Governed Artemis Memory MCP server

Memory MCP tool and ledger contracts, with current standalone startup restrictions and authenticated host integration requirements.

The Python artemis-memory-mcp package exposes four typed memory tools over the canonical PostgreSQL ledger. Its authorization boundary is MemoryAccessService, which combines verified authority with operation and namespace policy before accessing memory.

Standalone startup currently fails closed. The production authentication verifier and memory host-policy binding are unavailable in the inspected source. Database credentials, a bearer proof, or environment-declared capability strings cannot enable the missing bindings. HTTP and SSE transports are disabled.

This guide records the local working-tree source contract reviewed on October 3, 2026, including uncommitted changes. These observations can differ from a released revision. It describes the available adapter and required integration work; it is not a verified running deployment.

Choose the correct memory surface

Surface	Storage and integration
services/mcp/artemis-memory	Governed tools over the canonical PostgreSQL memory service.
Agentic Memory Layer	Separate Node REST shell for Obsidian-backed notes.
Agent Studio prototypes	Separate JSON-backed stores; no automatic shared-ledger integration is established.

Obsidian and vector projections are separate from the canonical ledger record. A shared name or a running MCP process does not establish that two services share a data store.

Current launch boundary

The console entry point belongs to services/mcp/artemis-memory/pyproject.toml, which requires Python 3.12 (>=3.12,<3.13). Satisfying this interpreter requirement does not provide the missing verifier or host binding. Its accepted transport is stdio:

cd services/mcp/artemis-memory
uv run artemis-memory-mcp --transport stdio

This shows entry-point syntax only. With dependencies resolved and the entry point reached, the current standalone path reports:

artemis-memory-mcp: authenticated host binding is unavailable

It returns exit code 2. Dependency or manifest errors can occur before that boundary; the October 3 local review found an invalid root Python manifest, so a successful installation was not verified.

The CLI does not accept the previously documented --http, --host, or --port arguments. Non-stdio wiring raises memory_non_stdio_transport_disabled.

Authentication and host policy

Programmatic integration requires a real authentication verifier and a host-bound MemoryAccessService. The service checks verified authority, the ATP envelope, namespace grants, host namespace policy, and parent ownership before constructing or accessing memory.

ARTEMIS_MCP_BEARER_TOKEN is transient authentication proof for the stdio startup path. It is not a static HTTP access configuration. ARTEMIS_MCP_PRINCIPAL_ID, ARTEMIS_MCP_CAPABILITIES, and HTTP subject/scope settings do not grant authority in the current runtime.

Transport identity, ATP structure validation, and permission to perform a specific memory operation are distinct checks. An mTLS handshake or a well-formed ATP message alone does not establish operation admission.

Startup authentication runs before the host service factory is invoked. The factory must supply a host-bound MemoryAccessService; missing or invalid host binding also fails startup. Storage connections and projection construction may be deferred separately; this does not defer every configuration error until the first tool call.

Tools

The adapter defines these tools for an authenticated, host-bound runtime:

Tool	Operation
write-memory	Append an immutable memory version for a namespace and key, then attempt requested projections.
read-memory	Read the current ledger version for a namespace and key.
search-memory	Perform bounded search within an authorized namespace.
get-memory-status	Inspect projection delivery for an immutable record version.

Inputs include an ATP envelope. Verified read/write authority and the namespace policy must satisfy the service’s checks. Environment scope strings do not replace those checks.

Ledger and schema preparation

The canonical memory service uses PostgreSQL. A Neon-hosted database is a possible PostgreSQL destination; provider selection does not complete runtime integration or migrate prototype stores.

The database schema is defined by the ordered migrations under db/migrations/:

1. 0001_memory_write_through.sql
2. 0002_memory_server_contract.sql

Review and validate migrations against an isolated database before applying them to an existing store. Preserve source records and ownership bindings during any separately planned migration. These memory-ledger migrations do not import all operational SQLite databases or Agent Studio JSON files.

ARTEMIS_MEMORY_DATABASE_URL is the ledger connection setting used by the storage layer. Supply a PostgreSQL connection string for the selected database. Configuring it does not provide the missing verifier or host-policy implementation.

Projection delivery

In the domain service, the ledger write precedes projection attempts. Projection failure does not remove the committed ledger record.

State	Meaning
pending	Delivery has not completed.
succeeded	Delivery was recorded as successful.
failed	Delivery or requested projection setup failed; inspect the failure before retrying.
skipped	The projection was not requested or delivery was superseded, as determined by the service.

The service contains retry logic for eligible projection states. The CLI does not launch a background retry worker. A persisted outbox entry records work; it does not prove a worker is running or that delivery will happen automatically.

Verify a host integration

Once the verifier and host binding are implemented, verify startup admission first. Then exercise an authorized tool call against the selected schema, check rejection of unauthorized operations and namespaces, and inspect the ledger record and projection status separately.

No successful live tool operation or production deployment is claimed by this review.

Source locations

• services/mcp/artemis-memory/src/artemis_memory_mcp/__main__.py
• services/mcp/artemis-memory/src/artemis_memory_mcp/wiring.py
• services/mcp/artemis-memory/src/artemis_memory_mcp/server.py
• src/auth/config.py
• src/memory/access.py
• src/memory/service.py