Repository navigation
MCP Servers
EGC ships two Model Context Protocol servers, both local stdio processes with no network exposure: egc-memory (persistent project memory, lessons, team sync, session bus) and egc-guardian (command, write and content validation, catalog routing). Together they expose 30 tools, listed below with the input schemas from the source (mcp/servers/egc-memory/src/index.ts and mcp/servers/egc-guardian/src/index.ts).
Both are registered automatically by the installers and by egc init in every supported tool's MCP config. You do not invoke them by hand: the AI calls them as part of the memory and safety protocol EGC injects into each tool's instruction file (cognitive protocol v6 since v1.1.22: the state store is owned by the memory server, encrypted and per branch, never read from disk, and the protocol says what to do when get_state is missing).
Storage engine: SQLite with WAL mode, write-lock arbitration via a message queue. Native sqlite3 is used when its prebuilt binary loads; otherwise the server opens the same file through the portable sql.js engine (EGC_SQLITE_ENGINE pins either). State files live at ~/.egc/state/<project-slug>/<branch>.md, encrypted at rest with AES-256-GCM.
| Tool | Required args | What it does |
|---|---|---|
get_project_state |
none | Returns server health metadata (storage engine, write arbitration mode). Use to verify the server is running before calling get_state or update_state. |
get_state |
project_path (optional, defaults to cwd) |
Returns the current project memory: decisions, preferences, things to avoid, next steps, followed by the deduplicated global memory. Scoped to the current git branch, falling back to the default branch then the legacy flat state file. Call at the start of every session. |
update_state |
project_path (recommended to pass explicitly) |
Updates project memory with context, decisions, avoid, preferences, next. Merges with existing state, does not erase it. scope: "global" writes the user-wide memory instead. Accepts force: true to recover from a state file that fails to decrypt: the corrupted file is renamed to a .corrupted-backup-<timestamp> sibling rather than deleted, and the call proceeds as a fresh write. |
store_decision |
context, decision
|
Persists a single decision to the SQLite store. Queryable via query_history and surfaced in get_state. |
query_history |
none (optional limit, offset) |
Paginated list of past decisions, newest metadata included. |
search_history |
query (optional limit, min_score) |
Keyword search over decision history with BM25 relevance ranking (SQLite FTS5). Returns a normalized score in [0, 1]. |
working_memory_set |
key, value (optional ttl_seconds, default 86400) |
Stores a transient key-value entry scoped to the project. Overwrites silently. Not for data that must survive a session restart. |
working_memory_get |
key |
Retrieves a transient entry. Returns null if missing or expired, does not throw. |
working_memory_list |
none | Lists all live transient entries for the project, expired ones excluded. |
lesson_save |
content, context
|
Persists a new lesson with an initial confidence score (default 0.7). Does not deduplicate; call lesson_recall first. |
lesson_recall |
query |
Searches active lessons by keyword. Only lessons at or above min_confidence (default 0.2) are returned; results ranked by confidence descending. |
lesson_reinforce |
id |
Increases a lesson's confidence by 0.15 (capped at 1.0) and unarchives it if it had decayed below threshold. |
detect_patterns |
none (optional window_days, min_occurrences) |
Analyzes captured hook events for recurring shell commands or error signatures using frequency analysis; suggests automation. |
compress_observations |
none (optional project_path, since, limit) |
Compresses raw hook observations into typed summaries (tool_failure, tool_success, file_edit, generic) to reduce token cost. Marks observations compressed rather than deleting them. |
team_init |
remote |
Initializes a git-backed sync backend for sharing memory across teammates; prints the team key other members join with. Currently git is the only supported backend. |
team_sync |
none | Pulls remote lessons and pushes local ones; only files sealed with the team key and an intact signature are merged. |
team_status |
none | Reports last sync time, uncommitted changes, conflict count, and configured remote. |
session_announce |
all optional: territory, session_id, project_path
|
Registers this session on the local session bus (presence + territory claim); doubles as a heartbeat. Sessions silent for 10 minutes are swept. |
session_peers |
none | Lists live sessions on the bus with their roles and territories, so parallel tabs can split work instead of colliding. |
claim_path |
path |
Takes a fail-fast cooperative lock on a file or directory before editing shared state. A refused claim means another live session holds it. |
release_path |
path |
Releases a cooperative path lock held by this session. |
session_send |
kind (required); optional payload, to_session
|
Publishes an event on the session bus, directed to one live session or broadcast to all. Payloads are size-capped and treated as untrusted data by receivers. |
session_events |
none (optional peek) |
Reads this session's pending bus events exactly once (cursor-based, compare-and-swap across overlapping readers); peek inspects without consuming. |
session_wait |
none (optional timeout_ms) |
Long-polls the session bus: returns immediately when events are already pending, otherwise parks until an event arrives or the timeout elapses (wake-on-write, on by default). With EGC_MESH_PUSH=0 it degrades to a single session_events read. |
Runs automatically on every tool call, before it executes.
| Tool | Required args | What it does |
|---|---|---|
validate_command |
command |
Validates shell command execution safety before it runs. |
validate_write |
filepath |
Validates that a file write path is safe (not a credential file or protected path). |
validate_content |
content |
Heuristically scans untrusted content (fetched web pages, third-party files, API responses, fork PR diffs) for prompt-injection patterns before it is trusted. Advisory only: returns [FLAGGED] or [CLEAN], never blocks; the caller decides how to treat flagged content. |
reduce_context |
filepaths (optional mode: FAST_RESPONSE or DEEP_COGNITION) |
Loads files and mutates payloads to save token budget (Adaptive Context Routing). |
orchestrate_task |
prompt (optional filepaths) |
Routes a prompt against the EGC catalog of skills, agents, and rules. Keyword scoring against the local catalog by default; semantic LLM routing only with EGC_LLM_ROUTING=1 plus a provider API key (ANTHROPIC_API_KEY, GEMINI_API_KEY, OPENAI_API_KEY, or OPENROUTER_API_KEY). Also returns context-reduction metrics for any file payloads. |
auto_learn |
project_path (optional target_file, limit) |
Mines recent tool failures from session history and writes actionable recommendations to every AI tool config file found in the project (CLAUDE.md, GEMINI.md, AGENTS.md, Cursor, Copilot, Devin Desktop, and others). Safe to call at any time; skips gracefully if no failures are found. |
The shell installers and egc init register both servers into the MCP config of every detected tool, using each tool's native mechanism: .mcp.json files, Claude Code's own claude mcp add -s user, Zed's context_servers key in settings.json, Codex MCP merging, and so on. --target installs skills and rules only; it never touches MCP registration. Run egc doctor to confirm both servers are built, registered, and reachable.
Build output for both servers goes to build/ inside mcp/servers/egc-guardian/ and mcp/servers/egc-memory/ respectively (the egc-memory and egc-guardian package bins point there), compiled from TypeScript via tsc.