SPM - Structured Project Memory

com.getspmPublished by getspm.comOfficial publisherv0.2.10Updated Oct 25, 2026

Durable, shareable and governed project memory with smart triage and explicit project composition.

VerifiedStreamable HTTPWeb executableKnowledge & MemoryDeveloper Tools

Overview

AI-generated overview

SPM is a hosted MCP endpoint that gives AI agents durable, governed project memory: requirements, decisions, tests and evidence carried across chats, runs and,

What you can do
Use durable project memory across chats, runs and tools, resolving the active project without mixing in other authorized projects and composing cross-project context only on explicit request. Work with smart memory packs, query temporal project memory, request scoped context packs, and verify pack provenance and hashes. Query context graphs and boundaries and run policy-aware preflight checks. Report completed actions, tests, evidence and decisions back to SPM, and submit lifecycle turns to memory triage when the client supports hooks. Choose source-capture modes, inspect an append-ordered capture journal, compare body-free workspace manifests, and continue a project on another agent or
When to use it
Useful for coding agents that should start with the project's requirements, current decisions, constraints and completed work before changing code, and for delivery teams that need to share scoped memory packs with engineers, clients, partners or support without exposing the whole project.
Requirements
Remote streamable HTTP endpoint at getspm.com, with an Authorization bearer token required. Needs an SPM account, an organization with at least one project, a trial or paid plan, and a token scoped to one project, a project set or an organization user's projects. Client bundles exist for Codex, Claude Code, Cursor and OpenClaw; other MCP clients use the same endpoint and token.
Before you install
The Authorization bearer token is a credential: do not commit it, prefer environment variables or the client's secret storage, and keep it scoped and revocable. Agents can write memory events and report evidence back to SPM, and the smoke test creates a project-scoped memory event unless run read-only. The connector deliberately excludes billing, payment, destructive tenant administration and raw secrets.

Installation

In SourceWeft

  1. Open SPM - Structured Project Memory in the dashboard and add it to a workspace.
  2. Connect Authorization token credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.getspm%2Fspm/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "spm-structured-project-memory": {
      "type": "http",
      "url": "https://getspm.com/v1/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_TOKEN>"
      }
    }
  }
}

README

SPM Agent Connectors

Public connector package for SPM - Structured Project Memory.

SPM turns project knowledge into durable, shareable, governed and internally smart project memory for AI agents. This repository contains only the public connector surface: the authenticated remote MCP configuration, installable bundles for Codex, Claude Code, Cursor and OpenClaw, browser authorization helpers, lifecycle adapters, examples and security guidance.

The SPM application, backend, billing system, private console, memory engine and infrastructure are not included in this repository.

Hosted MCP Endpoint

Human setup and inspection guide:

text
https://getspm.com/agents
text
https://getspm.com/v1/mcp

Official MCP Registry descriptor:

text
server.json

Registry name:

text
com.getspm/spm

The endpoint is public for discovery, but authenticated for use. A client needs:

  • an SPM account;
  • an organization and at least one project;
  • a trial or paid plan;
  • an SPM token authorized for one project, a selected project set or the projects the user may access in an organization.

What Agents Can Do

Connector profiles expose the agent-facing SPM surface:

  • use durable project memory across chats, runs and tools;
  • resolve the active project without confusing it with other authorized projects;
  • list authorized projects and compose cross-project context only when the user explicitly requests it;
  • work with smart memory packs that preserve requirements, current decisions, completed work, source-backed context and temporal signals;
  • query temporal project memory;
  • request scoped context packs;
  • verify context pack provenance and hashes;
  • query context graphs and boundaries;
  • run policy-aware preflight checks;
  • report completed actions, tests, evidence and decisions;
  • submit agent lifecycle turns to LLM-first memory triage with source provenance, when the client supports lifecycle hooks.
  • choose selective, complete redacted, summaries-only or metadata-only source capture independently from the memory that triage promotes for future use;
  • inspect and verify an append-ordered capture journal without exposing retained conversation bodies to agent tools.
  • propose a source-grounded project-memory bootstrap when no authorized project matches, request only the specific authorized evidence still needed, then wait for the user to create, link or skip it in SPM;
  • continue an authorized project in another agent or device through a short-lived one-time handoff that carries references rather than memory bodies or credentials;
  • compare body-free workspace manifests before a handoff: Git identity, revision and local-state hash; non-Git file or document snapshots; remote version references; or memory-only work;
  • refresh workspace manifests automatically at session start, before user turns and after completed work when the client supports lifecycle hooks, making stale observations and out-of-band changes visible without uploading local file bodies;
  • distinguish metadata-only source observations from material evidence and request an authorized source handoff when current content is required.

