Read-only scan of an Agent workspace: instructions, skills, memory, local RAG. Returns findings with evidence. No network, no writes.

Explain a finding's evidence, impact, suggestion, and confidence.

List authorized sources (project directory, selected folders, Obsidian vaults). Read-only.

Run a read-only scan and return snapshot + coverage ledger. Proves scan completeness (unaccounted_count must be 0).

Read the scoped neuron graph projection (read-only). Requires explicit agent_instance_id or share_group_id. Returns {empty: true, reason: 'not_built'|'missing_governance_scope'|...}.

Query scoped CodeGraph symbol metadata. Source bodies are never returned.

Find one bounded directed path between two scoped CodeGraph symbols.

Explain one scoped CodeGraph symbol with metadata-only source map and bounded edges.

Return bounded reverse-impact metadata for one scoped CodeGraph symbol.

Project a trusted MemoryGuard Graphify Core metadata export into scoped CodeGraph storage. Source bodies are rejected.

Report scoped CodeGraph counts and Graphify metadata-export capability without claiming production readiness.

Preview an offline import bundle (ChatGPT/Claude/Gemini/Generic). Read-only detection + inventory.

Read a single shared memory record by memory_id. Read-only.

Search shared memory records by query, kind, or status. Read-only.

Write a new memory record. Auto-organizes: classify, dedup, supersede, conflict, quarantine. Returns memory_id and auto_actions.

Update an existing memory record (body, kind, status). Records a DecisionEvent.

Soft-delete a memory record (status=deleted). Records a DecisionEvent.

Get shared memory group status: record counts, event counts, conflicts, quarantine. Read-only.

Read-only preflight for memoryguard_memory_merge_safe. Resolves one explicit canonical/duplicate atom pair in the trusted share group, returns current atom revisions, policies, priorities, and relation safety, and does not write transactions, decisions, undo, or idempotency records. There is no force or bypass.

Admin-only governed supersede of one active same-group duplicate memory atom into a stronger canonical atom. Reuses GovernanceV2.supersede. Requires confirmed=true. There is no force or bypass; owner update/delete stay unchanged.

Build one bounded, read-only long-term-memory context packet for a new task. Uses the trusted MCP identity/binding, includes active preferences plus task-relevant governed memories, omits sensitive/unsafe states, and never replaces or repeats the host's current conversation.

Record explicit evidence for a mandatory-rule bootstrap match. This closes the loop for follow/violate/not_applicable/corrected decisions. One feedback is bound to one receipt_id.

Create one mandatory rule from text. Automatic scope inference is fail-closed: only the trusted current agent or that agent plus the trusted project cwd are allowed. Broader scope requires explicit manual=true, an explicit scope object, and admin capability.

Read one explainable rule lifecycle decision by decision_id. Read-only.

Undo a V2 rule lifecycle mutation (including feedback/evidence compensation) using its persisted pre-rule undo_id. Requires the trusted actor or admin capability.

Read rule audience statistics and the automatic scope policy. Read-only.

Issue one opaque, single-use rule-merge capability for a candidate proposal. Requires the trusted admin AccessContext. The raw token is returned once to the caller; persistent storage keeps only its hash.

Approve one candidate rule-merge proposal with a server-issued single-use capability and trusted admin AccessContext.

Acknowledge first-merge risk with a server-issued single-use capability and trusted admin AccessContext.

Clear one rule-merge proposal cooldown with a server-issued single-use capability and trusted admin AccessContext.

Read-only preflight for memoryguard_rule_merge_safe. Resolves the requested canonical/duplicate source or definition ids in the trusted share group, returns current definition revisions and pair safety, and does not write transactions, decisions, undo, settlement, or idempotency records. There is no force or bypass; composer/pair safety still decides mergeability.

Admin-only source-aware fold of active same-group duplicate rules into one canonical definition. Reuses the V2 historical reconciliation transaction. Requires confirmed=true. There is no force or bypass; composer/pair safety still decides mergeability.

Bind an agent instance to a share_group. Creates an AgentBinding record (active). Read-only listing is via binding_list; unbind goes through CLI/GUI.

List existing AgentBinding records. Read-only.

List imported external MCP server descriptors and their resources. Descriptor-level only (no live MCP client discovery). Read-only.

Import a new external MCP descriptor (JSON). Classifies the server (L0-L4), persists it, and returns the detection result. Descriptor-level import only; does not call the live MCP server.

Extract memory segments from a source file under an authorized source root (read-only preview). Returns candidate list with kind, risk_level, and preview. Does NOT write to shared memory. Use memoryguard_accept_candidates to write accepted candidates.

Accept extracted memory candidates through GovernanceEngine and write them to shared memory. Records governed automatic writes plus a DecisionEvent (action=accept_extract). Requires extract_id from a prior extract_memories call and explicit candidate_ids list.

Check a new text against existing memories for semantic duplicates/conflicts (cross-lingual, paraphrase). Returns similar memories with similarity scores. Read-only.

Install/repair the provider's global MCP, redirect rules, and supported user-level lifecycle Hook (Claude/Codex/Cursor; TRAE reports MCP+rules fallback). Ensures the trusted Agent has a personal binding unless an explicit shared binding already exists. Requires admin capability; idempotent.

Resolve which share_group_id an agent should write to, based on its AgentBinding. Read-only. Agents should call this before memory_write to know their group.

List pending memory enrichment tasks. Skill path: after build_and_enrich returns host_action_required, YOU (host agent) must classify+translate each task and call apply_enrichments — do not ask the user to pick a CLI.

Apply host-agent enrichment results to the V2 memory plane. Each result: task_id, kind, title, body, confidence. After YOU enrich pending tasks, call this then memoryguard_build_and_enrich again to refresh the graph.

Check enrichment queue status: pending/applied counts. Primary enrich happens inside build_projection; use this to see residuals.

Build memory projection. Default enrich_mode=host: YOU are the LLM. If pending_tasks / host_action_required, immediately classify+translate, call apply_enrichments, then call this again. Multi-agent GUI may pass enrich_mode=cli with a chosen Agent CLI. Do not require a separate AI-整理 button.

Read-only canonical reconciliation status for a share_group_id: canonical_ready, failures, checks, read_path. Always allowed, even when governance is degraded.

Read-only governance diagnostics snapshot JSON: reconciliation jobs by status, canonical activation, projection, source links, bindings. Snapshot uses sqlite3.Connection.backup(); never copies DB/WAL files and accepts no arbitrary SQL or file paths. Always allowed, even when governance is degraded.

Read-only projection status (projection_lag / projection_error / scopes) for a group. Always allowed, even when governance is degraded.

Read-only runtime process facts: current pid, memoryguard_version, code_fingerprint, control_workspace, database_paths, runtime lease status. Always allowed, even when governance is degraded.

V2-native read surface.

V2-native read surface.

V2-native read surface.

V2-native read surface.

List the trusted Agent's local conversation-history sessions. Read-only; raw text is not returned.

Export explicitly selected sessions owned by the trusted Agent. This is raw-history evidence, not long-term memory.

Permanently delete explicitly selected raw-history sessions for the trusted Agent. Requires confirmed=true; never deletes long-term memories.

V2-native knowledge surface.

V2-native knowledge surface.

V2-native knowledge surface.

V2-native knowledge surface.

V2-native knowledge surface.