Agenten stärken
Installation vom Herausgeber. Kein PlugMCP-Endpunkt.
Host a copy with our keys and logs.
Noch kein paketiertes Release in der Registry. Folgen Sie der README des Repositorys.
Remote-URL oder ein Befehl auf Ihrem Rechner? Worin sich die beiden Installationen unterscheiden
Auf PlugMCP ausführen
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
StartenVom Herausgeber
Point an AI at anything: code, research, writing, your own notes, a whole fleet of agents. You run into the same two problems every time. It is , and it will cheerfully do something catastrophic if a prompt injection asks it nicely.
An AI organism - the human-AI interface layer. A safety reflex that refuses known lethal actions even when the model is fooled, and a memory that only keeps what actually worked. For code, research, writing, or a fleet of agents. 100% local.
SentAInce is the layer in between. It gives your AI an immune system that physically refuses known lethal actions, even when the model itself has been fooled. It gives it a memory that only remembers what actually worked. And it gives you a page you can look at to watch both of them doing their job.
Everything runs on your own machine. It installs in a few minutes, stays out of your way, and uninstalls with one command. Safety is never for sale.
Coding agents were the first place we could build this and prove it, and they are still where most of it runs. They are not the boundary. Who this is for says plainly what each kind of user gets today, and what they don't.
A SyncQutrit Research Group product (syncqutrit.com) · part of the FreqOS software portfolio (freqos.com).
The body has two halves, and they reach different distances. The reflex installs into your AI tool's own hook for running commands, so it only exists where that hook exists. The memory speaks a common standard (MCP), so almost anything can read it. Find yourself in this table. The third column is what you actually get today:
Two things to know before you install, not after.
docs/LANDSCAPE.md.Watch the safety reflex refuse a lethal command that a prompt injection talked the model into:
This is a labeled demonstration, so don't take the picture's word for it. Run it yourself from a fresh clone:
python -m pip install -e ".[dev]"
python experiments/exp1_autoimmune.py # a compromised model proposes a lethal action; the gate refuses
python -m pytest -q tests # the full 99-test evidence lock, deterministic
The hard reflex above is the somatic gate, and it refuses known lethal commands outright. Running alongside it is a softer epistemic gate, which watches for actions that are perfectly legitimate but still a big deal, and stops to ask you first. Here it is firing in real use, when the maintainer's own agent went to push a release to the public repo:
Hook PreToolUse:Bash requires confirmation for this command:
exocortex epistemic VERIFY: grounded but high-stake ((1 − 0.60)·8 > 2.0)
Do you want to proceed?
❯ 1. Yes
2. No
That arithmetic is the organism showing its reasoning. The command looked plausible (a grounding of
0.60 means a real action, but not yet a habitual one) and high-stakes (8). So the expected cost of
being wrong, (1 − 0.60)·8 = 3.2, cleared the "just ask" threshold of 2.0. It did not refuse, because a
push is not lethal. It paused and put a human in the loop. A command it recognizes as lethal never
reaches this prompt at all, because the somatic reflex has already refused it.
The kernel is untouched. 99 frozen tests, the C1–C7 lock, no API change, and the pinned hook is byte-identical. This release is about what the agent is told about its own memory. Full detail in the changelog.
[notes:N] now counts notes, and only notes. The count of verified notes per task class was
matching any id containing .md, which also caught shell steps that merely named a Markdown file (5 of
349 such ids in a census of the maintainer's stores). It now accepts only note ids as the digest mints them, and the regression tests fail on
the old rule.declarative.inventory_notice: gap and one extra hook line. Whether it
changes agent behaviour is not yet measured.The kernel is untouched. 99 frozen tests, the C1–C7 lock, no API change. Every behavior change below is either opt-in or can only withhold memory, never grant it. This release is built on a red-team pass over the memory itself. Full detail in the changelog.
exocortex/tests/redteam/ drives the real hook through eight attack families: prompt injection, forged
stores, misleading tool output, stale state, conflict, revocation, cross-project transfer and route
keying.
cd repo && pytest was filed as
bash:cd.
results/verb_keying_v1/).colony.verb_keying: working. The default is unchanged.exit status, pytest
summaries, npm ERR!, make: ***, line-start error:, Permission denied and bare exception lines.
