SPM - Structured Project Memory

com.getspm由 getspm.com 發布官方發布者v0.2.10更新於 Oct 25, 2026

Durable, shareable and governed project memory with smart triage and explicit project composition.

已驗證Streamable HTTP可網頁執行知識與記憶開發者工具

概覽

AI 產生的概覽

SPM 是託管式 MCP 端點，為 AI 助理提供持久、可分享且受治理的專案記憶，涵蓋需求、決策、測試與證據，可跨對話與執行延續。

可以做什麼
跨對話、執行與工具使用持久專案記憶，解析目前作用中的專案而不與其他已授權專案混淆，且僅在使用者明確要求時組合跨專案脈絡。使用智慧記憶包，查詢時間性專案記憶，請求限定範圍的脈絡包，並驗證脈絡包的來源與雜湊。查詢脈絡圖譜與邊界，執行具政策意識的預檢檢查。向 SPM 回報已完成的操作、測試、證據與決策，並在用戶端支援生命週期鉤子時提交生命週期回合進行記憶分診。選擇來源擷取模式，檢視依附加順序記錄的擷取日誌，比較不含內文的工作區清單，並透過一次性交接在其他助理或裝置上繼續專案。
適用情境
適合在修改程式碼前需要先取得專案需求、目前決策、限制與已完成工作的編碼助理；也適合需要向工程師、客戶、合作夥伴或支援團隊分享限定範圍記憶包而不暴露整個專案的交付團隊。
執行需求
位於 getspm.com 的遠端 streamable HTTP 端點，需要 Authorization bearer 權杖。需要 SPM 帳號、至少含一個專案的組織、試用或付費方案，以及限定到單一專案、專案集或組織使用者可存取專案的權杖。提供 Codex、Claude Code、Cursor 與 OpenClaw 用戶端套件；其他 MCP 用戶端使用同一端點與權杖。
安裝前請注意
Authorization bearer 權杖屬於憑證：不要提交到程式碼庫，優先使用環境變數或用戶端的密鑰儲存，並保持其範圍受限且可撤銷。助理可寫入記憶事件並向 SPM 回報證據，冒煙測試會建立專案範圍的記憶事件，除非以唯讀方式執行。此連接器刻意不提供計費、付款、破壞性租戶管理與原始密鑰。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 SPM - Structured Project Memory，將其新增到工作區。
  2. 連接 Authorization token 憑證。它們會被私密儲存，絕不會在公開頁面上展示。
  3. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/com.getspm%2Fspm/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "spm-structured-project-memory": {
      "type": "http",
      "url": "https://getspm.com/v1/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_TOKEN>"
      }
    }
  }
}

README

SPM Agent Connectors

Public connector package for SPM - Structured Project Memory.

SPM turns project knowledge into durable, shareable, governed and internally smart project memory for AI agents. This repository contains only the public connector surface: the authenticated remote MCP configuration, installable bundles for Codex, Claude Code, Cursor and OpenClaw, browser authorization helpers, lifecycle adapters, examples and security guidance.

The SPM application, backend, billing system, private console, memory engine and infrastructure are not included in this repository.

Hosted MCP Endpoint

Human setup and inspection guide:

text
https://getspm.com/agents
text
https://getspm.com/v1/mcp

Official MCP Registry descriptor:

text
server.json

Registry name:

text
com.getspm/spm

The endpoint is public for discovery, but authenticated for use. A client needs:

  • an SPM account;
  • an organization and at least one project;
  • a trial or paid plan;
  • an SPM token authorized for one project, a selected project set or the projects the user may access in an organization.

What Agents Can Do

Connector profiles expose the agent-facing SPM surface:

