The Chamber server lets you query your local notes corpus with sourced, citation-checked answers, detect source drift, and inspect the index via three MCP tools:
chamber_ask — Ask a natural-language question against indexed notes. Each claim is marked ALLOWED (citations verified) or UNSUPPORTED (no verified source), with file/passage references. Options include exact, semantic, and strict. Writes: verified claims become beliefs/pins, unsourced claims create citation debt, and activity goes through the commit gate.
chamber_verify — Re-check every stored belief's pinned sources against the current corpus. Reports drift as not_found or hash_mismatch; optional since date filter. Read-only.
chamber_corpus — Inspect what is actually indexed: passage/file counts, citable source kinds, top folders, and unusually large files. Useful for diagnosing empty results. Read-only.
Ask questions about your own notes. Get answers that cite their sources — and a daily check that tells you when a source has changed underneath a conclusion you already trusted.
Zero runtime dependencies. Everything is node:sqlite and files on your disk.
No account, no cloud call unless you point it at one.
Requires Node 23.6+ — Chamber runs TypeScript directly, with no build step.
git clone <this repo> chamber && cd chamber
npm ci && node --experimental-strip-types src/cli.ts tryNo config, no database, no model, no network. It builds a throwaway workspace,
runs the real code paths against it, and deletes it (--keep to look around).
That recording is scripted from assets/demo.tape rather
than hand-captured, so it is regenerated when the output changes instead of
quietly showing a version of Chamber that no longer exists. Everything below is
the same command's actual output, trimmed:
$ chamber believe belief "Customers may return any purchase within 30 days of delivery."
committed blf_ddcf4f3c9b2e81b8
an unsourced assertion is not refused — it mints citation debt.
$ chamber debts
dbt_18bd1c1171cdbfcb [pending]
$ chamber pay-debt
proposed 2 source(s), 2 pinned; best=0.694
$ chamber verify
blf_ddcf4f3c9b2e81b8 2/2 pins verifiedThat is the ordinary state: a belief standing on evidence that still holds. Then
someone edits the note it was built on — 30 days becomes 14 days:
$ chamber ingest ./notes
ingested 2 file(s) as 4 passage(s)
$ chamber verify
blf_ddcf4f3c9b2e81b8 1/2 pins verified
hash_mismatch: refunds.md#p0Nobody asked it to re-examine that belief. The conclusion did not change; the ground under it did, and the exit code is non-zero, so a scheduled job can act on it. That is the whole product.
Four more scenarios — a rolled-back ledger caught by an outside anchor, a
sandbox that refuses rather than degrade, a hostile tool catalogue rejected —
are in demos/, and run in CI so they cannot drift from the code.
Related MCP server: brainMD
Everything Chamber does is rows in one SQLite file. Each term in the transcripts names a table or a hash:
Word | What it actually is |
passage | one chunk of one markdown file. |
belief | a row in |
pin | a sha-256 of a cited passage's stored title, body and ref, taken at the moment of citation and kept in |
verify | re-read every pinned passage, recompute the hash, compare. Any mismatch exits non-zero. No model involved. |
citation debt | a row in |
pay-debt | retrieval proposes passages for the indebted claim; accepting them pins them. |
APORIA | the verdict when no retrieved passage supports an answer. The reply is "I don't know", recorded as that. |
gate | a check and a write inside one SQLite transaction — both commit or neither does. |
audit log | append-only |
anchor | the log's root hash stored outside the database, so truncating the log is detectable rather than silent. |
the scheduler | a launchd/systemd job running |
None of it is hidden machinery: sqlite3 ~/.local/share/chamber/chamber.sqlite '.tables' shows the whole thing.
With a model configured, chamber ask judges every sentence on its own
citations. Against the same two sample notes, on a local 30B:
$ chamber ask "summarise our refund policy"
Customers may return any purchase within 30 days of delivery [2]. Refunds
are issued to the original payment method, usually within five working days
of the returned item arriving at the warehouse [2]. However, perishable goods
and personalised items cannot be returned once dispatched [1].
[ALLOWED] Customers may return any purchase within 30 days of delivery [2]. Refu
sources: refunds.md#p0 — refunds › Refund policy, refunds.md#p1 — refunds › Refund policy › ExceptionsThe model is shown [1]…[k] and never a document id or a hash, so it cannot
fabricate a citation even in principle — the numbers are resolved back to files
after the answer is written. A sentence that cites nothing is marked
UNSUPPORTED: recorded, but not treated as load-bearing.
