agmiAgent Memory Integrity GitHub

Stores

Every store on the board

31 rows across 18 stores, measured 2026-10-07. Each page shows the verdicts, the tool's own reason for every cell, where the attacker stood, and the command that reproduces it.

Stores that make no integrity claim

Frameworks and managed services whose job is to remember, not to prove. Every applicable edit is served as genuine; for them the row is a design fact rather than a bug.

  1. LangGraph SqliteSaverlanggraph-checkpoint-sqlite 3.1.1L0 · 9 served · 0 reported · 0 rejected · detection on read
  2. LangGraph PostgresSaverlanggraph-checkpoint-postgres 3.1.2L0 · 9 served · 0 reported · 0 rejected · detection on read
  3. LangGraph RedisSaverlanggraph-checkpoint-redis 0.5.2L0 · 9 served · 0 reported · 0 rejected · detection on read
  4. OpenAI Agents SDK SQLiteSessionopenai-agents 0.20.0L0 · 9 served · 0 reported · 0 rejected · detection on read
  5. LlamaIndex Memory, SQLAlchemy chat storellama-index-core 0.14.24L0 · 9 served · 0 reported · 0 rejected · detection on read
  6. CrewAI long-term memory, LanceDB datasetcrewai 1.15.23L0 · 9 served · 0 reported · 0 rejected · detection on read
  7. Vertex AI Agent Engine Memory Bank, managed store, edits through the data-plane APIgoogle-cloud-aiplatform 2.4.0L0 · 7 served · 0 reported · 0 rejected · detection on read
  8. Letta block checkpoint historyletta 0.16.8L0 · 9 served · 0 reported · 0 rejected · detection on read
  9. Mem0 local Qdrant storemem0ai 2.0.20L0 · 8 served · 0 reported · 0 rejected · detection on read
  10. inspeximus, receipts off (default)inspeximus 3.0.0L0 · 8 served · 0 reported · 0 rejected · detection on read
  11. AtMem 2.3.7, audit chain alone, verify() auditatmem 2.3.7L0 · 9 served · 0 reported · 0 rejected · detection on audit

Stores that claim tamper evidence

Hash chains, signed heads, per-entry MACs, watchers. The row measures the claim as shipped, with the detection point named.

  1. OpenFang model, tip-persistence fixreference model of a hash chainL1 · 1 served · 0 reported · 5 rejected · detection on read
  2. inspeximus, receipts on, attacker holds the store directoryinspeximus 3.0.0L0 · 0 served · 8 reported · 0 rejected · detection on audit
  3. inspeximus, receipts on, attacker also holds the config homeinspeximus 3.0.0L0 · 2 served · 6 reported · 0 rejected · detection on audit
  4. langgraph-ledger over SqliteSaver, hash-chained ledger, verify_thread auditlanggraph-ledger 0.3.0L0 · 2 served · 7 reported · 0 rejected · detection on audit
  5. memory-blackbox memory.md watcher, agent process alive, scan auditmemory-blackbox 0.1.1L0 · 0 served · 9 reported · 0 rejected · detection on audit
  6. memory-blackbox memory.md watcher, agent restarted before the scan, scan auditmemory-blackbox 0.1.1L0 · 1 served · 8 reported · 0 rejected · detection on audit
  7. Atelya Attest, keyed hash chain, verify_chain auditatelya-attest 0.1.1L0 · 2 served · 7 reported · 0 rejected · detection on audit
  8. Atelya Attest, keyed hash chain plus anchored head, verify and consistency auditatelya-attest 0.1.1L0 · 0 served · 9 reported · 0 rejected · detection on audit
  9. CONTINUUM event log, hash chain, verify_events auditcontinuum-agent 0.1.0L0 · 2 served · 7 reported · 0 rejected · detection on audit
  10. CONTINUUM event log, hash chain plus Ed25519-signed head, attest-verify auditcontinuum-agent 0.1.0L0 · 0 served · 9 reported · 0 rejected · detection on audit
  11. AtMem 2.3.7, audit chain with an external checkpoint outside the attacker-controlled store directory, verify() auditatmem 2.3.7L0 · 8 served · 1 reported · 0 rejected · detection on audit
  12. acrf-memory-guard, per-entry HMAC over a JSON storeacrf-memory-guard 0.1.0L0 · 6 served · 0 reported · 3 rejected · detection on read
  13. Agent Memory reference runtime, SQLite canonical substrate, bucketed row digests, fail-closed openagent-memory-reference 0.2.0 (f2aef57)L3 · 1 served · 0 reported · 8 rejected · detection on read

Measured through the front door

Retrieval stores attacked through their own API with no store access at all.

  1. LangGraph SqliteStorelanggraph-checkpoint-sqlite 3.1.15 surfaced · 1 kept out
  2. Letta archival memoryletta 0.16.84 surfaced · 1 kept out
  3. inspeximus, trust root keyed on the labelinspeximus 3.0.0, maintainer-contributed5 surfaced · 1 kept out
  4. inspeximus, trust root keyed on an attested keyinspeximus 3.0.0, maintainer-contributed5 surfaced · 1 kept out
  5. Reference store, user-scopedno defence, for calibration5 surfaced · 1 kept out
  6. Reference store, unscopedno defence, for calibration6 surfaced · 0 kept out
  7. Reference store, defendedsigned writes, quarantine, stuffing check3 surfaced · 3 kept out