One persistent, local memory shared by every AI coding agent — Antigravity, Cursor, Claude, OpenCode, Codex, Windsurf — through MCP. Decisions, conventions, bugfixes and session handoffs, always one recall away.
No account. No server. No network. Steal it, fork it, audit it.
The problem
Your agent re-derives the same architecture decisions, re-fixes the same class of bug, and re-litigates the same conventions — every single session.
Paste an error log with an API key into an agent and it lands in plain-text memory stores forever — unless it's redacted before it's written.
Copilot knows what Cursor doesn't. Your memory should outlive any single client — switching agents shouldn't mean starting from zero.
What you get
SQLite's built-in full-text search ranks memories by relevance — architecture decisions, bugfixes, conventions — in microseconds, fully offline.
ZERO DEPENDENCIESEnd a session in Antigravity, resume in Cursor. Structured session summaries, next steps and active files travel with the repo's memory.
log_session_summaryStored decisions, conventions and bugfixes compile into the rules file every major agent reads natively. Atomic writes, timestamped .bak backups, hand-written files never overwritten without force: true.
OpenAI, GitHub, AWS, Slack, Google keys, JWTs and PEM blocks are masked with [REDACTED:kind] before anything touches disk. Tools report how many were caught.
Mitigations for CVE-2026-111497: stdio-only transport, runtime version enforcement, and a Brotli decompression hard-lock installed before any other module loads.
CVE-2026-111497Decisions evolve — memory does too. Update records without losing their ID or timestamp, export portable JSON snapshots, keep FTS5 in sync automatically.
update_memory · export_memory_snapshotArchitecture
Every tool call flows through the same pipe. No hidden network, no implicit writes, no silent overwrites.
security/bootstrap.tsFirst import evaluates the CVE-2026-111497 hard-lock (node:zlib Brotli APIs replaced with throwing stubs) and checks your Node/Bun version against the patched releases.
index.ts10 tools, 2 resources, 1 prompt. Pure stdio transport; tool failures return isError: true, never a protocol crash.
validation.tsTypes, ranges, positive IDs and hard size limits on every argument. The MCP SDK doesn't enforce schemas — so this does, always.
security/secretRedactor.tsPattern-based masking (OpenAI / GitHub / AWS / Slack / Google / JWT / PEM) on every write path — memories, handoffs, preferences.
db/memoryStore.tsEmbedded SQLite (WAL) + FTS5 BM25 at ~/.mindgate/mindgate.db — owner-only permissions (chmod 600, dir 700). Triggers keep the index in sync.
rulesSync.tsCompiles memory into AGENTS.md-class files: atomic temp+rename, .bak-<timestamp> backups, sentinel marker guards your hand-written files.
⚠️ Honest limits: memories are data, not instructions · redaction is best-effort pattern matching · the Brotli lock is defense-in-depth — a patched runtime is the definitive fix. Full threat model in SECURITY.md.
MCP Tools
Install
# requires Node 22.23.4+ / 24.22.1+ / 26.12.1+ npm install -g mindgate-mcp # or zero-install npx -y mindgate-mcp init # prints ready-to-paste MCP config
# Windows / macOS / Linux git clone https://github.com/aaserag1/mindgate-mcp.git cd mindgate-mcp npm install npm test # 29 tests — real SQLite + FTS5 npm run build npm run init-config
{
"mcpServers": {
"mindgate": {
"command": "node",
"args": ["/absolute/path/to/mindgate-mcp/dist/index.js"],
"env": { "MINDGATE_DB_PATH": "/home/you/.mindgate/mindgate.db" }
}
}
}
FAQ
No. MindGate has no network code at all — it speaks stdio JSON-RPC to your agent and SQLite to your disk. The only way data leaves is if you paste it into an agent that sends it to a model API, same as always.
Known token shapes (OpenAI, GitHub, AWS, Slack, Google, JWT, PEM) are replaced with [REDACTED:kind] before anything is written, and the tool response tells you how many were caught. It's a strong safety net, not a guarantee — keep secrets out of prompts entirely.
Never silently. MindGate-generated files carry an HTML sentinel marker; hand-written files are refused unless you explicitly pass force: true — and a timestamped .bak backup is always created first. Writes are atomic (temp file + rename).
Anything that speaks MCP over stdio with tool support: Antigravity, Cursor, Claude Desktop, OpenCode, Codex CLI, Windsurf, Cline. If it launches an MCP server, MindGate plugs in.
Remove the MCP server entry from your client config, then delete ~/.mindgate/. That's it — one directory, one config block. No daemon, no registry, no residue.
Free, open-source, MIT licensed. Audit every line — that's the point of local.
Star on GitHub →