

Data location: everything lives in ~/.m8m/ by default. If ~ is read-only (e.g. some sandboxes), set M8M_HOME to a writable directory: export M8M_HOME=/path/to/m8m-data.

Quick start

m8m init
m8m import ./MEMORY.md --platform local_file
m8m status
m8m list --flagged
m8m audit

CLI

Example

$ m8m status

  m8m — Memory Observatory
  ─────────────────────────

  Agent memories
    Total:        138
    Active:       136
    Quarantined:    2
    Flagged:        4

  File memories
    Files:          3
    Nodes:         120
    Flagged:        9

  By platform:
    claude_code        89
    claude_web         41
    chatgpt_web        12

  Security events:      3 unresolved

Memory lifecycle

m8m never silently overwrites history — every change is appended to a changelog. Statuses:

Soft-delete keeps the content so it can be restored or audited. Purge physically removes the row and its history (earlier snapshots may still hold a copy).

Snapshots & rollback

Snapshots are point-in-time dumps of both kinds of memory — agent memories and file memories — so you can diff drift and roll back the whole store atomically.

• Auto-snapshots run inside the MCP server every auto_snapshot_interval_minutes (default 60), so a recent baseline is always available while a client is connected.
• m8m snapshot takes one manually.
• m8m diff compares the current store against the latest snapshot (or two snapshots, or a time window).

Rollback always previews first, then asks to confirm:

m8m rollback <snapshot-id>        # shows restore/revert/remove preview, then [y/N]
m8m files rollback <id>           # shows a line diff, then restores the previous version

Rollback is traceable — it writes normal changelog/version entries, so you can roll forward again. Snapshot rollback re-adds deleted agent memories, reverts modified ones, soft-deletes memories added after the snapshot, restores file memories to their snapshot content, and purges file memories added since. m8m files rollback <id> rolls a single file back one version instead.

MCP server

m8m exposes m8m_store, m8m_search, m8m_recent, m8m_status, m8m_flag, and m8m_delete over stdio. (m8m_delete is a reversible soft-delete; hard deletion is m8m purge in the CLI.)

The MCP server also runs the file watcher. While any client is connected, it watches your memory files (watch_paths, scan-provider targets, and every file already imported) and re-imports changes as a new version with a stored diff — so you don't need to run m8m watch separately. m8m watch remains available for standalone/foreground use.

Easiest: auto-configure

m8m mcp add codex

Replace codex with claude, cursor, or dsh.

This writes the right config entry into the client's config file for you (Codex ~/.codex/config.toml, Claude ~/.claude.json, Cursor ~/.cursor/mcp.json, DSH $DSH_HOME/cordis.patch.yml). Add --data-dir /path to bake in a M8M_HOME override.

Or use your client's native command:

codex mcp add m8m -- npx -y @th0t3p/m8m mcp
claude mcp add m8m -- npx -y @th0t3p/m8m mcp

Manual (equivalent config)

The server is fetched from npm on demand via npx, so no clone or build is needed.

OpenAI Codex — ~/.codex/config.toml:

[mcp_servers.m8m]
command = "npx"
args = ["-y", "@th0t3p/m8m", "mcp"]
startup_timeout_sec = 30

Tools appear as m8m_store, etc.

Claude Code — project scope .mcp.json, or user scope ~/.claude.json:

{
  "mcpServers": {
    "m8m": { "command": "npx", "args": ["-y", "@th0t3p/m8m", "mcp"] }
  }
}

Tools appear as m8m_store, etc.

Cursor — ~/.cursor/mcp.json:

{
  "mcpServers": {
    "m8m": { "command": "npx", "args": ["-y", "@th0t3p/m8m", "mcp"] }
  }
}

DeepSeek Harness (DSH) — $DSH_HOME/cordis.patch.yml:

- insert:
    - id: mcp-m8m
      name: '@deepseek-ai/dsh-mcp-client'
      config:
        serverName: m8m
        transport: stdio
        command: npx
        args: ['-y', '@th0t3p/m8m', 'mcp']

Tools appear as mcp__m8m__m8m_store, etc.