Replayed over recorded traffic first, 0.52% and 0.32% of past successes would now read as failures,
and every inspectable one was a real failure (results/outcome_signatures_v1/). A command that also
silences its output is still open.The kernel is untouched. 99 frozen tests, the C1–C7 lock, no API change. The note-reading organ still ships switched off. Two measurements drove this release; full detail in the changelog.
results/circadian_wake_v1/.git
spawned by the MCP server inherited the server's stdin — the JSON-RPC pipe — and Windows' git
startup probe parked in the kernel behind its standing read, freezing the whole server on one
call. Every MCP-reachable spawn now gets stdin=DEVNULL, verified by an A/B control (hang → 0.02 s)
and pinned so a new call site can't reintroduce the class.agent_id/agent_type,
chain-safe, with the era readable from the row alone. Instrumentation only — nothing consumes it
yet, and that is recorded as such.The kernel is untouched. 99 frozen tests, the C1–C7 lock, no API change. The note-reading organ still ships switched off. This release is shaped by an exchange: the governance RFC drew its first external falsification, and checking it against our own ledger found — and fixed — a real over-claim. Full detail in the changelog.
release/tag_drift_sweep.py) now
runs before releases.ingest: "tracked" fails open to all by
contract if git can't resolve inside the hook process. That flip used to be silent; it is now stamped
in the audit (WikiIngestFailOpen, with what was requested, what resolved, and why) on the live path
only — measuring a repo never writes to it. declarative.exclude is documented as the seatbelt that
bounds what a fall-open can digest.results/declarative_tail_v1/). The fuel exists. The bridge stays dormant for the one honest reason
left — whether a proposed shortcut is valid is only decidable by the body — and the gauge for
exactly that question now exists (bridge_validity_gauge). It flips on evidence, not enthusiasm.The kernel is untouched. 99 frozen tests, the C1–C7 lock, no API change. This release came out of a measurement pass over the note-reading organ, which ships switched off, so a default install sees no change in behaviour beyond a read-path fix and tidier ingestion. Full detail in the changelog.
results/proposer_diversity_v1/. This measures what gets
offered, not what actually succeeds. The efficacy question is still open, and recorded as open.declarative.exclude lets you tell the organ what not to read. You give it folder patterns, and
it skips them while walking the directory rather than reading them and throwing them away. Build
directories are now always skipped. One of them, .pytest_cache/README.md, had quietly been digesting
as memory. It ships empty, so nothing changes unless you set it.The kernel is untouched. 99 frozen tests, the C1–C7 lock, no API change. The one change in behaviour is a gate that refuses more, never less. Full detail in the changelog.
-EncodedCommand payloads unwrapped before matching. Coverage of commands that change
something went 46% → 57%. That is a coverage number, not a claim that harm was prevented. Tricks
like splatting, & $cmd, and Invoke-Expression over a string built at runtime stay invisible to any
fixed vocabulary. We would rather say that plainly than round up.sentaince status --full tells you whether it's actually doing anything. A refusal fires about
once in a thousand tool calls, so a working install and a dead one look identical from the outside.
This prints two numbers: how often memory had an earned answer for you, and how much of your
command traffic the safety floor actually saw. It is read-only, it reads your own local log, and it
sends no telemetry of any kind. It reports dose, never effect. The effect question is the A/B
below, still unproven.No code changed. That one was documentation. Full detail in the changelog.
Two new abilities and the body page's first proper screenshots. No change to the immune kernel or the hooks.
sentaince why asks the organism to show its work. For a habit it has recently learned, it prints
the route behind it, which past successes still back it, and re-checks its tamper-proof record in front
of you. There's a "why?" link on the body page too.The face release. Nothing changed in the immune kernel or the hooks. The organism simply became something you can look at. Full detail in the changelog.
