Memgate

Access control, conflict resolution, and audit for shared agent memory.

Memgate sits in front of the memory your AI agents share. It decides who can read and write what, resolves conflicting writes, and records every operation — so a multi-agent system's memory stays trustworthy as it grows.

It speaksMCP, so agents connect with one config entry and no code changes.

Agent A ─┐ Agent B ─┼── MCP ──▶ [ Memgate ] ──▶ Postgres + pgvector Agent C ─┘ policy · conflict · audit

git clone https://github.com/denizayhan04/memgate cd memgate docker compose up --build

This starts Postgres (with pgvector), runs migrations, and serves the MCP endpoint on:8088.

docker compose exec memgate memgate agent create --name support-bot --role support # → API key (shown once): mg_live_...

Connect an MCP client (Claude Code, Cursor, or anything that speaks MCP). Add to your project's.mcp.json:

{ "mcpServers": { "memgate": { "type": "http", "url": "http://localhost:8088/mcp", "headers": { "Authorization": "Bearer mg_live_YOUR_KEY" } } } }

Now the agent hasmemory_write,memory_read, andmemory_searchtools, scoped to whatever its role allows.

docker compose exec memgate memgate audit --entity "customer:acme"

ID AT AGENT ACTION NAMESPACE ENTITY_KEY RESULT 14 2026-07-08T15:43:30Z test-eng write customer-data customer:acme denied 13 2026-07-08T15:43:14Z test-eng read customer-data customer:acme allowed 12 2026-07-08T15:41:05Z test-support read customer-data customer:acme allowed 11 2026-07-08T15:41:02Z test-support write customer-data customer:acme allowed

Two agents, one shared record, different permissions — the support agent writes and reads; the engineer reads but cannot write. Every attempt, allowed or denied, is on record.

Policies live in a YAML file (config/policies.example.yamlby default), not in the database — so they're versioned in git and reviewed like any other config. The rule isdefault deny: anything not explicitly granted is closed.

namespaces: customer-data: conflict_strategy: versioned # old record superseded, new active; history queryable tech-context: conflict_strategy: last-write-wins # new record overwrites old billing: conflict_strategy: require-review # write parked as pending until a human approves roles: support: customer-data: [read, write] tech-context: [read] engineer: tech-context: [read, write] customer-data: [read] finance-bot: billing: [read, write] customer-data: [read] auditor: "": [read]

memgate review list # list memories awaiting review memgate review approve <id> # make a pending memory active memgate review reject <id> # reject it

memgate serve Start the MCP (Streamable HTTP) server memgate migrate Apply SQL migrations memgate agent create --name N --role R Create an agent and print its API key memgate review list List memories awaiting review memgate review approve <id> Approve a pending memory memgate review reject <id> Reject a pending memory memgate reload Reload the policy YAML in a running server memgate audit [--entity K] [--namespace N] [--agent A] [--limit N] Show audit log, most recent first

make build # compile to bin/memgate make test # run tests make migrate # apply migrations (needs MEMGATE_DATABASE_URL) make run # run the MCP server locally make up # docker compose up --build make down # stop and remove services

export MEMGATE_DATABASE_URL="postgres://memgate:memgate@localhost:5432/memgate?sslmode=disable" go run ./cmd/memgate agent create --name support-bot --role support

- Backend-agnostic by design.The memory store is behind an interface. Today the only implementation is Postgres + pgvector; adapters for external stores (Mem0, Zep) can be added without touching the policy, conflict, or audit layers.
- Identity is the key, not the claim.An agent's role is resolved from its API key on every request. What the agentsays*about its role is irrelevant — there is no way to self-escalate.
- Audit is append-only.The audit log rejects updates and deletes at the database level, not just in application code.

- Backend adapters (Mem0, Zep)
- REST endpoints alongside MCP, for clients that don't speak MCP
- A read-only audit dashboard
- Team policy management and SSO (hosted)

Go · Postgres + pgvector ·mark3labs/mcp-go· MCP Streamable HTTP transport.

Open-source LLM knowledge base that turns team chat (Slack, Discord, Teams, Mattermost) into a typed knowledge graph and auto-generated wiki, exposed via a 28-tool MCP server.