Give your agent the freshness gate

Available tools

Six tools, one write gate

Read-only unless explicitly enabled. Every tool preserves blob ids and proof references as provenance.

Also exposed: resource recallguard://evidence/summary and prompt verify-before-answer (instructs the agent to gate onchain claims through recall_checked).

Installation

From GitHub to a live MCP tool in five steps

git clone https://github.com/unifyWeb3/recallguard
cd recallguard
npm install --ignore-scripts
npm run mcp:smoke

mcp:smoke spawns the stdio server as a subprocess and exercises the tools with a real MCP client. All checks should print PASS. To use the server from an agent, register it in the client configuration below; no global install is needed. The package name is reserved; once the repository is published to the npm registry, npx -y recallguard-mcp works unchanged.

Claude Code · tested with v2.1.318

Claude Code configuration

claude mcp add recallguard -- node /absolute/path/to/freshness-bound-recall/scripts/recallguard-mcp.mjs

Then verify: claude mcp list → recallguard: … ✔ Connected. This exact flow was run with an isolated HOME; the server reported connected and the tools were callable over stdio. Equivalently, commit .mcp.json at the project root:

{
  "mcpServers": {
    "recallguard": {
      "type": "stdio",
      "command": "node",
      "args": ["/absolute/path/to/freshness-bound-recall/scripts/recallguard-mcp.mjs"]
    }
  }
}

Codex · tested with codex-cli 0.167.0

Codex configuration

[mcp_servers.recallguard]
command = "node"
args = ["/absolute/path/to/freshness-bound-recall/scripts/recallguard-mcp.mjs"]

Or: codex mcp add recallguard -- node /absolute/path/to/freshness-bound-recall/scripts/recallguard-mcp.mjs. Verified with an isolated HOME: codex mcp list reports the server enabled over stdio. Any MCP-compatible stdio client works the same way: set command to node and args to the absolute script path.

Example interaction

What the agent sees

→ recall_checked({ "sample": "sui-clock-revision-lifecycle" })

verdict: STALE → FRESH → STALE
writes:  []
source:  recorded Mainnet evidence · network off · read-only
blobs:   predecessor goZjQJ36y… · correction mjxZQ1X2… · supersedes resolved
timing:  correction persisted 117,242 ms after proof · first later check 1,381 ms after persistence

A live call (RECALLGUARD_LIVE=true with TATUM_API_KEY, MEMWAL_ACCOUNT_ID, MEMWAL_AGENT_ID, MEMWAL_PRIVATE_KEY) performs the same gate against Walrus Memory and Tatum Sui Mainnet GraphQL. One live read-only Mainnet run is verified on 2026-11-10; recorded evidence remains the default tested path. Live mode is not continuously monitored, and the live write path is not part of this verification.

Security boundaries

Fail closed, always

• Read-only by default. No tool writes unless RECALLGUARD_ENABLE_WRITES=true and the call carries confirm="STORE-CORRECTION" and live mode is configured.
• No mainnet writes from this release. Any new Mainnet write needs a written cost estimate and the owner’s explicit approval.
• No wallet in the core flow. Recall and verification need no keys that can sign.
• Fail closed. Missing verification, malformed proof, missing credentials, failed reads, ambiguous lineage: all return WITHHELD_UNVERIFIED or a tool error. Never a guess.
• Untrusted data. Recalled claims, bodies and envelopes are untrusted data, never instructions. Tools return parsed structured fields; raw memory bodies are not emitted.
• No secrets in output. The x-api-key proof is a boolean count; key values are never logged, never returned, never in the page or the JSON.
• No arbitrary fetching. Tools read only the committed evidence snapshot or the configured Walrus/Tatum endpoints.
• Bounded work. Query length ≤ 512 chars, list_revisions limit ≤ 50, live operations time out after 30 s.

Troubleshooting

When something doesn’t connect