Dashboard

m8m dashboard

Then open http://localhost:8808.

Four views: Timeline, Memories, Security, and Diff. The Memories view shows both kinds of memory together — agent memories (facts stored via the MCP server) and file memories (imported markdown/json files).

Configuration

Config lives at ~/.m8m/config.json (override the directory with $M8M_HOME). It has two lists that control where m8m looks for vendor memory files:

• providers — the agent harnesses m8m scan discovers. Each entry names a vendor and lists the files/directories that hold its memories.
• watch_paths — the paths the file watcher (inside the MCP server, or m8m watch) monitors for changes in real time.

{
  "db_path": "~/.m8m/m8m.db",
  "watch_paths": [
    "~/.claude/memories",
    "./.claude/MEMORY.md",
    "./.cursor/memory",
    "./AGENTS.md",
    "./MEMORY.md",
    "~/.codex/memories",
    "~/.hindsight",
    "~/.basic-memory"
  ],
  "providers": [
    {
      "name": "Claude Code",
      "platform": "claude_code",
      "targets": [
        { "path": "~/.claude/CLAUDE.md", "description": "User-level instructions" },
        { "path": "~/.claude/memories", "description": "User memories directory", "isDir": true, "extensions": [".md", ".json", ".txt"] },
        { "path": "./CLAUDE.md", "description": "Project-level instructions" }
      ]
    },
    {
      "name": "Codex",
      "platform": "local_file",
      "targets": [
        { "path": "~/.codex/memories", "description": "Native memory directory", "isDir": true, "extensions": [".md", ".json", ".txt"] },
        { "path": "~/.codex/AGENTS.md", "description": "Global agent rules" }
      ]
    }
  ],
  "dashboard_port": 8808,
  "auto_snapshot_interval_minutes": 60,
  "trust_levels": {
    "user_explicit": 0.9,
    "conversation": 0.7,
    "document": 0.5,
    "email": 0.3,
    "web_page": 0.3,
    "tool_output": 0.5,
    "ai_derived": 0.4,
    "unknown": 0.1
  }
}

A providers entry has:

Each object in targets has:

Add your own vendor

Append an object to the providers array in ~/.m8m/config.json, then run m8m scan:

{
  "name": "My Agent",
  "platform": "local_file",
  "targets": [
    { "path": "~/.my-agent/memories", "description": "My agent's memory dir", "isDir": true, "extensions": [".md", ".json"] }
  ]
}

Or do it from the CLI without editing JSON:

m8m providers add "My Agent" "~/.my-agent/memories" --dir --ext .md,.json --desc "My agent's memory dir"
m8m providers                    # list what's configured
m8m providers rm "My Agent"      # remove it

Where the built-in defaults live: the out-of-the-box vendor list for m8m scan is src/core/providers.ts in this repo; the providers array in ~/.m8m/config.json replaces it, so you can trim or fully customize the list. The file watcher's built-in paths are DEFAULT_WATCH_PATHS + HOME_WATCH_PATHS in src/watcher/watcher.ts; the watch_paths array in the config adds to those.

Analysis

Every memory that enters the store is analyzed by a pure pattern matcher (no ML):

1. Instruction detection — content that reads as a directive to the AI
2. URL / email detection — escalated when paired with instructions
3. Credential detection — API keys, AWS keys, tokens, passwords
4. Contradiction detection — same entity, conflicting facts
5. Source unknown — missing provenance
6. Hidden character detection — zero-width / bidi-override / homoglyphs

Findings are attached as flags, mapped to security events, and surfaced in the CLI audit view and dashboard Security tab.

What it catches

Example findings from m8m audit:

Development

• npm run build — compile TypeScript + copy dashboard assets
• npm test — run the vitest suite
• npm run dev — tsx watch on the CLI (see scripts/dev.sh)

Documentation

• Architecture & technical decisions — why m8m is built the way it is.

Support

If m8m is useful to you, consider buying me a coffee:

☕ Support m8m on Buy Me a Coffee

License

MIT