Inspiration
AI agents are moving from chat into actions, but their memory is still treated as trusted input. A poisoned, stale, unsigned, or contradictory memory can make an otherwise capable agent take a dangerous action. MnemoGuard turns agent memory into a zero-trust production boundary.
What it does
MnemoGuard intercepts every candidate memory before it reaches an autonomous agent. It verifies provenance and signatures, checks expiration, finds assertion-level contradictions against trusted history, detects high-impact authorization changes, and assigns a trust decision:
Trusted memories are exposed to agents. Review memories wait for human validation. Quarantined memories remain auditable but can never enter agent context.
The judge-facing demonstration injects the same poisoned customer record into two agents. A baseline agent approves a $10,000 refund. MnemoGuard detects the untrusted source and contradictions with the signed CRM record, quarantines the memory, and blocks the action.
How it works
CockroachDB is the durable system of record for memory state, vector embeddings, conflicts, and append-only decision events. Distributed Vector Indexing retrieves related memories while transactional fields keep provenance and trust state consistent with each embedding. The CockroachDB Cloud Managed MCP Server exposes only the read-only trusted_agent_memory view, making quarantine an enforceable boundary rather than a prompt instruction.
AWS Lambda runs the intake pipeline independently of the agent process. Amazon Bedrock provides a constrained second opinion for ambiguous high-impact memories; deterministic security policy remains authoritative and Bedrock cannot override forced quarantine.
What makes it different
Most agent-memory projects optimize recall. MnemoGuard asks the missing production question: should this memory be trusted at all? It demonstrates a complete attack-and-containment loop, visible evidence, human review, and a design that fails closed.
Current status
The trust engine, HTTP API, evidence dashboard, automated attack simulation, CockroachDB Cloud adapter and schema, AWS Lambda handlers, and Bedrock adjudicator are implemented. The judge-facing demo is live on AWS Lambda and connected to CockroachDB Cloud.
Built With
- amazon-bedrock
- amazon-web-services
- aws-lambda
- cockroachdb
- javascript
- model-context-protocol
- node.js