LoCoMo-200 retrieval snapshot

This is the same public-safe comparison surfaced on the website: a local LoCoMo-derived 200-question retrieval-only harness. It measures whether the needed context appears in the top 5 retrieved items and how fast the local API responds. It is not generated-answer accuracy, and it is not a universal benchmark-win claim against Mem0, Zep, Letta, or Memobase.

Read the full methodology and caveats in docs/launch/memory-benchmark-report-2026-04-29.md or the public page at lorecontext.com/benchmark.

What is Lore Context

Lore Context is an open-core control plane for AI-agent memory: it composes context across memory, search, and tool traces; evaluates retrieval quality on your own datasets; routes governance review for sensitive content; and exports memory as a portable interchange format you can move between backends.

It does not try to be another memory database. The unique value is what sits on top of memory:

• Context Query — single endpoint composes memory + web + repo + tool traces, returns a graded context block with provenance.
• Memory Eval — runs Recall@K, Precision@K, MRR, stale-hit-rate, p95 latency on datasets you own; persists runs and diffs them for regression detection.
• Governance Review — six-state lifecycle (candidate / active / flagged / redacted / superseded / deleted), risk-tag scanning, poisoning heuristics, immutable audit log.
• MIF-like Portability — JSON + Markdown export/import preserving provenance / validity / confidence / source_refs / supersedes / contradicts. Works as a migration format between memory backends.
• Multi-Agent Adapter — first-class agentmemory integration with version probe + degraded-mode fallback; clean adapter contract for additional runtimes.

When to use it

Quick Start

# 1. Clone + install
git clone https://github.com/Lore-Context/lore-context.git
cd lore-context && pnpm install

# 2. Run the quickstart helper and inspect the activation report
pnpm quickstart -- --dry-run --activation-report

# 3. Generate a real API key (do not use placeholders in any environment beyond local-only dev)
export LORE_API_KEY=$(openssl rand -hex 32)

# 4. Start the API (file-backed, no Postgres required)
pnpm build && PORT=3000 LORE_STORE_PATH=./data/lore-store.json pnpm start:api

# 5. Write a memory
curl -H "Authorization: Bearer $LORE_API_KEY" -H "Content-Type: application/json" \
  -X POST http://127.0.0.1:3000/v1/memory/write \
  -d '{"content":"Use Postgres pgvector for Lore Context production storage.","memory_type":"project_rule","project_id":"demo"}'

# 6. Query context, then inspect the returned traceId in the Evidence Ledger
curl -H "Authorization: Bearer $LORE_API_KEY" -H "Content-Type: application/json" \
  -X POST http://127.0.0.1:3000/v1/context/query \
  -d '{"query":"production storage","project_id":"demo","token_budget":1200}'

For the public website quickstart, see lorecontext.com/quickstart. For full setup (Postgres, Docker Compose, Dashboard, MCP integration), see docs/getting-started.md.

The canonical alpha quickstart is git clone + pnpm quickstart. Lore does not currently publish or claim a public @lore-context/quickstart npm package. The MCP stdio server is published separately as @lore-context/server for registry and client distribution.

For AI-readable discovery, the website publishes /llms.txt and /llms-full.txt from public documentation only. The Official MCP Registry entry is published, and additional distribution drafts live under docs/distribution. Launch drafts live under docs/launch, and design partner intake under docs/design-partners. The public benchmark page is a public-safe LoCoMo-200 retrieval-only lab report with explicit caveats, not a competitive benchmark-win claim.

Architecture

                       ┌─────────────────────────────────────────────┐
   MCP clients ──────► │ apps/api  (REST + auth + rate limit + logs) │
   (Claude Code,       │   ├── context router (memory/web/repo/tool) │
    Cursor, Qwen,      │   ├── context composer                      │
    Dify, Hermes...)   │   ├── governance + audit                    │
                       │   ├── eval runner                           │
                       │   └── MIF import/export                     │
                       └────────┬────────────────────────────────────┘
                                │
                  ┌─────────────┼──────────────────────────┐
                  ▼             ▼                          ▼
           Postgres+pgvector   agentmemory adapter     packages/search
           (incremental        (version-probed,        (BM25 / hybrid
            persistence)        degraded-mode safe)     pluggable)
                                                                 ▲
                       ┌─────────────────────────────┐           │
                       │ apps/dashboard  (Next.js)   │ ──────────┘
                       │   protected by Basic Auth   │
                       │   memory · traces · eval    │
                       │   governance review queue   │
                       └─────────────────────────────┘

For detail, see docs/architecture.md.

What's in v0.6.0-alpha

See CHANGELOG.md for the full v0.6.0-alpha release notes.

Current release status

v0.6.0-alpha is published as a public alpha pre-release. The release tag points to 4f0eadf369e99e364bd06b7d3228b84a9f7501b9; public main includes the release-closure, integration-validation, and distribution commits with passing CI. The production website, AI-readable docs, public API health endpoint, GHCR MCP image, npm MCP server package, and Official MCP Registry listing are live.