Asking something the corpus cannot answer is the more important case:
$ chamber ask "what should a customer do if they want to return a perishable
item after the office has closed?"
I don't know
[APORIA] I don't knowBoth notes are in the index and both are relevant. Neither answers the question, so nothing is composed from the pieces.
npm link # puts `chamber` on your PATH
chamber init # writes ~/.config/chamber/config.jsonThen edit that config to add a notes folder and a model:
{
"database": "~/.local/share/chamber/chamber.sqlite",
"model": { "base": "http://127.0.0.1:8087/v1", "name": "your-model", "mode": "openai" },
"ingest": [{ "root": "~/Notes", "exclude": ["transcripts", "attachments"] }]
}model.base may name any OpenAI-compatible endpoint. A loopback address needs
no API key; anything else reads CHAMBER_API_KEY from the environment, never
from the file.
chamber ingest # index every configured root
chamber ask "..." # ask, with citations
chamber verify # re-check stored pins against the corpus
chamber corpus # what is actually in the indexSet your excludes before the first ingest. There is no default exclude list.
Pointed at a folder of exported chat logs, Chamber will happily index all of
them and answer from them — see chamber corpus and
docs/KNOWN_LIMITATIONS.md entry 11.
The same verify loop works on a repo: claims in docs pinned to passages of
code or policy, chamber verify --json failing the build when the ground
moves. One line in a workflow — this repo ships the action:
- uses: abm9111/chamber@v0.1.5docs/CI_DRIFT_GATE.md is the one-page recipe;
demos/06_ci_drift_gate.ts is the runnable
transcript.
deploy/launchd/com.chamber.verify.plist (macOS) and deploy/systemd/
(Linux) run ingest and verify on a schedule, and raise a notification only when
something drifted. A check that correctly reports nothing on most days is a
check you stop reading, so it stays quiet until it isn't.
The companion plugin Chamber Drift
renders verify --json's report as a vault sidebar panel and a per-note
banner — nothing more. It never verifies and never writes; Chamber does both,
on its own schedule, outside Obsidian. Setup, including the report-writing
one-liner and the Obsidian Sync caveat: docs/OBSIDIAN.md.
src/mcp_server.ts exposes three tools over MCP — chamber_ask,
chamber_verify, chamber_corpus — so a host like Claude Code can query your
corpus and see the per-claim citation verdicts rather than just the prose.
From the npm package, the server is one subcommand:
claude mcp add -s user chamber \
-e CHAMBER_PYTHON=/path/to/python-with-onnxruntime \
-- npx -y @bu7umaid/chamber mcpThat form works when the host's spawn environment can resolve a Node 23.6+
npx. When it cannot — and MCP hosts often spawn with a minimal PATH — name
the interpreters absolutely:
claude mcp add -s user chamber \
-e CHAMBER_PYTHON=/path/to/python-with-onnxruntime \
-- /absolute/path/to/node --experimental-strip-types /path/to/chamber/src/mcp_server.tsBoth absolute paths are deliberate. A spawned MCP server does not inherit your
interactive shell's PATH: node may resolve to a version below the 23.6
floor, and python3 to one without onnxruntime — which makes the embedder
fall back to non-semantic hash vectors and every question answer "nothing in
the corpus matches." Naming the interpreters is the only reliable fix. See
docs/KNOWN_LIMITATIONS.md entry 15.
The server resolves config once, on its first tool call, and pins it for the
life of the process — so reconnect the server after editing config. Editing
model.base while a host held the process open produced ECONNREFUSED against
the old address while the CLI answered fine from the same file, which reads
as a broken config rather than a stale daemon. The resolved database, mode and
base are printed to stderr on first use so the host's MCP log can settle it.
Nothing on that surface can activate a skill, approve a pending write, or ingest — the gates exist so a human passes through them, and handing a model the approval side would invert them rather than weaken them.
chamber_ask is not read-only, and the write is not just bookkeeping: every
claim goes through the commit gate, so a claim with verified citations is
recorded as a belief with its pins — which is exactly what chamber verify
later re-checks for drift. Unsourced assertions mint citation debt; spend is
recorded. This is the same behaviour as chamber ask on the command line. The
guarantee is that the gate is not bypassed, not that nothing is written.
Chamber proves a cited passage is the passage it claims to be — unmodified, still present, still saying what the citation says it says.
It cannot tell you the claim follows from the passage. A model can cite a real source and misread it, and every layer here will pass it. That is a stated non-goal, it has been observed happening, and it is not solved.