sentaince body opens the dashboard above. Each project is drawn as a human
silhouette, with organs colored by live readings and the exact rule printed beside every color. Green
means a stated rule met a stated number, never a guess. Dormant organs are gray on purpose, and organs
with no data yet are drawn as outlines. Nothing ever fakes green. No Docker needed.sentaince status. The vitals line as a real command, so it works even where the message at the
start of a session doesn't show up.sentaince why. Ask the organism to show its work. For its most recently earned habits it
prints the route it reconstructed, which past successes still back it, and re-checks the tamper-proof
record. A plain-language audit trail, read-only.~/.exocortex/repos.json) names every project you
watch. Projects without it installed show up asleep, with a deploy command you can copy and paste.sentaince <subcommand>s through the
sentaince.commands entry-points group. They load only when called, so a broken plugin can never break
your vitals.The honesty release. If you tried SentAInce before and it seemed to do nothing, that was a bug, and it was ours. Full detail in the changelog.
pip users. Installing it turned on a check against a list of files
that aren't in the package, so every session start failed, silently, and memory never woke up. Now
fixed and confirmed in a clean install. If you bounced off this project earlier, this is why.pip install sentaince[embed].python -m exocortex.orient --estate grades every project on live
evidence: its git history, its tests, when files really changed, and the gap between what a project
claims about itself and what the disk actually shows.This is the full body, reflex included. It works with Claude Code and Cursor. No account, no telemetry, nothing leaves your machine. (Using a chat app instead? Skip to reading your memory from anywhere.)
pip install sentaince
sentaince-deploy install /path/to/your/project # or: python -m exocortex.deploy install ...
sentaince body /path/to/your/project # opens the body page in your browser
That last command is the payoff. Your browser opens on the silhouette above, and you can watch each organ light up as your AI works. It needs no Docker, and nothing leaves your machine. From here on, your sessions run through the organism:
python -m exocortex.deploy uninstall /path/to/your/project removes it and
nothing else. Your accrued memory is kept unless you add --purge. Deleting one config file puts
everything back to sleep.On a fresh install the body page looks like this. Every organ is an outline, because nothing is earned yet and nothing pretends to be:
The full walkthrough is in docs/QUICKSTART.md: what you'll see in the first
session, how the memory starts building, and the live dashboard. The operator's runbook is
docs/DEPLOY_TO_A_PROJECT.md.
Memory is earned per project and never crosses between them. What does travel is orientation: what a project is, and how current its own claims are. Point it at the folder your projects live in:
python -m exocortex.orient --estate --projects-root /path/to/your/projects
You get every project side by side with a credibility grade of High, Medium, Low or Unknown. The grade is worked out when you read it, from live checks of the git history, the tests, when files really changed, and the gap between what a project says about itself and what the disk shows. A project's own summary never carries a grade of its own, because a project cannot vouch for itself. That is the whole point. Below High, the rule is to look again before you act on it.
It is file-based, read-only, and uses nothing but the standard library. No database, no background
process, nothing to run. See docs/ORIENTATION_DISCIPLINE.md.
This is the estate-aware stage: many bodies, one view, and memory that stays strictly inside each project. Where it goes from here, to bodies that get better because the others are working, is the flock, labeled as the bet it currently is.
Nothing in the one law is about code. It is about consequence, and research, writing, analysis and note-keeping all generate consequence too. Three parts of the organism already point that way:
📖 Your own notes, as the notebook organ. Point it at any folder of Markdown: a research vault, a lab notebook, a personal wiki. It reads what's there, offers the notes it thinks bear on what you're doing, and keeps its trust only in the ones the work actually used. One file, one setting:
// exocortex_config.json in your project
{ "declarative": { "mode": "live", "vault_path": "~/notes", "explore_budget": 5 } }
Honest status, because this is the newest organ. It ships off, and we have not measured whether it helps. What 0.1.10 measured is what the organ offers, on a replay of 344 prompts from this repo's own history: distinct documents proposed 51 → 104 of 105, with recall of genuinely-earned documents 73% → 97% (banked here, and these are snapshot figures against a living collection, not constants). It did not measure whether offering better notes causes more work to succeed. That question is open, and recorded as open. Turn this on as an experiment, not as a solved thing.
🧭 A governor for the things you started and dropped. Research dies in the gap between "I opened this"
and "I never closed it." resurrection_candidates reads your notes for things you actually wrote down,
like checkboxes and ledger entries, that were opened, went quiet for a long stretch, and never closed. It
ranks them by how long they have been silent and calls out whole clusters that have gone dormant. It is
read-only: it surfaces them, and you decide whether to resume or close. It can only see what you wrote
down, so treat it as a floor under your own record-keeping rather than a mind-reader.