See docs/release-status.md for the current public-safe status snapshot.

Release focus

The v0.6 release is the Distribution and Trust Sprint. The goal is not more memory storage features; it is making the v0.5 substrate easier to discover, install, verify, and share without leaking local secrets or private data.

Shipped v0.6 work:

• AI-readable website docs at /llms.txt and /llms-full.txt;
• canonical, Open Graph, Twitter, and static header metadata for public docs;
• pnpm quickstart -- --activation-report with redacted dry-run and real first-value proof;
• stricter activation proof that fails instead of skipping when the target port is occupied;
• public-safe eval reporting and smoke coverage for eval export plus MIF JSON export;
• @lore-context/server@0.6.0-alpha.1 npm publication, Official MCP Registry publication, plus distribution metadata drafts for marketplace listings and agent plugins;
• launch content drafts and design partner intake/scorecard workflow;
• HN-ready website surfaces for quickstart, v0.6 changelog narrative, and benchmark methodology.

It deliberately does not claim public SaaS, billing, managed sync, remote MCP HTTP, or benchmark wins.

See docs/project-plan.md, docs/roadmap.md, and docs/release-governance.md.

Integrations

Lore Context speaks MCP and REST and integrates with most agent IDEs and chat frontends:

Deployment

All deployment paths require explicit secrets: POSTGRES_PASSWORD, LORE_API_KEYS, DASHBOARD_BASIC_AUTH_USER/PASS. The scripts/check-env.mjs script refuses production startup if any value matches a placeholder pattern.

Security

v0.6.0-alpha keeps the v0.5 adoption baseline and adds distribution-facing AI-readable docs, activation evidence, public-safe reports, and launch materials. The security posture remains appropriate for local and private alpha deployments:

• Authentication: API-key bearer tokens with role separation (reader/writer/admin) and per-project scoping. Empty-keys mode fails closed in production.
• Rate limiting: per-IP + per-key dual bucket with auth-failure backoff (429 after 5 fails in 60s, 30s lockout).
• Dashboard: HTTP Basic Auth middleware. Refuses to start in production without DASHBOARD_BASIC_AUTH_USER/PASS.
• Containers: all Dockerfiles run as non-root node user; HEALTHCHECK on api + dashboard.
• Secrets: zero hardcoded credentials; all defaults are required-or-fail variables. scripts/check-env.mjs rejects placeholder values in production.
• Governance: PII / API key / JWT / private-key regex scanning on writes; risk-tagged content auto-routed to review queue; immutable audit log on every state transition.
• Memory poisoning: heuristic detection on consensus + imperative-verb patterns.
• MCP: zod schema validation on every tool input; mutating tools require reason (≥8 chars) and surface destructiveHint: true; upstream errors sanitized before client return.
• Logging: structured JSON with auto-redaction of content, query, memory, value, password, secret, token, key fields.

Vulnerability disclosures: SECURITY.md.

Project structure

apps/
  api/                # REST API + Postgres + governance + eval (TypeScript)
  dashboard/          # Next.js 16 dashboard with Basic Auth middleware
  mcp-server/         # MCP stdio server (legacy + official SDK transports)
  web/                # Server-side HTML renderer (no-JS fallback UI)
  website/            # Marketing site (handled separately)
packages/
  shared/             # Shared types, errors, ID/token utilities
  agentmemory-adapter # Bridge to upstream agentmemory + version probe
  search/             # Pluggable search providers (BM25 / hybrid)
  mif/                # Memory Interchange Format (v0.2)
  eval/               # EvalRunner + metric primitives
  governance/         # State machine + risk scan + poisoning + audit
docs/
  i18n/<lang>/        # Localized README in 17 languages
  integrations/       # 11 agent-IDE integration guides
  deployment/         # Local + Postgres + Docker Compose
  legal/              # Privacy / Terms / Cookies (Singapore law)
scripts/
  check-env.mjs       # Production-mode env validation
  smoke-*.mjs         # End-to-end smoke tests
  apply-postgres-schema.mjs

Requirements

• Node.js >=22
• pnpm 10.30.1
• (Optional) Postgres 16 with pgvector for semantic-search-grade memory

Contributing

Contributions are welcome. Please read CONTRIBUTING.md for the development workflow, commit message protocol, and review expectations.

For documentation translations, see the i18n contributor guide.

Operated by

Lore Context is operated by REDLAND PTE. LTD. (Singapore, UEN 202304648K). Company profile, legal terms, and data handling are documented under docs/legal/.

License

The Lore Context repository is licensed under Apache License 2.0. Individual packages under packages/* declare MIT to enable downstream consumption. See NOTICE for upstream attribution.

Acknowledgments

Lore Context builds on top of agentmemory as a local memory runtime. Upstream contract details and version-compatibility policy are documented in UPSTREAM.md.