Read docs/KNOWN_LIMITATIONS.md before trusting
any output. Eighteen limitations are documented there, including the two least
flattering. The sandbox confines only where bubblewrap works — Linux with
unprivileged user namespaces — and refuses to run anything anywhere else, which
is safe but is not the same as working. And citation debt blocks a verbatim
repeat reliably, while the paraphrase leg over it is a heuristic: calibration
found no cosine threshold that separates a restatement from a contradiction. A
numeric and negation check now removes the worst of that — an operator
correcting an indebted claim is no longer refused for restating it — but two of
five true paraphrases still slip through, and a contradiction that is neither
numeric nor negated still reads as a repeat.
No assertion may become executable, citable, or load-bearing except through a gate whose check and write commit in one transaction — anything else may decay, park, or be defeated, but it may never silently pass.
Gate | Blocks when |
| assertion with open blocking citation debt; missing or unverifiable pins; a defeater used as a source; a belief-typed commit on the fast path |
| open holds; load-bearing stale beliefs; content ≠ last critic-cleared hash; capability manifest over-ask |
Both gates write into a hash-chained audit log — entry_hash = sha256(prev_hash || canonical JSON) with an incremental Merkle tree — so altering a past
decision breaks every hash after it. Retraction types (defeater, unknown)
commit freely and never mint blocking debt.
Defaults are refusals: memory and skill writes require approval, learned skills land in quarantine rather than applying silently, and a pending write that expires is not an approved one.
npm test # 308 tests
npm run typecheck
npm run probes # adversarial probes; each one asserts a defect is absentnpm run probes passes today, and that statement is dated the moment it is
written — run it rather than trust it. Two of these probes (sandbox_escape,
debt_paraphrase) spent weeks red against real, open defects before their
fixes landed, and they are wired in as gates precisely because they can go red
again. A gate that cannot fail reports safety it never checked.
src/ask.ts retrieval → prompt → per-claim citation gate
src/mcp_server.ts the read side over MCP: ask, verify, corpus
src/commit_belief.ts the belief gate; check and write in one transaction
src/pins.ts content pins and drift verification
src/audit.ts hash-chained log + incremental Merkle
src/config.ts settings: flag → env → config file → default
src/db.ts opens the database, loads every schema
probes/ adversarial probes, run by npm run probes
demos/ the four scenarios above, run in CI so they cannot rot
docs/KNOWN_LIMITATIONS.md what does not work, and what it costsMIT.
Ask a question of the local Chamber corpus and get an answer whose every claim is judged against its own citations. Each claim comes back ALLOWED (its cited passages verified against their stored hashes) or UNSUPPORTED (no verified source — recorded, not load-bearing). Cited sources are returned as file#passage references you can open. Answers only from the indexed corpus; says so when nothing matches. NOTE: this WRITES, exactly as chamber ask does — each claim goes through the commit gate, so a claim with verified citations is recorded as a belief with its pins (which is what chamber_verify later checks for drift), an unsourced assertion mints citation debt, and spend is recorded. It cannot bypass that gate, activate a skill, or approve a pending write.
| Name | Required | Description | Default |
|---|---|---|---|
| exact | No | Retrieve only passages containing the question as a literal phrase. Narrowing; use for identifiers and codenames. | |
| strict | No | Refuse assertions that have no verified source instead of minting citation debt for them. Default false. | |
| question | Yes | The question to ask. | |
| semantic | No | Vector-only retrieval, switching off the lexical leg that runs alongside it by default. Contradicts `exact`. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Despite annotations indicating no read-only guarantee (readOnlyHint: false), the description goes beyond by explicitly warning 'this WRITES' and detailing the commit-gate effects: claims with verified citations are recorded as beliefs with pins, unsourced assertions mint citation debt, and spend is recorded. It also explains what it cannot do (bypass gate, activate skill, approve pending write). This is rich behavioral disclosure beyond the annotation flags.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but each sentence contributes unique information: purpose, citation judging, reference format, corpus-only scope, and the write behavior. It is front-loaded with the main action. The note about 'exactly as `chamber ask` does' is slightly redundant but clarifies equivalence. Overall, it is well-structured for the complexity, though a bit verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description fully explains the return format (ALLOWED/UNSUPPORTED claims with file#passage references) and the side-effects of the write. It covers the tool's scope (corpus-only), its limitations (cannot bypass gate, etc.), and its relationship to verification. This is complete for a complex write tool with several behavioral nuances.