ShawnDemos
Open sourceAI engineering

Knowledge Base Server (Memstalker)

A shared memory server that lets Claude, Codex and Gemini read and write the same knowledge base.

Source on GitHub

What it is

An MCP and REST server that captures, classifies, promotes, synthesizes and retrieves notes for AI agents, backed by SQLite FTS5 with an Obsidian vault as the human-facing source of truth. One knowledge base serves several agents through the same tools. Open source under MIT.

What it does

  • 16 MCP tools (search, hybrid semantic search, context briefings, read, write, ingest, classify, promote, synthesize, capture).
  • kb_context returns summaries only; README claims 90%+ token savings versus reading full documents.
  • Three-tier hot/warm/cold retrieval so recent project context ranks above raw captures.
  • Ingests Obsidian notes, YouTube transcripts, web clippings, terminal session captures and bug-fix captures.

The problem

AI agents forget everything between sessions, and several agents cannot share what one of them learned. Copying context by hand is slow and loses fixes. This server keeps one searchable memory that Claude, Codex, Gemini and ChatGPT read from and write to.

Design decisions

  • Obsidian is the source of truth for people, and the server is the retrieval layer for agents. The tradeoff is that the two must be kept in sync.
  • Retrieval returns summaries first (kb_context) and loads full text only when asked. This saves tokens and context space, but an agent must make a second call for details.
  • Use SQLite with full-text search plus local embeddings, instead of a hosted vector database. It is simple to self-host, but it is a single-machine design.
  • Record mistakes in an append-only ledger and teach only patterns that a person has approved. The tradeoff is human review work, in return for fewer repeated mistakes.

How it works

  1. Access layerMCP over stdio or HTTP and a REST API let agents connect, and every HTTP tool needs an API key or an OAuth token.
  2. ToolsSearch, read, context, write, capture, classify and safety-check tools run on the stored documents.
  3. StoreSQLite with full-text search holds documents, and local embeddings add semantic search.
  4. Vault syncA bidirectional sync keeps the Obsidian vault and the database in step.
  5. Capture and classifyYouTube, web, bookmarks, terminal sessions and bug fixes come in, and a classifier tags and summarizes them.
  6. Promotion and mistake ledgerPromotion and synthesis refine notes, and the ledger drafts patterns from repeated mistakes for approval.

Security: enforced, simulated and known gaps

  • Enforced in code: API keys compared by value with a constant-time check, OAuth 2.1 for MCP clients with public sign-up disabled, and path-escape checks on file access. Secrets are redacted before a mistake is stored.
  • Local-only tools such as the message bus and the mistake ledger are not exposed over HTTP.

What broke and how it was fixed

What broke
The API-key check looked the key up in a plain JavaScript object, so any inherited name such as constructor, toString or __proto__ passed as a valid key.
How it was found
The automated commit security review flagged it while the mistake ledger was being built. It was confirmed with a unit probe and a boot of master on a spare port.
The fix
A function now compares the given key with each configured key by value using a constant-time comparison, and both the middleware and the Brain API gate use it.
What guards it now
tests/auth-bypass.test.js, seen failing on constructor before the fix.
Reference
84663d6

Where it runs

Runs as an Express server managed by systemd, with a web dashboard. The README also documents a hosted option and an OAuth connection for ChatGPT.

Who did what

The owner conceived the product, architecture, specs and acceptance tests and directed the work. Coding agents (Claude, Codex, Gemini) did much of the implementation and review, including the security review that found the bug above.

Limits and honest status

  • Used daily by one operator; treat it as a single-operator system, not a multi-user product.
  • README roadmap still lists multi-user roles, watch mode and a plugin system as unchecked.
  • Agent integrations depend on the respective agent tools being installed; hosted version is a separate product.

Connected to

Daniel (Agent Orchestrator)Agent SwarmCareOpsSoftware Factory

Next: Daniel (Agent Orchestrator) — A terminal orchestrator that fails over between Claude, Codex and Gemini so work continues when one runs out.