📚 Orientation over any folder. The estate grader above doesn't require code either. It reports on whatever a folder claims about itself versus what the disk shows, which is as useful for a stack of half-finished manuscripts as for repositories.
Two limits worth stating plainly. The muscle memory, which learns the routes you take through a task, only builds up where real commands succeed. A pure writing vault will leave that organ quiet. And a large collection of notes takes anywhere from seconds to a few minutes to read through the first time. The memory server does that once, in the background, so no request ever hangs on it, but your first answer may come back saying "warming."
The memory server speaks plain MCP, and it is read-only by design. Looking something up never creates a memory, which is exactly what stops popularity from passing itself off as usefulness. So Claude Desktop, ChatGPT, Cline, or any MCP client can ask what your projects have already learned:
pip install "sentaince[mcp]"
sentaince-mcp # Claude Desktop, Cline, any local MCP client
sentaince-chatgpt-mcp --transport sse --port 8000 # adds ChatGPT's search/fetch convention
Wiring for each app is in docs/MCP_SERVER.md, and the ChatGPT specifics are in
docs/CHATGPT_APP.md. Put the remote version behind a trusted tunnel before you
connect it, and remember what this half is. It lets a chat app read memory. It does not give that app a
safety veto, and it never lets it earn memory of its own.
Most "AI memory" rewards whatever gets looked up often, treating popularity as a stand-in for usefulness. That is exactly why a knowledge base bolted onto an AI rots: it will confidently quote a stale note because the note was read a lot, not because it ever helped. SentAInce obeys one law instead:
A memory is earned when an action actually succeeds (a verified
exit 0). Never by being read, and never by being repeated.
Everything else follows from that. The 💪 muscle memory, which learns the routes you take through the work you actually do, forms only when that work verifiably succeeds. The 📖 notebook holds notes that earn their trust the same way. 😴 Sleep prunes whatever went unused. And the 🛡️ immune system rests on the shape of an action rather than on the model's opinion of it. A model that has been talked into something can propose anything it likes. The known lethal actions still will not run.
→ The whole organism in everyday language, with honest numbers: docs/STORY.md.
The biology does real work here, it isn't decoration. But you shouldn't need a biology degree to find the part you came for:
Full mapping (metaphor → CS reality → code → status): docs/GLOSSARY.md.
Already using another guardrail? Good. Most of them sit at a different layer than we do, and we are
built to run alongside them rather than instead of them. docs/LANDSCAPE.md draws
the shelf honestly: where each layer catches things, what we claim, and the one number we have that isn't
flattering.
Want the live dashboard? The quickest view needs no Docker at all. sentaince body opens the body
page (the silhouette at the top of this page) straight in your browser:
sentaince body /path/to/your/project # → http://localhost:9109/ · no Docker, nothing leaves your machine
For the full history, with trends over time, the Grafana story board and the audit log, bring up the local monitoring containers:
cd exocortex/testbed/compose && docker compose up -d --build # then open http://localhost:3000
Today the organism guards and remembers one body at a time. It is already estate-aware, in that one file names every project it watches and the dashboard reports across all of them. But memory is earned inside a single project and never crosses between them. That boundary is deliberate, and it is also the frontier.
The direction is flock intelligence: many bodies, each still in charge of its own memory, that get better because the others are working. Not a central brain handing down orders. No shared weights, no cloud, no coordinator. Something older and stranger than that, closer to what ants and termites do, where coordination appears because each individual leaves traces in a shared environment that change what the next one does.
We did not invent that idea, and we won't pretend otherwise. It is called stigmergy, it has a literature going back decades, and the pheromone colony already in this repo is a direct application of it. Our one departure is the law at the top of this page. Our traces are laid down only by work that verifiably succeeded, where classical stigmergy lays them down for activity of any kind. That difference is the whole bet. It is what should stop a flock from stampeding down a popular but wrong path.
Status: a bet, and we'll call it one. No flock behavior ships today. The one controlled experiment we have that bears on the idea is trending, and misses the gate we set for it in advance (+15pp, p = 0.0781 vs p ≤ 0.05, written up honestly in LANDSCAPE.md). Memory has to earn its keep in one body before wiring many together is worth anything, and we would rather show you the arc with the gate openly unmet than a demo with hidden wires.