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides 100% coverage for all four parameters with clear descriptions. The tool description adds no additional parameter-specific semantics beyond the schema, except indirectly noting the commit gate implications for the strict parameter (not explicitly). With high schema coverage, the baseline of 3 is appropriate; the description does not need to compensate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb+resource: 'Ask a question of the local Chamber corpus and get an answer...' This clearly differentiates the tool from siblings by focusing on question-answering with citation-based claims. It also states the output format (ALLOWED/UNSUPPORTED claims with file#passage references), making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes its usage context clear: it is the tool to ask questions of the indexed corpus and receive cited answers. It also hints at the relationship with chamber_verify by noting that verified claims are 'what chamber_verify later checks for drift,' implicitly distinguishing answer generation from verification. However, it does not explicitly say 'use this when you want to ask a question' or provide direct when-not-to-use guidance for siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Report what is actually in the index: passage and file counts, source kinds and which of them are citable, the top contributing folders, and any file far above the median passage count (the signature of an export rather than a note). Use this before trusting a 'nothing matches' answer. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds behavioral detail beyond the readOnlyHint and idempotentHint annotations by specifying that the tool identifies files 'far above the median passage count' and interprets them as 'the signature of an export rather than a note.' It also explicitly states 'Read-only,' reinforcing the annotation without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences: the first enumerates the tool's report contents, the second gives usage guidance and a safety note. Every clause adds value with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having no parameters or output schema, the description thoroughly sets expectations: it lists the report contents, explains the outlier heuristic, and tells the agent when to invoke the tool. The 'Read-only' statement also confirms safety, making this a self-contained description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, and the input schema already reflects this with an empty properties object. The description doesn't need to explain parameter usage, so the baseline of 4 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Report what is actually in the index'—a specific verb and resource—and then enumerates the exact report contents (counts, source kinds, top folders, outliers). This clearly differentiates it from the sibling tools chamber_ask and chamber_verify, which are about querying rather than inspecting the corpus.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides an explicit trigger for use: 'Use this before trusting a "nothing matches" answer.' This is a clear context. However, it doesn't mention when not to use it or reference alternatives by name, so it's one step below full guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Re-check every stored belief's pinned sources against the corpus as it stands now, and report the ones whose evidence moved: a source that no longer exists (not_found) or whose text changed under the pin (hash_mismatch). This is drift detection — the conclusion did not change, the ground under it did. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| since | No | Only check beliefs committed at or after this date (any format Date can parse, e.g. 2026-07-01). Omit to check all. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds behavioral detail beyond the annotations by explaining that the tool reports sources that no longer exist or whose text changed, and that it does not change conclusions. It explicitly states 'Read-only' matching annotations and clarifies the meaning of results, providing useful context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences, with the main action front-loaded. The second sentence adds conceptual context without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This tool has a simple optional param, no output schema, and annotations cover read-only/idempotent. The description explains what the tool reports and the meaning of results, making it complete for an agent to understand when and how to invoke it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema fully describes the only parameter 'since' with its purpose and default behavior. The description adds no additional parameter information, but since schema coverage is 100%, the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool re-checks stored beliefs' pinned sources against the current corpus and reports those whose evidence moved, specifying outcome types (not_found, hash_mismatch). It identifies this as drift detection, which distinctively separates it from sibling tools like chamber_ask and chamber_corpus.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains that the tool is for drift detection, providing clear context for when it should be used. However, it does not explicitly state when not to use it or mention alternatives, so it lacks explicit exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v0.1.2chamber_askchamber_corpuschamber_verifyEach tool has a clearly distinct purpose: ask queries and records answers, verify checks for drift in stored beliefs, and corpus inspects the index. There is no overlap in their functionality.
All tools follow a consistent pattern of 'chamber_' followed by a single lowercase word (ask, verify, corpus). Though one is a noun, the convention is uniform and predictable.
Three tools is within the ideal range and each serves a necessary, non-redundant role for the server's purpose of querying and maintaining a citation-verified corpus.
The set covers the full workflow: query with verification (ask), maintain confidence (verify), and understand the index (corpus). No obvious missing operations for the stated domain.
Self-hostable shared brain for you and your AI agents — docs, flows, meetings, decisions, rationale
Portable AI memory shared across models and harnesses - plain markdown you own.
AI research library. Save, organise and reuse notes and webpages as clean markdown context.
Personal wiki and memory layer for AI assistants. Persistent, structured memory across sessions.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/abm9111/chamber'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