Typical Use Cases

  • Coding agents receive the project memory they should actually use before changing code: requirements, current decisions, tests, constraints and completed work.
  • Delivery teams turn scattered project knowledge into scoped packs for engineers, clients, partners or support without exposing the whole project.
  • Partners or external collaborators receive bounded memory with source, expiry, revocation, provenance and audit evidence.
  • Agent workflows preserve memory after the task by reporting decisions, tests and evidence back to SPM.

What Agents Cannot Do

The hosted MCP connector does not expose:

  • billing or checkout;
  • invoice payment;
  • customer portal creation;
  • destructive tenant administration;
  • raw secrets;
  • global operator tools.

This boundary is intentional. Agents receive the memory tools they need without being given commercial or destructive administrative powers.

Codex

Install the Codex plugin from this repository marketplace:

text
.agents/plugins/marketplace.json

Or configure Codex manually:

toml
[mcp_servers.spm]url = "https://getspm.com/v1/mcp"bearer_token_env_var = "SPM_CODEX_MCP_TOKEN"startup_timeout_sec = 30tool_timeout_sec = 120

Authorize Codex for all projects the signed-in organization user may access:

bash
python3 plugins/spm-codex/scripts/auth_spm_codex.py \  --project-id <authorization-project-id> \  --access-mode organization \  --write-env ~/.spm/codex.envsource ~/.spm/codex.env

Verify:

bash
python3 plugins/spm-codex/scripts/doctor_spm_codex.py

Run the functional remote MCP smoke:

bash
python3 plugins/spm-codex/scripts/smoke_spm_remote_mcp.py \  --project-id <authorized-project-id>

The smoke uses the same SPM_CODEX_MCP_TOKEN as Codex and requires an explicit authorized project id (or SPM_SMOKE_PROJECT_ID). It initializes the hosted MCP endpoint, verifies the project-resolution, multi-project, agent-session and memory tool surface, creates a small project-scoped smoke memory event, reads temporal state, creates and verifies a context pack, queries the context graph, runs agent preflight and reports post-action evidence. It never prints the token and the hosted connector strips raw event bodies from returned context.

For a non-mutating token check, use:

bash
python3 plugins/spm-codex/scripts/smoke_spm_remote_mcp.py \  --project-id <authorized-project-id> --read-only

Claude Code, Cursor And OpenClaw

The repository includes native client bundles:

  • plugins/spm-claude
  • plugins/spm-cursor
  • plugins/spm-openclaw

Clients that only support MCP can use the same remote endpoint and bearer token. The generic authorization helper is scripts/agent-connectors/authorize_spm_agent.py. See also:

  • examples/codex/config.toml
  • examples/claude-desktop/claude_desktop_config.json
  • examples/cursor/mcp.json
  • examples/windsurf/mcp_config.json

Security

Do not commit tokens. Prefer environment variables or each agent client's secret storage. Tokens must be explicitly scoped and revocable from SPM. Organization visibility does not permit silent project mixing: each task keeps one active project, while cross-project packs require an explicit user request. Session continuation does not clone, pull, reset or overwrite a workspace. Receiving agents inspect their actual material state, compare it with SPM's manifest and ask before obtaining or reconciling resources.

See SECURITY.md and docs/security-boundary.md.

Links

Source: README.md at commit 3e1e06d

Tools

0
This server asks for a credential such as an API key, so SourceWeft could not read its tools without one and has not indexed them.

Version history

1
  1. v0.2.10LatestSep 16, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts