Vestige MCP
An MCP memory server for agents plus a free gate that stops dangerous commands before they run
- 658 ★ on the repository
- Last commit
- AGPL-3.0
Broad access
Why this level
- The installer edits agent configuration and installs a hook before every tool call, and the gate in enforce mode can stop a command you need
- Install scripts are downloaded from the network and run on the system, and curl | sh runs them without preview
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/vestigeDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The installer edits agent configuration and installs a hook before every tool call, and the gate in enforce mode can stop a command you need
- Install scripts are downloaded from the network and run on the system, and curl | sh runs them without preview
This is third-party code. Review the repository files before installing.
What it does
Vestige has two parts. The first is an MCP memory server with 18 tools. It keeps a log called Strata that is append-only: each frame carries the hash of the previous one, and sealed segments are signed with Ed25519. Every write passes a check and returns a receipt. A memory is found by exact ID or tag, with no vector search. The second part is Operator Lite, a gate on the PreToolUse hook. It sits outside the model and checks every tool call against 30 deterministic rules. Some rules stop a command, the rest only record suspicious activity. A stopped command is let through only after you approve it from your own terminal. For investigations there is causal_walk: it walks backward over recorded links (commits, tool calls, memory writes) and says so when no cause can be found. gather starts such a walk from a GitHub issue, and precedent shows any connected agent what the gate stopped or allowed and under which rule.
Who it is for. For developers who run Claude Code, Cursor or Codex with broad permissions and want a decision log plus protection from destructive commands.
Good fit when
- An agent runs nearly unattended and you want `rm -rf`, a force-push or `DROP TABLE` stopped before it runs
- You want to see what the rules would have stopped in the last 30 days of your history: the `operator-gate replay` command executes nothing
- Pinned decisions and corrections should return to context after every session compaction
- You are investigating a failure: causal_walk follows recorded commits and calls to the cause, and gather starts from a GitHub issue
- Several agents work together and the second should read through precedent what was stopped and under which rule
Not a fit when
- You need semantic search over free text: recall works only by ID or tag
- You want protection from everything: the gate blocks only what goes through connected hooks
- You need signed gate receipts: Operator Lite receipts are hash chains without signatures
- You work on Windows and need a verified path: Windows x64 binaries ship in the package, but that path has not been tested end to end
Example request
Use precedent to show which commands the gate stopped in this project this week and under which rulesMCP
- Transport
- stdio
- Authentication
- not required
Limitations
The installer edits the configuration of the clients it finds (Claude Code, Claude Desktop, Cursor, VS Code, OpenCode, Xcode, JetBrains, Windsurf) and backs up each file before changing it. Operator Lite requires Python 3.9 or newer and refuses to install from inside the agent's own shell: run the installation in your terminal. The `--dry-run` flag shows all changes without writing.
The project is released under AGPL-3.0-only. The memory server and Operator Lite are free. The paid Vestige Operator costs $149 once, and adds your own rules, a board of the day's stops, a weekly letter, judgement of the chain of steps and six more stop rules. End-to-end testing covers macOS and Linux.
The gate starts in enforce mode right after installation. The `mode shadow` setting only records decisions. Wiring Codex through a hook is not yet marked ready in the list. The OpenAI and Anthropic APIs are unavailable from Russia, but Vestige itself runs locally.
How to disable. Switch the gate to observe-only with `mode shadow` or remove the hook from the agent's settings. Remove the memory server from the MCP config; for Claude Code that is `claude mcp remove vestige`.
FAQ
How do I install Vestige in Claude Code?
Run `npx @vestige/init` in your own terminal: it installs the binaries, starts the server once to check it, adds the rules hook for Claude Code and installs Operator Lite in enforce mode. Manually: `curl -fsSL https://raw.githubusercontent.com/samvallad33/vestige/main/scripts/install.sh | sh`, then `claude mcp add vestige vestige-mcp -s user`.
Which commands does Operator Lite stop?
Fifteen rules block, among them recursive deletes outside the project, force-push and `.git` removal, unreviewed publishes, production deploys and infrastructure teardown, destructive SQL, reverse shells, cloud-metadata access and a download piped into a shell. Another fifteen rules record suspicious activity without blocking.
How do I allow a stopped command?
Approve that exact command from your own terminal. The ALLOW ONCE option runs it a single time, and an old approval does not count as permission for a new action.
How do I verify the integrity of the Strata log?
The `vestige strata-verify` command checks the hash chain and the signatures of sealed segments while the server keeps running. A segment is sealed at backup, nightly by default.
Is Vestige paid?
The memory server and the Operator Lite gate are free. The paid Vestige Operator costs $149 once and adds your own rules, a board of the day's stops, a weekly letter and analysis of the chain of steps in a session.
Discussion
No questions or reviews yet.
Related
MCP serversAn offensive security MCP server: the agent runs 150+ pentest and recon tools and drives automated target assessments
An MCP server that gives the agent vulnerability triage: NVD data, EPSS, the CISA KEV catalog, MITRE ATT&CK mapping and one-call CVE risk scoring
An authorized bug-bounty suite: 50 subagents, 26 commands and 2 bug-bounty-platform MCP servers for Claude Code, Codex and five more agents
Access control for agents: rules for what Claude Code, Codex, Cursor and MCP servers may do, review of risky actions before they run, and one audit log
MCP-Shield finds your MCP configs, connects to servers and scans tool descriptions for hidden commands, exfiltration channels and tool shadowing
MCP server that gathers your HackerOne history and 3,600 disclosed reports into a database the agent uses to plan program work
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Vestige (this entry) | no | not required | 658 | |
| HOL Guard | yes | 1,022 | checks commands, secret reads, MCP calls and package installs and waits for your decision, but keeps no memory with causal failure analysis | |
| Claude-Mem | no | 104,915 | a persistent memory plugin that injects context into new sessions, without a gate for dangerous commands | |
| marm-memory | no | not required | 426 | local memory with a codebase index and a concept graph, without command-stopping rules |
README in short
The description opens with the problem: agents run destructive commands on their own, and similarity search finds only lookalikes. The version 5 section lists precedent, gather, rules that survive context compaction and a new dashboard. Then come a quick start, a separate Operator Lite install with a sample `operator-gate replay` report, a section on root-cause tracing, installing the memory server and connection tables for each client and gate port. Documentation links and the license close the page.