apunkt/vestige
1
0
Fork 0
mirror of https://github.com/samvallad33/vestige.git synced 2026-07-14 22:52:11 +02:00
Code Issues Projects Releases Packages Wiki Activity
vestige/crates/vestige-mcp
History
Sam Valladares 0e5c71b4ca
fix(backend): resolve 10 bugs from the final full-codebase audit (#141) 
A second adversarial audit of shipped main (post the 29+3 earlier fixes) found
10 more real bugs in areas the first pass under-covered (FTS sanitizer,
protocol/HTTP, connectors, frontend). None regressions — all pre-existing, and
several are "twin sites" of a class fixed elsewhere but missed here.

Majors:
- FTS5: sanitize_fts5_terms leaked bare operators on doubled input ("foo AND AND
  AND"), aborting MATCH with a syntax error or silently flipping AND->OR. Now
  filters operator tokens (repetition-proof).
- Server crash (DoS): unbounded MCP `hours_back`/`hours_forward` panicked via
  Duration::minutes in CaptureWindow; unclamped `limit` in match_context
  panicked via negative Vec::with_capacity / limit*2 overflow. Both now
  bounded/checked.
- Connectors: the source idempotency key omitted source_project, so two repos
  (or two Redmine instances) with overlapping ids clobbered each other's memory.
  Key + unique index (migration V19) now include source_project.

Minors/nits:
- list_memories now honors node_type/tag on the search path (were dropped).
- HTTP Accept honors */* and type wildcards (was hard 406 for curl et al.).
- Bearer scheme matched case-insensitively (RFC 7235).
- Dream insight time-span no longer seeds from now/-365d sentinels (fabricated a
  TemporalTrend for old clusters).
- WebSocket disconnect() detaches onclose before close() so it can't resurrect
  the socket via scheduleReconnect.
- Redmine thread truncation keeps the NEWEST journals (was keeping oldest, so
  new activity never re-indexed).

Tests: FTS operator-leak regression added. Full workspace green (1559 tests,
clippy -D warnings clean); dashboard check + 937 tests green.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-02 16:05:40 -05:00
..
src fix(backend): resolve 10 bugs from the final full-codebase audit (#141) 2026-07-02 16:05:40 -05:00
Cargo.toml release: v2.2.1 — Windows embeddings fix + backfill safety + first-run guide (#105) 2026-07-02 12:02:42 -05:00
README.md Add ComposedGraph composition ledger 2026-06-18 16:00:29 -05:00

README.md

Vestige MCP Server

Local cognitive memory for MCP-compatible AI agents.

This crate provides the vestige-mcp stdio MCP server plus the vestige CLI. The cognitive engine lives in vestige-core; this crate owns protocol handling, tool dispatch, optional dashboard serving, backups, restore, update, and portable import/export commands.

Install

For normal users, prefer the release package:

npm install -g vestige-mcp-server

For local development:

cargo build --release -p vestige-mcp

Register With An MCP Client

Use the command vestige-mcp in any stdio MCP client:

{
  "mcpServers": {
    "vestige": {
      "command": "vestige-mcp"
    }
  }
}

Examples:

claude mcp add vestige vestige-mcp -s user
codex mcp add vestige -- vestige-mcp

Transports

  • Default: JSON-RPC 2.0 over stdio.
  • Optional: MCP-over-HTTP on /mcp, enabled only with --http, --http-port, or VESTIGE_HTTP_ENABLED=1.
  • Dashboard: vestige dashboard or VESTIGE_DASHBOARD_ENABLED=1.

HTTP and dashboard bearer tokens are generated locally; see docs/CONFIGURATION.md.

Current Tool Surface

The server exposes the current unified MCP tools from src/server.rs, including:

  • session_context
  • search, smart_ingest, memory, codebase, intention
  • deep_reference, cross_reference, contradictions
  • dream, explore_connections, predict
  • memory_health, memory_graph, composed_graph, system_status
  • importance_score, find_duplicates
  • consolidate, memory_timeline, memory_changelog
  • backup, export, restore, gc, suppress

See the root README.md and docs/AGENT-MEMORY-PROTOCOL.md for agent instructions.

License

AGPL-3.0-only