Documentation · Version contract

From config to record.

The public documentation targets ax0s-memory 0.5.0; the CLI parser, MCP stdio startup, and recall serialization paths are implemented and test-covered. A recorded product round trip is linked below.

CPU install path · Python 3.11+
pip install 'ax0s-memory[cpu]'

Documentation map

Choose the contract behind the question.

HTTP surface

Three mounted surfaces. One visible auth boundary.

The unified ASGI application mounts the REST facade at /api, streamable MCP over HTTP at /mcp, and the MCP server-sent-events transport at /sse. Core static documentation remains useful without starting the service.

/api

REST facade

JSON endpoints cover health, recall, remember, feedback, claims, sessions, tasks, record inspection, conflicts, timelines, maturity, and entity-fabric operations.

Auth: per-principal bearer token on non-health routes, followed by applicable slug and capability checks.

/mcp

Streamable MCP over HTTP

The MCP tool surface is mounted on the streamable-HTTP transport, with a keepalive response available at the same path.

Auth: bearer-gated in the current unified application.

/sse

MCP over server-sent events

The same application also mounts the SSE transport and its message path for clients that use that MCP transport.

Auth: bearer-gated in the current unified application.

Route groupWhat it exposesBoundary
GET /health
GET /api/health
Liveness and configured-surface discovery.Public. Stored slug names appear only for a resolvable bearer and are filtered to that principal’s grants.
GET /api/recall
/api/compose_context
/api/timeline
Current recall, bounded context, and explicit history-oriented reads.Bearer plus applicable slug-read grant.
POST /api/remember
/api/session/*
/api/feedback
Record writes, session lifecycle, and use feedback.Bearer plus applicable slug-write grant; input contracts fail visibly.
/mcp
/sse
MCP transports backed by the same application and principal context.Bearer-gated in the unified application; tool and slug checks still apply after authentication.
Current mode

Per-principal token.

Registry-issued bearer tokens resolve a principal and can carry expiry, revocation, slug grants, capability grants, and rate limits. A documented legacy bearer compatibility path remains under the conditions stated in Security.

Public exceptions

Health and discovery.

/health, /api/health, OAuth routes, and well-known discovery routes are public. Public health does not expose the stored slug list.

No-auth ChatGPT disclosure

Separate, read-only, operator-enabled mode.

The current unified app bearer-gates its MCP and bespoke ChatGPT routes. A separate no-auth connector or deployment mode exists only through operator configuration; when enabled, it exposes six read-only tools and no write or command-execution tool.

Authorization limit

Authentication is not record isolation.

Record-level authorization, hardened multi-tenant isolation, and externally validated identity controls are not established. Network exposure and transport security remain operator responsibilities.

Error contract, at a glance.

  • 400 invalid or missing required input with a structured body where documented.
  • 401 missing, invalid, expired, or revoked bearer.
  • 403 authenticated principal lacks the required grant or capability.
  • 404 unknown slug or record on routes that require one.
  • 409 conflicting active claim lease.
  • 422 request-shape validation error.

48 Evidence wording: 48 test functions are defined.

The ax0s-memory HTTP surface has 48 test functions defined in the current source snapshot.

This is a static definition count, not a current test run, passing-suite receipt, coverage result, security review, or runtime-health claim. Inspect the dated source-count artifact.

Static source counts

Definitions are breadth signals, not run receipts.