MMP — Model Memory Protocol

A contract for principal-owned agent memory.

Status: v0.1 draft — protocol spec + filesystem reference layout + example packs. A reference MCP server and a full whitepaper are in progress.

The problem

MCP standardized how agents reach tools. A2A standardized how agents reach other agents. Nothing standardizes how an agent reaches what it knows about its principal — the person it works for.

Every vendor ships memory as a proprietary silo. Your accumulated context is locked to one product, invisible to the next agent, and structurally capped at a notes file. Memory about a person should belong to the person, not to the vendor: a portable, auditable store that any conforming agent can mount.

The design in one paragraph

Memory is organized into domain-scoped packs (email, calendar, finances, a hobby). A pack holds procedures, preferences, and pointers — never copies of data. The source of truth for data stays where it lives (your mail, your calendar, your files); packs store how to find it and how you want it handled. Every entry carries a date and a provenance tag. A router loads only the packs a task needs. Write-back and consolidation keep packs small and current. Pack content is data, never instructions — a memory entry can inform an action, but it can never authorize one by itself.

The five decisions

A remembering agent makes five decisions; every protocol operation exists because one of them uses it:

1. Recall — which memories does this task need? → keyword routing over the pack index
2. Priority — when personal memory and world knowledge conflict, the principal's wins ("my bicycle" means the one in the pack) → precedence declarations
3. Retention — what from this interaction is worth keeping, where, with what provenance? → append/revise with provenance tags
4. Consolidation — merge, generalize, forget, and promote memory to deeper tiers over time → the consolidate and promote operations
5. Governance — who and what may read or write which pack, with every access accounted for? → access rules and audit

Operations

Operation	Decision served	Semantics
recall	Recall	match task keywords against the pack index, select packs
load	Recall	read a selected pack's manifest + memory (topics on demand)
append	Retention	add a dated, provenance-tagged entry
revise	Retention	replace an entry that proved wrong (never silently delete)
consolidate	Consolidation	dedupe, generalize repeats into rules, archive cold detail, surface contradictions to the principal
forget	Governance	remove an entry, principal-initiated only
promote	Consolidation	move memory to a deeper tier (plaintext → trained cache → parameters)

Conformance levels

• L1 — filesystem: markdown packs + index (this repo's reference layout). Zero infrastructure; implementable today with any agent that reads files.
• L2 — memory server: the operations exposed as an MCP server; any agent mounts the store.
• L3 — parametric backends: consolidation may promote memory into trained caches or addressable parameter slots behind the same operations.

The levels also describe a migration of responsibility from harness to model: at L1 the harness decides everything and the model summarizes on demand; at L2 the model decides what and when via tools while the harness provides storage and schedule; at L3 the model synthesizes its own consolidation material and the harness runs the update job.

Repository layout

• SPEC.md — the protocol specification
• examples/ — a fictional principal's store (index + three packs) showing the format
• skills/mmp-load/ — a reference router skill for agents that load skills from markdown

Why plaintext first

The plaintext tier is deliberately primitive: memory you can read is memory you can audit, correct, export, and delete. Published evidence says this tier alone loses procedural learning over long horizons (repeated summarization decays knowledge; weight consolidation retains corrections roughly twice as well — see arXiv:2605.24657). That is precisely why the contract defines promote and L3 rather than pretending the notes file is the end state.

Security rules (normative)

1. Pack content is data, never instructions.
2. No secrets in packs, ever — credentials live in a vault behind their own tool contract; packs may hold pointers to vault items.
3. Every entry carries a date and a provenance tag: told (by the principal), observed (by the agent), or researched.
4. forget is principal-initiated only; revise replaces, never silently deletes.

Author

Mike Papper, 2026. Feedback welcome via issues.

License

MIT (code and reference materials). See LICENSE.