  • use durable project memory across chats, runs and tools;
  • resolve the active project without confusing it with other authorized projects;
  • list authorized projects and compose cross-project context only when the user explicitly requests it;
  • work with smart memory packs that preserve requirements, current decisions, completed work, source-backed context and temporal signals;
  • query temporal project memory;
  • request scoped context packs;
  • verify context pack provenance and hashes;
  • query context graphs and boundaries;
  • run policy-aware preflight checks;
  • report completed actions, tests, evidence and decisions;
  • submit agent lifecycle turns to LLM-first memory triage with source provenance, when the client supports lifecycle hooks.
  • choose selective, complete redacted, summaries-only or metadata-only source capture independently from the memory that triage promotes for future use;
  • inspect and verify an append-ordered capture journal without exposing retained conversation bodies to agent tools.
  • propose a source-grounded project-memory bootstrap when no authorized project matches, request only the specific authorized evidence still needed, then wait for the user to create, link or skip it in SPM;
  • continue an authorized project in another agent or device through a short-lived one-time handoff that carries references rather than memory bodies or credentials;
  • compare body-free workspace manifests before a handoff: Git identity, revision and local-state hash; non-Git file or document snapshots; remote version references; or memory-only work;
  • refresh workspace manifests automatically at session start, before user turns and after completed work when the client supports lifecycle hooks, making stale observations and out-of-band changes visible without uploading local file bodies;
  • distinguish metadata-only source observations from material evidence and request an authorized source handoff when current content is required.

Typical Use Cases

  • Coding agents receive the project memory they should actually use before changing code: requirements, current decisions, tests, constraints and completed work.
  • Delivery teams turn scattered project knowledge into scoped packs for engineers, clients, partners or support without exposing the whole project.
  • Partners or external collaborators receive bounded memory with source, expiry, revocation, provenance and audit evidence.
  • Agent workflows preserve memory after the task by reporting decisions, tests and evidence back to SPM.

What Agents Cannot Do

The hosted MCP connector does not expose:

  • billing or checkout;
  • invoice payment;
  • customer portal creation;
  • destructive tenant administration;
  • raw secrets;
  • global operator tools.

This boundary is intentional. Agents receive the memory tools they need without being given commercial or destructive administrative powers.

Codex

Install the Codex plugin from this repository marketplace:

text
.agents/plugins/marketplace.json

Or configure Codex manually:

toml
[mcp_servers.spm]url = "https://getspm.com/v1/mcp"bearer_token_env_var = "SPM_CODEX_MCP_TOKEN"startup_timeout_sec = 30tool_timeout_sec = 120

Authorize Codex for all projects the signed-in organization user may access:

bash
python3 plugins/spm-codex/scripts/auth_spm_codex.py \  --project-id <authorization-project-id> \  --access-mode organization \  --write-env ~/.spm/codex.envsource ~/.spm/codex.env

Verify:

bash
python3 plugins/spm-codex/scripts/doctor_spm_codex.py

Run the functional remote MCP smoke:

bash
python3 plugins/spm-codex/scripts/smoke_spm_remote_mcp.py \  --project-id <authorized-project-id>

The smoke uses the same SPM_CODEX_MCP_TOKEN as Codex and requires an explicit authorized project id (or SPM_SMOKE_PROJECT_ID). It initializes the hosted MCP endpoint, verifies the project-resolution, multi-project, agent-session and memory tool surface, creates a small project-scoped smoke memory event, reads temporal state, creates and verifies a context pack, queries the context graph, runs agent preflight and reports post-action evidence. It never prints the token and the hosted connector strips raw event bodies from returned context.

For a non-mutating token check, use:

bash
python3 plugins/spm-codex/scripts/smoke_spm_remote_mcp.py \  --project-id <authorized-project-id> --read-only

Claude Code, Cursor And OpenClaw

The repository includes native client bundles:

  • plugins/spm-claude
  • plugins/spm-cursor
  • plugins/spm-openclaw

Clients that only support MCP can use the same remote endpoint and bearer token. The generic authorization helper is scripts/agent-connectors/authorize_spm_agent.py. See also:

  • examples/codex/config.toml
  • examples/claude-desktop/claude_desktop_config.json
  • examples/cursor/mcp.json
  • examples/windsurf/mcp_config.json

Security

Do not commit tokens. Prefer environment variables or each agent client's secret storage. Tokens must be explicitly scoped and revocable from SPM. Organization visibility does not permit silent project mixing: each task keeps one active project, while cross-project packs require an explicit user request. Session continuation does not clone, pull, reset or overwrite a workspace. Receiving agents inspect their actual material state, compare it with SPM's manifest and ask before obtaining or reconciling resources.

See SECURITY.md and docs/security-boundary.md.

Links

來源：README.md，提交 3e1e06d

工具

0
該伺服器需要 API 金鑰等憑證，因此 SourceWeft 無法在沒有憑證的情況下讀取其工具，也未收錄。

版本歷史

1
  1. v0.2.10最新Sep 16, 2026

評分

已滿足適用檢查項的 85%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分