The rest of the arc:
Everything above is labeled in the docs with its real status: SHIPPED, DORMANT, or PROPOSED. We would rather show you the vision with honest gates than a demo with hidden wires.
CONTRIBUTING.md.Every claim in this repo is bounded by docs/CLAIMS.md — the binding ledger nothing
may exceed. The core safety claims rest on a falsifiable arc, scoped to a deterministic symbolic
harness: every claim is broken by its load-bearing null or it is vacuous, and two of the seven
verdicts are intended −1s (boundaries the arc was run to produce), not failed wins.
(Claim boundary, stated plainly: the deterministic evidence lock proves the refusal logic under mock
executors — it records intent, not syscalls. Real-body protection is the layered container posture
described in docs/SECURITY.md.)
python experiments/exp1_autoimmune.py # any experiment runs standalone (+ --json)
python -m pytest -q tests # the deterministic suite
The suite is 99 tests: the 69-test C1–C7 evidence lock + 30 domain-crucible /
adapter tests. Pure-Python, deterministic (same seed → byte-identical ledger), numpy + pytest only —
no Docker, no real syscalls in the lock; the only "execution" is MockExecutor, which records intent.
Determinism is deliberate: a real, non-deterministic LLM would break the reproducible −1/+1, so the
locked claims use a scripted proposer. See docs/CLAIM_BOUNDARY.md for the
binding ledger of what each experiment does and does not claim.
And the live demonstration (labeled, never a substitute for the lock): the same composition in a
real Docker container with a real LLM head over a real, disposable body — latest run (llama3:8b,
N=100): survival 1.000, 0 lethal slips, 100 distinct episodes. See
docs/battle_test/. The organism is additive over, and imports
read-only from, the frozen circle_of_fifths_rc2 kernel (lock b0702a3, vendored at vendor/kernel/).
The same locked organs re-skinned onto hostile domain substrates as deterministic,
Experiment-1-style contracts (each with a load-bearing null). Built + +1 (2026-06-26):
manufacturing, scada, soc, spacecraft (experiments/*_crucible.py, 6 tests each).
Design-only (human-authority bounded, no crucible yet): medical, military, search-and-rescue.
These are applications of the locked physics, kept out of the C1–C7 claim ledger.
See docs/use_cases/.
A tool/action = (name, description, JSON-Schema input); the proposer emits a typed call;
the host decides execution. This is the common shape of Anthropic tool use, OpenAI/Ollama
function-calling, and MCP — so the deterministic stub and a real local model are
interchangeable behind sentaince.interface.tools.Proposer. The OllamaProposer
(interface/ollama.py) is the live additive swap; MCP is the promotion path for exposing the
ActionGraph across a process boundary.
The whole local body — the safety gate, the earned memory, the dashboards — is Apache-2.0, free, and
open. Safety is never paywalled. It runs entirely on your machine: no account, no telemetry, nothing
leaves the box. For the plain-language tour, see docs/STORY.md.
Built by one maintainer, in the open, gauge-first — every claim is broken by its own null or it doesn't ship.
An AI organism - the human-AI interface layer. A safety reflex that refuses known lethal actions even when the model is fooled, and a memory that only keeps what actually worked. For code, research, w
Übersicht
An AI organism - the human-AI interface layer. A safety reflex that refuses known lethal actions even when the model is fooled, and a memory that only keeps what actually worked. For code, research, writing, or a fleet of agents. 100% local.
Tools
Noch keine Tool-Liste. Remote-Server erhalten eine nach dem ersten Health-Check.
FAQ
Kopieren Sie auf dieser Seite die stdio-Konfiguration für Cursor, Claude Desktop, Claude Code oder VS Code. Sie nutzt die Installation des Herausgebers, keinen PlugMCP-Proxy.
In diesem Eintrag ist keine erforderliche Umgebungsvariable aufgeführt.
SentAInce läuft lokal über stdio.
Zuletzt geprüft: 2026-10-28. An AI organism - the human-AI interface layer. A safety reflex that refuses known lethal actions even when the model is fooled, and a memory that only keeps what actually worked. For code, research, writing, or a fleet of agents. 100% local.
