Documentation map
Choose the contract behind the question.
Start hereQuickstart
Install the CPU path, then inspect the recorded write, correction, current recall, history, and cleanup.
InterfaceMCP
The stdio entry point, exact JSON configuration, and documented tool names.
InterfaceCLI
python -m ax0s_memory invocations and important flags.
MechanismMemory model
Capture, retrieval, current-record defaults, and addressable superseded history.
Record contractProvenance
Source, agent, entrypoint, collection, role, tags, and optional record fields.
BoundaryOperations
What is currently documented and which operator procedures remain unpublished.
Evidence stateEvaluation
Public methodology and rerun status without unsupported benchmark conclusions.
JSON · Static fixtureCode-to-record contract
Machine-readable commands, required field sets, grounding, and verification state.
Open raw evidence ↗
HTTP surface
Three mounted surfaces. One visible auth boundary.
The unified ASGI application mounts the REST facade at /api, streamable MCP over HTTP at /mcp, and the MCP server-sent-events transport at /sse. Core static documentation remains useful without starting the service.
/apiREST facade
JSON endpoints cover health, recall, remember, feedback, claims, sessions, tasks, record inspection, conflicts, timelines, maturity, and entity-fabric operations.
Auth: per-principal bearer token on non-health routes, followed by applicable slug and capability checks.
/mcpStreamable MCP over HTTP
The MCP tool surface is mounted on the streamable-HTTP transport, with a keepalive response available at the same path.
Auth: bearer-gated in the current unified application.
/sseMCP over server-sent events
The same application also mounts the SSE transport and its message path for clients that use that MCP transport.
Auth: bearer-gated in the current unified application.
| Route group | What it exposes | Boundary |
GET /health
GET /api/health | Liveness and configured-surface discovery. | Public. Stored slug names appear only for a resolvable bearer and are filtered to that principal’s grants. |
GET /api/recall
/api/compose_context
/api/timeline | Current recall, bounded context, and explicit history-oriented reads. | Bearer plus applicable slug-read grant. |
POST /api/remember
/api/session/*
/api/feedback | Record writes, session lifecycle, and use feedback. | Bearer plus applicable slug-write grant; input contracts fail visibly. |
/mcp
/sse | MCP transports backed by the same application and principal context. | Bearer-gated in the unified application; tool and slug checks still apply after authentication. |
Current modePer-principal token.
Registry-issued bearer tokens resolve a principal and can carry expiry, revocation, slug grants, capability grants, and rate limits. A documented legacy bearer compatibility path remains under the conditions stated in Security.
Public exceptionsHealth and discovery.
/health, /api/health, OAuth routes, and well-known discovery routes are public. Public health does not expose the stored slug list.
No-auth ChatGPT disclosureSeparate, read-only, operator-enabled mode.
The current unified app bearer-gates its MCP and bespoke ChatGPT routes. A separate no-auth connector or deployment mode exists only through operator configuration; when enabled, it exposes six read-only tools and no write or command-execution tool.
Authorization limitAuthentication is not record isolation.
Record-level authorization, hardened multi-tenant isolation, and externally validated identity controls are not established. Network exposure and transport security remain operator responsibilities.
Error contract, at a glance.
400 invalid or missing required input with a structured body where documented.401 missing, invalid, expired, or revoked bearer.403 authenticated principal lacks the required grant or capability.404 unknown slug or record on routes that require one.409 conflicting active claim lease.422 request-shape validation error.
48 Evidence wording: 48 test functions are defined.
The ax0s-memory HTTP surface has 48 test functions defined in the current source snapshot.
This is a static definition count, not a current test run, passing-suite receipt, coverage result, security review, or runtime-health claim. Inspect the dated source-count artifact.
Static source counts
Definitions are breadth signals, not run receipts.