Mycelium2

A self-hosted memory, book, and skills server for AI agents, written in Rust and exposed over the Model Context Protocol (MCP).

Mycelium2 is built on two assumptions:

1. The database is untrusted at rest. A leaked database must not yield plaintext, a usable session, an API key, or a second-factor secret.
2. The model is untrusted. The LLM proposes changes to memory; code decides what is allowed, where it lands, and whether it worked.

It is a ground-up rewrite of Mycelium that keeps the Open Knowledge Format (OKF) memory model and adds per-user encrypted stores, user authentication, shared bookshelves, and a skills store.

Status

In active development. Crypto, storage, authentication, MCP, the librarian, and the full memory lifecycle (status-aware reads, BM25 + hybrid retrieval, revision history, scheduled dream maintenance) are implemented and covered by 860+ tests. The web interface works and is being improved; expect it to change.

What it does

• Agent memory. Agents store and query knowledge as markdown concepts with YAML frontmatter, cross-linked into a graph. Each user has a private, encrypted bundle.
• Memory lifecycle. Concepts carry frontmatter status (active, superseded, retired) with superseded_by and valid_to, so stale knowledge stops contaminating search. Retrieval uses BM25 scoring with optional hybrid vector fusion; a scheduled dream job flags duplicates, drift, and broken links for consolidation; every write records a per-concept revision with one-click restore.
• Bookshelves. An administrator uploads books; a librarian catalogs them into chapters and sections that agents can search and read by passage.
• Skills store. Agents fetch skills (SKILL.md-style markdown) by name: private skills per user and administrator-managed global skills, with installable bundles (zip download / CLI export).
• MCP server. Seven tools over Streamable HTTP at /mcp, authenticated per user.
• Web interface. Bundle browser, concept editor, search, graph view, chat, per-concept revision history, and an admin portal (including retrieval tuning and the dream maintenance page).

Security model

Encryption

Every concept file and every search index entry is encrypted. Nothing a user stores is written in plaintext.

password ──Argon2id──▶ KEK ──unseals──▶ master key ──HKDF-SHA256──▶ per-file DEK ──AES-256-GCM──▶ file

• Per-file keys. Each file is encrypted under its own key, derived from the user’s master key and bound to the file it protects.
• Two-layer envelopes. The outer layer is bound to the stored filename, so a file swapped under a known name fails to decrypt. The inner layer carries the true path, checked on read, so a file copied to another name fails too.
• No path leakage. Files are stored under flat, opaque HMAC filenames, so concept names and paths are not visible on disk.